v5.2.6

Transactions and data integrity

• An explicit transaction() was not atomic when the context's transaction slot already held a released placeholder (#2325, cherry-picked as #2327). In that state — and on a context that never held a transaction at all, such as an instance load — txnForContext installs an ImmediateTransaction, which reports itself open but whose save() is the commit. Both join sites gated on the open flag alone, so transaction(ctx, cb) ran the callback and returned without ever reaching its own commit: every write self-committed as it happened, a throw partway through left the earlier writes durable, the error path's abort() never ran, and the handler still returned success. Both join sites now gate on whether the transaction stages its writes for a later commit, so an explicit transaction() on a released slot is atomic exactly as it is on a fresh one. Reachable in 5.2.1 through 5.2.5.

Restarts and shutdown

• A worker respawn could resurrect the thread pool mid-shutdown (#2316). Terminal process shutdown now latches worker creation and every replacement path, so a late worker exit or an overlapping rolling restart can no longer bring the pool back while the process is tearing down. The restart path sets that latch as its first act rather than waiting for shutdownWorkersNow(), closing the window where a debounced component reload could pre-start an HTTP replacement inside a process that is already exiting.
• Container restarts gain a bounded post-compaction exit watchdog (#2316). Every way the watchdog's shell could give up was a silent success — an unreadable procfs, a base image without sleep — so a successful spawn was not evidence it would ever fire. It now emits a readiness token once both facilities are proven, and arming reports failure unless that token arrives, so the "restart teardown is unbounded" warning reaches operators in exactly the environments that need it.
• The published image runs tini -g as PID 1 (#2316). This gives the container a reaper and makes a reliable SIGKILL fallback possible, while preserving compatibility with volumes written by earlier PID-1 images. Worth knowing on upgrade: group signal forwarding changes which signals component subprocesses receive on docker stop; the user-visible consequences are recorded in DESIGN.md.
• Shutdown listeners preserve requested failure exit codes and still terminate the process when PID-file cleanup fails, rather than exiting 0 or hanging (#2316).

Also in this release

• CI: the dispatched test workflows are pinned to a read-only token (#2318).

Full Changelog: v5.2.5...v5.2.6