[ajitpratap0]

Summary

The CHANGELOG and baselines PR that the perf audit PRs promised; those PRs left CHANGELOG.md and performance_baselines.json alone so this could be one consolidated update.

CHANGELOG.md [Unreleased]

• Covers every PR merged since v1.14.0, from chore(integrations): bump to GoSQLX v1.14.0 #509 to fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597, plus batch 3 (issues cli: gosqlx format silently corrupts many expressions; switch the CLI to pkg/formatter #599–schema/postgres: loader misreports index columns and key flags (column order, INCLUDE, expression and partitioned indexes, read-only roles) #620, PRs fix(ast): return CreateTable, FunctionDesc and trigger children as pointers (#617) #621–fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 and fix(cli): render gosqlx format through pkg/formatter and refuse non-round-tripping output (#599) #624).
• Batch-3 entries were written from the merged code and PR discussions. An independent Opus pass then checked them against origin/main: API names, error codes, CLI behaviour and PR/issue numbers. That pass corrected the fix(parser,ast): ClickHouse parametric aggregates, FROM table functions and their rendering (#605, #606, #607) #628 SQLite claim and narrowed the fix(formatter,ast,parser): no inner semicolons; keep IGNORE NULLS, named args, ON DUPLICATE KEY, OUTPUT, SETTINGS (#602, #600) #631 FORMAT rule.
• Records the fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 render-time SQL injection fix under Security. Performance now lists the measured costs of the batch-3 fixes, not only the gains.
• The intro describes the release as source-compatible with runtime behaviour changes. The [Unreleased] compare link is now v1.14.0...HEAD, and a [1.14.0] link is added.
• Starts with a Behavior changes section listing everything observable on upgrade:
  • comments now count toward MaxTokens (E1007);
  • the E2007 depth limit now covers unary operators, NOT and derived tables;
  • $name placeholders keep their text;
  • token values are zero-copy, so cached strings keep the input alive and need strings.Clone; Extract* results and the DDL loader already clone;
  • Oracle bind variables;
  • INSERT ... WITH, and gosqlx format keeps leading CTEs on INSERT, UPDATE and DELETE, with changed error texts;
  • multi-part names and parenthesized join groups (E4001, cap of five name parts);
  • visitors see pointers into the tree;
  • narrower ReleaseAST pooling;
  • schema loader requirements;
  • linter rules now reach nested queries;
  • structured parser errors.
• Then come Added, Changed, Fixed, Performance, Security and Internal entries.
• The two existing Unreleased entries are kept; fix(tokenizer): restore default dialect on pool return #525 is now credited on the tokenizer-pool entry.
• Performance numbers are copied from each PR's own measurements; none were re-run here.

performance_baselines.json

• Re-measured with BenchmarkPerformanceBaseline -count=10 -benchmem (median) on an Apple M4. Tolerances are unchanged.
• Convention change: the baselines are now about 2.5× the M4 median, up from 1.5×.
  • The CI Benchmark job (ubuntu-latest) has measured these queries at about 1.5–3.2× the M4 numbers over the last 9 test runs on main (0715bb9..61ca6c8).
  • At 1.5× with the current tolerances, the limit would be about 2.4× M4, so CI's slowest runs would fail.
  • The cost: a local regression of up to about 4× would now pass.

Benchmark	ns_per_op	tolerance	current_performance
SimpleSelect	800	60%	~318 ns/op on Apple M4 (median of 10 runs, re-measured 2026-10-13); ~467-918 ns/op typical on CI (GitHub ubuntu-latest Benchmark job, range over the last 9 Tests runs on main, 0715bb9..61ca6c8)
ComplexQuery	2900	65%	~1165 ns/op on Apple M4 (median of 10 runs, re-measured 2026-10-13); ~1842-3386 ns/op typical on CI (GitHub ubuntu-latest Benchmark job, range over the last 9 Tests runs on main, 0715bb9..61ca6c8)
WindowFunction	1500	60%	~585 ns/op on Apple M4 (median of 10 runs, re-measured 2026-10-13); ~940-1876 ns/op typical on CI (GitHub ubuntu-latest Benchmark job, range over the last 9 Tests runs on main, 0715bb9..61ca6c8)
CTE	1400	60%	~561 ns/op on Apple M4 (median of 10 runs, re-measured 2026-10-13); ~824-1692 ns/op typical on CI (GitHub ubuntu-latest Benchmark job, range over the last 9 Tests runs on main, 0715bb9..61ca6c8)
INSERT	950	60%	~382 ns/op on Apple M4 (median of 10 runs, re-measured 2026-10-13); ~605-1169 ns/op typical on CI (GitHub ubuntu-latest Benchmark job, range over the last 9 Tests runs on main, 0715bb9..61ca6c8)

