feat(specializer): two new fuzzer-found regex reject classes — leading-$ row-path bug + RE2 program-size budget

The standing fuzzer's 20k-case deep run on seed 20260728 caught:

- Class 13: DuckDB's row path literal-optimizes a leading '$'+literal
  into a PREFIX match ('$hello' matches 'hello world') while its own
  constant fold matches normally — self-inconsistent, unservable.
  Reject: unescaped '$' outside a class not followed by end, '|', ')',
  '$', or an anchor escape.
- Class 14: counted repetitions can blow RE2's POST-SIMPLIFICATION
  program budget ('(\p{L}){1,500}' is 'pattern too large' in DuckDB)
  where rust-regex still compiles. Guard: one-sided weight estimate
  (\p/\P = 800 range-units, classes = member count, literals 4;
  threshold 100k, below the measured ~216k error floor) — the engine may
  over-refuse but can never serve where DuckDB errors.

Pins: pins-waveB/fuzzer-20260728.json. Doc + twin rows added. Gates:
cargo 163, pytest 609 + 13 xfail, corpus 529 unchanged, 20k re-sweep on
the finding seed divergence-free.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

docs/known-limitations.md

@@ -92,7 +92,7 @@ wrong answer or require semantics we can't reproduce exactly:
 | `^` operator | It IS pow in DuckDB, but sqlparser's precedence differs from DuckDB's (`2*x^y` would parse as `(2*x)^y`). Mapping it computes the wrong tree silently. Use `pow()`. |
 | prefix `~`, `#`, `NOT GLOB` | Same class: precedence/parse divergences that would silently mis-associate. `xor()` covers bit-xor; `NOT (x GLOB p)` works. |
 | Regex reject list: `\B`, `\Q…\E`, `(?<name>…)`, duplicate group names, bounds > 1000, stacked quantifiers (`a*+`), `\u` escapes, negated Perl classes inside `[...]` | The RE2↔rust-regex differential battery (98 entries) proved these are the constructs where the engines disagree or DuckDB itself is broken (`\B` crashes DuckDB at runtime on non-ASCII). Everything else is byte-identical. |
-| Fuzzer-found regex rejects (TASK-54): `\1`–`\9` backrefs outside classes, the full stacked-quantifier grammar (`{2}*`, `?*`, `a???` — one lazy `?` is the only legal follower), nested repetition products > 1000, whitespace inside `{m, n}` bounds, class set-op lookalikes (`--`/`&&`/`~~`), non-POSIX `[` inside classes, Perl-class range endpoints (`[a-\d]`), capturing `(x){0}`, anchor-only multi-anchor patterns (DuckDB is SELF-inconsistent on these — its row path disagrees with its own constant fold) | The standing differential fuzzer (`tests/test_duckdb_regexp_fuzz.py`, in the normal gate) found these 12 classes in its first 3k-case deep run — each one a silent-wrong-answer risk in rust-regex — then re-swept to ZERO divergences over 40k cases across 8 seeds. Pins: `pins-waveB/fuzzer-task54.json`. |
+| Fuzzer-found regex rejects (TASK-54): `\1`–`\9` backrefs outside classes, the full stacked-quantifier grammar (`{2}*`, `?*`, `a???` — one lazy `?` is the only legal follower), nested repetition products > 1000, whitespace inside `{m, n}` bounds, class set-op lookalikes (`--`/`&&`/`~~`), non-POSIX `[` inside classes, Perl-class range endpoints (`[a-\d]`), capturing `(x){0}`, anchor-only multi-anchor patterns (DuckDB is SELF-inconsistent on these — its row path disagrees with its own constant fold), `$` anchors in non-final position (`'$hello'` — DuckDB's row path literal-optimizes the leading `$`+literal into a PREFIX match, matching "hello world", while its own constant fold matches normally; found by the standing fuzzer on seed 20260728), and counted repetitions over RE2's PROGRAM-SIZE budget (`(\p{L}){1,500}` is "pattern too large" in DuckDB while rust-regex serves it — rejected via a one-sided weight estimate that always fires before DuckDB's real budget; same seed, pins `pins-waveB/fuzzer-20260728.json`) | The standing differential fuzzer (`tests/test_duckdb_regexp_fuzz.py`, in the normal gate) found these 12 classes in its first 3k-case deep run — each one a silent-wrong-answer risk in rust-regex — then re-swept to ZERO divergences over 40k cases across 8 seeds. Pins: `pins-waveB/fuzzer-task54.json`. |
 | `SIMILAR TO ... ESCAPE` | Not implemented in DuckDB itself. |
 | `* EXCLUDE (t.key)` on a USING join | DuckDB UNMERGES the coalesced column (it reappears at the right table's position) — measured, not modeled. Unqualified EXCLUDE works. |
 | `BETWEEN`/`IN` mixing non-numeric string literals with numbers | DuckDB converts at EXECUTION time (an empty input succeeds!); a bind-time conversion was measured to be over-eager. Numeric literals convert fine. |

