IBLTs Measure Before They Decode: Self-Sizing Set Reconciliation for Database Consistency Verification

Abstract

Cross-system data replication pipelines cannot confirm end-to-end consistency from the local guarantees of each hop, so the two endpoints must be compared directly on a periodic basis. Once the rows of a fixed snapshot are normalized into fingerprints, the task reduces to finding the symmetric difference of the two sets. Set reconciliation encodes both sets with an Invertible Bloom Lookup Table (IBLT), whose communication grows only with the difference cardinality $d$ and is independent of table size, which suits large tables. The capacity of an IBLT, however, must be fixed while $d$ is still unknown. Across 41,603 production reconciliations over 90 days, nonzero $d$ spans about seven orders of magnitude, and no reliable empirical constant exists. We show that the count array of an IBLT has already measured $d$ before decoding. The measurement is in-band: it is carried by the recovery sketch itself and adds no bytes dedicated to estimation. A mapping-aware theorem carries the same construction to Irregular, Rateless, and MET IBLTs. The protocol reads the estimate only after a decoding failure; we prove that the failure-conditioned lower quantile bounds the risk of underestimation, which gives the second-round capacity a configurable success-probability guarantee. On this basis we build a self-sizing protocol: the first round attempts recovery with a small sketch and stops there on success; on failure it reads $d$ and sets the second-round capacity, completing reconciliation in at most two rounds. Against a controlled oracle, communication is 1.29--1.47 times that of a scheme given $d$ in advance; production workload characterization, relational-database replay, and a cross-city KV deployment confirm the end-to-end mechanism. Measurement and recovery share one IBLT and need no separate estimation structure.