# v0.87.1 - Correctness Oracle Hardening

> **Status:** Released
> **Scope:** 6-7 person-weeks
> **User promise:** *"A wrong result cannot pass as a count, skip, or fallback."*
> **Blocked by:** [v0.87.0](v0.87.0.md)
> **Program:** [Composition-aware differential correctness](../plans/PLAN_DVM_COMPOSITION_CORRECTNESS.md)

## Theme

Make the correctness oracle trustworthy before generating more cases. Every
accepted DIFFERENTIAL query is checked against PostgreSQL's direct result and
an independent FULL stream table. The comparison covers the schema and the
exact row multiset.

This release also makes failures fail closed. A refresh error, backend crash,
unexpected fallback, missing baseline, or ineffective mutation cannot become a
skip or a passing self-comparison.

## Items

### COR-1: One exact oracle

Extract the existing exact comparator into a shared E2E helper and use it in
all DVM correctness paths. The helper:

- compares output types, order, names, typmods, and collations before values;
- compares rows with symmetric `EXCEPT ALL` so duplicate counts matter;
- excludes only documented internal columns;
- reports concrete extra and missing rows; and
- returns an explicit unsupported-type result when PostgreSQL has no suitable
  equality operation.

Remove count-only semantic assertions from the internal SQLancer-style,
DIFFERENTIAL-versus-FULL, and stateful fuzz paths. Counts remain diagnostics.

### COR-2: Fail-closed case outcomes

Replace `Option` and string matching with typed outcomes that distinguish:

- a supported case that passed;
- a query rejected at the admission boundary;
- invalid generator output;
- a product failure; and
- a test-infrastructure failure.

After DIFFERENTIAL admission succeeds, every refresh error is a product
failure. Each case also asserts the effective refresh mode so FULL fallback
cannot satisfy a DIFFERENTIAL test.

### COR-3: #938 and #939 sensitivity baseline

Store deterministic reproductions for both #939 root causes and add reduced,
wide-table, and simultaneous-two-leaf variants. Add negative controls for the
physical-width rescan bug and the incorrect aggregate-CTE snapshot assumption.

The new oracle must catch a wrong result even when the actual and expected row
counts match.

## Exit criteria

- [x] Every DVM correctness path uses the shared schema and multiset oracle.
- [x] No count-only semantic assertion remains in the DVM fuzz paths.
- [x] Only a structured unsupported-at-admission result is a normal skip.
- [x] DIFFERENTIAL tests assert the effective refresh mode.
- [x] Same-count, different-content and duplicate-multiplicity self-tests fail
      with useful row differences.
- [x] Both principal #939 negative controls produce the expected failure.