I Shipped...

I fixed a problem where a dynamic Edge could report ready before its catalogue-backed runtime had been installed. Now a dynamic Edge reports unhealthy until runtimeforclient() is available after catalogue adoption.

I fixed a problem where a zero-depth bound could grant one-hop access, and validators disagreed over whether zero was valid. Now zero includes only the seed, one includes exactly one hop, and every public and internal layer applies the same non-negative depth contract.

I updated Jazz to load Vite’s standard environment files for the active development or production mode. I also changed it to use Vite’s own dotenv parsing, variable expansion and precedence rules.

I fixed a problem where an unmarked policy-shaped value could be mistaken for policy code and weaken a declared row predicate. Now these values fail closed unless the schema makes them valid row data.

I fixed a problem where values could race after onError, public Db.subscribe did not expose the error channel, legacy callbacks could drop failures, and browser relays reduced errors to messages. Now subscribers observe one terminal error and no later values.

I fixed a problem where a refresh failure could make a durable batch look unapplied, omit remote progress, and trigger reconnect or replay. Now the tick records applied progress exactly once, routes the refresh failure, retains the row, and does not redeliver the batch.

I fixed a problem where out-of-order activation could leave an over-capacity sibling durably pending and poison a later reopen. Now invalid pending lineage is quarantined and durably removed without consuming physical IDs.

I fixed a problem where sibling receipts could use a different generation from their view, disappear on backpressure, or miss fate registration. Now sibling messages share one generation, retry exactly once after backpressure, register fates, and avoid the established-set copy when no clone is pending.

I fixed a problem where inherited large values could fail during branch upserts. Now branch upserts read the complete head-over-base view and preserve verified inherited large-value descriptors.

I fixed a problem where retrying an ambiguously acknowledged insert could issue a second insert with the same UUID. Now a submitted insert keeps one stable UUID and is never submitted as a second insert.

I updated Jazz to attribute each retained query-shape registration to the peer that owns it. I also changed it to make repeated registration by one peer idempotent while keeping shared shapes until their final owner releases them.

I fixed a problem where cross-receipt eviction could deadlock behind a lifecycle guard, and reclaim could read the same backend metadata twice. Now eviction returns a retryable deferred result until persistence advances, and reclaim performs one required durable metadata read.

I fixed a problem where explicit close could remain incomplete until unrelated database work drove another tick. Now close drains ownership directly, later callers rejoin the same retained result, and wire unsubscribe remains retryable after local retirement.

I fixed a problem where tied winners could depend on record arrival, while implementation and recursion specifications disagreed about whether recursive ArgBy was valid. Now both extrema choose deterministic tied winners, preserve multiplicity by full-record identity, and reject ArgBy inside recursive children consistently.

I fixed a problem where cancelling close during an early drain could leave transactions open and omit the shutdown sweep. Now every close attempt leaves a closed admission gate and node-owned sweep behind, so cancellation cannot strand mergeable or exclusive transactions.

I updated Jazz to stop a retiring broker realm from accepting new runtime or foreground-lease bootstraps before it releases its physical database owners. I also changed it to return explicit closing and physical-owner busy responses so pages can recover through a bounded SharedWorker generation hand-off.

I fixed a problem where the transport could wait indefinitely when a peer accepted TCP but stalled the HTTP WebSocket upgrade. Now one deadline begins before connectasync and covers:.

I fixed a problem where background WAL writeback smoothed I/O, but the number of acknowledged mutation batches since the last synchronous WAL boundary was unbounded. Now every 64 successful backend mutation batches completes a synchronous WAL flush by default.

I updated Jazz to remove Windows from the advertised jazz-tools CLI targets because the release workflow does not produce a standalone Windows executable. I also changed it to keep the separate Windows NAPI build unchanged.

I made migration publication verify that each operation, filename, and schema description all agree before anything is sent to the server. I also made each upload use private temporary storage and reject symlinked or executable inputs that could escape the project directory.