Release v0.19.0 - xchain-documentation - #40
Merged
Merged
Conversation
The wallet can now author an ORDER whose give and get coins sit on different chains. The feature list names the form, its token-only rule and the receive address on the get chain.
Adds the action page, the protocol pages, the bridge activation constants and the hub engine's configuration reads.
Adds the per-coin indexer endpoint rows and the escrow proof timeout, and raises the computed-read baseline for the coin-keyed lookups.
The helper-module figure in the e2e architecture and README pages moves from 53 to 57 for the bridge drills.
…itHub The literals suite reads the indexer registry as a sibling checkout and skipped on every push here, so the generated flag-day page could rot with the workflow green. The env-var coverage fleet floor now applies only when every sibling is present, because a one-sibling checkout surveys about a hundred reads and was accused of a broken scanner.
The canon constants mirror the per-chain map and the two bridge pages describe the slot each chain reads. (cherry picked from commit 523d3daede8b0a72c98f670249bfc4b817d9a1cd)
…he cut The notice floors now say plainly that they govern mainnet only. On testnet a consensus value goes live the instant the fleet runs the release, with the replay caveat stated once. (cherry picked from commit e9643fd95eda4e912efcdc467b5ceeb256f33737)
…rrival margin Adds the admission margins, the paired producer and consumer activation maps keyed by coin and network, and the 64800 s maturity-horizon margin, all inert on every network pending their sizing at the release cut. These are the canonical copies the hub and indexer twins are held value-identical to by the activation-constants parity suite.
The overview, introduction, metalayer, scope and whitepaper pages no longer say the platform has no bridge at all. They now name XBRIDGE, the protocol-native lock and mint that moves the platform's own XCHAIN token between supported chains with no wrapped asset and no custodian, while keeping the claim that trade settlement on the cross-chain rail stays bridgeless. (cherry picked from commit 21e5bbfb42e09af53bef3e431e0ef8123fae8351)
Assertions across the corpus stated rules the implementation does not carry: the activation inventory labelled six genesis-armed mainnet gates inert and omitted three testnet time gates, the wallet reference described mobile as the web shell and claimed passwords are never persisted despite biometric unlock, multisig payload capacity was stated on three incompatible bases, and the user guide promised unconditional unlimited supply and single-transaction dividends. The token-information standard published a schema rejecting the data_ref-only shape its own prose recommends, so v1.1.1 relaxes it while the published versions stay byte-identical. nft.tisDocument's imageType is documented as what it actually writes, a display role rather than a MIME type. From the 2026-09-12 review round.
The helper layer gained the bridge rail venue module, so the two published module counts move from 57 to 58 to match the tree the count check reads.
… sites it has One computed read became a named read when the numeric override validation landed, so the ratchet drops to match.
…etime settings Six hub settings read from the environment had no row on the configuration page.
… variables Add configuration rows for SYNC_META_RETENTION_INTERVAL_MS and SYNC_STATUS_MAX_AGE_MS, both read in xchain-sync but missing from the sync component's configuration reference. Values and defaults are read from xchain-sync/src/config.js.
The indexer split its monolithic src/db.js into src/db/index.js plus 57 mixins, so the supply-permanence guard's read of db.js no longer resolves and the suite would go red on the sibling checkout. The ledger formula the "outstanding at one time" wording rests on now lives in src/db/credits.js, so the assertion reads that one mixin rather than a concatenation of the tree, which would let the regex match in a file where the behavior does not live.
The indexer moved cross_settle, deploy and the loader into directories under src/actions, so the three documentation-truth guards that read those sources now open the new paths. Each guard was driven against the moved tree and falsified once by pointing it at a missing file.
…eaders The explorer split db.js into a composition root plus reader modules, so the default-constant and no-network-branch assertions now read src/db/readers/health.js, and a new case pins db.js to still composing it. A moved file now fails instead of skipping (the skip keys on the repo, not the file), and the guard also asserts the per-coin and global knobs the regtest guide documents are still read.
The explorer moved its two envPrefix reads out of db.js behind config.js's env view, so the scanner now counts seven computed sites where it counted eight. The comment records that the same keys are still read one hop further away, so the lower number is not mistaken for a smaller blind spot.
The responsible-set vector description named the indexer's two implementations by their old underscore-prefixed method names. It now names the renamed methods and leaves the hub's unchanged names as they were.
xchain-decoder moved its source and test files into feature directories with snake_case names, so the requires, paths and comments here that name them follow.
xchain-utxo-tracker moved its source and test files into feature directories with snake_case names, so the requires, paths and comments here that name them follow.
The decoder now reads XCHAIN_INDEXER_DIR from its reference-map tool, so the variable gets a row in its configuration page.
xchain-regtest-miner moved its source and test files into feature directories with snake_case names, so the requires, paths and comments here that name them follow.
…goes missing The endpoint-count and error-code registry gates now read the explorer's http/static_mounts.js and http/concurrency_gate.js, and the component and ABI pages name the new module paths. Both gates skip only when the explorer repository itself is absent; a missing pinned file now fails with its path instead of skipping or evaluating against an empty stand-in.
