Repository navigation
Document super_user-only replication directives and the unconfirmed-commit error - #740
Merged
Ethan-Arrowood merged 6 commits intoNov 2, 2026
Conversation
…ommit outcome X-Replicate-To and the operations API replicateTo/replicatedConfirmation fields require super_user (harper#3084). A confirmation failure after a local commit is reported with replicationUnconfirmed: true and retryable: false (harper#3187). Dispatch-Task: documentation-replicate-to-superuser-and-unconfirmed Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KEQo4qTSsfyXTJf7JNQVsz
The sql operation never reads a body replicateTo or replicatedConfirmation, so it is outside the verifyPerms guard by design; keep the claim to the operations that consume them. Dispatch-Task: documentation-replicate-to-superuser-and-unconfirmed Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KEQo4qTSsfyXTJf7JNQVsz
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-740 This preview will update automatically when you push new commits. |
dawsontoth
reviewed
Oct 23, 2026
The 403 notes now point to Programmatic Replication Control, whose example shows the application deciding replication itself, and a sentence says that copying client input into context.replicateTo or replicatedConfirmation hands that client the control the super_user check removes. Dispatch-Task: fix-kriszyp_documentation_740-efd46db4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… method transaction() copies context.replicatedConfirmation onto the transaction when it starts, and a REST request starts its transaction before the resource method runs, so setting the count in put() was silently ignored. The example now sets only replicateTo (read at write time) in the method and shows the count passed to a new transaction() context. Dispatch-Task: fix-kriszyp_documentation_740-efd46db4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… own Dispatch-Task: fix-kriszyp_documentation_740-efd46db4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dawsontoth
approved these changes
Oct 23, 2026
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-740 This preview will update automatically when you push new commits. |
Ethan-Arrowood
approved these changes
Nov 2, 2026
Ethan-Arrowood
left a comment
Member
There was a problem hiding this comment.
Pre-approving, but one necessary change and then this can merge.
harper#3392 (in v5.4.0-alpha.1) makes replicatedConfirmation wait for peers on LMDB too, through the same ReplicationConfirmationError path. Dispatch-Task: fix-kriszyp_documentation_740-1169ad29 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ethan-Arrowood
deleted the
docs/replicate-to-super-user-and-unconfirmed-commit
branch
November 2, 2026 22:19
🧹 Preview CleanupThe preview deployment for this PR has been removed. |
kriszyp
added a commit
that referenced
this pull request
Nov 2, 2026
The Confirmation Failure After a Local Commit section in sharding.md (from #740) is the one place that explains replicationUnconfirmed and retry safety. Replace the restatement in residency.md with a short link, and point the API reference and 5.4 release note at that section rather than the LMDB-only Confirmation outcomes section. Dispatch-Task: docs-753-rebase-20261102 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem
Ethan-Arrowood
pushed a commit
that referenced
this pull request
Nov 2, 2026
* Document declarative slot residency and conversion Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: state application branch residency limitation Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: make conversion steps and example independently readable Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: limit online residency adoption to key policies Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify shard agreement for legacy wire fallback Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: require replica drain before residency downgrade Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: state the slot-map precedence over replicateTo Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Complete residency references and verified rollback procedure Document conditional shard configuration, initialization and verification operations, status diagnostics and schema metadata. Give operators an executable replica-drain procedure and require custom-map installation before declarative application deployment on joining nodes. Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify initialization and conversion boundaries Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify residency prerequisites and confirmation behavior Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify confirmation failures and unknown slot deletion Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Clarify single-key reads and unknown-slot deletion guidance Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Document residency quarantine, writer replicas and confirmation timeouts Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Connect replica lifetime settings to declarative writer caches Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Clarify quarantined declarations and audit blob retention costs Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Clarify residency activation and transaction confirmation examples Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Link the subscription projection limitation directly Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: link confirmation outcomes directly Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify new-owner confirmation scope Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Document database-wide sharding and regional slot expressions Explain hashed tenant affinity, logical regional slots, immutable policy, older residency APIs, and the spread follow-up in #1122. Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: define sharded recovery and existing-owner admission Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: preserve ordinary writes during sharding root recovery Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: clarify sharding placement and recovery boundaries Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: explain local-only slot transition refusal Describe the application-only refusal before native submission, internal apply exemptions, ordinary local-only behavior and affected-database rollback boundary. Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Clarify local-only writer replica retention Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Document the attribute-slot retry gap and marker-gated refusal Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Clarify the binding affected by the attribute-slot retry gap Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * docs: describe the 5.4 abort-marker default and minimal retry fallback Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Document primary-key sharding and defer concurrent attribute moves Dispatch-Task: hp-980-slot-residency Co-Authored-By: GPT-5 Codex <noreply@openai.com> * Remove leftover attribute admission prose and clarify key conversion eligibility Dispatch-Task: hp-980-slot-residency Dispatch-Task: docs-753-rebase-20261028 Dispatch-Task: pr-maint-2615cc297c5c7e582179e0c7f65fb1b3 Co-Authored-By: GPT-5 Codex <noreply@openai.com> Co-Authored-By: Gemini <noreply@google.com> * Point confirmation-failure guidance at the single explanation The Confirmation Failure After a Local Commit section in sharding.md (from #740) is the one place that explains replicationUnconfirmed and retry safety. Replace the restatement in residency.md with a short link, and point the API reference and 5.4 release note at that section rather than the LMDB-only Confirmation outcomes section. Dispatch-Task: docs-753-rebase-20261102 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem * Correct what the rowFilter warnings say a subscriber can learn Non-owner invalidation payloads carry only indexed fields, so the exposure a negated predicate creates is a record's id and indexed fields, not an unindexed value. Match the wording in residency.md on the resource API and schema pages. Dispatch-Task: docs-753-rebase-20261102 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017xoBAASx3a6cCDKgFGeZem --------- Co-authored-by: GPT-5 Codex <noreply@openai.com> Co-authored-by: Gemini <noreply@google.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
⊙ Problem
Harper v5.4.0 changes two replication behaviors the sharding page does not describe. Require a super user for X-Replicate-To and the operations API replicateTo/replicatedConfirmation fields returns HTTP 403 to other callers. Distinguish replication confirmation failure from a local write failure marks a failed confirmation after a local commit with
replicationUnconfirmed: trueandretryable: false. Retrying callers must know the write landed.🤔 Is the page ready now that both harper PRs have merged?
Yes. Both merged to
mainwith milestone v5.4, and the newest harper tag is v5.3.3, so the v5.4.0 badges hold. A 5.4 release-notes entry is not included, because the task limited this PR to the sharding page.💡 Solution
In
reference/replication/sharding.md, tagged v5.4.0:X-Replicate-Toneedssuper_user; others get 403.replicateToandreplicatedConfirmation, for the operations that accept them.replicationUnconfirmedmeans, an example error, and why not to retry blindly.replicateToset in a resource method,replicatedConfirmationthrough a newtransaction()context, and a warning against copying request input. The old example's count insideput()did nothing.🤔 Which wording wins where this PR and #723 disagree?
Clarify confirm/replicatedConfirmation any-N semantics in the sharding docs edits the same file. Its text says a too-large confirmation count is rejected after the write took effect locally. Harper main refuses it before the write lands, and this PR says so. Whichever merges second needs a small rebase and one corrected sentence.
🤔 Badge at the start of a paragraph, or plain "As of v5.4.0"?
Gemini suggested plain text for the two "changed" notes. I kept the badge: the approved patch used it, and 21 other reference paragraphs open the same way. The new section's badge sits on its own line under its heading, as CONTRIBUTING.md describes. Switching is a two-line edit.
✅ Verification
npm run buildpasses andprettier --checkis clean.replication/knownNodes.ts.main:resources/transaction.tscopiesreplicatedConfirmationonly when a transaction starts, andTable.getResidencyreadscontext.replicateToat write time. Thetransaction()example follows harper'sreplicationConfirmationOutcometests.confirmReplicationAfterCommitpath (resources/LMDBTransaction.ts).v5.4.0-alpha.1.Depends-on: harper#3084, harper#3187
🤖 Generated by Claude Sonnet 5.5 via Claude Code (session); posted via @kriszyp.
Related PRs: #723 overlaps (same page; adjacent insertions after the programmatic example), #753 overlaps (same page; edits the programmatic example and adds its own
replicationUnconfirmedparagraph, so whichever merges second keeps one copy)Complexity: medium
Origin — the dispatch brief this PR was written from
Open a draft PR in HarperFast/documentation that documents two Harper v5.4.0 replication changes in reference/replication/sharding.md: (1) X-Replicate-To and the operations API replicateTo/replicatedConfirmation fields now require super_user (HarperFast/harper#3084), and (2) a confirmation failure after a local commit is reported with replicationUnconfirmed: true and retryable: false (HarperFast/harper#3187). Apply the approved patch below, adjusting only what is needed to fit the current file and the repo's doc conventions.
Acceptance
Draft PR on HarperFast/documentation changing only reference/replication/sharding.md (plus any index/sidebar change the repo requires), using the repo's VersionBadge convention, building cleanly with the repo's docs build/lint. PR body links harper#3084 and harper#3187 and states the merge order.
Dispatch: task
documentation-replicate-to-superuser-and-unconfirmed· queued by kriszyp-session · ran by claude/sonnet/xhigh · worker kzyp-xps-1Review-Coverage: authored=claude; ran=gemini,codex,cursor-composer; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse,muse; rounds=6; full=2 @ a0c95c0
Review-Attention: skim ~2m (decisions: count-only-resource-example) @ a0c95c0