Sprint v0.2.0 — Drivers, CI, README hero

[NikolayS]

Sprint goal: ship v0.2.0 — drivers polished + tested + published, Go bugfixes, CI exercising live PG with per-client visibility, README hero leading on xmin-horizon argument with WI #77 R8 numbers (no link), plus release-blocker audit findings from #113.

Wave 1

• W1: Go driver bugfixes — Nack $12 placeholder, eager Connect, Consumer panic recovery #91 — W1 Go driver bugfixes — MERGED fix(clients/go): Nack placeholder, eager Connect ping, Consumer panic recovery #115
• W2: PR #83 — fix REV round 1 findings (TypeScript driver) and re-review #88 — W2 PR feat(clients/typescript): bring driver to parity with Go (API surface, tests, packaging) #83 fix-and-re-REV (TS) — MERGED feat(clients/typescript): bring driver to parity with Go (API surface, tests, packaging) #83
• W3: PR #84 — split client-tests into per-client jobs (Go/Python/TypeScript) #90 — W3 PR ci: client-tests job runs all 3 driver suites against live PG #84 split client-tests into per-client jobs — REV done; rebase to drop band-aids in flight

Wave 2

• W4: PR #82 — fix REV round 1 findings (Python driver) and re-review #94 — W4 PR feat(clients/python): bring driver to parity with Go (API, tests, packaging) #82 Python driver fix-and-re-REV — MERGED feat(clients/python): bring driver to parity with Go (API, tests, packaging) #82
• W5: PR #66 polish — benchmark methodology, mark ready-for-review #92 — W5 PR docs: bench methodology + tooling under benchmark/ #66 polish (benchmark methodology) — engineer looping leak fix
• Bug: receive(max_return) can return extra row and ack can skip unreturned messages #95 — W10 receive(max_return) — MERGED fix(pgque.receive): reject max_return < 1 and document batch-ownership #114

Wave 3

• W6: PR #68 polish — three-latencies doc (callout in README + dedicated docs/three-latencies.md) #89 — W6 PR docs: three-latencies explanation #68 three-latencies doc — REV clean, ready-for-review
• W7: PR #72 polish — R8 chart analyzers (blocked by W5/PR #66) #93 — W7 PR charts: add R8 analyzers to benchmark/charts/ #72 R8 chart analyzers (blocked by W5: PR #66 polish — benchmark methodology, mark ready-for-review #92)
• W8: PR #81 — REV cycle on Go thorough tests (blocked by W1) #86 — W8 PR test(clients/go): comprehensive coverage — error paths, concurrency, edge cases, benchmarks #81 Go thorough tests REV cycle — rebase + dedupe in flight
• W9: README hero rewrite — lead with xmin-horizon argument and R8 numbers #87 — W9 README hero rewrite — engineer pushing post-approval

Wave 4 — release-blocker audit findings (added per umbrella #113)

Order roughly by user's umbrella priority list. All require red/green TDD where there's a real bug.

Critical security (highest priority)

• Security: pgque roles are bypassed by default PUBLIC EXECUTE on functions #96 — pgque roles bypassed by default PUBLIC EXECUTE
• Security: pgque_admin can escalate via queue_extra_maint executed by SECURITY DEFINER maint() #101 — pgque_admin escalation via queue_extra_maint in SECURITY DEFINER maint()

Correctness bugs (release blockers)

• Bug: nack() DLQ path trusts caller-supplied pgque.message and allows forged DLQ rows #98 + Bug: repeated nack() of same DLQ-bound message creates duplicate replayable DLQ rows #104 — nack/DLQ canonical+idempotent terminal handling (combined fix)
• Bug: receive() can strand consumer on empty active batch with no batch_id to ack #103 — receive() empty-batch consumer-stranding trap
• Bug: batch_retry() fails on xid8 schema (NULL::int8 inserted into ev_txid xid8) #107 — batch_retry() fails on xid8 schema
• Bug: pgque.maint() VACUUM branch fails because VACUUM cannot run inside PL/pgSQL function #110 — maint() VACUUM cannot run inside PL/pgSQL
• Bug: queue names longer than 57 bytes fail via pg_notify channel name in ticker/create_queue #109 — queue names >57 bytes break pg_notify

Concurrency (contingent on intended model)

• Bug: concurrent receive() for same consumer can double-deliver same events #97 — concurrent receive() double-delivery (clarify model + lock or document)

Python client release-scope

• Client/docs: Python consumer/client contract can drop unhandled messages and misdocuments string payloads #111 — Python consumer drops unhandled messages + misdocuments string payloads

Docs (release-quality bar)

• Docs: manual scheduler and reference are stale for retry_events, maint(), force_tick(), nack(), grants #99 — manual scheduler + reference drift (retry_events / maint / force_tick / nack / grants)
• Docs: README/examples client snippets have invalid ack usage, event-type mismatch, benchmark/version drift #105 — README/examples invalid ack usage, event-type mismatch, version drift
• Docs: clarify PgQue roles are global/coarse, not per-queue multi-tenant isolation #112 — roles are global/coarse — document clearly (clarifies Security: any pgque_writer can ack another consumer/app's active batch by batch_id #102/Security: low-level primitives let writers mutate/read other consumers' active batches #106 design call)

Deferred to v0.2.1+ (per umbrella triage)

• Hardening: validate queue config values and external ticker monotonicity #100 hardening (config validation), Security: any pgque_writer can ack another consumer/app's active batch by batch_id #102/Security: low-level primitives let writers mutate/read other consumers' active batches #106 (design call dependent on Docs: clarify PgQue roles are global/coarse, not per-queue multi-tenant isolation #112), Security/docs: get_batch_cursor(extra_where) executes raw SQL predicate and can forge returned rows #108 (extra_where docs trust note)

Non-negotiables

1. Red/green TDD for every bug fix.
2. PR lifecycle: CI → REV → tested with evidence → user merges.
3. Anti-leak strict.
4. CLAUDE.md style.
5. No SOC2 in REV.

Definition of Done

• All sprint-labeled issues closed (PRs merged by user).
• Spec alignment vs SPECx.md; deviations documented in SPECx.amendments.md.
• No outstanding REV-blocking findings on any merged PR.