# v0.92.0 — Defaults, Bounds & Diagnosis

> **Status:** Planned
> **Scope:** Large
> **User promise:** *"I can confidently run this for years."*
> **Blocked by:** [v0.91.0](v0.91.0.md)
> **Renumbered and split:** previously the first half of v0.87.0 "Production
> Polish". Monitoring integration, assurance testing and packaging moved to
> [v0.93.0](v0.93.0.md).

## Theme

The first of the two final feature releases. The question it answers is not
"what else can pg_trickle do?" but **"does it behave sensibly without being
tuned, and does it tell me what went wrong?"**

Everything here is about defaults, bounds and diagnosis. No new capability, no
new architecture, no distributed anything.

## Items

### PP-1: Defaults that are right without being tuned

Ship a zero-config adaptive mode that detects the environment on first start —
available memory, `max_worker_processes`, CPU count, whether the instance looks
like a laptop, a modest managed instance, or a large dedicated server — and
selects a coherent configuration profile rather than a set of independent
defaults.

The chosen profile is reported (`pgtrickle.active_profile()`), explained in
`explain()`, and fully overridable. The design constraint: **the out-of-the-box
configuration should be the right answer for the large majority of installs**,
and the config advisor should usually have nothing to suggest.

### PP-2: Bounded resource consumption, proven

Every resource pg_trickle consumes has a documented, enforced ceiling:

| Resource | Bound |
|----------|-------|
| Memory | `pg_trickle.memory_budget_mb` (v0.87.0), enforced per component |
| Background workers | `adaptive_workers_min`..`adaptive_workers_max` (v0.90.0) |
| Disk (change buffers, history, state) | quota with retention policy and alert |
| WAL generated | reported per source; capture-side reduction measured |
| CPU share under load | bounded by the backpressure controller (v0.87.0) |
| Connections | bounded, documented, PgBouncer-compatible |

Disk in particular becomes predictable: `pgtrickle.disk_usage()` reports current
and projected usage per stream table, retention is enforced automatically, and
`health_check()` warns before the trend crosses available headroom.

### PP-3: Progress reporting

Long operations report progress the way PostgreSQL does, via a
`pg_stat_progress_pgtrickle`-style view: initial population, FULL refresh,
rebuild after `ALTER`, reinitialisation after repair. Each reports phase, rows
processed, rows estimated, and elapsed time. No more staring at a query that
might be five seconds or five hours from finishing.

### PP-4: Error messages that tell you what to do

An audit of every user-visible error and warning, held to a standard:

- correct SQLSTATE (the rollout begun in earlier releases is completed)
- `MESSAGE` states what failed, in the user's vocabulary
- `DETAIL` gives the specific object, value or limit involved
- `HINT` gives a concrete next action, and where possible the exact SQL

Enforced by a CI lint over `ereport!` sites, and by a documented error-code
reference generated from the source.

### PP-6: A simple, auditable privilege model

One documented model for who can create, alter, refresh, pause and inspect
stream tables, expressed with predefined roles (`pg_trickle_admin`,
`pg_trickle_operator`, `pg_trickle_reader`) rather than a matrix of function
grants. Includes the RLS interaction, `SECURITY DEFINER` boundaries, and what a
non-superuser can and cannot do — with tests asserting each boundary.

This is the user-facing packaging of the explicit ACL matrix enforced in
[v0.84.0](v0.84.0.md) CAT-81-2, not a second privilege model. If the two
disagree, v0.84.0 wins and the roles are adjusted to match.

## Exit criteria

- [ ] Zero-config profile selection ships; the config advisor has no suggestions
      for the standard benchmark environments
- [ ] Every resource in the bounds table has an enforced ceiling and an alert
- [ ] Progress view covers all four long operations
- [ ] Error-message audit complete; CI lint blocks regressions; generated error
      reference published
- [ ] Predefined roles shipped, documented, and boundary-tested against the
      v0.84.0 ACL matrix