# v0.83.0 — DVM Semantic Fidelity Gate

> **Status:** Planned
> **Scope:** Very Large
> **Blocked by:** [v0.82.0](v0.82.0.md)
> **Driven by:** August 2026 pre-scaling hardening review
> **Renumbered:** previously planned as v0.81.2. It rejects query forms that
> are accepted today and changes the persisted composite row-identity encoding,
> forcing reinitialisation of affected stream tables — breaking changes that do
> not belong in a patch release.

## Theme

Make DIFFERENTIAL and IMMEDIATE results obey PostgreSQL semantics across the
currently supported operator surface. Where a proof is not yet available,
AUTO must use FULL and explicit incremental modes must fail with an actionable
error. Silent approximation is never an acceptable fallback.

## Non-Goals

- No new SQL operators or aggregate families.
- No expansion of the documented DVM support matrix.
- No performance work unless it is required to preserve semantics safely.

## Items

### DVM-81-1: Set-Operation State Is Not User Data

Separate INTERSECT and EXCEPT multiplicity state from the user-visible stream
table. Direct `SELECT` results must exactly match PostgreSQL, including invisible
values and the repeated rows required by `INTERSECT ALL` and `EXCEPT ALL`.
Preserve one-sided counts when visibility crosses zero so later changes can
restore rows correctly.

Until that representation is proven, AUTO uses FULL and explicit DIFFERENTIAL
or IMMEDIATE creation rejects these forms.

### DVM-81-2: Positional and NULL-Safe Set Semantics

Bind set-operation branches by ordinal position, not by the first branch's
column names. Initialize and update state with NULL-safe equality using `IS NOT
DISTINCT FROM`, including composite rows and branches with different aliases.

### DVM-81-3: Nullable Aggregate Fidelity

Track non-NULL input counts for every algebraically maintained non-DISTINCT
`SUM`, not only FULL JOIN cases. Preserve SQL's NULL result for non-empty groups
whose inputs are all NULL and for groups whose final non-NULL value is removed.
Cover `FILTER` and expressions that wrap `SUM` in `COALESCE`.

Cast statistical aggregate operands to their accumulator type before computing
squares or cross-products so valid `STDDEV`, `VAR`, `CORR`, `COVAR`, and `REGR`
inputs cannot overflow in a narrower source type.

### DVM-81-4: Scalar Subquery Cardinality

Remove injected `LIMIT 1` behavior from scalar-subquery snapshots. A defining
query that produces multiple scalar rows must raise PostgreSQL's cardinality
error atomically, without changing stream-table data or advancing its frontier.

### DVM-81-5: LATERAL Dependency and Identity Safety

Reject unsupported IMMEDIATE LATERAL inner-source mutations until transition
tables drive the affected-outer-row branch correctly. Compute the complete set
of outer dependencies and identity keys, preserve required hidden identity
state, and never emit a broad `TRUE` deletion join when projected output does
not retain outer identity.

LATERAL precomputation is allowed only when all outer references are covered or
functionally determined by its grouping keys.

### DVM-81-6: Volatility and Rewrite Validation Fail Closed

Treat STABLE expressions as unsupported for incremental maintenance unless an
operator-specific proof shows unchanged rows remain semantically valid. AUTO
uses FULL; explicit DIFFERENTIAL and IMMEDIATE reject unsafe cases.

Complete volatility inspection across ORDER BY, FROM, GROUP BY, HAVING,
LIMIT/OFFSET, LATERAL, JSON_TABLE-like expressions, and overloaded operators.
An uninspectable expression or AST conversion failure must return a controlled
fallback/error, never silently substitute `TRUE` or `NULL`.

### DVM-81-7: Sound Circular Monotonicity Admission

Conservatively reject LEFT/FULL joins, scalar subqueries, and LATERAL subqueries
inside circular dependencies unless a specific monotonicity proof exists.
Admission rules must reflect whether adding input can remove or replace output,
not merely recurse through child operators.

### DVM-81-8: Collision-Free Row Identity Encoding

Replace delimiter-only composite hash encoding with an unambiguous framed or
escaped encoding. Define migration behavior for persisted row IDs and CDC
primary-key hashes so existing stream tables are safely reinitialized when the
encoding changes.

## Release Gate

v0.83.0 will not ship until all of the following pass:

- Direct reads match PostgreSQL for INTERSECT, EXCEPT, and both ALL variants
  across initialization and repeated visibility-boundary crossings.
- Differing branch aliases and NULL-containing composite rows pass every set
  operation in FULL and incremental modes.
- Property tests compare DIFFERENTIAL with FULL after every INSERT, UPDATE, and
  DELETE for nullable SUM, scalar subqueries, and LATERAL queries.
- Scalar cardinality violations leave data and frontiers unchanged, then recover
  after the source is corrected.
- Volatile and STABLE expressions in every supported clause either prove safe or
  produce the documented FULL fallback/rejection.
- Circular queries containing non-monotone operators are rejected while the
  proven monotone fragment remains accepted.
- Statistical aggregate boundary tests and adversarial composite-key hashing
  pass with production types and production hash functions.

Any unexplained DIFFERENTIAL-versus-FULL mismatch is a release blocker.