Viewing on GitHub? The roadmap lives in ROADMAP.md. This stub is served by the pg_trickle docs site — the include below renders there.

pg_trickle Roadmap

Audience: Product managers, stakeholders, and technically curious readers who want to understand what each release delivers and why it matters — without needing to read Rust code or SQL specifications.

Versions

Foundation (v0.1.x)

Early Feature Development (v0.2.x – v0.5.x)

Scalability and Robustness (v0.6.x – v0.9.x)

Production Readiness (v0.10.x – v0.14.x)

Performance and Integration (v0.15.x – v0.19.x)

Self-Monitoring and Deep Correctness (v0.20.x – v0.27.x)

Toward Stable (v0.28.x – v1.0)

pg_tide Extraction (v0.46.0)

Embedding & AI Programme (v0.47.x – v0.48.x)

v1.0 Readiness Arc (v0.49.x – v0.51.x)

Assessment-Driven Final Hardening Arc (v0.52.x – v0.55.x)

Driven by the findings in the v0.51.0 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_11.md). The assessment found 0 critical, 2 HIGH, and 22 MEDIUM findings across correctness, performance, scalability, test coverage, code quality, security, and feature completeness — all resolved in this four-release arc before v1.0.

Documentation Excellence Arc (v0.56.x – v0.57.x)

Driven by the findings in the Round 2 documentation audit (plans/PLAN_DOCUMENTATION_GAPS_2.md, 2026-05-11). The audit found 3 P0 blockers (corrupted GUC_CATALOG.md, 54%-complete ERRORS.md, wrong GUC default), 8 P1 items, 7 P2 items, 5 P3 items, and 7 new documents that should exist before v1.0. This two-release arc resolves all findings and delivers the world-class documentation standard planned for the stable release.

Assessment-Driven Hardening Arc (v0.58.x – v0.61.x)

Driven by the findings in the v0.57.0 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_12.md). The assessment found 0 critical, 4 HIGH, 23 MEDIUM, and 20 LOW findings across security (ownership bypass in outbox/publication APIs), correctness (recursive-CTE depth guard in DIFFERENTIAL mode, multi-column NOT IN + NULL semantics, WAL decoder TOCTOU race), performance (per-source SPI fan-out in monitor, merge-template clone overhead, WAL decoder allocation patterns), observability (missing CDC-lag percentiles, worker queue-depth, WAL decoder queue, refresh-mode ratio counters), code quality (scheduler log levels, codegen decomposition, cdc.rs split), and test coverage (refresh orchestrator, CDC, hooks, remaining fixed sleeps). This four-release arc resolves all findings before v1.0.

Scheduler Throughput Arc (v0.62.x – v0.63.x)

Two releases targeting scheduler throughput: eliminating redundant change-buffer scans via fan-out, adding the pause_scheduler / resume_scheduler / stream_table_spec SQL API required by the planned pg_aqueduct migration tool (plans/pg-aqueduct-plan.md), and implementing fused CTE refresh to reduce per-tick statement overhead for multi-node DAGs.