The coverage scanner now treats env.X, env['X'] and configInfo.env reads in the explorer as environment reads, so a variable read through config.js's live view keeps its doc row requirement, and the explorer's computed-read baseline rises to 9 as two hidden sites come back into view. The newly visible metrics and log-shipping variables get their rows on the explorer configuration page.
The explorer now logs listener failures as named events beside the Node errno, so a log call's event name no longer reads as a response code the registry owes a row. Every REST code the explorer returns is still collected, the same 33 as before its feature-directory move.
The coverage scanner now follows the read-time accessor the explorer's feature directories bind to config.js's env view, and reads taken straight off that module, so all 90 named explorer reads stay gated after the move. The accessor counts only in a file that binds it to the view, and the other components scan byte-identically.
The explorer architecture and configuration pages still listed the per-coin adapters under src/configs/, which the explorer folded into src/coin-config/.
Measured against hub origin f3401e34: 52671173 routed the anchor family's six computed env reads (checkpoint_engine/options.js, publisher/state.js, reorg_handler.js) through config.env(), one hop past what this scanner matches, so the count fell from 11 to 5. The ceiling only goes down; the test itself prescribes this value.
The hub pass drops the leading underscore from its private helper methods; the anchor canonical, the responsible-set rule and the oracle round prose now name them as the hub spells them. The anchor vector note stays with its byte-identical twin.
`node --test --test-force-exit` let a child process exit 0 while the tail of its event stream was still queued behind a full stdout pipe. The parent counted only what arrived, printed a summary short by 26 to 30 tests, and exited 0: under load the two hub-reading files read 146 to 168 tests where the tree holds 176, and the coverage suite's per-component cases were the ones never counted. A cut inside a message also spun the parent forever. Drop the flag: the suite finishes in about six seconds without it, and --test-timeout still bounds a hung test. Add bin/complete_run_reporter.js beside the tap reporter: it requires every file that ran to deliver its own test:summary (the last thing a child writes), checks that the per-file counts match what the parent saw and add up to the run total, and fails the run with one line per problem otherwise. Replaying the truncation with the flag put back reads 168 tests and exits 1 with the file named.
…ck every decoder The clear-reorg-halt section now says --dry-run needs no --reason, so an operator can read the verdict before composing one. It also tells whoever finds one REORG_HALT marker to run xchain-node ps and check every decoder on the box, since a deep reorg on one chain often halts the others too.
…state Every page that stated the reorg recovery window now gives the per-network table (mainnet and regtest BTC 12, LTC 120, DOGE 120; every testnet 120), replacing the stale LTC 48. The tracker operations page says what an exhausted window does: the tracker halts in place, /status answers 503 with halted, halt_reason, halted_at and halted_height, a restart reproduces it, and the recovery is xchain-node reset xchain-utxo-tracker or a current bootstrap, never the same drifted one.
A BTC indexer on a network with a roll-call activation proves each epoch's signatures from a Dogecoin indexer before closing it, and defers every block from the first close without DOGE_INDEXER_API_URL; a hub without it publishes nothing and says nothing, and its validator is recorded absent. The validator guides now carry the wiring step, the consequence and two troubleshooting rows, and the indexer and hub configuration pages name the public explorer read (explorer.xchain.io/TDOGE/api/ on testnet, /DOGE/api/ on mainnet) for a validator without its own Dogecoin indexer.
… exit status On a Raspberry Pi 5 the firmware injects cgroup_disable=memory ahead of cmdline.txt, so the appended enable wins while the disable stays visible in /proc/cmdline; judge the fix by docker inspect and the tracker boot line. The multi-chain disk section is restated around page cache: at idle with page cache intact the trackers read nothing, and the cliff comes when another process evicts it, so the tracker memory cap is what leaves the host its page cache. The node operations page gains an exit status section and the note that $? after a pipe is the last command's status.
…DERATION_READ_KEY The node configuration page gains the override that lets a deploy proceed without a Dogecoin read on an armed roll-call network, and the explorer configuration page gains the key that gates the federation reads served off its replicated indexer databases.
The command table showed --reason as always required. It now shows the option in brackets and says a dry run, which only reports the verdict, needs no reason.
…r its constants part
…ASELINE 7 -> 6 The hub-mirror client split (xchain-indexer c3000819, vendored into xchain-explorer 7b2a28e3 and xchain-indexer 29a1b18e) consolidated 11 scattered process.env reads across hub_db_sync.js's methods into one vendored reader, src/hub/hub_db_sync/env.js, whose single readEnvNow(key) is now the sole computed-read site every caller goes through. Lowered because the count fell, not because the unscannable surface shrank.
…ndex.js xchain-indexer moved src/rollback.js to src/rollback/index.js (rollback code-structure pass); follow the path in the architecture doc's file table.
