The safety contract

Every connection pgdba makes — checks, doctor probes, migration preflight — runs under the same contract, applied before any analysis query:

1. Read-only transaction (default_transaction_read_only=on) — the server rejects writes even if pgdba had a bug; nothing depends on pgdba being correct.
2. Statement timeout (default 30s) — a pathological query cannot wedge the session; the run degrades gracefully instead.
3. Connect timeout (default 10s) — a hung host cannot stall the run.
4. Version gate — PG 13–17 verified from server_version_num; anything else refuses with a clear error rather than guessing.
5. Managed-host detection (RDS and friends) — privilege-sensitive checks adapt or skip instead of erroring.

Why writes are opt-in, always

Advice-only is the default for every command that can write: --apply executes remediation you approve per action; migration writes only after preflight passes and you confirm; restore rehearsal is fenced away from production targets. The tool’s job is to make the safe path the default path — and to record, in an audit log, every action that did run.

On pooled targets (PgBouncer and friends), session SETs do not survive, so the contract is re-applied per statement with transaction-scoped SET LOCAL when pooled = true marks the profile.