fix: address v3.3.0 audit findings

Author: rockyshi1993

README.md

@@ -332,18 +332,33 @@ Relative model paths are resolved from `process.cwd()`. In production services,
 Model-declared indexes are still created automatically by default for backward compatibility. Production services can turn off automatic indexing and run an explicit preflight before creating missing indexes:
 
 ```js
+const MonSQLize = require('monsqlize');
+
+async function main() {
+MonSQLize.Model.define('users', {
+  schema: { email: 'email!' },
+  indexes: [{ key: { email: 1 }, unique: true }]
+});
+
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'mydb',
   config: { uri: 'mongodb://localhost:27017' },
   autoIndex: false
 });
 
-const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
-
-if (plan.totals.conflicts === 0) {
-  await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+try {
+  await msq.connect();
+  const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
+  if (plan.totals.conflicts === 0) {
+    await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+  }
+} finally {
+  await msq.close();
 }
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 `ensureModelIndexes()` creates only missing indexes. It does not drop, rename, or rebuild conflicting indexes.
@@ -449,6 +464,8 @@ Transaction cache invalidations are recorded during the transaction and flushed
 ### Connection Pools
 
 ```js
+const MonSQLize = require('monsqlize');
+async function main() {
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'main',
@@ -458,7 +475,16 @@ const msq = new MonSQLize({
   ]
 });
 
-const reports = msq.pool('analytics').collection('reports');
+try {
+  await msq.connect();
+  const reports = msq.pool('analytics').collection('reports');
+  console.log(await reports.countDocuments({}));
+} finally {
+  await msq.close();
+}
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 ### Change Streams

docs/en/cache-invalidation.md

@@ -2,6 +2,8 @@
 
 Read caching is opt-in per query, and write invalidation is opt-in per write or per runtime configuration.
 
+Distributed invalidation received from another instance clears local cache entries without publishing another invalidation. Locally initiated invalidation still publishes normally, so concurrent local writes and incoming messages are handled independently.
+
 ## Default Behavior
 
 Writes do not invalidate read caches by default:

docs/en/count-queue.md

@@ -2,6 +2,8 @@
 
 ## Overview
 
+For direct `CountQueue.execute(task, { signal })` calls, an aborted queued task is removed before execution. Timeout or caller abort rejects the caller and aborts the task signal, but the running slot remains occupied until the underlying task actually settles. Tasks that ignore abort can therefore keep a slot occupied.
+
 Count queue control is an advanced feature of monSQLize that limits the number of `countDocuments` operations that can be executed simultaneously.
 
 

docs/en/data-tasks.md

@@ -2,6 +2,8 @@
 
 `dataTasks` uses one `DataTaskJob` configuration for release-scoped index checks, filtered data synchronization, local field edits, reviewed preview, affected-scope backup, and restore.
 
+Backup manifests and data rows are read as canonical EJSON. Only manifest control fields (`version`, `entryCount`, `maxBytes`) are converted from safe numeric BSON values to JavaScript numbers. Identity, target IDs, before/after images, and index keys retain their BSON types and key order. An unsafe or ambiguous legacy control value fails backup validation instead of being guessed.
+
 Start with [Production Data Migration](./production-data-migration.md) to choose the right tool. See [Production Rollout](./production-rollout.md) for the complete release sequence.
 
