Compatibility is a matrix of versions, states, and failure paths

Wire compatibility asks whether an older or newer peer can decode a message under its format rules. Behavioral compatibility asks whether the decoded message still means what the application expects. Adding an optional field can be wire-compatible while changing the default behavior in a way an old client cannot request or interpret. Removing a field can leave old senders transmitting it. Preserve field identities and follow the format's evolution rules; for Protocol Buffers, reserve deleted field numbers to prevent later reuse, and reserve deleted field names when preserving JSON/TextFormat compatibility. Unknown fields and unknown enum values also need runtime-appropriate behavior rather than a blanket assumption of harmlessness.

Serialization paths matter. A binary round trip that preserves unknown fields can differ from a JSON conversion or an application rebuilding a message field by field. Schema acceptance alone therefore cannot prove a proxy preserves future information. Define required semantics for missing fields, zero values, unknown enum values, content types, status handling, and retry behavior. A stricter server validation rule can break old clients even if the wire grammar stays unchanged. Conversely, permissive parsing can preserve apparent availability while admitting ambiguous or unsupported state that downstream participants interpret differently.

For each relevant direction, test old client to new server, new client to old server, and same-version baselines. Include negotiated settings and intermediaries that translate framing, cache responses, or terminate connections. Feed a valid byte sequence through every meaningful fragmentation point and verify that the emitted messages are unchanged. Coalesce multiple messages into one input too. Invalid lengths, truncated bodies, conflicting metadata, excessive resource requests, and forbidden frame states should produce the documented bounded failure rather than a hang, resource leak, or divergent interpretation between hops.

Failure injection should target boundaries that affect meaning: before transmission, after server receipt, after effect commit but before response, during a streaming half-close, and during retry reconciliation. Verify the business invariant as well as the status returned to the caller. A connection error can be expected while a duplicate side effect is unacceptable. Use deterministic fixtures and state traces so a failure can be reproduced, then broaden with fuzzing or generated sequences. Fuzzing explores inputs; the oracle still needs to specify what must remain true, such as bounded allocation, consistent framing, or at-most-one committed effect for a retained operation identity.

A useful release artifact records protocol and schema versions, runtime versions, negotiated parameters, scenarios, expected invariants, actual outcomes, and known exclusions. Include resource and deadline bounds as observable behavior, not merely byte-for-byte output comparisons. If a matrix cell cannot be supported during a rolling upgrade, enforce an explicit rollout boundary or feature gate rather than relying on every peer updating simultaneously. Regression tests should preserve minimized failure traces so the same mechanism stays covered when code is refactored. Passing tests support the documented claim; they do not remove the need to reason about untested states and assumptions.

Use the probability lab to question coverage claims. Reset, explicitly set BOTH p=0.1 and n=10, predict the zero-success bar and its complement, then Play or Step. Reset and re-set BOTH p=0.1 and n=30 for comparison. Under independent selections, the chance of selecting the scenario at least once rises from about 65.1% to 95.8%, yet neither value certifies correctness. The exact bars do not run tests or model correlated generators. A rare scenario that is never generated remains invisible; combine targeted state coverage and sound invariants with random exploration instead of treating more trials as a universal guarantee.