Beyond v1.0

How these versions fit together

v0.1.0   ─── Foundation: differential engine, CDC, scheduling, 1300+ tests
    │
v0.2–0.5 ─── TopK, IMMEDIATE mode, RLS, partitioned sources, parallel refresh
    │
v0.6–0.9 ─── Circular DAGs, watermarks, Prometheus, algebraic aggregates
    │
v0.10–14 ─── PgBouncer compat, 34× latency, partitioned outputs, tiered scheduling
    │
v0.15–19 ─── Nexmark, append-only fast path, cost model, security, packaging
    │
v0.20–23 ─── Self-monitoring, zero-crash guarantee, downstream CDC, TPC-H at scale
    │
v0.24–27 ─── Join correctness complete, thousands of STs, snapshot/PITR
    │
v0.28–29 ─── Reliable event messaging (outbox + inbox) + relay CLI
    │
v0.30    ─── Quality gate: correctness, stability, docs (required for 1.0)
    │
v0.31    ─── Scheduler intelligence and performance hot paths
    │
v0.32    ─── Citus: stable naming foundation (additive, safe for all users)
    │
v0.33    ─── Citus: distributed CDC and stream table support
    │
v0.35    ─── EC-01 fix, Citus chaos rig, reactive subscriptions, shadow-ST, relay hardening
    │
v0.36    ─── L0 cache, WAL backpressure, api split, temporal IVM, columnar, RowIdSchema
    │
v0.37    ─── Scheduler split, pgVectorMV, OpenTelemetry, pg_partman compat
    │
v0.38    ─── Correctness closeout and truthfulness: EC-01, RowIdSchema planning, backpressure, wake/docs repair
    │
v0.39    ─── Distributed hardening and diagnostics: Citus chaos, durable CDC hold, TPC-H explain artifacts, fuzzing
    │
v0.40    ─── Operator trust and maintainability: generated docs, alerting, drain proof, secret hygiene, unsafe gating
    │
v0.41    ─── DVM correctness: structural cache keys, placeholder safety, WAL transition guards
    │
v0.42    ─── Docs truthfulness + test quality: repair_stream_table, catalog generator, sleep removal, fuzz CI
    │
v0.43    ─── Performance tunability: deep-join GUCs, GROUP_RESCAN improvement, explain diagnostics, D+I CB refactor
    │
v0.44    ─── Security hardening: IVM search_path, SQL builder, RLS warnings, module decomposition
    │
v0.45    ─── Operational readiness: preflight, scalability, CI completeness, CNPG production
    │
v0.46    ─── Extract pg_tide: standalone outbox/inbox/relay → trickle-labs/pg-tide; attach_outbox() integration
    │
v0.47    ─── Embedding infrastructure: post-refresh actions, drift-based reindex, vector monitoring
    │
v0.48    ─── Complete embedding programme: sparse vectors, hybrid search, embedding_stream_table(), per-tenant ANN
    │
v0.49    ─── Test infrastructure hardening: concurrency sync overhaul, 10-module unit sweep, merge fuzz, DDL E2E, scheduler split
    │
v0.50    ─── Performance, security & ops hardening: SPI batching, dblink fix, CNPG drain hook, digest pinning, ring observability
    │
v0.51    ─── Citus chaos resilience & doc truth: chaos rig, deprecated GUC removal, pg_tide boundary, CTE strategy docs
    │
v0.52    ─── DVM hot-path perf: O(1) placeholder resolution, volatility cache, lazy DiffContext, O(1) LRU eviction
    │
v0.53    ─── Unit test depth: dag/scheduler/CDC/parser/config sweep, proptest extension, sleep removal
    │
v0.54    ─── DVM hardening: diff_node depth limit, DiffContext OOM cap, snapshot fingerprint cache, view inlining fixpoint, O(V+E) diamond detection
    │
v0.55    ─── Final pre-1.0 polish: configurable ring, module decomposition, serde_json NOTIFY, multi-column IN rewrite, DVM metrics, docs
    │
v0.56    ─── Documentation Foundation: GUC_CATALOG fix, ERRORS.md complete (44 variants), MENTAL_MODEL.md, LIMITATIONS.md, PERFORMANCE_CHEATSHEET.md
    │
v0.57    ─── Documentation Excellence: 4 new tutorials, P2/P3 polish, full 83-file consistency sweep
    │
v0.58    ─── Security & correctness hardening: ownership checks (outbox/publication APIs), NOT IN + NULL fix, recursive CTE depth guard, WAL decoder TOCTOU lock, DDL hook escalation
    │
v0.59    ─── Performance & observability: batched monitor SPI, query-hash cache, Arc<str> templates, WAL decoder Vec pre-alloc, CDC-lag percentiles, worker queue metrics, app_name BGW, backup docs
    │
v0.60    ─── Code quality, test coverage & CI: cdc.rs split, codegen decompose, refresh/CDC/hooks unit tests, idempotence proptest, sleep removal, WAL OID filter, partition-attach rebuild, path-filtered E2E on PRs
    │
v0.61    ─── DX, docs & pre-1.0 polish: health_check foreign-owner row, SQL_REFERENCE complete, snapshot secondary equality, cte_counter reset, outbox name fix, sublinks decompose, 3 ADRs, LATERAL docs
    │
v0.62    ─── Scheduler throughput: change-buffer fan-out (O(N)→O(1)), pause/resume_scheduler SQL API, stream_table_spec() stable JSON projection
    │
v0.63    ─── Fused multi-node refresh: CTE-chain composition across ready nodes, ≥ 20 % wall-time reduction on TPC-H 22-node DAG
    │
v1.0.0   ─── Stable release, PostgreSQL 19, package registries, signed artifacts, SBOMs

