- Send-side residency: every non-resident receives current stubs unless residency is by id; capability-gated copy frames preserve stubs, and GET_RECORD distinguishes not resident from absence, and RocksDB reads keep a local replica instead of relocating (never on a by-id table, nor with
replicaExpiration: 0); LMDB reads remain proxies. - A clone copies filesystem-only applications as the leader packaged them:
node_modulesincluded from a leader that streams it (5.2.3+ over HTTP); an application it cannot copy keeps the clone Unavailable and uncloned. - Removed-origin history: membership removal preserves audit history, origin mappings and resume cursors; retention purges eligible segments independently.
- Replication base-copy compatibility: reported 5.x peers receive historical copies; v4 and unidentified peers retain baseline verification.
- A release cherry-pick skips a change its branch already has (
workflows/cherry-pick-patch.yml,.github/scripts/change-landed.sh) — skip only when one pick of the PR's whole net change would be empty; replaying a landed PR commit by commit conflicts instead. - Release backport verification: milestone targeting and the publication gate.
- Analytics CPU profiling: one-period sampling window before each capture, and the
profiler-samplingmarker for theutilizationsamples it inflates - The release tarball bundles the locked JavaScript tree, never a host binary: core's bundler with pro's native roots unbundled, the dev/prod declaration rule, and what still floats.
- A core sync warns when it drops content the committed pointer has: the sync always proceeds;
core-sync-guard.sh's warning (dropped commits and diffstat) leads the Sync Core PR body; detection is the seam test and the cluster shards, prevention is at the merge step. - A YCSB trend point is published only from a turbo-off host: the bench runner owns turbo (off per job, on when idle); the nightly checks sysfs itself and skips the publish when the CPU was not at base clock.
- A marker-free PR is green only if every submodule pointer it moves is settled (
workflows/companion-check.yaml): settle branch is the base-named submodule branch else its default; patchless file entries are decided by the head tree; unreadable is pending. - Release-candidate CI gate: pinned candidate SHAs, per-job workflow evidence, and the override.
- Startup dependencies: packages the built-in components load only on first use.
Every thread loads the built-in components (HARPER_BUILTIN_COMPONENTS in bin/harper.js), so a package they import at the top level costs each thread heap even when the feature that needs it never runs. lmdb also allocates a 16 MB native buffer per thread on load. As in core (see the lazy-loading paragraph of core/AGENTS.md), lmdb loads on first use at the LMDB-only call site, node-forge through loadForge() in security/certificate.ts, and lodash is imported per method (lodash/cloneDeep.js) rather than as the full build. Type-only imports must be import type, because type stripping keeps import { type X } as a runtime load.
unitTests/startupDependencies.test.mjs loads the built-in component entry points listed in bin/harper.js in a fresh process and fails if any of these packages lands in the require cache. It requires Pro's own entry modules (replication, license, analytics, secretCustody, waf) and what they transitively import, so it passes only when those modules' core imports defer them as well; core's own built-in components are covered by a separate core test.