docs: document Enterprise resource groups for query workload isolation

documentation/changelog.mdx

@@ -18,7 +18,11 @@ This page tracks significant updates to the QuestDB documentation.
 
 - [Memory limits](/docs/configuration/cairo-engine/#memory-limits) - New section covering the per-query, materialized view refresh, WAL apply, and live view refresh memory limits, what counts toward them, and what happens on a breach, plus the previously undocumented [`cairo.mat.view.max.refresh.retries`](/docs/configuration/materialized-views/#cairomatviewmaxrefreshretries), [`cairo.mat.view.refresh.busy.retry.limit`](/docs/configuration/materialized-views/#cairomatviewrefreshbusyretrylimit), [`cairo.mat.view.refresh.busy.retry.timeout`](/docs/configuration/materialized-views/#cairomatviewrefreshbusyretrytimeout), [`cairo.write.back.off.timeout.on.mem.pressure`](/docs/configuration/cairo-engine/#cairowritebackofftimeoutonmempressure), [`ram.usage.limit.bytes`](/docs/configuration/cairo-engine/#ramusagelimitbytes), and [`ram.usage.limit.percent`](/docs/configuration/cairo-engine/#ramusagelimitpercent) keys
 - [RBAC memory limits](/docs/security/rbac/#memory-limits) - Per-user, per-group, and per-service-account query memory limits in QuestDB Enterprise: `SET MEMORY LIMIT` on `ALTER USER`, `ALTER GROUP`, and `ALTER SERVICE ACCOUNT`, how limits resolve, the `SET MEMORY LIMIT` permission, and the upgrade migration
-- [ALTER GROUP](/docs/query/sql/acl/alter-group/) - New reference page covering `SET MEMORY LIMIT` and external alias mapping
+- [Resource groups](/docs/concepts/resource-groups/) - Isolate competing query workloads inside one QuestDB Enterprise instance. Covers who a policy applies to, which statements are managed, and what admission, weighted CPU and memory limits each actually guarantee, including why CPU control is cooperative and what happens while a replica's catalog is behind
+- [Configure and use resource groups](/docs/operations/resource-groups/) - Requirements, choosing limits, and six worked scenarios: an instance that stops answering while CPU looks idle, keeping dashboards responsive, throttling a background job, bounding a workload's memory, governing a service account, and sharing one instance between teams, plus inspection, monitoring, client errors and troubleshooting
+- [Resource groups configuration](/docs/configuration/resource-groups/) - The `resource.groups.enabled` master switch and `resource.groups.process.memory.limit.bytes` process ceiling, neither reloadable
+- [CREATE RESOURCE GROUP](/docs/query/sql/acl/create-resource-group/), [ALTER RESOURCE GROUP](/docs/query/sql/acl/alter-resource-group/) and [DROP RESOURCE GROUP](/docs/query/sql/acl/drop-resource-group/) - New reference pages for the policy statements, with the parameter table, the effect of an online change on running queries, and what happens to queries still using a dropped group
+- `ALTER USER`, `ALTER GROUP` and `ALTER SERVICE ACCOUNT` are now one page per statement form, matching `ALTER TABLE`. Twenty-three pages covering `ENABLE`, `DISABLE`, `WITH PASSWORD`, `WITH NO PASSWORD`, `CREATE TOKEN`, `DROP TOKEN`, [SET MEMORY LIMIT](/docs/query/sql/acl/alter-group-set-memory-limit/), [SET RESOURCE GROUP](/docs/query/sql/acl/alter-user-set-resource-group/), [UNSET RESOURCE GROUP](/docs/query/sql/acl/alter-user-unset-resource-group/), [WITH EXTERNAL ALIAS](/docs/query/sql/acl/alter-group-with-external-alias/) and `DROP EXTERNAL ALIAS`
 - [Migrate QuestDB onto the Kubernetes Operator](/docs/enterprise-kubernetes-operator/getting-started/migrate/) - Move an existing Enterprise deployment onto the Operator with a replica-first cutover: restore the source backup, consume replication WAL, then promote after a controlled source drain
 - [Copy a schema to another instance](/docs/cookbook/operations/copy-schema-between-instances/) - Recreate one instance's tables, views, and materialized views on another from `SHOW CREATE DATABASE`, either by replaying the statements over the REST API or by dumping them to a `.sql` file, with `INCLUDE (SCHEMA)` and `INCLUDE (ACL)` for separating structure from permissions on Enterprise, plus the Web Console schema explorer as a manual alternative and the ordering caveat that comes with it
 - [SUBSAMPLE](/docs/query/sql/subsample/) - New SQL keyword that reduces a query result to a subset of its existing rows, without interpolating values. Covers the six methods with a diagram each: `lttb` for line charts, with a gap-preserving mode, `minmax` and `m4` for per-time-bucket envelopes, `uniform` and `cadence` for position-based selection, and `sdt` (Swinging Door Trending) for error-bounded compression with a `2 * compdev` reconstruction bound and an animated walkthrough. Also covers where the clause goes in a query, output order, `NULL` handling, and which query shapes each method accepts
@@ -28,11 +32,20 @@ This page tracks significant updates to the QuestDB documentation.
 