v0.1.0 through v0.27.0 build the complete core engine and harden it for production use. v0.28.0 and v0.29.0 deliver the event-driven integration story. v0.30.0 is a mandatory correctness and polish gate before 1.0. v0.31.0 sharpens scheduler intelligence before new features are added. v0.32.0 is the first of two Citus releases, shipping stable object naming and detection helpers as an additive, non-breaking foundation. v0.33.0 delivers the full Citus integration immediately after — per-worker slot CDC, distributed ST placement, cross-node coordination, and the Citus test suite. Pulling v0.33.0 forward means users with Citus topologies (including billion-row all-distributed deployments) are unblocked two releases earlier. v0.35.0 was intended to be the single most important release before v1.0, but the v0.37.0 overall assessment shows several of those closeout items remain partially open or insufficiently proven. v0.36.0 and v0.37.0 still delivered substantial structural gains: L0 cache construction, temporal IVM, RowIdSchema, scheduler and merge splits, pgVectorMV, and OpenTelemetry trace capture. The next three releases now form a hardening programme rather than an immediate feature expansion.

v0.38.0 is a dedicated EC-01 correctness sprint with a hard release gate: This release will NOT ship until join phantom rows are proven closed with a comprehensive DIFF-vs-FULL property test suite covering Q07/Q15-style joins. EC-01 has been labeled critical since v0.20.0 (6+ releases) and deferred multiple times; v0.38.0 breaks that pattern by making EC-01 closure the sole release objective. No other features, no operational docs, no SQLSTATE rollout — just the join phantom-row fix and its proof.

v0.39.0 absorbs the operational truthfulness items that were originally planned for v0.38.0: backpressure hysteresis or deprecation, wake-truthfulness repair, generated configuration and upgrade docs, OpenTelemetry collector proof, SQLSTATE rollout on hot paths, and the full distributed/diagnostic coverage (Citus chaos testing, durable CDC hold semantics, per-query TPC-H explain artifacts, SQLancer light PR mode, targeted fuzzing, and inbox/outbox reliability tests).

v0.40.0 then focuses on operator trust and maintainability: generated SQL/GUC references, drain-mode proof, monitoring/alert rules, security-model and secret-handling docs, upgrade-gate coverage, unsafe-inventory PR gating, and continued decomposition of the largest files.

v0.41.0 through v0.45.0 form a second hardening arc driven by the findings in the v0.40 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_9.md). These five releases systematically close every gap identified across 10 dimensions: correctness (P0 cache-key and placeholder fixes), documentation truthfulness (repair function implementation, catalog generator rewrite), test quality (sleep removal, property tests, fuzz CI — merged into v0.42.0), performance tunability (GUC-exposed thresholds, explain diagnostics), security (search_path hardening, centralized SQL building), and operational readiness (preflight functions, scalability infrastructure, CI completeness). Only after this arc does the roadmap resume the embedding programme in v0.47.0–v0.48.0, preserving the pgvector work while aligning the release order with the assessment's conclusion that closing correctness and operational gaps matters more than adding new surface area. The embedding programme itself is consolidated into two releases: v0.47.0 for infrastructure and ANN maintenance, and v0.48.0 completing the full feature set (sparse/half-precision aggregates, hybrid search, the ergonomic embedding_stream_table() API, per-tenant ANN patterns, and outbox-emitted embedding events). v0.46.0 precedes this arc with the extraction of pg_tide — moving the outbox, inbox, and relay subsystems into a standalone extension at trickle-labs/pg-tide.

v0.49.0 through v0.51.0 form the v1.0 readiness arc, driven by the findings in the v0.48.0 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_10.md). The assessment confirmed that every P0 correctness issue from prior assessments is closed — EC-01 phantom rows, snapshot cache-key weakness, placeholder resolution, and WAL transition TOCTOU are all fixed. The project has transitioned from a capability problem to a coverage confidence problem. These three releases systematically close the remaining gaps across test reliability, performance, security hardening, operational polish, and documentation truth before v1.0.

v0.58.0 through v0.61.0 form the final assessment-driven hardening arc before v1.0, driven by the findings in the v0.57.0 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_12.md). The assessment found 0 critical findings, 4 HIGH severity issues (ownership-check bypass in the outbox and publication APIs, recursive-CTE depth guard not applied in DIFFERENTIAL mode, multi-column NOT IN with NULL row semantics, and per-source SPI fan-out in the monitor health check), plus 23 MEDIUM and 20 LOW items spanning performance, observability, code quality, test coverage, and documentation. v0.58.0 closes all HIGH findings as a hard gate. v0.59.0 eliminates the performance and observability gaps. v0.60.0 completes the code quality and test coverage sweep. v0.61.0 delivers the final developer-experience and documentation polish, closing the last remaining items so that v1.0 is a clean, fully verified stable release.

