fix: improve report completeness and resource calculations

Preserve detailed auto_explain logs with larger capture and transport budgets,
retain partial results, and redact credentials in stored query text.

Correct table and slot deltas, security checks for unanalyzed tables,
wait-series identity, sampled ClientWrite scoring, and log-window boundaries.
Remove duplicate plan-chart boundary points and expand regression coverage.

Author: O2eg

README.md

@@ -1115,6 +1115,13 @@ block opens its sanitized, bounded plan in the bundled read-only
 `pg-explain-viewer`. An SFTP fallback for shell-less SSH
 accounts is planned but deliberately not part of this release.
 
+Log collection is bounded to 512 MiB scanned and 128 MiB returned per window.
+An auto_explain record can retain up to 512 KiB; chart plan references have a
+separate 64 MiB / 1024-plan budget. Reaching a scan or return limit preserves
+already collected events and marks coverage incomplete; it does not discard the
+whole item. Larger limits allow detailed analytical plans while keeping resource
+use bounded.
+
 The artifact records the phase outcome in `runtime.log_collection`
 (`{status, reason, coverage}`); `coverage` states the requested and actually
 covered window, scanned bytes, and truncation reasons, so an incomplete window

src/pg_diag/artifact.py

@@ -21,6 +21,7 @@
 from .security import (
     json_safe,
     redact_error,
+    redact_query_credentials,
     redact_text,
     sanitize_public_structure,
     sanitize_result,
@@ -461,7 +462,7 @@ def _remember_query_text(query_texts: dict[str, str], query_id: Any, query_text:
     if query_id is None or query_text is None:
         return
     query_id_text = str(query_id).strip()
-    sql_text = str(query_text).strip()
+    sql_text = redact_query_credentials(str(query_text).strip())
     if not query_id_text or not sql_text:
         return
     existing = query_texts.get(query_id_text)

src/pg_diag/cli.py

@@ -751,7 +751,9 @@ def _machine_artifacts(args: argparse.Namespace) -> list[dict[str, Any]]:
             args.output_format,
         )
         if json_path is not None:
-            paths.append(("DiagnosticReport", "pg_diag/artifact-v4", json_path))
+            paths.append(
+                ("DiagnosticReport", f"pg_diag/artifact-v{runtime_config.ARTIFACT_SCHEMA_VERSION}", json_path)
+            )
         if html_path is not None:
             paths.append(("DiagnosticReportHtml", None, html_path))
     artifacts = []

src/pg_diag/content/instructions/items/snapshot_delta_workload/logical_decoding_slot_delta.md

@@ -12,8 +12,9 @@ This instruction belongs to report item `snapshot_delta_workload.logical_decodin
 - No severity is assigned because spilling can be acceptable for large transactions and bounded workloads.
 
 ## Interval coverage
-- Slot name is the stable key and `stats_reset` is the reset epoch.
-- New, dropped, or reset slots are omitted rather than represented as zero deltas.
+- Slot name identifies the endpoint pair and `stats_reset` detects explicit statistics resets.
+- Slots absent or already lost at either endpoint, changed reset epochs, and decreasing counters are omitted rather than represented as zero deltas.
+- PostgreSQL does not expose a slot creation identifier here. Dropping and recreating a healthy slot with the same name between endpoints can remain undetectable when `stats_reset` is NULL and counters do not decrease. Check lifecycle logs before interpreting such a window.
 
 ## Common fault causes
 - Large transactions, insufficient `logical_decoding_work_mem`, slow consumers, and output-plugin behavior.

src/pg_diag/content/integrity.sha256

@@ -1 +1 @@
-sha256:b7599f0f621cdb60f871af8c3155d98d52e3f97aa17de2b218549ec6d74f1a7d
+sha256:19e60f96138c7a86a240fefa473d881711d1137a803fd119fd37baa0fd8ca16b

src/pg_diag/content/metrics.yaml

@@ -1918,7 +1918,7 @@ metrics:
       mode: interval
       limit: 12
       key_refs: [dimensions.database, dimensions.wait_event_type, dimensions.wait_event, dimensions.query_id]
-      label_refs: [dimensions.wait_event_type, dimensions.wait_event, dimensions.query_id]
+      label_refs: [dimensions.wait_event_type, dimensions.wait_event, dimensions.query_id, dimensions.database]
       value_ref: gauges.sessions
       transform: avg
       unit: sessions

