Skip to content

Document super_user-only replication directives and the unconfirmed-commit error - #740

Merged
Ethan-Arrowood merged 6 commits into
mainfrom
docs/replicate-to-super-user-and-unconfirmed-commit
Nov 2, 2026
Merged

Ethan-Arrowood merged 6 commits into
mainfrom
docs/replicate-to-super-user-and-unconfirmed-commit

Conversation

@kriszyp

@kriszyp kriszyp commented Oct 20, 2026 •

Copy link
Copy Markdown
Member
A calm cartoon dog sips coffee in a burning room beside a green checkmark and a cut phone line, standing for a write that committed locally while its peer confirmation never arrived.

⊙ Problem

Harper v5.4.0 changes two replication behaviors the sharding page does not describe. Require a super user for X-Replicate-To and the operations API replicateTo/replicatedConfirmation fields returns HTTP 403 to other callers. Distinguish replication confirmation failure from a local write failure marks a failed confirmation after a local commit with replicationUnconfirmed: true and retryable: false. Retrying callers must know the write landed.

🤔 Is the page ready now that both harper PRs have merged?

Yes. Both merged to main with milestone v5.4, and the newest harper tag is v5.3.3, so the v5.4.0 badges hold. A 5.4 release-notes entry is not included, because the task limited this PR to the sharding page.

💡 Solution

In reference/replication/sharding.md, tagged v5.4.0:

🤔 Which wording wins where this PR and #723 disagree?

Clarify confirm/replicatedConfirmation any-N semantics in the sharding docs edits the same file. Its text says a too-large confirmation count is rejected after the write took effect locally. Harper main refuses it before the write lands, and this PR says so. Whichever merges second needs a small rebase and one corrected sentence.

🤔 Badge at the start of a paragraph, or plain "As of v5.4.0"?

Gemini suggested plain text for the two "changed" notes. I kept the badge: the approved patch used it, and 21 other reference paragraphs open the same way. The new section's badge sits on its own line under its heading, as CONTRIBUTING.md describes. Switching is a two-line edit.

✅ Verification

  • npm run build passes and prettier --check is clean.
  • Each claim was checked against the code of harper#3084 and harper#3187. The example error's message and 504 status come from the confirmation timeout in harper-pro replication/knownNodes.ts.
  • The programmatic claims were traced in harper main: resources/transaction.ts copies replicatedConfirmation only when a transaction starts, and Table.getResidency reads context.replicateTo at write time. The transaction() example follows harper's replicationConfirmationOutcome tests.
  • The first-database limit applies to LMDB too: Make replicatedConfirmation wait for peers on LMDB sends LMDB commits through the same confirmReplicationAfterCommit path (resources/LMDBTransaction.ts).
  • The merge commits of harper#3084, #3187 and #3392 are all in v5.4.0-alpha.1.
  • Not run against a live Harper: replication needs Harper Pro. Both harper PRs carry their own tests for these paths.

Depends-on: harper#3084, harper#3187

🤖 Generated by Claude Sonnet 5.5 via Claude Code (session); posted via @kriszyp.

Related PRs: #723 overlaps (same page; adjacent insertions after the programmatic example), #753 overlaps (same page; edits the programmatic example and adds its own replicationUnconfirmed paragraph, so whichever merges second keeps one copy)
Complexity: medium

Origin — the dispatch brief this PR was written from

Open a draft PR in HarperFast/documentation that documents two Harper v5.4.0 replication changes in reference/replication/sharding.md: (1) X-Replicate-To and the operations API replicateTo/replicatedConfirmation fields now require super_user (HarperFast/harper#3084), and (2) a confirmation failure after a local commit is reported with replicationUnconfirmed: true and retryable: false (HarperFast/harper#3187). Apply the approved patch below, adjusting only what is needed to fit the current file and the repo's doc conventions.

Acceptance

Draft PR on HarperFast/documentation changing only reference/replication/sharding.md (plus any index/sidebar change the repo requires), using the repo's VersionBadge convention, building cleanly with the repo's docs build/lint. PR body links harper#3084 and harper#3187 and states the merge order.

Dispatch: task documentation-replicate-to-superuser-and-unconfirmed · queued by kriszyp-session · ran by claude/sonnet/xhigh · worker kzyp-xps-1

Review-Coverage: authored=claude; ran=gemini,codex,cursor-composer; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse,muse; rounds=6; full=2 @ a0c95c0

Review-Attention: skim ~2m (decisions: count-only-resource-example) @ a0c95c0

kriszyp and others added 2 commits October 20, 2026 08:15
…ommit outcome

X-Replicate-To and the operations API replicateTo/replicatedConfirmation
fields require super_user (harper#3084). A confirmation failure after a
local commit is reported with replicationUnconfirmed: true and
retryable: false (harper#3187).

Dispatch-Task: documentation-replicate-to-superuser-and-unconfirmed
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEQo4qTSsfyXTJf7JNQVsz
The sql operation never reads a body replicateTo or replicatedConfirmation,
so it is outside the verifyPerms guard by design; keep the claim to the
operations that consume them.

Dispatch-Task: documentation-replicate-to-superuser-and-unconfirmed
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEQo4qTSsfyXTJf7JNQVsz
gemini-code-assist[bot]

This comment was marked as resolved.

@github-actions
github-actions Bot temporarily deployed to pr-740 October 20, 2026 14:33 Inactive
@github-actions

Copy link
Copy Markdown

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-740

This preview will update automatically when you push new commits.