v0.49.0 targets test infrastructure quality — the single highest-risk category from the v10 assessment. All concurrency tests currently rely on sleep(50ms) for synchronization, which provides false confidence: tests may pass locally while missing real race conditions on slow CI runners or under load. This release replaces sleep-based synchronization with pg_locks-polling patterns throughout tests/e2e_concurrent_tests.rs. Alongside, ten source modules that have zero #[cfg(test)] unit test coverage are systematically addressed: catalog.rs, template_cache.rs, ivm.rs, cdc/polling.rs, cdc/rebuild.rs, diagnostics.rs, logging.rs, metrics_server.rs, and otel.rs. New fuzz targets are added for the refresh merge SQL codegen (src/refresh/merge/) and row identity tracking (src/dvm/row_id.rs) — two high-value surfaces with no current fuzz coverage. An E2E test for concurrent DDL during active refresh (ALTER STREAM TABLE + in-flight refresh) is added. The src/scheduler/mod.rs monolith (6,700+ lines) is decomposed into focused submodule files: scheduling loop, parallel dispatch state, and cost model each become separate files. The e2e-smoke CI filter is widened to cover join, aggregate, and window operator regressions on every PR, and a consolidated just fuzz-all recipe is added to the justfile.

v0.50.0 targets performance, security, and operational hardening. The differential refresh hot path currently makes 3–4 separate SPI round-trips per refresh cycle — buffer existence check, change count per source, and table row estimate — that are consolidated into a single CTE query, saving 10–15ms per multi-source refresh. The CDC trigger SQL generation loop is tightened using String::with_capacity() to eliminate per-column heap allocations. The watermark computation in the scheduler tick is consolidated into a single compound query. On the security side, the src/citus.rs dblink calls that use manual single-quote doubling for escaping are replaced with pg_escape_literal() SPI calls for defense-in-depth. Operational gaps are closed: the CNPG cluster-production.yaml gains a preStop lifecycle hook that calls pgtrickle.drain(timeout_s => 120) before pod termination, preventing interrupted in-flight refreshes during rolling upgrades. All Docker base images are pinned to SHA256 digests for reproducible builds. The shared memory invalidation ring capacity limit (1,024 entries) is documented in docs/CONFIGURATION.md with a new pg_trickle_invalidation_ring_overflow Prometheus counter. Two additional Prometheus metrics are added: pg_trickle_dag_cycles_detected and pg_trickle_cache_stale_evictions. The deep join chain Part 3 correction threshold GUC and its trade-off between SQL complexity and correctness at >6 join tables is documented in the configuration reference with an associated soak-test assertion.

v0.51.0 closes the Citus resilience gap and brings documentation into full truth — the chaos test rig (node kill, rebalance, and network-partition scenarios) proves that every Citus failure mode is handled, while deprecated GUC removals, ARCHITECTURE.md boundary updates, recursive CTE strategy documentation, and CDC-enabled-flag documentation eliminate the last documentation inaccuracies identified in the v10 assessment.

v0.52.0 through v0.55.0 form the final pre-1.0 hardening arc, driven by the findings in the v0.51.0 overall assessment (plans/PLAN_OVERALL_ASSESSMENT_11.md). The assessment found no critical issues, two HIGH findings (both performance-class), and 22 MEDIUM findings across correctness, performance, scalability, test coverage, code quality, security, and feature completeness. These four releases close every one of them in priority order.

v0.52.0 targets the two HIGH-severity performance gaps on the DVM hot path. resolve_delta_template() currently resolves LSN placeholders by calling .replace() twice per source OID — an O(k×n) scan for k source tables in a SQL string of length n. This is replaced with a single aho-corasick pass that resolves all placeholders in one traversal, cutting multi-source refresh latency proportionally. Alongside, lookup_function_volatility() currently makes one SPI round-trip to pg_proc for every unknown function in a query — up to 50 ms overhead for function-heavy queries. A thread-local HashMap<String, char> cache pre-populated with all PostgreSQL built-in functions eliminates these trips on the hot path. Two further allocator improvements close the LOW-rated findings: DiffContext::new() switches from 12 unconditional HashMap::new() calls to Option<HashMap> with lazy initialization (saving 5–10 µs per refresh for simple queries), and the template cache eviction path is replaced with a proper LRU data structure for O(1) eviction instead of O(N) scanning.

v0.53.0 is the eleven-module unit test depth sweep. Five source modules that are responsible for core algorithmic logic — dag.rs (cycle detection, topological sort, diamond detection, schedule resolution), the eight scheduler/ submodules (cost model, tier transitions, watermark computation), cdc.rs/cdc/polling.rs/cdc/rebuild.rs (buffer naming, column escaping, trigger SQL), all five dvm/parser/ files (Expr::to_sql(), AggFunc classification, strip_qualifier()), and config.rs (mode parsing, threshold conversion) — have zero inline #[cfg(test)] unit tests and are only exercised through full-stack E2E tests. This release adds focused #[cfg(test)] modules to every one of them using mock structures that require no PostgreSQL backend. proptest! coverage is extended to DAG cycle detection and schedule resolution. The two remaining fixed-sleep tests in e2e_buffer_growth_tests.rs (7s and 20s sleeps) are replaced with adaptive pg_locks-polling helpers.

v0.54.0 hardens the DVM engine against pathological queries and slow parsing. diff_node() gains a depth counter that errors on breach of max_parse_depth (default 64), preventing stack overflow on extreme nesting. DiffContext gains a configurable CTE count ceiling (default 1,000) that returns a clean error before OOM can occur. The snapshot cache fingerprint is computed and stored at OpTree construction time instead of re-traversing the tree on every diff cycle, and Expr::to_sql() caches its result string to eliminate redundant allocations. View inlining (rewrite_views_inline()) is refactored to batch all relkind lookups into a single SPI query and use a fixpoint check (no changes this iteration) instead of a hard counter, cutting 3-level view hierarchies from ~15 ms to a single parse + one SPI call. The ST-to-ST frontier resolver is hardened to return PgTrickleError::SourceNotFound instead of silently defaulting to "0/0" when a required source is missing. Finally, diamond detection is reimplemented with a BFS-based visited-set merge algorithm, reducing complexity from O(V²) pairwise comparisons to O(V+E) — critical for deployments with 500+ stream tables.

v0.55.0 delivers the final pre-1.0 polish pass across scalability, module structure, security, documentation, and one new SQL feature. The shared-memory invalidation ring capacity (currently hardcoded at 1,024) becomes a GUC with a default of 1,024 and a maximum of 4,096, preventing excessive full DAG rebuilds in DDL-burst environments. src/api/mod.rs (7,600+ lines) is decomposed into focused submodules (api/create.rs, api/alter.rs, api/refresh.rs), and src/monitor.rs (4,000+ lines) is split into monitor/alert.rs, monitor/health.rs, and monitor/tree.rs. NOTIFY alert payloads are switched from manual string escaping to serde_json::json!() to guarantee correct JSON for error messages containing backslashes or control characters. The DVM parser gains automatic rewriting of WHERE (a, b) IN (SELECT x, y FROM ...) multi-column row IN subqueries to equivalent EXISTS form, closing the last user-visible SQL coverage gap. DVM parse timing metrics (pg_trickle_dvm_parse_ms, pg_trickle_delta_query_size_bytes) are added to the Prometheus metrics endpoint. The __PGS_/__PGT_ reserved column-name prefixes are documented in docs/SQL_REFERENCE.md, rationale comments are added to all magic-number GUC defaults in src/config.rs, and coverage reporting is added to the PR gate so regressions are visible before merge. truth.** The Citus distributed support shipped in v0.32–v0.34 has never had a chaos test suite — there are zero tests validating behaviour under node failure, shard rebalance, or network partition. This release delivers a docker-compose-based chaos rig with three scenarios: coordinator restart, worker node kill with automatic reconnect, and rolling shard rebalance during active refresh. The deprecated pg_trickle.event_driven_wake GUC (non-functional since background workers cannot use LISTEN) is removed entirely along with all associated code paths and the runtime warning it emits. Documentation is brought to full truth: docs/ARCHITECTURE.md is updated to clearly describe the pg_tide boundary after v0.46.0 extraction; docs/CONFIGURATION.md gains a deprecation header on the removed GUC entry; the recursive CTE strategy selection heuristic (semi-naive vs. DRed vs. recomputation fallback) is documented for the first time with an example EXPLAIN output; and a note is added to docs/CONFIGURATION.md clarifying that CDC triggers fire even when pg_trickle.enabled = false (by design, to keep buffers ready for re-enable).