further review fixes: treat absent FK fields as failed, drop NULL indexed_at

convert_fks_to_uuids_batch previously treated a missing local_field as
null. convert_fk_to_uuid errors in that case — only an explicit JSON
null is a legitimate null FK — so the batch helper now flags absent
fields as failed to match the per-record contract.

Entry::query_for_sync no longer falls back to modified_at when
indexed_at is NULL. The cursor filter/order uses indexed_at exclusively,
so a returned cursor derived from modified_at wouldn't match the next
query's predicate. The indexed_at backfill migration populated existing
rows; any NULL here is a data bug, logged and skipped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jamiepine

core/src/infra/db/entities/entry.rs

@@ -302,6 +302,21 @@ impl crate::infra::sync::Syncable for Model {
 				None => continue,
 			};
 
+			// The sync cursor filters/orders on `indexed_at`, so a row with a
+			// NULL `indexed_at` would emit a cursor the next query predicate
+			// doesn't represent. Skip them — the indexed_at backfill migration
+			// populated every existing row, so this should be unreachable.
+			let indexed_at = match entry.indexed_at {
+				Some(ts) => ts,
+				None => {
+					tracing::warn!(
+						uuid = %uuid,
+						"Entry has NULL indexed_at; skipping sync until it's populated"
+					);
+					continue;
+				}
+			};
+
 			let mut json = match entry.to_sync_json() {
 				Ok(j) => j,
 				Err(e) => {
@@ -323,8 +338,7 @@ impl crate::infra::sync::Syncable for Model {
 				}
 			}
 
-			let timestamp = entry.indexed_at.unwrap_or(entry.modified_at);
-			staged.push((uuid, json, timestamp));
+			staged.push((uuid, json, indexed_at));
 		}
 
 		// Batch-convert FK integer IDs to UUIDs one FK type at a time across

core/src/infra/sync/fk_mapper.rs

@@ -127,13 +127,20 @@ pub async fn convert_fks_to_uuids_batch(
 
 	let uuid_field = fk.uuid_field_name();
 
-	// First pass: collect IDs and flag records whose local_field isn't a valid
-	// integer so they can be dropped by the caller.
+	// First pass: collect IDs and flag records that can't be resolved. An
+	// absent `local_field` is treated as failed (matches `convert_fk_to_uuid`
+	// semantics — only an explicit JSON `null` is a legitimate null FK).
 	let mut ids_to_lookup: HashSet<i32> = HashSet::new();
 	for (idx, json) in records.iter().enumerate() {
 		match json.get(fk.local_field) {
-			None => { /* absent — treated as null below */ }
-			Some(v) if v.is_null() => { /* null — treated as null below */ }
+			None => {
+				tracing::warn!(
+					fk_field = fk.local_field,
+					"FK field missing in sync payload; dropping record"
+				);
+				failed.insert(idx);
+			}
+			Some(v) if v.is_null() => { /* explicit null — treated as null below */ }
 			Some(v) => match v.as_i64() {
 				Some(id) => {
 					ids_to_lookup.insert(id as i32);
@@ -165,7 +172,8 @@ pub async fn convert_fks_to_uuids_batch(
 
 		match local_field_value {
 			None => {
-				json[&uuid_field] = Value::Null;
+				// First pass already flagged this as failed; nothing to do.
+				continue;
 			}
 			Some(v) if v.is_null() => {
 				json[&uuid_field] = Value::Null;