# v0.87.3 - Composition-Aware Differential Testing

> **Status:** Planned
> **Scope:** 7-8 person-weeks
> **User promise:** *"Tests cover operator combinations, not only isolated features."*
> **Blocked by:** [v0.87.2](v0.87.2.md)
> **Program:** [Composition-aware differential correctness](../plans/PLAN_DVM_COMPOSITION_CORRECTNESS.md)

## Theme

Search the high-risk neighborhood around #938 before broadening generation.
The first matrix combines outer joins, aggregate CTE leaves, group rescans,
column pruning, aliases, nullable keys, duplicate matches, and simultaneous
changes to multiple sources.

A typed relational model then generates supported operator trees with a known
logical schema. Invalid compositions fail during generation instead of
becoming skipped SQL.

## Items

### COR-7: Mandatory #938-neighborhood matrix

Run deterministic cases for the 18 mandatory combinations in the source plan,
including:

- chained outer joins over aggregate CTEs;
- mixed algebraic and rescan aggregate branches;
- wide physical tables with narrow logical projections;
- nullable group and join keys;
- existing-group and first-group transitions; and
- one, two, and all-source mutation cycles.

These cases run on every pull request. At least one must detect silent stale
rows rather than only a generated-SQL error.

### COR-8: Typed Wave A query generator

Generate `Scan`, `Filter`, `Project`, `Aggregate`, INNER JOIN, LEFT JOIN, FULL
JOIN, CTE, and subquery nodes as a relational tree. Each node computes its
logical schema before SQL rendering.

The same tree can render CTE, inline-subquery, alias, and safe join-order forms
for later metamorphic checks.

### COR-9: Deterministic combination coverage

Use mandatory triples and quadruples for known risks, then a deterministic
pairwise covering array for the remaining P0 dimensions. Publish the generated
set and any uncovered combinations. Do not execute the full Cartesian product.

## Exit criteria

- [ ] Every mandatory #938-neighborhood case runs on each pull request.
- [ ] Declared P0 pairwise coverage reaches 100%.
- [ ] Every generated query has a logical schema before rendering.
- [ ] Every generated query parses and runs directly in PostgreSQL.
- [ ] Both #939 defects are detected when their negative controls are applied.
- [ ] At least one case catches a same-count wrong result.