The mystery has been solved.
The app was written in 1997 in PB 5 by someone who clearly didn't know what they were doing.
The pfc_save event on the window was overridden and contained over 400 lines of code doing various filtering and other stuff. The instance datastores do a ShareData with the DataWindows.
Near the bottom is a bunch of calls to .Update() to the datastores. Up around line 150 is a call to the pfc_update event. The pfc_update event is at some level of the pfc issuing .Update() against the DataWindow which causes the shared datastore to issue the delete sql. Then the manually coded Update() directly against the datastore causes it to issue the same delete sql.
Commented out the call to pfc_update and now it works fine.
I'm not sure if this would be considered a bug. It certainly is different from how PB 5 works.