Analysis facts, drill-downs and anomaly counts for blocking and deadlocks count events by when they happened, in both apps

[erikdarlingdata]

Builds on #4906 (an Azure SQL Database master's analysis findings skip separately monitored databases), which rewrote these same queries and is now merged; this PR's diff against dev is the window columns below.

What a user saw

The analysis findings, the drill-downs and the anomaly detector counted blocked-process reports (BPRs) and deadlocks by when they were COLLECTED. The grids and cards count by when the event HAPPENED (#4909). So a finding could cite a deadlock count for its window that the Deadlocks grid for the same window doesn't show.

What changed

Every analysis read of blocked_process_reports and deadlocks now windows, and buckets, on the event's own time.

Darling: each read is now the event column in the window, plus collection_time >= EventWindowFloor.For(start) (#3895), with no upper bound on collection_time.

• The BLOCKING_EVENTS fact (the plain and separate-databases forms, with its date_bin bucket);
• the DEADLOCKS fact and its graph reads;
• the anomaly detector's current-window blocking and deadlock counts (all three of Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's forms);
• the drill-down top deadlocks, and the top blocking chains' BPR arm.

pg_deadlocks (PostgreSQL targets): the exemplar count, the exemplar list and the MCP deadlock reader now agree. Each is COALESCE(occurred_at, collection_time) in the window, plus the floor. occurred_at is nullable, and a row without one counts by its collection time, as it did before. The MCP reader already used occurred_at but dropped a row without one; the fact and the drill-down used collection_time. The MCP reader also stamps, sorts and builds its report identity from the same expression, and the detail lookup matches on it, so a row without occurred_at is listed by its collection time (not as 0001-01-01 at the top of the page) and its identity resolves.

Lite: the event predicate alone. The reads:

• the BLOCKING_EVENTS fact (its 4-hour bucket too) and the DEADLOCKS fact, plus Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's scoped deadlock count;
• the drill-down top deadlocks and the top chains' BPR arm;
• the anomaly detector's current counts;
• the Blocking and Deadlock baselines and the per-minute blocking baseline.
• The baseline's events are bucketed by event time with the same server-local clock conversion. Its coverage CTE stays on collection_time, because coverage means when the collector ran. EventBaselineSql itself is unchanged: it's pinned byte-identical to Darling's.

Left alone, and why

• Darling's baselines are continuous aggregates. A TimescaleDB continuous aggregate must bucket the hypertable's own time column, and these are hour-of-week baselines, where a seconds-long collection lag doesn't move a bucket. Changing them needs a rung and a rebuild.
• The DMV blocking-snapshot arms: a snapshot's event_time IS its collection time.
• The alert reads: a delivery cursor (see Blocking and deadlock windows count events by when they happened, in both apps' grids, MCP reads, slicers, trends and daily summary #4909).
• The reads already on the event time: the blocking-chain fact and the reconstructed chains keep their event-time window and gain the collection_time floor, like every other read here.

