Test plan: hunting for more corruption bugs after the July 2026 fix wave

[NikolayS]

Analysis of the last three days of commits (50 commits, Jul 15–17 2026, v19 beta) identified recurring bug classes behind the fixes (unregistered-buffer WAL omissions, summarizer blind spots, deparse round-trip failures, recovery-boundary state machines, unvalidated wire/file input, boundary off-by-ones). A source-verified audit produced this prioritized plan.

Key verified findings

1. wal_consistency_checking is structurally blind to visibility-map corruption: rm_mask gets no fork number, so heap_mask()/mask_unused_space() wipes the whole VM bitmap before comparison, and mask_page_hint_bits() clears PD_ALL_VISIBLE. The stale-VM-bit corruption fixed in ed62d26 could never be caught by it. No checked-in PostgreSQL CI job enables the general path; external buildfarm coverage is unquantified.
2. Trust-boundary hardening of logical sequence sync: get_and_validate_seq_info() in src/backend/replication/logical/sequencesync.c reads sequence metadata returned by the publisher. last_value already had explicit NULL handling and was never Assert-only; the Assert-only fields were is_called, page_lsn, and the sequence type/start/increment/min/max/cycle. A broken or malicious publisher returning NULL (or an out-of-range index) there crashes assert builds or feeds garbage into sequence state. PR Validate remote sequence data in sequencesync worker #64 hardens those fields and, more importantly, range-checks seqidx before list_nth(). This is trust-boundary hardening against a broken/malicious publisher — not evidence of an organically reachable corruption bug.
3. The backup-comparison oracle (pg_combinebackup/t/002_compare_backups.pl) compares pg_dumpall output only — unquestionably blind to stale VM/FSM bits and index corruption. This is one contributing oracle gap in the layers that let ed62d26 through, not the sole reason it survived.

Priorities

P0 means fast, continuously executable signal — not the largest architectural investment. It is what gives us a running detector this week.

P0 — quick, continuously executable signal

• Enable the existing wal_consistency_checking path in one measured CI job (record the runtime cost) — Enable wal_consistency_checking coverage in CI #69.
• Targeted "kill tests" that deliberately recreate the defect (stale VM bits, unregistered blocks) and prove each oracle actually fails on it — otherwise a green oracle proves nothing.
• Narrow input-validation and file-mutation tests: sequencesync remote-NULL/index hardening (PR Validate remote sequence data in sequencesync worker #64) and pg_walsummary/pg_verifybackup file-mutation smoke tests — Add file-mutation smoke tests for pg_walsummary and pg_verifybackup #70.

P1 — targeted structural fixes

• Pass forknum through rm_mask and add a VM-specific mask so VM pages are compared meaningfully — Pass fork number through rm_mask and stop masking away VM page contents #72.
• Debug-build dirty-vs-registered instrumentation: every buffer dirtied in a WAL-emitting critical section must be registered (or explicitly classified) — Debug check: every buffer dirtied in a WAL-emitting critical section must be registered #73.

P2 — large architectural investments

• Full physical full-vs-incremental backup differential harness under a concurrent workload (restore + replay to a common target LSN, AM/fork-aware normalization, plus pg_amcheck / pg_visibility) — Physical full-vs-incremental backup differential harness #74.
• Large crash / state matrices: wal_level-transition × crash matrix for logicalctl + WAL summarizer fast-forward edges (a passing incremental across a wal_level=minimal window = silent data loss).
• Adversarial mock replication server feeding malformed responses to walreceiver/tablesync/sequencesync/slotsync and frontends.
• postgres_fdw loopback differential harness under divergent remote session state.

Campaign-level requirement: kill tests + provenance

Every new oracle in this campaign must ship with two things, or it does not count:

1. A committed/recorded kill test — a procedure that reintroduces the defect class the oracle guards (e.g. reinstate ed62d26, inject a stale VM bit, drop a block registration) and demonstrates the oracle fires on it. An oracle never shown to fail is not evidence.
2. Recorded provenance for every reported run: base commit, build flags, GUCs, seed (where applicable), runtime, raw logs, and a minimization procedure for any failure.

Follow-up work on PRs #65, #68, #79, and #80 is addressing this requirement.

Quick wins now being executed (sub-issues below)

• FSM/VM boundary-geometry regression tests (a2fd8d6 shipped with no test) — PR Add regression test for FSM vacuum of bulk-extended relations #68
• base64/base64url + uuidv7 property tests (1f41403, 7575215) — PR Add property-style tests for base64 padding and uuidv7 shifts #66
• Persist JSON_TABLE PLAN variants as views for permanent dump/restore round-trip coverage (af6fad8/160ef27/cd5fd08) — PR Add persisted JSON_TABLE PLAN views for dump/restore round-trip tests #67
• Harden sequencesync.c remote-NULL/index handling (Assert → ereport, range-check seqidx) — PR Validate remote sequence data in sequencesync worker #64
• Upgrade backup-comparison oracle: pg_amcheck + pg_check_visible/pg_check_frozen + IOS-vs-seqscan diff in pg_combinebackup TAP tests — PR Strengthen restored-cluster oracle in pg_combinebackup tests (amcheck + pg_visibility + IOS/seqscan comparison) #65

Wave 2 / P0 infrastructure now executing:

• Enable wal_consistency_checking coverage in CI — Enable wal_consistency_checking coverage in CI #69
• Add file-mutation smoke tests for pg_walsummary and pg_verifybackup — Add file-mutation smoke tests for pg_walsummary and pg_verifybackup #70
• Add unlogged-relation LSN-interlock stress tests for hash and GiST — Add unlogged-relation LSN-interlock stress tests for hash and GiST #71
• Pass fork number through rm_mask and stop masking away VM page contents — Pass fork number through rm_mask and stop masking away VM page contents #72
• Debug check: every buffer dirtied in a WAL-emitting critical section must be registered — Debug check: every buffer dirtied in a WAL-emitting critical section must be registered #73
• Physical full-vs-incremental backup differential harness — Physical full-vs-incremental backup differential harness #74

Backlog (not yet started)

• wal_level-transition × crash matrix for logicalctl + WAL summarizer fast-forward edges.
• Adversarial mock replication server feeding malformed responses to walreceiver/tablesync/sequencesync/slotsync and frontends.
• Fuzz file-format readers (blkreftable, backup manifests, pgstat.stat, timeline history, backup_label).
• postgres_fdw loopback differential harness under divergent remote session state.