Test Plan

• go test -count=3 -run TestPerformanceRegression ./pkg/sql/parser/ passes locally.
• performance_baselines.json is valid JSON.
• An independent reviewer checked every new CHANGELOG bullet against the merged diffs and PR bodies over two rounds. That covered PR and issue numbers, API names and signatures, error codes, and performance figures, and every correction was applied. I read the Behavior changes section again before opening this PR.
• The reviewer also checked the baselines against BenchmarkPerformanceBaseline medians and against CI Benchmark job output from main.

Breaking Changes

None. This PR changes documentation and test baselines only.

Part of #566

🤖 Generated with Claude Code

https://claude.ai/code/session_01UZSk1292jPc8ipDboNxeve

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 14, 2026 12:16pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 32s —— View job

---

Review of PR #598: CHANGELOG consolidation and baseline refresh

• Read performance_baselines.json diff
• Read CHANGELOG.md diff, Behavior changes section (about 120 lines of the 337 added)
• Checked that the baseline arithmetic is consistent
• Not done: I did not re-read every CHANGELOG bullet against the merged PRs, and I did not run any tests. This is a docs and JSON change, and the PR says it was already reviewed against the diffs.

Verdict

No blocking issues. I'd approve this, but I can't submit a formal approval.

performance_baselines.json

• The JSON parses. The diff touches only ns_per_op, updated, and the description and note strings. The tolerances are unchanged, as the PR says.

• The 2.5× convention matches the numbers. Each baseline divided by its M4 median gives:

  • SimpleSelect: 800 / 318 = 2.52×
  • ComplexQuery: 2900 / 1165 = 2.49×
  • WindowFunction: 1500 / 585 = 2.56×
  • CTE: 1400 / 561 = 2.50×
  • INSERT: 950 / 382 = 2.49×

• Every slowest CI run in the PR body stays under the new limit (baseline × (1 + tolerance)):

  Benchmark	Limit (ns/op)	Slowest CI run (ns/op)
  SimpleSelect	1280	918
  ComplexQuery	4785	3386
  WindowFunction	2400	1876
  CTE	2240	1692
  INSERT	1520	1169

  Headroom is about 25–40%.

• Trade-off (already stated in the PR): a local regression of up to about 4× the M4 median now passes. TestPerformanceRegression is a coarse guard, not a precise one. A tighter local check, such as a benchstat comparison, would complement it. That would be separate work.

• Nit, not blocking: "version": "1.14.0" is unchanged although the content now covers unreleased work. It makes sense as "last release baselined against". It may be worth bumping when the release is cut.

• Nit, not blocking: the same long note string is repeated five times. It's harmless, but a single top-level note would be easier to maintain if the schema allows one.

• Nit, not blocking: the "(up to ~3.2x)" parenthetical is redundant next to "1.5-3.2x".

CHANGELOG.md

• Structure is good. The opening Behavior changes section lists what is observable on upgrade, with PR and issue references on each bullet. It follows Keep a Changelog conventions.
• The zero-copy bullet is the most important one. It tells callers to use strings.Clone on cached token and AST strings, and it notes that Extract* and the DDL loader already clone. Consider also putting this in the release notes.
• The "Oracle arr[1:n] now fails" bullet is a real change in behavior. It is documented clearly and is limited to DialectOracle.
• The visitor-pointer bullet warns that mutating nodes now changes the AST and that the pointers are invalid after ReleaseAST. That is the right level of warning.
• Wording nit: the intro says "Exported signatures are unchanged apart from additions", but the Behavior changes include ReleaseAST pooling semantics and error text changes. That's accurate for signatures, but you may want to say "source-compatible" so readers don't assume runtime behavior is unchanged.
• Release-time check: the section header says [Unreleased]. When the release PR is cut (per the CLAUDE.md release workflow), make sure the version and date replace it. The baselines version field should be updated at the same time.
• Perf figures are not independently verifiable here. The PR states they were copied from each PR's own measurements. I treated them as given.

