[throwawayninja]

I love this! computer science is all about abstractions and guarantees, and it's great to have an option for more control. One thought about graceful degradation: would it be easy/possible to build in configuration to "when guarantee cannot be met, only throw an error x% of the time"? This keeps the situational awareness (errors about different query plans) while having an escape hatch: if postgres is updated & the new version decides to never generate good queries, the queries will still happen for some ~95% of users, just slower until the team can read through the new version's instructions to get the plan they need.