Pins

• Darling, EventTimeAnalysisReadsLiveTests: three rows per table:
  • (a) happened before the window and was collected inside it;
  • (b) happened and was collected inside it;
  • (c) happened inside it and was collected after it ended.
    The facts (both forms), the anomaly counts (both forms), the drill-downs and the pg_deadlocks reads count b and c, not a. The a/b/c row counts differ per table, so a collection-time window can't match by accident. For pg_deadlocks, a fourth row with no occurred_at counts by its collection time.
• Lite, EventTimeAnalysisReadsTests: the same rows through the facts, the drill-downs, the anomaly counts and the baselines. An event at 10:58 collected at 11:03 lands in the 10:00 baseline bucket.
• Existing pins updated: PgDeadlockRemaskTests binds the exemplar list's new floor parameter, PgTargetDeadlockDrillDownTests asserts the COALESCE form, and LocalClockBucketKeyTests reads the event column in the baseline's local-clock day. DarlingEventBaselineCoveredDaysTests still pins the same shared baseline body and collectors in both products, and now also pins the deliberate difference: Lite's Blocking and Deadlock arms wrap it with OnEventTime(..., "event_time") and (..., "deadlock_time"), and Darling's continuous-aggregate arms don't wrap.
• Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's scoped variants moved too: TopDeadlocksSkippingSeparateSql, TopBlockingChainsSkippingSeparateSql, both DeadlockOutsideCountSql copies and BlockingSkippingSeparateCountSql. Lite's scoped deadlock count and its chain/fact scoping moved the same way. The reconstructed chains were already on the event time.
• Parameter order: a plain read takes the floor as $4. A scoped read keeps Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's list at $4 and takes the floor as $5. Every caller binds the list first, then the floor.
• Tighter pins (they passed before, and guard against a regression): the Darling drill-down seeds distinct waits and asserts the chains are {200, 300}; it also runs scoped (["GP"] over HS rows), which exercises Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's skipping variants. Lite adds scoped cases for the deadlock fact and the top deadlocks.
• The two newer pins, RED at their tests commit on a local live store: the NULL-occurred_at reader pin (the stamp, the sort and the identity round trip), and BlockingChainReadsFloorTests (2 of 2).
• Seeders that set no event time now set it equal to the collection time (test data only): EventBaselineCoveredDaysTests, Lite's AnomalyTileWindowEndTests, and AzureMasterAnalysisScopeTests.SeedBprAsync.
• Darling's AnomalyTileWindowEndTests text pin counts the open-ended window on event_time < $3 / deadlock_time < $3 as well, and still rejects the closed spellings.
• RED before the fix, Darling: a local live store at the tests-first head 3653d8efb. EventTimeAnalysisReadsLiveTests failed 6 of 6, on assertions:
  • BlockingAndDeadlockFacts_… (plain and Azure-master forms);
  • AnomalyDetectorCurrentWindowCounts_… (both forms);
  • DrillDownTopDeadlocksAndTopChains_…;
  • PgDeadlockCapture_CountsByOccurrenceWithTheCollectionTimeFallback_….
    CI's RED run was skipped while Actions is degraded.
• RED before the fix, Lite: reasoned from the old query text, which windowed on collection_time. Every pin seeds row (a) (happened before the window, collected inside it) and row (c) (happened inside it, collected after it ended). The old predicate counts (a) and drops (c).
  • BlockingEventsFact_… and DeadlocksFact_… seed a second (c) row and assert a count of 3 (b + 2c). The old read counts a + b = 2.
  • TopDeadlocks_… asserts victims [c, b], and TopBlockingChains_… waits [300, 200]. The old read returns a and b.
  • AnomalyDetector_CurrentCounts_… asserts 6 events (3 b + 3 c). The old read counts 1 a + 3 b = 4.
  • BaselineBuckets_CountEventsByWhenTheyHappened (blocking and deadlocks) asserts that the 10:58-event / 11:03-collected row lands in hour 10 and not 11. The old read buckets by collection, into hour 11.
• At the fix, after the Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906 merge, locally: 23 Darling classes green on a live store, 0 failed. They are the new class, AzureMasterAnalysisScopeLiveTests, AnomalyDetectorErrorGuardLiveTests, AnalysisCoverageLivePostgresTests, AnalysisFactsReadRunsDetectorParityTests, CountFamilyZeroHistoryTests, DarlingAnomalyBaselineTests, PgTarget*, PgDeadlockRemaskTests, PgFactCollectorTests, McpPageContractTests, DarlingAnalysisPipelineTests, AnomalyTileWindowEndTests, AzureMasterScopeTests and Azure SQL Database: a monitored master's analysis findings no longer repeat the blocking and deadlocks of databases monitored as their own targets #4906's new classes. Lite.Tests builds with 0 errors; CI runs it.

CHANGELOG

The collection-time windows shipped in v3.8.0, so this is a Fixed entry.

SECTION: Fixed
ENTRY: - Analysis findings, drill-downs and anomaly checks count blocking and deadlocks by when they happened, matching the grids ([#4913]) - These reads counted events by when they were collected, so a finding's count for a window could differ from the grid's for the same window. On PostgreSQL targets, the deadlock fact, drill-down and MCP reader now also agree, and a deadlock without a timestamp is counted by when it was collected.
REF: [#4913]: #4913