Extend #2490's synthetic-slug convention to the spots it did not reach

[erikdarlingdata]

Extends #2490.

#2490 pinned fixture hostnames to invented placeholder slugs. FleetIdentifierScrubTests matches only the full hostname shape — (prod|stage|staging|dev|qa|uat)-[a-z]+-[a-z0-9]+-(slug)-[0-9]+ — so two other kinds of reference to the same fleet were never in its reach:

1. Other identity-bearing fixture fields. DarlingPeerDisclosureTests' list_servers fixture row carried an already-synthetic hostname (prod-sql-use1-beta-01) with the real short name still sitting in its display_name, and an Assert.Equal pinning that same value. Both halves changed together.
2. Comments naming a server by its short name rather than a full hostname, so the hostname-shaped pin never matched them.

What changed

The bare short name becomes omega, an allowlisted slug. 13 tracked locations, 14 occurrences:

File	Lines
CHANGELOG.md	33, 156 (2 occurrences on 156)
Darling/Darling.Tests/DarlingPeerDisclosureTests.cs	385 (fixture display_name), 413 (the assertion)
Darling/Darling.Tests/QueryStorePlanFetchTests.cs	312, 441
Darling/Darling.Tests/QueryStorePlanSizeLearnTests.cs	124
Darling/Darling.Tests/StatementSplitTimingTests.cs	79
Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs	4908
PerformanceMonitor.Collectors/CollectorContext.cs	333
PerformanceMonitor.Collectors/QueryStoreCollector.cs	1273, 1419
PerformanceMonitor.Collectors/QueryStorePlanXmlState.cs	60

omega was chosen because it named no other server anywhere in the tree — it appeared only inside SyntheticSlugs itself. beta, multi, alpha, gamma and monitor all already denote other servers, and DarlingWorker.cs:4908 names multi-03 on the very line being edited, so reusing any of those would have merged two distinct servers into one identity and changed what a measurement refers to. Case and hostname shape are preserved: the old bare name → OMEGA, and its ordinal short form → omega-01.

Every measurement is unchanged. Across the 13 edited lines there are 83 digit runs; the extracted sequence hashes identically before and after (c2dbceb807baed9355544b7ec1d81f3d), and with the name token normalised out the 13 lines are byte-identical. Nothing else in any comment moved.

Also adds pgmonitor to SyntheticSlugs. It is a role word exactly like monitor, which is already on the list, so a legitimate reference to that host would otherwise trip the guard. Nothing depends on it today — pure hardening.

No schema-version change, no migration, no behaviour change.

Verification

Darling.Tests targets net10.0-windows and cannot execute on macOS, so the two affected classes were compiled from their real source files into throwaway net10.0 harnesses and invoked directly:

• FleetIdentifierScrubTests.NoTrackedSourceFileNamesARealFleetTenant — passes on pristine origin/dev (so it was green before this change, as expected: every hostname-shaped slug in the tree was already monitor/beta/multi/alpha/gamma), and passes on this branch. Negative control: planting prod-sql-use1-acmecorp-01 in a tracked file makes it fail with (slug 'acmecorp'), so the pass is not vacuous.
• DarlingPeerDisclosureTests — all 25 cases (22 [Fact] + 3 [InlineData]) pass against the real service assembly. Negative control: desyncing the fixture value from the assertion fails exactly ListServers_CarriesThePeerFleetsSummary, confirming the fixture/assertion pair is load-bearing and that both halves were changed consistently.
• dotnet build Darling/Darling.Tests -p:EnableWindowsTargeting=true — 0 errors.

CI remains the arbiter for the full Windows suites, which were not run locally.

Out of scope, noted for the record

• Screenshots/Screenshot MCP server analysis.jpg shows up as a binary match. Opened and inspected: the byte sequence is a case-mangled fragment of the old name at offset 885253, inside the JPEG's entropy-coded scan data. The rendered image is a SQL2022 Health Check report naming only LoadTestDB, dbo.BlockingTest and dbo.DeadlockTest — no fleet or customer name is legible. Left untouched.
• CHANGELOG.md:27 names two other servers' ordinal short forms, and CHANGELOG.md:623 / DefaultTraceEventsCollector.cs:32 / QueryStatsCollector.cs:182 / RobustBaselineTests.cs refer to "the reporting fleet's apex box". Neither is hostname-shaped, so the guard does not reach them either. apex is also the codebase's own domain term for a head blocker in ~40 files, so it needs a judgement call rather than a sweep. Not changed here.
• DarlingWorker.cs:4907 describes an "application-class distinct-plan-population signature" one line above an edited line. Pre-existing, and a different decision — flagged, not touched.

🤖 Generated with Claude Code

[claude]

Reviewed the full diff (9 files, CHANGELOG + Darling.Tests + Darling service + shared Collectors comments). This is a documentation/fixture-only privacy scrub with no executable logic touched — no T-SQL, no runtime code paths, no schema/migration changes.

Verification of the rename itself:

• Confirmed all 13 tracked lines / 14 occurrences described in the PR body are exactly the ones changed (the old name → OMEGA/omega, case preserved). No stray references to the old name remain anywhere in the tree (grep -rni for the old name is empty post-change).
• Confirmed omega doesn't collide with any other server identity in the codebase — it only appears in these 13 changed lines plus its pre-existing slot in SyntheticSlugs (it was already an allowlisted Greek-letter slug, just unused as an actual fixture value until now).
• pgmonitor addition to SyntheticSlugs is consistent with the existing monitor role-word entry and doesn't weaken the guard (it only widens the allowlist, doesn't loosen the regex).
• No Lite-side files reference either the old or new name at all, so there's no Lite/Darling parity drift here — this is purely a Darling-test/shared-comment fixup, and Lite never carried the leaked identifier in the first place.

One non-blocking observation: FleetIdentifierScrubTests.NoTrackedSourceFileNamesARealFleetTenant still only matches the full hostname shape (InstanceName regex). This PR manually fixes the two categories of reference it can't reach (bare short-name comments, display_name fixture fields) but doesn't close the detection gap itself — a future PR could reintroduce a bare short-name-only reference or a real value in a display_name-shaped field and the guard wouldn't catch it. That's presumably accepted as hard to regex reliably without false positives, but worth being aware of as the actual residual risk here (this being a public repo where leaking a real tenant/customer identifier is the thing the whole guard exists to prevent).

No correctness, performance, or security issues found in the change as submitted.

[claude]

Reviewed. This is a clean, mechanical rename confined to comments, doc-comments, one test fixture/assertion pair, and CHANGELOG.md — no T-SQL, no production logic, and nothing here needed a Lite-side counterpart (Lite has no matching fixtures using the old name).

Checked:

• No stray references to the old name remain anywhere in the tree (grep -rniE for the old name is empty).
• DarlingPeerDisclosureTests.cs's fixture display_name (line 385) and its assertion (line 413) were updated together — verified consistent, not desynced.
• omega was already on FleetIdentifierScrubTests' SyntheticSlugs allowlist before this PR, so the rename target was already sanctioned there; pgmonitor is a reasonable addition alongside the existing monitor role word.
• FleetIdentifierScrubTests's hostname-shape regex ((?:prod|stage|...)-[a-z]+-[a-z0-9]+-(slug)-[0-9]+) genuinely does not reach bare short-name comments like the old ordinal short form, so those needed the manual sweep this PR does — consistent with the stated rationale.

No correctness, Lite/Darling parity, security, or performance concerns found.