 ## Entry Point and Four Methods

docs/en/deleteBatch.md

@@ -2,6 +2,8 @@
 
 ## API parameter description
 
+The original business filter is checked again for each selected document at write time. A document that changed before deletion is skipped. After a fatal batch error, workers stop acquiring new batches and wait for in-flight batches to settle before returning the error.
+
 ## Method signature
 
 ```typescript

docs/en/model.md

@@ -2,6 +2,8 @@
 
 The Model layer adds schema validation, custom methods, lifecycle hooks, relations, and model-scoped write helpers on top of the MongoDB runtime. It keeps collection access explicit while giving repeated document workflows a consistent Model surface.
 
+Migration note for 3.3.0 fixes: hydrated `remove()` now follows Model delete hooks and soft-delete rules. Boolean soft delete treats only `true` as deleted; `false`, `null`, and a missing field remain visible. Strict versioned updates enumerate all matching candidates without the public `find` limit, and classify a changed business filter or removed document as skipped rather than a version conflict. Populate `skip`/`limit` is applied per parent; an unlimited populate can retain a large result in memory.
+
 **Features**: Schema validation · Custom methods · Lifecycle hooks · Automatic indexing · Data source binding
 
 ---
@@ -134,7 +136,7 @@ Model.define('users', {
             username: 'string:3-32!',
             email: 'email!',
             password: 'string!',
-            role: this.enums.role.default('user')
+            role: s(this.enums.role).default('user')
         });
     },
     methods: (model) => ({
@@ -843,7 +845,7 @@ schema: function(s) {
         username: 'string:3-32!',
         email: 'email!',
         age: 'number:0-120',
-        role: this.enums.role.default('user')  //Reference enums
+        role: s(this.enums.role).default('user')  //Reference enums
     });
 }
 
@@ -1029,7 +1031,7 @@ enums: {
 //Referenced in schema
 schema: function(s) {
     return s({
-        role: this.enums.role.default('user')
+        role: s(this.enums.role).default('user')
     });
 }
 ```
@@ -1052,10 +1054,10 @@ Model.define('users', {
         return s({
             username: 'string:3-32!',
             email: 'email!',
-            password: 'string!'.pattern(/^[a-zA-Z0-9]{6,30}$/),
-            role: this.enums.role.default('user'),
-            status: this.enums.status.default('active'),
-            loginCount: 'number'.default(0),
+            password: s('string!').pattern(/^[a-zA-Z0-9]{6,30}$/),
+            role: s(this.enums.role).default('user'),
+            status: s(this.enums.status).default('active'),
+            loginCount: s('number').default(0),
             lastLoginAt: 'date',
             createdAt: 'date!',
             updatedAt: 'date!'

docs/en/multi-pool.md

@@ -2,6 +2,8 @@
 
 ## Introduction
 
+Opening pools reserve capacity before the client factory completes. Closing the manager rejects new additions, waits for pending additions, and closes clients that finish opening after shutdown began.
+
 Use this page when your application needs more than one MongoDB connection, such as a primary pool plus read replicas, an analytics pool, or tenant-specific pools. The recommended runtime path is to declare pools when creating the `MonSQLize` instance:
 
 - `pools: PoolConfig[]` defines named connection pools.

docs/en/ssh-tunnel.md

@@ -2,6 +2,8 @@
 
 ## Function Overview
 
+`ssh.hostHash` and `ssh.hostVerifier` are optional ssh2 host-key verification settings. With `hostHash: 'sha256'`, the verifier receives a hexadecimal SHA-256 fingerprint; returning `false` rejects the handshake and closes the tunnel listener. If no verifier is configured, the previous ssh2 default behavior is retained.
+
 ## What is an SSH tunnel?
 
 SSH Tunneling, also known as SSH port forwarding, is a technology that establishes an encrypted channel between local and remote servers through the SSH protocol.

docs/en/transaction.md

@@ -4,6 +4,8 @@
 
 monSQLize wraps MongoDB driver sessions with `withTransaction()` and `startSession()` helpers. The ACID boundary is MongoDB's transaction/session boundary; monSQLize adds retry, timeout, statistics, and cache-invalidation coordination around that driver behavior.
 
+Managed transaction writes stop being accepted as soon as commit or abort begins, including lazy aggregate writes and batch subwrites. An unknown commit result retries commit without rerunning the business callback; errors after a successful commit also do not rerun it. Native sessions passed directly to the MongoDB driver keep their native behavior.
+
 
 ## Core Features
 

docs/en/updateBatch.md

@@ -2,6 +2,8 @@
 
 ## API parameter description
 
+Each selected document is checked against the original business filter again when its write is dispatched. Documents that no longer match are skipped. On a fatal batch error, no new batch is acquired; already running batches finish before the error is returned. For strict Model updates, `conflictCount` refers to a version mismatch, while a changed filter or concurrent deletion is counted as skipped.
+
 ## Method signature
 
 ```typescript