The delivered artifact
Release readiness, written down
Two candidates from the same team on the same product. The difference between them is not how many defects were found, it is how much the methods agreed with each other. One of these blocks the release and the other clears it.
methods Static analysis (46), Manual review (44), Fuzzing (50) pairwise overlap 11, 19, 9 distinct found 104 estimated total 175 [89 to 336] estimated left 71 coverage 59% gate 90% budget 3 estimated remaining verdict KEEP TESTING
Found 104 of an estimated 175, so roughly 71 are still in there. The gate is 90% coverage and this run is at 59%.
- The 3 methods above are treated as independent. If any two of them share a rule set, a checklist, or a reviewer, the overlap is inflated and the coverage figure is too high.
- Defects are treated as equally findable. They are not. Defects that are hard for every method never enter the overlap, so this estimate is a floor and the true remaining count is usually worse.
- This does not say the product is unsafe. It says the testing done so far cannot support a claim that it is finished.
methods Static analysis (26), Manual review (26), Fuzzing (21) pairwise overlap 16, 14, 13 distinct found 40 estimated total 41 [33 to 50] estimated left 1 coverage 97% gate 90% budget 3 estimated remaining verdict SHIP
Every pair of methods overlapped heavily, so the population is well covered. Found 40 of an estimated 41, about 1 still out there against a budget of 3.
- The 3 methods above are treated as independent. If any two of them share a rule set, a checklist, or a reviewer, the overlap is inflated and the coverage figure is too high.
- Defects are treated as equally findable. They are not. Defects that are hard for every method never enter the overlap, so this estimate is a floor and the true remaining count is usually worse.
- This clears a stated residual budget. It is not a statement that the product is defect-free, and nothing here can be.
Anyone can write a gate that blocks on open criticals. What nobody currently produces is the first card: 104 findings, all triaged, all fixed, and a defensible statement that roughly 71 are still in there. Without that number the honest answer to “are we done” is a shrug, and the release goes out on whoever is most tired of arguing.