v5.3.2

Replication

• Main-thread hang after a replication worker exits is fixed. When a worker exited, the sweep that reassigns its subscriptions staggers them 50 ms apart. If an armed fire time sat within 50 ms below a power of two of process uptime in ms (4096, 8192, …), floating-point rounding could make the next slot equal the current one, and the main thread looped forever: it served no operations and managed no subscriptions until restart. The bug was latent in 5.3.0 and 5.3.1. (#990)
• v4-to-v5 replication no longer corrupts the v4 source's audit log. An automatic reverse base copy could rewrite an unchanged v4 migration source's audit history. v5 now verifies that the v4 peer already holds the historical baseline before completing the reverse subscription, and fails with an explicit error, naming the key, when historical restoration into v4 would be required. Forward migration and new v5 writes are unaffected. (#848)
• With replication.recordLocks on, subscriptions are spread across workers. Every (peer, database) subscription used to be placed on the worker that coordinates that database's locks, so a single-database cluster applied all inbound replication on one thread whether or not anything called lock(). Subscriptions are now placed round-robin, and lock control entries are relayed to the coordinating worker (core #3038). (#987)
• Isolated-application workers carry no replication or lock ownership. Replication subscriptions and record-lock coordination could land on a worker reserved for one isolated application, so a scoped restart of that application also dropped replication connections and lock ownership. Those workers are now excluded. (#979)

Packaging

• The published package locks its JavaScript dependency tree. npm 12 ignores npm-shrinkwrap.json, and a tarball install (as in the Docker images) never reads it, so most installs resolved the transitive tree fresh. Harper Pro now ships its production JavaScript dependencies as a bundle, matching core. The gzipped tarball grows from about 18.5 MB to about 40.7 MB. (#981)
• npm latest/next dist-tags stay on the newest release line. Publishing 5.2.15 after 5.3.1 moved latest back to 5.2.x. The publish job now takes latest/next only for the newest release; an older line gets a line-scoped tag such as latest-5.2. (#971)

Also in this release

Core synced to harper v5.3.2; a replication test now waits for the persisted resume cursor before killing a node (#1002); review-coverage tooling, review-surface declarations and a PR-description glossary.

---

Harper (core) v5.3.2

Subscriptions and MQTT

• Subscriptions deliver commits that finish out of timestamp order. RocksDB timestamps a transaction when it starts, but commits can finish in any order. Default subscriptions could drop a late merged write, a write below a collection scan's newest timestamp, or a QoS 0 delivery after a durable session was saved. Those events are now delivered. (#3029)
• Resume positions are checked against retained history. Table.subscribe can verify a resume position before replaying from it: a request that names its database generation is refused when that database was replaced or the history after the position is gone, instead of silently replaying what is left. Durable MQTT sessions use this check, and a session that can no longer catch up is reset rather than resumed with a gap. (#2946)
• Unacknowledged durable MQTT messages are redelivered after a reconnect. When a message's transaction committed after one with a higher log key, acknowledging the higher-keyed message could move the saved session position past the unacknowledged one, so a reconnect never redelivered it. The saved position now stays below every outstanding delivery. (#3103)

Backup and restore

• A restore can no longer race a database open. Opening a database now holds the per-database restore lock (shared) across the restoring-marker check and the open itself, so an opener can no longer pass the check and then open a directory a restore has begun purging. (#2649)
• get_backup archives identify themselves. Every archive now starts with a harper-backup.json capability manifest, and managed backups carry the same document in their completion manifest. Both restore paths now enforce it. (#2648)
• Safer replay-abort advice. When boot replay stops at a time or progress limit, the warning no longer tells operators to re-clone. It explains that unreplayed entries may already be durable, asks for a copy of the database and transaction log before further writes, and warns that re-cloning discards local-only writes. (#2998)

Upgrade and rollback

• 5.3 → 5.2 rollback keeps tables first created on 5.3. A table first created on 5.3 used generation-suffixed store names that 5.2.15 cannot read, so after a rollback it opened empty and writes made during the rollback were lost on re-upgrade. First-time RocksDB creates now use the legacy names. Tables already created on 5.3.0–5.3.1, and recreated tables, remain unreadable by 5.2.15. (#3118)

Configuration

• 41 config params are now settable by env var, CLI flag and set_configuration. These params were read by Harper or Harper Pro but never registered, so they could be set only in the config file; set_configuration returned 400 and env vars were dropped silently. Six Harper Pro replication tuning params were ignored even in the config file. Examples include replication.recordLocks, agent.systemPromptAppend and the per-section logging settings. (#3113)

Applications and processes

• branchedDatabases works for package-deployed applications. A package-deployed application that declared branchedDatabases was served against the base databases. It now gets its own private branches, and its nested components share them. (#3083)
• Named child processes are verified before reuse or signalling. A component's constrained fork/spawn could adopt an unrelated process after its recorded PID was recycled, and a version replacement could signal that process. Harper now records each child's OS lifetime identity and checks it before adopting, replacing or signalling. (#3000, #3005)
• Incomplete built-in component registrations are skipped. A malformed HARPER_BUILTIN_COMPONENTS entry now logs its position and is skipped before runtime loading and config backfill, and Harper starts without it. (#2979)

Security and TLS

• The UDS mirror sockets directory is owner-only. The TLS Unix-socket mirrors trust the PROXY v2 identity a fronting proxy passes, so their sockets directory is their only access gate; it is now created with mode 0700 instead of the umask default. Each mirror's metadata file is published by atomic rename, and an isolated application's worker no longer reports ready without a bound mirror. (#3019)
• Certificate renewal detection survives a quickly cancelled renewal. A cancelled renewal that removed the certificate path twice within the file watcher's 100 ms throttle left Harper watching a deleted file, so it never read the restored certificate or any later renewal of that path. Harper now re-checks TLS files after every raw watcher event. (#3010)

Record locks

• Lock releases reach the coordinating thread. A peer's record-lock release that arrived on a worker which does not coordinate the database's locks was dropped. It is now relayed to the coordinating worker. This lets Harper Pro spread replication subscriptions across workers with record locks on. (#3038)

Analytics

• Aggregate queue-depth peaks are real peaks. The aggregate maxDepth for the read and write transaction queues averaged each thread's per-sample peaks before summing them, which produced neither a peak nor a bound. Peak-named measures now take the maximum within a thread, and the per-thread peaks are summed. (#3017)

Packaging

• The published package locks its JavaScript dependency tree. npm 12 ignores published shrinkwraps, and the shrinkwrap broke npm ci for consumers on older npm. Harper now ships its production JavaScript dependencies as a bundle (bundleDependencies), so installs get the tested tree on npm 10, 11 and 12. The tarball is larger and bundled packages are not deduplicated with the consumer's. (#3030)

Also in this release

rocksdb-js 2.11.0 (#3094); CI now runs minor-version upgrade and rollback tests against 5.2.15 and 5.3.1 (#3114); test stabilization (startup-install deadline, log-rotation notice); review-tooling updates.

Harper core release: https://github.com/HarperFast/harper/releases/tag/v5.3.2

Full changelog: v5.3.1...v5.3.2 · core