Sync-rules silent-row-loss audit: 8 PRs (4 merged, 4 open) — summary + reproductions

[sravan27]

Sharing a consolidated map of an audit pass I ran on packages/sync-rules over the past two weeks for anyone who wants the silent-row-loss shape spelled out in one place. Eight PRs filed; five merged, one open, three closed as of June 8 after maintainer feedback that the engine's preferred direction is Unicode-aware JS, not ASCII-only SQLite parity. Including the closes for posterity since the discussion itself is informative.

The common shape (for the merged set): a SQL operator that the sync-rules engine evaluates in JavaScript on the server compiles cleanly and runs without errors, but disagrees with SQLite (which the client runs) at the operator's edge. The server and client return different rows for the same input. No exception, no log line — just a silent miss at the bucket boundary.

Merged (Sprint #1, May)

PR	Operator	Silent-loss trigger
#643	NOT over NULL	SQLite three-value logic mismatch on WHERE NOT nullable_flag and WHERE state NOT IN ... against NULL
#644	LIKE escape / newlines	% did not span \n; backslash-escaped wildcards leaked through
#645	CAST (integer / numeric)	CAST('-12abc' AS integer) returned NaN instead of -12n
#646	divide-by-zero	a / 0 threw JS Infinity/NaN rather than NULL
#647	json_each	Object-vs-array iteration order under bucket parameter querier

Open

PR	Operator	Status
#662	JOIN on aliased primary	Non-fatal warning in new compiler with quoted-alias escape hatch per @simolus3's review — awaiting re-review

Closed by maintainer

PR	Operator	Maintainer call
#663	upper() / lower()	Closed — preferred direction is Unicode-aware JS; if the SQLite client wants alignment it can enable ICU. Engine team suggested overriding upper()/lower() in the client wa-sqlite expression engine to use JS Unicode-aware semantics for consistency.
#664	length() (code points vs UTF-16 code units)	Closed — same operator-direction call as #663.
#665	substring() (code points vs UTF-16 code units)	Closed — same operator-direction call as #663.

Reproductions

Every PR ships a regression test in packages/sync-rules/test/src/sync_plan/evaluator/sqlite_semantics.test.ts. The merged set fails on main pre-fix and passes after. The closed set's tests would need to invert direction (assert Unicode-aware JS behavior, not SQLite ASCII parity) to fit the engine's preferred semantics. The same checks have surfaced equivalent bugs in Rocicorp Zero (#6083, #6088), InstantDB (#2714), ElectricSQL (#4437 open), Dexie (#2306 open), RxDB, and TanStack DB (#1574); the operator-direction question is repo-by-repo.

The checker is open source if you want to run it against your own sync layer:

→ silentdrop (npm i silentdrop)
→ silentdrop-llm for the agent-output equivalent

How this surfaces in your deployment (refined)

If your sync-rules.yaml does any of the following, you may be exposed:

• a JOIN where the primary table wears a bare alias and the joined table is referenced unaliased → silently empty client database (this is the fix(sync-rules): surface JOIN clauses in Sync Streams as a loud error (#565) #662 case, fix in progress)
• a length(content) > N or substring(content, …) over content with emoji / CJK / astral scripts → numbers diverge by 2x vs SQLite, but the engine considers JS code-unit count the right answer — so the divergence is a spec question, not a bug, until the client also adopts Unicode-aware overrides
• a upper(name) / lower(name) over non-ASCII data → same spec question

For client-side alignment, an ICU-enabled SQLite build will give you the same Unicode-aware results the Service returns. Otherwise you accept JS / SQLite ASCII drift on those operators.

---

Disclosure: I am the author of the eight PRs. I previously did a 48-hour paid hardening sprint against this same engine. Open to scoping another against the adjacent surfaces (the inverse-direction client overrides @simolus3 mentioned, replication-mongo / replication-postgres filter evaluators, bucket-parameter querier comparison) if there is interest — happy to scope inline or by email.

---

Tracking pages, all PRs, and booking page consolidated at https://silentdrop-sravan.vercel.app.