docs/superpowers/specs/pins-waveB/fuzzer-20260728.json

@@ -0,0 +1,17 @@
+{
+ "topic": "fuzzer deep-run classes, seed 20260728 (overnight run, TASK-56 branch)",
+ "duckdb_version": "1.5.5",
+ "pins": [
+  {
+   "q": "SELECT regexp_matches(s, '$h') FROM t -- s='hello world'",
+   "result": "row path TRUE, constant fold FALSE",
+   "note": "Class 13: DuckDB SELF-inconsistent on a leading '$' anchor followed by a literal. Its row path literal-optimizes '$'+literal into a PREFIX match: '$hello' matches 'hello world', '$b' matches 'b' (but not 'ab'); the constant path matches normally (never). Consistent (both False/True) for: 'h$', '^h', 'x^h', 'a$|b', '(h$)x', '($)h', 'a$b*', '$h*', '$[hb]', '$(h)', '(?i)$H', '[$]h', '\\\\$h', bare '$'. Reject: unescaped '$' outside a class not followed by end, '|', ')', '$', or an anchor escape (\\A \\z \\b \\B). Found: fuzz case 4275."
+  },
+  {
+   "q": "SELECT regexp_full_match(s, '\\S*([^\\wé-üa]{0}.|(?m)\\p{L}){1,1000}ab')",
+   "result": "DuckDB: Invalid Input Error: pattern too large - compile failed; rust-regex: compiles and serves",
+   "note": "Class 14: RE2 program-size budget. Boundary probes: (\\p{L}){1,300} ok, {1,500} ERR; (\\p{Nd}){1,1000} ok; (\\d){1,1000} ok; ([^\\w]){1,1000} ok; ([é-ü]){1,1000} ok; (.|\\p{L}){1,1000} ok (RE2 SIMPLIFIES the alternation to '.'). The budget is on the POST-SIMPLIFICATION program (range units), so exact modeling is impossible; the engine uses a one-sided over-estimate (\\p/\\P = 800 units >= any property's range count, classes = member count, literals 4) and rejects counted repetitions whose weight product clears 100_000 — below the measured error floor (~216k units), so the engine may over-refuse but can never serve where DuckDB errors. Found: fuzz case 17388."
+  }
+ ],
+ "summary": "Two new reject classes from the 20k-case deep run on seed 20260728: (13) leading-'$'-then-atom patterns are DuckDB-self-inconsistent (row-path prefix optimization bug) and unservable in principle; (14) counted repetitions can blow RE2's post-simplification program budget where rust-regex still compiles — guarded by a conservative one-sided weight estimate. After both rejects the full 20k sweep is divergence-free."
+}