src/pg_diag/content/python/backend/postgres_main_process_linked_libraries.py

@@ -56,13 +56,15 @@
 esac
 
 case "$postgres_main_pid" in
-  ''|*[!0-9]*|0|1)
+  ''|*[!0-9]*|0)
     echo "cannot resolve the parent of PostgreSQL backend PID $backend_pid" >&2
     exit 43
     ;;
 esac
 
 postgres_main_status=/proc/$postgres_main_pid/status
+# In a container the postmaster can be PID 1. Validate its process name below
+# just as for any other parent, rather than rejecting the namespace init PID.
 if [ ! -r "$postgres_main_status" ]; then
   echo "parent PID $postgres_main_pid of PostgreSQL backend PID $backend_pid is not visible" >&2
   exit 43
@@ -89,6 +91,16 @@
 esac
 
 postgres_executable=$(readlink "/proc/$postgres_main_pid/exe" 2>/dev/null || true)
+postgres_owner=
+runuser_bin=$(command -v runuser 2>/dev/null || true)
+if [ -z "$postgres_executable" ] && [ "$(id -u)" = 0 ] && [ -n "$runuser_bin" ]; then
+  # Container root may lack CAP_SYS_PTRACE. The actual process owner can still
+  # inspect its executable; use that identity only for readlink and ldd.
+  postgres_owner=$(stat -c %U "$postgres_main_status" 2>/dev/null || true)
+  if [ -n "$postgres_owner" ]; then
+    postgres_executable=$("$runuser_bin" -u "$postgres_owner" -- readlink "/proc/$postgres_main_pid/exe" 2>/dev/null || true)
+  fi
+fi
 if [ -z "$postgres_executable" ]; then
   echo "cannot resolve /proc/$postgres_main_pid/exe for PostgreSQL backend PID $backend_pid" >&2
   exit 45
@@ -105,7 +117,11 @@
 printf 'PGDIAG_POSTGRES_EXECUTABLE=%s\n' "$postgres_executable"
 printf 'PGDIAG_LDD_PATH=%s\n' "$ldd_bin"
 printf '%s\n' 'PGDIAG_LDD_BEGIN'
-"$ldd_bin" "/proc/$postgres_main_pid/exe"
+if [ -n "$postgres_owner" ]; then
+  "$runuser_bin" -u "$postgres_owner" -- "$ldd_bin" "/proc/$postgres_main_pid/exe"
+else
+  "$ldd_bin" "/proc/$postgres_main_pid/exe"
+fi
 """
 
 _RESOLVED_RE = re.compile(

src/pg_diag/content/python/server_log/auto_explain_plans.py

@@ -82,6 +82,11 @@ def collect(context: PythonSourceContext) -> PythonSourceResult:
             if rank < len(top_by_bucket[bucket]) and displayed_plan_count < event_point_limit:
                 selected[bucket][rank] = top_by_bucket[bucket][rank]
                 displayed_plan_count += 1
+    occupied_first_rank = {
+        _iso_timestamp(bucket, utc_offset_seconds)
+        for bucket, ranks in selected.items() if 0 in ranks
+    }
+    axis_points = [point for point in axis_points if point["t"] not in occupied_first_rank]
     refs = ChartReferencePool()
 
     result = {

src/pg_diag/content/queries/metrics/logical_decoding_slot_delta.sql

@@ -10,6 +10,10 @@ select
   stream_bytes::int8 as stream_bytes,
   total_txns::int8 as total_txns,
   total_bytes::int8 as total_bytes
-from pg_catalog.pg_stat_replication_slots
+from pg_catalog.pg_stat_replication_slots s
+join pg_catalog.pg_replication_slots r using (slot_name)
+-- A lost slot cannot resume decoding. Reusing its name after recreation does
+-- not reliably change stats_reset, so its counters are not a valid endpoint.
+where r.wal_status is distinct from 'lost'
 order by spill_bytes desc nulls last, slot_name
 limit 50

src/pg_diag/content/queries/metrics/objects_table_scan_delta.sql

@@ -9,8 +9,9 @@ select
     as database_stats_reset,
   st.seq_scan::int8 as seq_scan,
   st.seq_tup_read::int8 as seq_tup_read,
-  st.idx_scan::int8 as idx_scan,
-  st.idx_tup_fetch::int8 as idx_tup_fetch
+  -- pg_stat_all_tables sums index scans; the sum is NULL when no indexes exist.
+  coalesce(st.idx_scan, 0)::int8 as idx_scan,
+  coalesce(st.idx_tup_fetch, 0)::int8 as idx_tup_fetch
 from pg_stat_all_tables st
 join pg_class c on c.oid = st.relid
 join pg_namespace n on n.oid = c.relnamespace