# v0.98.x: Stabilization assessment and release series

> **Status:** Planned
> **Scope:** Two releases
> **User promise:** *"The next development baseline contains less risk, not more scope."*
> **Blocked by:** [v0.97.0](v0.97.0.md)
> **Assessed revision:** `e5018a7`, the v0.97.0 tag

## Decision

Use two releases:

1. [v0.98.0](v0.98.0.md) contains each known correctness or contract risk and
   freezes an executable qualification contract.
2. [v0.98.1](v0.98.1.md) qualifies one exact interim release candidate against
   that contract.

Do not assign themes to later v0.98 patch versions now. Create one only for a
release-blocking defect found during v0.98.1 qualification.

This split keeps evidence honest. A correctness fix in v0.98.0 can invalidate
earlier test results. v0.98.1 therefore collects release evidence only after
the implementation and public contracts stop changing.

The v0.98.1 contract excludes the 72-hour soak. Run it manually when resources
permit and record any result as supplemental evidence. A missing, failed, or
unavailable soak does not block v0.98.1. v0.105.x still runs the soak for final
v1.0 qualification.

## Assessment of v0.93.0 through v0.97.0

This is a source, test, roadmap, and workflow assessment. Checked-in evidence
does not prove every runtime defect described below. The v0.98.x releases must
settle each risk with a live PostgreSQL test or reject the affected behavior.

| Release | What shipped | What remains unproven or unsafe |
|---------|--------------|---------------------------------|
| v0.93.0 | Capability discovery, canonical contract data, and durable `EXTERNAL` ownership | [The release gate](../scripts/v0_93_release_gate.py) checks files, source markers, and test names. The independent security, lifecycle, restore, clone, and upgrade criteria remain unchecked. |
| v0.94.0 | `refresh_graph_strict()` and Graph V1 discovery | [Graph execution](../src/api/integration.rs) does not pass `full_policy = 'ERROR'` into every runtime FULL fallback. [Manual refresh](../src/api/refresh_ops.rs) can report the requested action instead of the action that ran. Mixed FULL and differential boundaries, busy behavior, exception cleanup, and graph conformance lack live proof. The capability is still advertised as stable. |
| v0.95.0 | Delta consumer catalogs, typed payload relations, batches, acknowledgement, and resnapshot APIs | [Delta acknowledgement](../src/api/output_delta.rs) can bypass the resnapshot protocol, and concurrent acknowledgements can move a cursor backward. Exact-batch completeness is not proven, hard retention pressure is incomplete, and clone or ownership transitions do not enforce every stored identity. Delta V1 is still advertised as stable. |
| v0.96.0 | Resource diagnostics, disk reporting, a progress view, error rows, and predefined roles | [The diagnostic implementation](../src/api/release_096.rs) reports some recommendations as selected values. Disk projection is a current partial sum, and [the progress view](../src/lib.rs) does not update row progress or its timestamp. The [two](v0.96.0.md) [roadmap files](v0.96.0.md-full.md) also disagree about completed exit criteria. |
| v0.97.0 | Monitoring files, package smoke tests, and a release-evidence file | [The release workflow](../.github/workflows/release.yml) records the 72-hour soak and full upgrade matrix as skipped, but [the evidence writer](../scripts/release_evidence.py) always records overall status as `passed`. Monitoring checks mostly validate text presence. Only the Linux amd64 artifact receives a live install and refresh smoke test. |

The v0.93.0 through v0.97.0 tags remain historical releases. Do not mark an
unchecked exit criterion complete without candidate-bound evidence. v0.98.x
closes the resulting risk. It does not rewrite release history.

## Cross-release blockers

The following findings block a qualified v0.98 baseline:

- WAL polling consumes logical-decoding changes before the local receipt
  transaction commits. A failure after consumption can roll back local buffer
  rows after the slot has advanced. Trigger capture must remain the only stable
  capture path until v0.103.0 implements durable receipt.
- Graph V1 and Delta V1 advertise stable version 1 without their independent
  conformance evidence.
- Graph FULL policy, effective-action reporting, boundary proof, and
  backend-local cleanup do not cover every runtime path.
- Delta acknowledgement, resnapshot, exactness, retention, recovery, and
  ownership rules have concrete fail-open paths.
- v0.96 operational claims exceed the behavior checked by its tests.
- v0.97 release evidence can pass while required suites are skipped or absent.

## Scope boundary

v0.98.x may fix correctness, security, compatibility, diagnostics,
documentation, packaging, tests, and measured regressions. It may narrow,
disable, or remove behavior that lacks proof.

Keep the following work in its assigned release:

- Generate the product capability and strategy manifest in v0.99.0. The small
  v0.98 qualification contract only defines release gates.
- Unify refresh execution and remove the manual stream-source FULL fallback in
  v0.100.0.
- Add relational state, aggregate, numeric, and identity coverage in v0.101.0.
- Add optimizer and delta-locality work in v0.102.0.
- Implement durable WAL acknowledgement, then consider lock-elision, shared
  decoding, and controller automation in v0.103.0.
- Package complete Graph V1 and Delta V1 conformance and consider stable
  readmission in v0.104.0.

New SQL features, query coverage, integrations, optimizer classes, and
controller actions remain outside v0.98.x.