@kriszyp
kriszyp marked this pull request as ready for review October 20, 2026 15:24
@kriszyp
kriszyp requested a review from a team as a code owner October 20, 2026 15:24
Comment thread reference/replication/sharding.md Resolved
kriszyp and others added 3 commits October 23, 2026 11:27
The 403 notes now point to Programmatic Replication Control, whose example
shows the application deciding replication itself, and a sentence says that
copying client input into context.replicateTo or replicatedConfirmation hands
that client the control the super_user check removes.

Dispatch-Task: fix-kriszyp_documentation_740-efd46db4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… method

transaction() copies context.replicatedConfirmation onto the transaction
when it starts, and a REST request starts its transaction before the
resource method runs, so setting the count in put() was silently ignored.
The example now sets only replicateTo (read at write time) in the method and
shows the count passed to a new transaction() context.

Dispatch-Task: fix-kriszyp_documentation_740-efd46db4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… own

Dispatch-Task: fix-kriszyp_documentation_740-efd46db4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions
github-actions Bot temporarily deployed to pr-740 October 23, 2026 17:47 Inactive
@github-actions

Copy link
Copy Markdown

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-740

This preview will update automatically when you push new commits.

@Ethan-Arrowood Ethan-Arrowood left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-approving, but one necessary change and then this can merge.

Comment thread reference/replication/sharding.md Resolved
harper#3392 (in v5.4.0-alpha.1) makes replicatedConfirmation wait for
peers on LMDB too, through the same ReplicationConfirmationError path.

Dispatch-Task: fix-kriszyp_documentation_740-1169ad29
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Ethan-Arrowood
Ethan-Arrowood merged commit f5d1d9c into main Nov 2, 2026
12 of 13 checks passed
@Ethan-Arrowood
Ethan-Arrowood deleted the docs/replicate-to-super-user-and-unconfirmed-commit branch November 2, 2026 22:19
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🧹 Preview Cleanup

The preview deployment for this PR has been removed.

kriszyp added a commit that referenced this pull request Nov 2, 2026
The Confirmation Failure After a Local Commit section in sharding.md
(from #740) is the one place that explains replicationUnconfirmed and
retry safety. Replace the restatement in residency.md with a short link,
and point the API reference and 5.4 release note at that section rather
than the LMDB-only Confirmation outcomes section.

Dispatch-Task: docs-753-rebase-20261102
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem
Ethan-Arrowood pushed a commit that referenced this pull request Nov 2, 2026
* Document declarative slot residency and conversion

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: state application branch residency limitation

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: make conversion steps and example independently readable

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: limit online residency adoption to key policies

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify shard agreement for legacy wire fallback

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: require replica drain before residency downgrade

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: state the slot-map precedence over replicateTo

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Complete residency references and verified rollback procedure

Document conditional shard configuration, initialization and verification operations, status diagnostics and schema metadata. Give operators an executable replica-drain procedure and require custom-map installation before declarative application deployment on joining nodes.

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify initialization and conversion boundaries

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify residency prerequisites and confirmation behavior

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify confirmation failures and unknown slot deletion

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Clarify single-key reads and unknown-slot deletion guidance

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Document residency quarantine, writer replicas and confirmation timeouts

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Connect replica lifetime settings to declarative writer caches

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Clarify quarantined declarations and audit blob retention costs

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Clarify residency activation and transaction confirmation examples

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Link the subscription projection limitation directly

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: link confirmation outcomes directly

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify new-owner confirmation scope

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Document database-wide sharding and regional slot expressions

Explain hashed tenant affinity, logical regional slots, immutable policy, older residency APIs, and the spread follow-up in #1122.

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: define sharded recovery and existing-owner admission

Dispatch-Task: hp-980-slot-residency

Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: preserve ordinary writes during sharding root recovery

Dispatch-Task: hp-980-slot-residency

Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: clarify sharding placement and recovery boundaries

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: explain local-only slot transition refusal

Describe the application-only refusal before native submission, internal apply exemptions, ordinary local-only behavior and affected-database rollback boundary.

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Clarify local-only writer replica retention

Dispatch-Task: hp-980-slot-residency

Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Document the attribute-slot retry gap and marker-gated refusal

Dispatch-Task: hp-980-slot-residency

Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Clarify the binding affected by the attribute-slot retry gap

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* docs: describe the 5.4 abort-marker default and minimal retry fallback

Dispatch-Task: hp-980-slot-residency

Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Document primary-key sharding and defer concurrent attribute moves

Dispatch-Task: hp-980-slot-residency
Co-Authored-By: GPT-5 Codex <noreply@openai.com>

* Remove leftover attribute admission prose and clarify key conversion eligibility

Dispatch-Task: hp-980-slot-residency
Dispatch-Task: docs-753-rebase-20261028
Dispatch-Task: pr-maint-2615cc297c5c7e582179e0c7f65fb1b3
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Co-Authored-By: Gemini <noreply@google.com>

* Point confirmation-failure guidance at the single explanation

The Confirmation Failure After a Local Commit section in sharding.md
(from #740) is the one place that explains replicationUnconfirmed and
retry safety. Replace the restatement in residency.md with a short link,
and point the API reference and 5.4 release note at that section rather
than the LMDB-only Confirmation outcomes section.

Dispatch-Task: docs-753-rebase-20261102
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem

* Correct what the rowFilter warnings say a subscriber can learn

Non-owner invalidation payloads carry only indexed fields, so the exposure
a negated predicate creates is a record's id and indexed fields, not an
unindexed value. Match the wording in residency.md on the resource API and
schema pages.

Dispatch-Task: docs-753-rebase-20261102
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem

---------

Co-authored-by: GPT-5 Codex <noreply@openai.com>
Co-authored-by: Gemini <noreply@google.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants