v5.3.2

Subscriptions and MQTT

• Subscriptions deliver commits that finish out of timestamp order. RocksDB timestamps a transaction when it starts, but commits can finish in any order. Default subscriptions could drop a late merged write, a write below a collection scan's newest timestamp, or a QoS 0 delivery after a durable session was saved. Those events are now delivered. (#3029)
• Resume positions are checked against retained history. Table.subscribe can verify a resume position before replaying from it: a request that names its database generation is refused when that database was replaced or the history after the position is gone, instead of silently replaying what is left. Durable MQTT sessions use this check, and a session that can no longer catch up is reset rather than resumed with a gap. (#2946)
• Unacknowledged durable MQTT messages are redelivered after a reconnect. When a message's transaction committed after one with a higher log key, acknowledging the higher-keyed message could move the saved session position past the unacknowledged one, so a reconnect never redelivered it. The saved position now stays below every outstanding delivery. (#3103)

Backup and restore

• A restore can no longer race a database open. Opening a database now holds the per-database restore lock (shared) across the restoring-marker check and the open itself, so an opener can no longer pass the check and then open a directory a restore has begun purging. (#2649)
• get_backup archives identify themselves. Every archive now starts with a harper-backup.json capability manifest, and managed backups carry the same document in their completion manifest. Both restore paths now enforce it. (#2648)
• Safer replay-abort advice. When boot replay stops at a time or progress limit, the warning no longer tells operators to re-clone. It explains that unreplayed entries may already be durable, asks for a copy of the database and transaction log before further writes, and warns that re-cloning discards local-only writes. (#2998)

Upgrade and rollback

• 5.3 → 5.2 rollback keeps tables first created on 5.3. A table first created on 5.3 used generation-suffixed store names that 5.2.15 cannot read, so after a rollback it opened empty and writes made during the rollback were lost on re-upgrade. First-time RocksDB creates now use the legacy names. Tables already created on 5.3.0–5.3.1, and recreated tables, remain unreadable by 5.2.15. (#3118)

Configuration

• 41 config params are now settable by env var, CLI flag and set_configuration. These params were read by Harper or Harper Pro but never registered, so they could be set only in the config file; set_configuration returned 400 and env vars were dropped silently. Six Harper Pro replication tuning params were ignored even in the config file. Examples include replication.recordLocks, agent.systemPromptAppend and the per-section logging settings. (#3113)

Applications and processes

• branchedDatabases works for package-deployed applications. A package-deployed application that declared branchedDatabases was served against the base databases. It now gets its own private branches, and its nested components share them. (#3083)
• Named child processes are verified before reuse or signalling. A component's constrained fork/spawn could adopt an unrelated process after its recorded PID was recycled, and a version replacement could signal that process. Harper now records each child's OS lifetime identity and checks it before adopting, replacing or signalling. (#3000, #3005)
• Incomplete built-in component registrations are skipped. A malformed HARPER_BUILTIN_COMPONENTS entry now logs its position and is skipped before runtime loading and config backfill, and Harper starts without it. (#2979)

Security and TLS

• The UDS mirror sockets directory is owner-only. The TLS Unix-socket mirrors trust the PROXY v2 identity a fronting proxy passes, so their sockets directory is their only access gate; it is now created with mode 0700 instead of the umask default. Each mirror's metadata file is published by atomic rename, and an isolated application's worker no longer reports ready without a bound mirror. (#3019)
• Certificate renewal detection survives a quickly cancelled renewal. A cancelled renewal that removed the certificate path twice within the file watcher's 100 ms throttle left Harper watching a deleted file, so it never read the restored certificate or any later renewal of that path. Harper now re-checks TLS files after every raw watcher event. (#3010)

Record locks

• Lock releases reach the coordinating thread. A peer's record-lock release that arrived on a worker which does not coordinate the database's locks was dropped. It is now relayed to the coordinating worker. This lets Harper Pro spread replication subscriptions across workers with record locks on. (#3038)

Analytics

• Aggregate queue-depth peaks are real peaks. The aggregate maxDepth for the read and write transaction queues averaged each thread's per-sample peaks before summing them, which produced neither a peak nor a bound. Peak-named measures now take the maximum within a thread, and the per-thread peaks are summed. (#3017)

Packaging

• The published package locks its JavaScript dependency tree. npm 12 ignores published shrinkwraps, and the shrinkwrap broke npm ci for consumers on older npm. Harper now ships its production JavaScript dependencies as a bundle (bundleDependencies), so installs get the tested tree on npm 10, 11 and 12. The tarball is larger and bundled packages are not deduplicated with the consumer's. (#3030)

Also in this release

rocksdb-js 2.11.0 (#3094); CI now runs minor-version upgrade and rollback tests against 5.2.15 and 5.3.1 (#3114); test stabilization (startup-install deadline, log-rotation notice); review-tooling updates.

Full changelog: v5.3.1...v5.3.2