sqlfluff's whitespace fix turns two minus signs into a comment, breaking a test fixture

sqlfluff removes whitespace it considers redundant ^[11]. Sometimes the characters on either side of that whitespace are tokens that fuse into a different token when they touch ^[11]. In the fixture `SELECT 1 * - - 5 AS a, 99 AS b FROM t`, the two minus signs closed up into `--`, which starts a line comment in SQL, and the fixer also reordered the select targets so the damaged column landed at the end and took the rest of the line with it ^[12].

Two more fixtures show the general shape. SQLite fuses `4 | ~ ~ ~4` into `4 | ~~~4`, a different token with no comment involved ^[13]. Oracle fuses the keywords `MULTISET EXCEPT` into `MULTISETEXCEPT`, and the rule responsible there is LT02, an indentation rule ^[14].

That last one is the argument for guarding at the token layer instead of patching rule by rule. "A rule that only ever adjusts indentation should not have to know what a token is," the author of the dev.to writeup wrote, and "the check belongs where fixes are applied" ^[15]. Five of the eight unparsable outputs pointed at one rule, and were filed as a single issue rather than five ^[9][16].

The second bug needs no unusual SQL. RF06 removes unnecessary quotes from identifiers, and in MySQL and MariaDB `'jeffrey'@'localhost'` is one account specification whose quotes are part of it ^[17]. `CREATE USER 'jeffrey'@'localhost'` comes back as `CREATE USER jeffrey@localhost`, which sqlfluff itself cannot parse ^[18]. Default config, no `.sqlfluff` file needed, and the same rewrite hits `GRANT ... TO`, `DROP USER` and `DEFINER =` clauses ^[19].

Corruption in this run means the fixture parsed before the fix and not after; unstable means fixing twice does not converge ^[3]. All 31 unstable results were expected, because sqlfluff's CLI loops the fixer until the output stabilises, so one unconverged pass is the tool working ^[5]. That is 79 percent of the flagged outputs ^[25]. Nine of the author's first ten findings on an earlier run were the same noise ^[6]. The author's point was that unstable means unresolved, not a confirmed bug ^[7]. One corruption candidate failed the other way: `ALTER USER 'jeffrey'@'localhost'` does not parse after the fix, and does not parse before it either, so it is a parser gap ^[8].

Eight unparsable outputs from 2,249 fixtures is 0.36 percent ^[26], and the corpus is nobody's production SQL: the fixtures were written by maintainers to sit on the edges of the grammar ^[29]. For the fusion bug to reach your repository you need adjacent tokens that lex differently when joined, like `1 * - - 5` ^[11][12]. For RF06 you need a MySQL grant script ^[17][19]. The whole run took roughly an hour single-process across 28 dialects, about 1.6 seconds per fixture ^[2][27]. The author's framing of the risk is that `--fix` writes across a whole repository, usually in CI, usually without anyone reading the diff ^[23], and that fixtures get used to test the parser while nobody points them all at the fixer at once ^[24].

The invariant is one line: if a fixture parses cleanly, its fix output must parse cleanly too ^[1]. It catches only the outputs that fail to parse. `1 * --5` parses perfectly and simply means something else, so the author added a second check for output that parses but has lost meaning ^[21]. The writeup's account of that second check breaks off before any results are reported ^[22].