Test plan

The PR reports TestPerformanceRegression passing locally and the JSON validating. I did not re-run the performance test. Race-detector runs skip it, and CI is the more meaningful signal given the runner variance this PR addresses.
· branch docs/changelog-perf-audit

[github-actions]

Claude finished @ajitpratap0's task in 27s —— View job

---

Review of PR #598 (re-review after new commits)

• Re-read performance_baselines.json diff (unchanged since my last review)
• Read the two new CHANGELOG commits (60f9f43 batch-3 fixes cli: gosqlx format silently corrupts many expressions; switch the CLI to pkg/formatter #599-schema/postgres: loader misreports index columns and key flags (column order, INCLUDE, expression and partitioned indexes, read-only roles) #620, 5c44d7e fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632/fix(cli): render gosqlx format through pkg/formatter and refuse non-round-tripping output (#599) #624 hardening)
• Not done: I did not check each new bullet against its merged PR, and I did not run any tests. This change is docs and JSON only.

Verdict

No blocking issues. I can't submit a formal approval.

performance_baselines.json

Unchanged since the last round. My earlier notes still apply:

• The baselines are about 2.5× the M4 medians.
• The slowest CI run is under each limit.
• A local regression of up to about 4× now passes. The PR states this trade-off.

CHANGELOG.md (new commits)

• Structure and content are good.
  • The new Behavior-changes bullets say what changed and what readers should do about it.
  • Examples: the MySQL "bob" refusal in format, the E2004 cap of 5 name parts, SQL Server hints needing bare words, and Children() returning pointers.
  • The Security entry for fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 describes the render-time injection fix with a concrete example. It is the most important new line for downstream users.
• Stale scope text.
  • The PR description says the changelog "covers every PR merged since v1.14.0, from chore(integrations): bump to GoSQLX v1.14.0 #509 to fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597". The new commits go up to fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632.
  • Update the PR description. Check that no intro line in the [Unreleased] section still says "fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597".
• Formatting nit.
  • The new bullets in each section are separated from the earlier ones by a blank line. For example, the new Added items follow ast.PoolLeakCount() after a blank line, and so do the new Fixed and Security items.
  • Markdown renders the same either way. If you want the sections to look uniform, remove those blank lines.
• Grouping nit.
  • "Performance impact" is mentioned in two places for the sorted Extract* results: 3-15% ns/op in Behavior changes, and the Performance section. This is fine, but pick one place if you want to shorten it.
• Potential duplication.
  • The gosqlx format entry appears in Behavior changes (cli: gosqlx format silently corrupts many expressions; switch the CLI to pkg/formatter #599, fix(cli): render gosqlx format through pkg/formatter and refuse non-round-tripping output (#599) #624), in Fixed ("dropped or mangled constructs"), and under Added ("ALTER TABLE rendering"). They cover different angles, so I wouldn't remove any, but check that the PR numbers on each are consistent.
• Wording nit from my last review still applies. The intro says "Exported signatures are unchanged apart from additions". "Source-compatible" would be clearer, given the runtime behavior changes listed.
• Release-time reminders.
  • Replace [Unreleased] with the version and date.
  • Bump "version" in performance_baselines.json when the release is cut.

Test plan

The PR reports TestPerformanceRegression passing locally. I did not re-run it. CI is the better signal for the runner variance this PR addresses.
· branch docs/changelog-perf-audit

[github-actions]

Claude finished @ajitpratap0's task in 16s —— View job

---

Re-review of PR #598 (after fa39ca9)

• Read the new commit fa39ca9 (CHANGELOG only, +19/-11)
• Checked that the earlier nits were addressed
• Not done: I did not check each new figure against the merged PRs, and I did not run any tests. This is docs only.

Verdict

No blocking issues. I can't submit a formal approval.

What the new commit fixes

• Blank-line nit: the stray blank lines inside the Behavior changes, Added, Fixed, Performance and Security lists are gone, so each section is one tight list.
• Compare link: [Unreleased] now points to v1.14.0...HEAD (it was v1.12.1...HEAD), and a [1.14.0] link is added.
• Corrections: the fix(parser,ast): ClickHouse parametric aggregates, FROM table functions and their rendering (#605, #606, #607) #628 and fix(formatter,ast,parser): no inner semicolons; keep IGNORE NULLS, named args, ON DUPLICATE KEY, OUTPUT, SETTINGS (#602, #600) #631 entries are narrower and more accurate. The new line on the measured costs of the batch-3 fixes fills a gap in the Performance section.
• Stale scope text: #597 still appears in the body only as an attribution on fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597's own entries. That is correct.

