# v0.87.6 - Deep Fuzzing, Shrinking, and Release Gate

> **Status:** ✅ Released (2026-08-25)
> **Scope:** 6-8 person-weeks
> **User promise:** *"Known differential defect classes cannot return unnoticed."*
> **Blocked by:** [v0.87.5](v0.87.5.md)
> **Program:** [Composition-aware differential correctness](../plans/PLAN_DVM_COMPOSITION_CORRECTNESS.md)

## Theme

Turn the correctness system into a durable pull-request, nightly, weekly, and
release gate. Deep jobs increase query depth, source width, aggregate families,
simultaneous changes, execution strategies, and recovery pressure without
making pull-request feedback unbounded.

Every new failure is preserved, minimized, and promoted into the permanent
corpus. Curated negative controls prove that the gate still detects known
defect classes.

## Items

### COR-17: Automatic shrinking and corpus retention

Minimize failures by removing cycles, mutations, rows, query branches,
operators, columns, aliases, types, constraints, and execution settings in
that order. Keep a candidate only when it preserves the invariant, failure
class, and operator-path family.

Retain passing cases only when they add semantic coverage. Periodically remove
redundant cases with a greedy set-cover pass.

### COR-18: Tiered correctness jobs

Add bounded pull-request jobs for the oracle, permanent corpus, mandatory
composition matrix, and a light typed-generator sample. Add sharded main,
nightly, and weekly jobs with deeper trees and longer stateful traces.

Each failed job uploads the complete reproducer. Scheduled deep jobs keep rare
coverage work unless the resource policy requires cancellation.

### COR-19: Strategy, recovery, and resource pressure

Replay selected corpus cases across supported planner, apply, prepared
statement, cache, CDC, and refresh-mode variants. Add deterministic transaction
barriers, refresh failpoints, and explicit resource-boundary cases. Timing-only
sleeps do not count as concurrency control.

### COR-20: Machine-enforced release gate

A release candidate fails on any exact mismatch, unexpected refresh error,
backend crash, silent fallback, self-comparison, ignored DML failure, missing
mandatory coverage bucket, or undetected active negative control.

## Exit criteria

- [x] `just dvm-shrink` reduces an injected #939 failure automatically.
- [x] Every failed CI case uploads a standalone reproducer.
- [x] The regression corpus and mandatory semantic coverage run on every pull
      request.
- [x] Main, nightly, weekly, and release tiers use explicit budgets.
- [x] Supported strategy and CDC variants converge to the direct query result.
- [x] Every failpoint preserves the last committed correct result and later
      convergence.
- [x] Every active negative control is detected by the release gate.

## What shipped

- **COR-17**: `scripts/dvm_shrink.py` greedily removes whole mutation cycles,
  then individual mutations, from a failing scenario JSON, re-validating
  against a live database after each removal and keeping only reductions
  that preserve the original failure class. `tests/corpus/dvm_negative_controls/negctrl_injected_939.json`
  is a padded, deliberately-broken #939-shaped scenario `just dvm-shrink`
  reduces down to its minimal reproducer. Row/column/operator/type-level
  shrinking (the rest of COR-17's ladder) is intentionally deferred — see the
  `ponytail:` note in `dvm_shrink.py`.
- **COR-18**: the PR gate (`ci.yml`) now also runs the DVM strategy,
  failpoint, negative-control, and light typed-generator sample tests
  alongside the existing corpus/composition/metamorphic checks. A new
  nightly/weekly tier (`.github/workflows/dvm-tiers.yml`) reruns the full
  deterministic DVM suite (weekly adds strategy/failpoint/negative-control)
  plus a 1800s/target cargo-fuzz budget on the weekly run, layered on top of
  the existing PR (~5 min), fuzz-nightly.yml (300s/target), and release
  (`dvm_release_gate.py`) tiers.
- **COR-19**: `tests/e2e_dvm_strategy_tests.rs` replays the permanent corpus
  under both its requested refresh mode and a forced-FULL variant, asserting
  both converge to the direct query result. `tests/e2e_dvm_failpoint_tests.rs`
  drives the existing `pg_trickle.test_chaos_for_table` TEST-MODE hook to
  suspend a stream table mid-refresh, confirms the last committed result is
  untouched, then resumes and confirms later convergence.
- **COR-20**: `tests/corpus/dvm_negative_controls/` holds three scenarios
  that are deliberately wrong (silent-fallback, multiset-mismatch, and an
  injected #939-shaped affected-row-count defect); `e2e_dvm_negative_control_tests.rs`
  asserts every one of them fails. `scripts/dvm_release_gate.py` checks
  coverage floors, the negative-control corpus, and leftover fuzz-failure
  artifacts, and is wired into `release.yml`'s preflight job.