Partial sync failures do not corrupt local state

A sync that processes records sequentially without transaction semantics can leave the local database in a partially-updated state if the process is interrupted mid-way. CWE-362 applies when an interrupted sync produces orphaned references — a local record pointing to a remote entity that was never fetched. ISO 25010:2011 reliability.recoverability requires that interrupted operations leave data in a valid, queryable state. The failure mode is subtle: the app appears to function normally after the crash, but relationship integrity is broken and queries silently return incomplete results.

Batch sync updates inside a database transaction so the local state either advances fully or not at all. Validate that all remote records can be fetched before writing any of them.

async function syncAtomic(records: LocalRecord[]) {
  // Phase 1: fetch everything before writing anything
  const remoteRecords = await Promise.all(
    records.map(r => fetchRemote(r.id))
  );

  // Phase 2: merge and write inside a transaction
  await db.transaction(async (tx) => {
    for (let i = 0; i < records.length; i++) {
      const merged = merge(records[i], remoteRecords[i]);
      await tx.update('records', merged.id, merged);
    }
  });
}

For storage layers without native transactions (e.g., AsyncStorage), implement a write-ahead staging key: write the full batch to a staging key first, then atomically swap it into the live key. Never partially update the live key.