…te.js The operator migration CLI moved from src/migration/migrate.js to src/db/migration/migrate.js in the indexer's code-structure pass, so the architecture table entry and the MIGRATION_STRICT_CHECKSUM configuration note now cite the new path. No other text on either line changes.
…ime readEnvNow accessor
…ines for the carrier logic pin
… raise the computed-read baselines XCHAIN_INDEXER_DIR, XCHAIN_SYNC_DIR and XCHAIN_HUB_DIR are the twin-checkout overrides bin/lib/carrier_logic_pin.js reads by computed name (activation-registry row 27), and the indexer identity tool compares its pin's armed env block by computed key (row 6), so the computed-read baselines move to hub 6, indexer 8 and sync 11 deliberately.
…arts The SDK's structure pass moved the action shorthands out of XChainSDK.js into src/XChainSDK/*.js parts that installMethods() attaches to the prototype, so scanning the entry alone found none of them. Read the entry plus its parts with the same readModuleSource helper already used for the session surface below, which also keeps the reading correct against a checkout that predates the split.
…D76) The twinned activation carriers become byte copies of the indexer's shims, reading their tables from src/consensus/gate_registry (the consumer core and the SHARED part files, whole-file twins of the hub's and the indexer's). Every table value is unchanged (activation-registry row 15). protocol/reference-impl carries the registry beside its three vendored carriers.
… generator and the action guards The generator reads the entry plus every src/protocol_changes/*.js, the array rows and the addGate time rows, naming the part file a row is declared in; the action-activation model and XBRIDGE registration guards load the indexer's registry module and read its 97 changes instead of regexing the old single file. The sdk's three regtest arming variables gain their configuration entries (activation-registry rows 11, 12, 15).
…the collector twin Adds the Activation Registry configuration rows the sdk page gained in row 15b, and the byte-identical shared_rows.js under protocol/reference-impl (D80).
…sify, and repoint the one moved e2e citation GitHub CI checks out exactly one sibling (xchain-indexer), so the bare-path grammar, which classifies against a component checkout's top-level entries, finds nothing for the other components and the scan read "only 131 references found; the scanner is probably broken" (runs 35027898489 and 35048431550) on a floor measured in the full platform checkout. The floor now has two parts: the repo-qualified corpus (needs no sibling, judged everywhere, 80 of a measured 133) and the whole-corpus floor (unchanged at 300 into 8 repos), judged where every declared component sibling is present and otherwise skipped NAMING the absent trees; under XCHAIN_REQUIRE_SIBLINGS=1, the platform venue, an absent declared sibling still throws first. The e2e-test README's actionSuiteCount.test.js citation follows the snake_case rename.
… nine non-twin activation files W4 retired; arming variables documented by name (activation registry row 19, P5) protocol-activation.md names the registry key or the <feature>/<stem>_gate.js path for each of the nine non-twin citations; the hub, indexer and sync configuration pages carry the XCHAIN_<NAME>_DIR arming variables and their sibling _DIR rows.
…es after the carrier logic pin reads its directory variables by name (activation registry P3)
Version 0.19.0, the 0.19.0 changelog section, the canonical TRAIN_ACTIVATION 0.19.0 row (testnet 152716) and the three per-chain testnet XCHAIN_BRIDGE_ACTIVATION heights (BTC 152795, LTC 4887694, DOGE 67900889) sized 2026-09-16 from the chain tips and their measured cadences, and the reference-impl registry part shared_rows_5.js re-vendored byte-identical from the indexer.
The first sizing (11:53Z) put the train boundary at TBTC 152716 and the chain reached it at 16:33Z on 2026-09-16 while the cut was still waiting on the e2e matrix, so the release gate's H_TRAIN > T_BTC no longer held. Re-cut from the tips and last-99-block cadences read in one sitting at 16:33Z with a 10 h lead (the origin at 3x): TRAIN_ACTIVATION 0.19.0 testnet 152787 (TBTC 152716 + 71 at 508.8 s/blk, about 10.0 h), XCHAIN_BRIDGE_ACTIVATION BTC:testnet 152929 (TBTC 152716 + 213, about 30.1 h, the origin, last), LTC:testnet 4887898 (TLTC 4887644 + 254 at 141.8 s/blk, about 10.0 h), DOGE:testnet 67902062 (TDOGE 67900748 + 1314 at 27.4 s/blk, about 10.0 h). Mainnet stays the sentinel and regtest 0. The pins and the tests that carry the literals follow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the package and lockfile to 0.19.0 and folds the Unreleased block into a dated 0.19.0 entry. The train carries the XBRIDGE cross-chain bridge, armed on testnet by the ladder and on mainnet at the sentinel, with the token bridge and policy code dark behind their sentinels, the rollcall and tracker fixes, the code-structure passes with the consensus identity pinned, and the activation registry. The testnet ladder is TRAIN 152716, BTC bridge 152795, LTC 4887694 and DOGE 67900889, sized 2026-09-16 11:53Z.
Platform notes ride xchain-node's Release.