without FORMAT=TRADITIONAL, on newer version of mysql it will return:

mysql> explain select 1 from str_test where id > 'a' and id <= 'z';
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| EXPLAIN                                                                                                                                                                                |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| -> Filter: ((str_test.id > 'a') and (str_test.id <= 'z'))  (cost=18.9 rows=93)
    -> Covering index range scan on str_test using PRIMARY over ('a' < id <= 'z')  (cost=18.9 rows=93)
 |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

what we want:

mysql> explain format=traditional select 1 from str_test where id > 'a' and id <= 'z';
+----+-------------+----------+------------+-------+---------------+---------+---------+------+------+----------+--------------------------+
| id | select_type | table    | partitions | type  | possible_keys | key     | key_len | ref  | rows | filtered | Extra                    |
+----+-------------+----------+------------+-------+---------------+---------+---------+------+------+----------+--------------------------+
|  1 | SIMPLE      | str_test | NULL       | range | PRIMARY       | PRIMARY | 202     | NULL |   93 |   100.00 | Using where; Using index |
+----+-------------+----------+------------+-------+---------------+---------+---------+------+------+----------+--------------------------+

We should still be deterministic in face of network errors.
Haven't we had this conversation before
#4097 (comment)
#3972 (comment)

This masks MariaDB rejecting EXPLAIN FORMAT=TRADITIONAL

surprised that tests that expect N partitions did not catch this, will take a look what happened here.

MariaDB seem to support it just fine:

MariaDB [test]> explain FORMAT=TRADITIONAL SELECT 1 FROM a where id1 > 0 and id1 < 1;
+------+-------------+-------+-------+---------------+---------+---------+------+------+-------------+
| id   | select_type | table | type  | possible_keys | key     | key_len | ref  | rows | Extra       |
+------+-------------+-------+-------+---------------+---------+---------+------+------+-------------+
|    1 | SIMPLE      | a     | range | PRIMARY       | PRIMARY | 4       | NULL | 1    | Using where |
+------+-------------+-------+-------+---------------+---------+---------+------+------+-------------+

My bad on Maria, gotta keep my AIs in check

🟠 Major — NUL byte in a boundary key → deterministic stuck snapshot

MySQL VARCHAR permits 0x00; mysql.Escape maps it to a valid literal so probes succeed and the NUL key lands in a StringRange boundary. Postgres then rejects it: the catalog insert of partition_start/partition_end (text columns, monitoring.go:393) fails with invalid byte sequence for encoding "UTF8": 0x00 (reproduced live against the dev catalog). GetQRepPartitions fails, Temporal recomputes identical partitions, fails identically — stuck forever. Bounded by defaults: with PEERDB_OFFLOAD_PARTITION_RANGES=true (default) and InitialCopyOnly snapshots, ranges are offloaded to encrypted bytea and this insert is skipped. Trigger requires offload disabled or a continuous mirror, plus a NUL in the min/max key.

I think this needs a fuzz integration test (quicker than e2e but real mysql/mariadb) and leave it overnight/weekend. LLMs can help with throwing in charsets/collations/index types (idk if relevant for PK)/padding and setting up the data generation.

🔴 Critical — Watermark values interpolated with the wrong escaping for the session's sql_mode

flow/connectors/mysql/qrep_partition.go:281 (and :294, :325, plus the pull query at flow/connectors/mysql/qrep.go:379)

Every new probe query and the StringRange pull query build SQL literals with mysql.Escape(...) wrapped in single quotes. But the connector unconditionally runs SET sql_mode = 'ANSI,NO_BACKSLASH_ESCAPES' (mysql.go:237). mysql.Escape does backslash escaping (' → \'), which under NO_BACKSLASH_ESCAPES is a no-op — the backslash is a literal character. This was masked at merge-base because non-UUID strings fell back to full-table and emitted no per-value SQL; UUID boundaries are hex-only. This branch routes arbitrary row data through these literals for the first time. Three concrete failure modes, reproduced live on MySQL 8.0:

• Silent data loss (this is the critical core). A max watermark value like Z:\tmp (Windows/UNC path as key) is stored unescaped, so partitioning succeeds — no fallback. The last partition's inclusive bound becomes BETWEEN ... AND 'Z:\\tmp', which under NO_BACKSLASH_ESCAPES is the literal 7-char string Z:\\tmp. The real Z:\tmp sorts above it, so the max row (and neighbors) are silently never replicated. Verified: SELECT ... BETWEEN 'Mmm' AND 'Z:\\tmp' returned only Mmm, dropping the real max. Symmetric at the min bound with \n/\t/\0. Interior boundaries stay consistent (adjacent partitions share the identical escaped key), so the leak is concentrated at the two endpoints — but it's a successful query with no error and no fallback.
• SQL injection. A source row value like x' OR '1'='1 escapes to 'x\' OR '1'='1'; the backslash is literal, the string closes early, and the tail executes. Watermark values are attacker-influenceable table data. Reachable but harder — quote-bearing values usually syntax-error the probe phase first (see below).
• Quote-free data breaks too. stringMidpoint synthesizes bytes in [0x20,0x7E] as base95 digits — including 0x27 (') and 0x5C (\). Verified: stringMidpoint("&&&", "(((") = "'''", invented from quote-free input. The probe then throws ERROR 1064 and the build silently degrades to a single full-table partition.

Fix: use parameterized Execute(query, args...) (already supported at mysql.go:303) or '' quote-doubling instead of mysql.Escape. This fixes all three at once.