src/specializer/retrans.rs

@@ -147,6 +147,17 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
     // Character-class member tracking for range-endpoint rejects.
     let mut class_members = 0usize;
     let mut rangey_dash = false; // last member was a bare '-' with a left operand
+    // RE2 program-size budget (fuzzer 2026-07-28 seed 20260728: DuckDB
+    // errors "pattern too large" on '(\p{L}){1,500}' while rust serves).
+    // One-sided over-estimate in "range units": \p/\P weigh 800 (above any
+    // property's real range count), classes their member count, literals a
+    // flat 4; a counted repetition whose weight product clears 100_000 is
+    // rejected — always BEFORE DuckDB's real budget (measured error floor
+    // ~216k units), so we can refuse but never serve where DuckDB errors.
+    let mut weights: Vec<u64> = Vec::new(); // per open group
+    let mut cur_weight: u64 = 0;
+    let mut last_weight: u64 = 4;
+    let mut class_p: u64 = 0; // \p/\P weight inside the open class
     while i < b.len() {
         let c = b[i];
         match c {
@@ -220,6 +231,13 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                         out.push(other as char);
                     }
                 }
+                let w = if matches!(n, b'p' | b'P') { 800 } else { 8 };
+                if in_class {
+                    class_p += w;
+                } else {
+                    last_weight = w;
+                    cur_weight = cur_weight.saturating_add(w);
+                }
                 i += 2;
                 quant = 0;
                 class_members += 1;
@@ -274,6 +292,9 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                 out.push(']');
                 i += 1;
                 quant = 0;
+                last_weight = 2 + 2 * class_members as u64 + class_p;
+                cur_weight = cur_weight.saturating_add(last_weight);
+                class_p = 0;
             }
             b'&' | b'~' | b'-' if in_class && b.get(i + 1) == Some(&c) => {
                 // '--' / '&&' / '~~' in a class: literals-or-ranges to RE2,
@@ -289,6 +310,30 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                 out.push('-');
                 i += 1;
             }
+            b'$' if !in_class => {
+                // A '$' anchor in NON-final position (not before '|', ')',
+                // or the end): DuckDB's row path literal-optimizes a
+                // leading '$'+literal into a PREFIX match ('$hello' matches
+                // 'hello world'!) while its own constant fold matches
+                // normally — self-inconsistent, unservable (fuzzer-measured
+                // 2026-07-28, seed 20260728 case 4275).
+                let benign = match b.get(i + 1) {
+                    None | Some(b'|') | Some(b')') | Some(b'$') => true,
+                    // Another anchor right after keeps both paths agreeing
+                    // (a '$$h' chain still rejects at ITS last '$').
+                    Some(b'\\') => matches!(b.get(i + 2), Some(b'A' | b'z' | b'b' | b'B')),
+                    _ => false,
+                };
+                if !benign {
+                    return Err(unsup(
+                        "regex '$' anchor in non-final position (DuckDB's row \
+                         path diverges from its own constant fold)",
+                    ));
+                }
+                out.push('$');
+                i += 1;
+                quant = 0;
+            }
             b'(' if !in_class => {
                 // (?<name>...) angle-bracket groups: DuckDB rejects them.
                 if p[i..].starts_with("(?<") && !p[i..].starts_with("(?<=") {
@@ -298,6 +343,8 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                     b.get(i + 1) != Some(&b'?') || p[i..].starts_with("(?P<");
                 groups.push((counted, capturing));
                 counted = 0;
+                weights.push(cur_weight);
+                cur_weight = 0;
                 out.push('(');
                 i += 1;
                 quant = 0;
@@ -329,6 +376,9 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                 } else {
                     counted = counted.max(inner);
                 }
+                // The group is one atom for a following {m,n}'s budget.
+                last_weight = cur_weight.max(1);
+                cur_weight = weights.pop().unwrap_or(0).saturating_add(last_weight);
                 out.push(')');
                 i += 1;
                 quant = 0;
@@ -347,6 +397,14 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                         )));
                     }
                     counted = counted.max(prod.min(1001));
+                    if last_weight.saturating_mul(max.max(1)) > 100_000 {
+                        return Err(unsup(
+                            "counted repetition over RE2's program-size budget \
+                             (pattern too large in DuckDB)",
+                        ));
+                    }
+                    cur_weight =
+                        cur_weight.saturating_add(last_weight.saturating_mul(max.max(1)));
                     out.push_str(&p[i..end]);
                     i = end;
                     quant = 1;
@@ -396,6 +454,10 @@ pub fn translate_pattern(p: &str) -> Result<String, PrepareError> {
                 quant = 0;
                 class_members += 1;
                 rangey_dash = false;
+                if !in_class {
+                    last_weight = 4;
+                    cur_weight = cur_weight.saturating_add(4);
+                }
             }
         }
     }

tests/test_known_limitations.py

@@ -186,6 +186,13 @@ def test_ubigint_static_payloads_reject():
         ("SELECT regexp_matches(s, '[a-\\d]') FROM __THIS__", "Perl class endpoint"),
         ("SELECT regexp_matches(s, '(x){0}') FROM __THIS__", "unsupported"),
         ("SELECT regexp_matches(s, '^$') FROM __THIS__", "anchor-only"),
+        # Seed-20260728 fuzzer classes: leading-$ prefix optimization bug;
+        # RE2 program-size budget ('pattern too large' in DuckDB).
+        ("SELECT regexp_matches(s, '$h') FROM __THIS__", "non-final position"),
+        (
+            "SELECT regexp_matches(s, '(\\p{L}){1,500}') FROM __THIS__",
+            "program-size budget",
+        ),
         # Not implemented in DuckDB itself.
         ("SELECT s SIMILAR TO 'a' ESCAPE 'x' FROM __THIS__", "escape"),
         # Exec-time conversion order (an empty input succeeds in DuckDB).