I made migration publication verify that each operation, filename, and schema description all agree before anything is sent to the server. I also made each upload use private temporary storage and reject symlinked or executable inputs that could escape the project directory.
I serialised authentication-secret and database changes so the newest login, logout, or session action wins even when earlier asynchronous work finishes later. Old databases and token refreshes can no longer overwrite the current session, and startup now reconciles changes that happen while the database opens.
I made query validation reject records and arrays used as sort or tie-breaking fields, because they do not have a reliable ordering and could make the runtime fail later. Valid scalar and nullable fields keep their existing ordering behaviour.
I made schema validation reject relation checks containing more than one comparison, because the query engine only knows how to use one and could otherwise silently ignore the rest. The check now applies through nested policy conditions and across reads and writes before any query runs.
I made React providers distinguish clients created by different factories or runtime sources, so one provider cannot accidentally reuse another runtime's client. I also kept the React Native factory stable between unchanged renders, avoiding unnecessary client replacement.
I fixed native mutation notifications so a rejected mutation reaches JavaScript as the one event the runtime expects, rather than an extra empty error argument followed by the event. Rejections can now become structured transaction errors instead of looking like timeouts or native callback failures.
I made server authentication check that each signed token has the configured issuer, audience, and valid time window, rather than trusting any token signed by a known key. Missing configuration now fails closed, and privileged infrastructure secrets cannot be used as ordinary user credentials.
I stopped separate update permissions from being combined into an authority that neither permission granted on its own. A table now accepts only one asymmetric update rule, while ordinary symmetric rules continue to combine normally.
I made repeated calls to stop the embedded server wait for the same final result. Callers now all see a successful shutdown only after the native server has really finished, and they all receive the same failure if shutting it down fails.
I fixed the alpha release checklist so it only names real Rust packages, preventing a release from publishing some crates and then failing on a stale name. Dry runs now ask Cargo to build the packages that would actually be published, and already-published versions can be skipped safely on retries.
I made simultaneous authentication requests share one download of the backend signing keys, instead of each request downloading the same document. Successful downloads start a short refresh cooldown, while failed downloads are not cached so a later request can try again.
I made publishing a new permission version one indivisible operation, so two administrators cannot both approve different changes based on the same old version. One request now wins, the other gets a conflict, and the saved version and active rules stay in agreement.
I changed the todo examples to insert synced titles and descriptions as text instead of treating them as HTML. Text that looks like markup is now displayed literally, so it cannot create unexpected elements or attributes in the page.
I made the tree used for large values reject branch children that claim to contain zero bytes, while keeping the single empty root needed for a genuinely empty value. This stops malformed trees from hiding their real size and sending later code into unsafe traversal.
I changed release publishing to rebuild its packages whenever the source tree differs from the one checked by the preview build, including when only the workflow files changed. This prevents a release from reusing packages made from a different version of the source.
I made an active subscription key keep one clear owner, so another subscription cannot quietly reuse it for a different kind of data. Safe replays still refresh the existing stream, while conflicting requests are rejected before they can leave subscriptions or cleanup in the wrong state.
I made a subscription remember the exact current, historical, or branch view the caller requested. When the server rechecks the rows later, it now uses that same view instead of silently switching to the latest data and removing rows that still belong.
I gave cached backend signing keys a five-minute maximum lifetime, so a key removed by the identity provider is not trusted indefinitely. After expiry, authentication fetches a fresh set and fails closed if that refresh is unavailable rather than using the old keys.
I made Counter schemas check their column types before they reach the runtime, so nullable or non-integer definitions fail where they are written. I also made large integer counters behave consistently across the Rust and TypeScript interfaces and added a two-client test for them.
I made concurrent shutdown calls wait for the one shutdown operation to finish. This means every caller now sees success only after the server's owner thread has exited and its storage has been cleaned up.