Remaining items (all non-blocking)

• PR description: it still says the changelog covers "chore(integrations): bump to GoSQLX v1.14.0 #509 to fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597", but the branch now goes up to fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632. Update the description.
• Intro wording: line 12 still says "Exported signatures are unchanged apart from additions". "Source-compatible" would be clearer, because ReleaseAST pooling and error texts do change at runtime.
• Duplicate figure: the sorted Extract* cost ("3-15% ns/op") is in both Behavior changes and Performance. That's fine, but you could keep it in one place.
• Compare-link order: [1.14.0] is correctly placed above [1.13.0]. Please check that the v1.13.0...v1.14.0 tags exist.
• Release-time reminders:
  • Replace [Unreleased] with the version and date.
  • Bump "version" in performance_baselines.json when the release is cut.

performance_baselines.json is unchanged since my last review, so those notes still apply. The baselines are about 2.5× the M4 medians, and the slowest CI runs stay under each limit.
· branch docs/changelog-perf-audit

[github-actions]

Claude finished @ajitpratap0's task in 20s —— View job

---

Re-review of PR #598 (after 36e4f43)

• Checked the diff stat (CHANGELOG.md and performance_baselines.json only)
• Checked that the "source-compatible" wording nit was addressed
• Checked the compare links
• Not done: I did not re-verify each bullet against the merged PRs, and I did not run any tests. The change is docs and JSON only. A sandbox restriction also stopped me from running a JSON parse check this round. The earlier reviews confirmed the file parses and that the diff touches only the baseline numbers and description strings.

Verdict

No blocking issues. I can't submit a formal approval.

What the new commit fixes

• Intro wording: line 13 of CHANGELOG.md now reads "source-compatible: exported signatures are unchanged apart from additions". That closes the wording nit from my last two reviews.
• Compare links: [Unreleased] points to v1.14.0...HEAD. [1.14.0] and [1.13.0] follow in the right order. I couldn't confirm here that the v1.13.0 and v1.14.0 tags exist. Please check that before the release.

Remaining items (all non-blocking)

• PR description: it still says the changelog covers "chore(integrations): bump to GoSQLX v1.14.0 #509 to fix(tokenizer,parser,formatter): bound input-driven recursion, comment counts and set-operation rendering #597", but the branch now goes up to fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632. Update it.
• Duplicate figure: the sorted Extract* cost ("3-15% ns/op") appears in both Behavior changes and Performance. It is fine to keep both.
• Release-time reminders:
  • Replace [Unreleased] with the version and date.
  • Bump "version" in performance_baselines.json.

performance_baselines.json is unchanged since my first review, so my earlier notes stand. The baselines are about 2.5× the M4 medians, and the slowest CI runs stay under each limit. A local regression of up to about 4× now passes, which the PR states.
· branch docs/changelog-perf-audit

[ajitpratap0]

Merge train (batch 3): #598, the last PR in the train

• Rebase: onto main baf528e, after all 12 batch-3 PRs (fix(ast): return CreateTable, FunctionDesc and trigger children as pointers (#617) #621–fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 and fix(cli): render gosqlx format through pkg/formatter and refuse non-round-tripping output (#599) #624) merged. This is docs and baselines only: CHANGELOG.md and performance_baselines.json.

• Batch-3 entries: written from the merged code and the merge-train comments. An independent Opus pass checked them against origin/main with probes and the CLI. It corrected:

  • the fix(parser,ast): ClickHouse parametric aggregates, FROM table functions and their rendering (#605, #606, #607) #628 SQLite alias claim;
  • the fix(formatter,ast,parser): no inner semicolons; keep IGNORE NULLS, named args, ON DUPLICATE KEY, OUTPUT, SETTINGS (#602, #600) #631 FORMAT rule.

  It also added the measured costs of the batch-3 fixes under Performance, plus the minor fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 rendering changes. It confirmed every API name, error code and CLI behaviour cited.

• Security: the fix(ast,formatter): NOT EXISTS, quoted identifiers, table hints and PIVOT render correctly (#601, #611, #604) #632 render-time SQL injection fix is recorded there.

• Intro: now describes the release as source-compatible, with runtime behaviour changes.

• Links: compare links fixed (v1.14.0...HEAD, plus a [1.14.0] link); both tags exist.

• Baselines: TestPerformanceRegression passes against current main with the refreshed baselines.

• CI: 28/28 green on 36e4f43.

• Bot review: no blocking items. Its intro-wording and description notes are addressed. The duplicated Extract cost figure is intentional: it appears once as a behaviour change and once as a cost.

• Release-time items (not in this PR): replace [Unreleased] with the version and date, and bump "version" in performance_baselines.json.