发表机构
VaidhyaMegha Private Limited（VaidhyaMegha私人有限公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对SQL聚合函数差异测试的不足，提出了条件感知预言机，基于引擎算法与真实值分类差异，验证了ClickHouse存在方差计算漏洞，预言机可靠且代码数据公开。
AI 中文摘要
差异数据库测试会对比不同数据库引擎的结果，并将差异标记为漏洞。对于浮点聚合函数而言这种方法不可靠：不同引擎因浮点算术不满足结合律会产生合法分歧，实际操作中会用epsilon来弥补；主流预言机则完全避开浮点运算。我们提供了现有实践缺失的预言机，并证明其关键量不是查询，而是引擎的算法。真实值是存储双精度数的精确有理值——基于算术而非其他引擎——每个差异被归类为精确、有界或不确定。算法A下聚合函数f的相对误差满足rel_err ≤ C_A(n,u) * κ_f^p，因此可测试边界（超出该边界则无预言机能区分漏洞与舍入误差）为κ*_{f,A} = (1/C_A)^(1/p)。SUM和AVG是p=1的线性情况；方差的单遍算法对应p=2，Welford算法对应p=1。在四类共八个引擎中，测量得到的指数能还原各算法，ClickHouse是唯一的单遍引擎（p=2.05）；该引擎整体返回零标准差、NaN相关性及符号错误的回归，而其他所有引擎结果精确且厂商已部署Welford修复。其方差在比SUM的条件数低10^6的情况下不可测试，而普通存储约定（纳秒级时间戳、精密传感器）会达到该条件数——此时ClickHouse的误差达2100%。对360个测试的随机搜索未发现异常，证明该预言机是可靠的。代码和数据公开。
英文摘要
Differential database testing compares results across engines and calls a discrepancy a bug. For floating-point aggregates this is unsound: engines legitimately disagree because floating-point arithmetic is not associative. Practice patches this with an epsilon; the leading oracles avoid floating point entirely. We give the oracle this practice lacks, and show its decisive quantity is not the query but the engine's algorithm. Ground truth is the exact rational value of the stored doubles -- arithmetic, not another engine -- and each discrepancy is classified exact, bounded, or indeterminate. The relative error of an aggregate f under an algorithm A obeys rel_err <= C_A(n,u) * kappa_f^p, so the testability boundary, beyond which no oracle can separate a bug from rounding, is kappa*_{f,A} = (1/C_A)^{1/p}. SUM and AVG are the linear case p=1; variance is p=2 for the one-pass algorithm and p=1 for Welford. Across eight engines in four classes the measured exponent recovers each algorithm, and ClickHouse is the lone one-pass engine (p=2.05); engine-wide, it returns zero standard deviation, NaN correlation and wrong-sign regression, while every other engine stays exact and the vendor ships the Welford fix. Its variance is untestable at a condition number 10^6 below SUM's, which ordinary storage conventions (epoch-nanosecond timestamps, tight sensors) cross -- there ClickHouse errs by 2100%. A randomised hunt of 360 tests finds zero anomalies, evidence the oracle is sound. Code and data are public.
Comments13 pages, 5 figures. Code + one-command reproduction: https://github.com/samyama-ai/numeric-semantics-oracle
