I updated Jazz to attribute each retained query-shape registration to the peer that owns it. I also changed it to make repeated registration by one peer idempotent while keeping shared shapes until their final owner releases them.
I fixed a problem where cross-receipt eviction could deadlock behind a lifecycle guard, and reclaim could read the same backend metadata twice. Now eviction returns a retryable deferred result until persistence advances, and reclaim performs one required durable metadata read.
I fixed a problem where explicit close could remain incomplete until unrelated database work drove another tick. Now close drains ownership directly, later callers rejoin the same retained result, and wire unsubscribe remains retryable after local retirement.
I fixed a problem where tied winners could depend on record arrival, while implementation and recursion specifications disagreed about whether recursive ArgBy was valid. Now both extrema choose deterministic tied winners, preserve multiplicity by full-record identity, and reject ArgBy inside recursive children consistently.
I fixed a problem where cancelling close during an early drain could leave transactions open and omit the shutdown sweep. Now every close attempt leaves a closed admission gate and node-owned sweep behind, so cancellation cannot strand mergeable or exclusive transactions.
I updated Jazz to stop a retiring broker realm from accepting new runtime or foreground-lease bootstraps before it releases its physical database owners. I also changed it to return explicit closing and physical-owner busy responses so pages can recover through a bounded SharedWorker generation hand-off.
I fixed a problem where the transport could wait indefinitely when a peer accepted TCP but stalled the HTTP WebSocket upgrade. Now one deadline begins before connectasync and covers:.
I fixed a problem where background WAL writeback smoothed I/O, but the number of acknowledged mutation batches since the last synchronous WAL boundary was unbounded. Now every 64 successful backend mutation batches completes a synchronous WAL flush by default.
I updated Jazz to remove Windows from the advertised jazz-tools CLI targets because the release workflow does not produce a standalone Windows executable. I also changed it to keep the separate Windows NAPI build unchanged.
I made migration publication verify that each operation, filename, and schema description all agree before anything is sent to the server. I also made each upload use private temporary storage and reject symlinked or executable inputs that could escape the project directory.
I serialised authentication-secret and database changes so the newest login, logout, or session action wins even when earlier asynchronous work finishes later. Old databases and token refreshes can no longer overwrite the current session, and startup now reconciles changes that happen while the database opens.
I made query validation reject records and arrays used as sort or tie-breaking fields, because they do not have a reliable ordering and could make the runtime fail later. Valid scalar and nullable fields keep their existing ordering behaviour.
I made schema validation reject relation checks containing more than one comparison, because the query engine only knows how to use one and could otherwise silently ignore the rest. The check now applies through nested policy conditions and across reads and writes before any query runs.
I made React providers distinguish clients created by different factories or runtime sources, so one provider cannot accidentally reuse another runtime's client. I also kept the React Native factory stable between unchanged renders, avoiding unnecessary client replacement.
I fixed native mutation notifications so a rejected mutation reaches JavaScript as the one event the runtime expects, rather than an extra empty error argument followed by the event. Rejections can now become structured transaction errors instead of looking like timeouts or native callback failures.
I made server authentication check that each signed token has the configured issuer, audience, and valid time window, rather than trusting any token signed by a known key. Missing configuration now fails closed, and privileged infrastructure secrets cannot be used as ordinary user credentials.
I stopped separate update permissions from being combined into an authority that neither permission granted on its own. A table now accepts only one asymmetric update rule, while ordinary symmetric rules continue to combine normally.
I made repeated calls to stop the embedded server wait for the same final result. Callers now all see a successful shutdown only after the native server has really finished, and they all receive the same failure if shutting it down fails.
I fixed the alpha release checklist so it only names real Rust packages, preventing a release from publishing some crates and then failing on a stale name. Dry runs now ask Cargo to build the packages that would actually be published, and already-published versions can be skipped safely on retries.
I made simultaneous authentication requests share one download of the backend signing keys, instead of each request downloading the same document. Successful downloads start a short refresh cooldown, while failed downloads are not cached so a later request can try again.