 - Added [`cairo.sql.subsample.max.rows`](/docs/configuration/cairo-engine/#cairosqlsubsamplemaxrows), the input row limit for the `lttb`, `m4`, `minmax`, `uniform`, and `cadence` methods of `SUBSAMPLE`. It does not apply to `sdt`
 
+### Reference
+
+- Added [`resource_groups()`](/docs/query/functions/meta/#resource_groups), which returns each group's policy alongside its live admission, CPU and memory counters, and [`current_resource_group()`](/docs/query/functions/meta/#current_resource_group), which reports the group a session's queries run in. `current_resource_group()` returns `DEFAULT` for an unmapped principal and `null` only when a query was never admitted to a group
+- Added the [`RESOURCE GROUP ADMIN`](/docs/security/rbac/#permissions) permission, which gates creating, altering and dropping resource groups, mapping principals to them, and reading `resource_groups()`. `SQL ENGINE ADMIN` keeps its existing scope of listing and cancelling queries
+- Added the [resource group metrics](/docs/operations/logging-metrics/#resource-group-metrics): nine Prometheus series per group labelled with `resource_group`, plus five instance-wide series for activation, catalog health, managed dispatch and scheduler degradation
+- Added the Fiber mode properties that resource groups depend on: [`http.worker.fiber.enabled`](/docs/configuration/http-server/#httpworkerfiberenabled), [`pg.worker.fiber.enabled`](/docs/configuration/postgres-wire-protocol/#pgworkerfiberenabled), [`shared.network.worker.fiber.enabled`](/docs/configuration/shared-workers/#sharednetworkworkerfiberenabled), [`shared.query.worker.fiber.enabled`](/docs/configuration/shared-workers/#sharedqueryworkerfiberenabled) and [`mat.view.refresh.worker.fiber.enabled`](/docs/configuration/materialized-views/#matviewrefreshworkerfiberenabled), all defaulting to `true` and none reloadable
+
 ### Updated
 
-- [query_activity()](/docs/query/functions/meta/#query_activity) - Documented the `is_wal`, `memory_used`, and `memory_limit` columns
+- [query.timeout](/docs/configuration/cairo-engine/#querytimeout) - The clock includes time spent queued for resource group admission, so a query can time out before it starts. Over PGWire each `Execute` message restarts it
+- [Replication](/docs/high-availability/overview/#resource-groups-in-a-replicated-cluster) and [SWITCH ROLE](/docs/query/sql/switch-role/) - Resource group policies replicate through the WAL pipeline while enforcement stays local, so a lagging replica applies the policy it has, and a replica that has not received the catalog cannot be promoted
+- [query_activity()](/docs/query/functions/meta/#query_activity) - Documented the `is_wal`, `memory_used`, and `memory_limit` columns, and added a `resource_group` column showing which group each running query was admitted to. `memory_limit` is now capped by the group budget as well, so a principal with no limit of its own still reports one when its group sets a ceiling
 - [wal_tables()](/docs/query/functions/meta/#wal_tables) - Documented the `errorTag`, `errorMessage`, and `memoryPressure` columns; `errorTag` reads `OUT OF MEMORY` after a WAL apply memory limit breach
-- [SHOW](/docs/query/sql/show/) - `SHOW USERS`, `SHOW GROUPS`, and `SHOW SERVICE ACCOUNTS`, including their filtered forms, gain a trailing `memory_limit` column. Clients that read these results by position need [updating](/docs/security/rbac/#memory-limit-upgrade)
+- [SHOW](/docs/query/sql/show/) - `SHOW USERS`, `SHOW GROUPS`, and `SHOW SERVICE ACCOUNTS`, including their filtered forms, gain a trailing `memory_limit` column. Clients that read these results by position need [updating](/docs/security/rbac/#memory-limit-upgrade). The unfiltered forms also gain `resource_group`, and `SHOW GROUPS` additionally `resource_group_priority`
 - [CREATE GROUP](/docs/query/sql/acl/create-group/) - Documented the `WITH EXTERNAL ALIAS` form that creates a group and its OIDC or LDAP mapping in one statement
 - [Kafka connector](/docs/connect/message-brokers/kafka/) - Updated for QWP with a quick start, guidance on preventing duplicates and recovering from outages, and migration steps for existing HTTP pipelines
 - [Kubernetes Operator](/docs/enterprise-kubernetes-operator/) - Refreshed for Operator 0.2.1 across installation, configuration, high availability, backup and restore, known limitations, troubleshooting, and the generated [API reference](/docs/enterprise-kubernetes-operator/reference/api/)