jdogresorg · Sep 24, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026
diff --git a/.env.example b/.env.example
@@ -19,18 +19,21 @@ HUB_PORT=10000
 # startup. ALWAYS set a strong random value in production. See
 # CONFIGURATION.md "Silent-failure variables".
 HUB_API_KEY=your-strong-api-key-here
-# Optional: requests per minute per client (default 100). Does NOT cover the
+# Optional: requests per minute per client without a hub key (default 100, on
+# every role). A JSON-RPC batch costs one token per call. Does NOT cover the
 # mirror-bootstrap routes, which carry their own budget below.
 # HUB_RATE_LIMIT_RPM=100
+# Optional: requests per minute per client presenting a configured hub key in
+# x-api-key (default 60000): the fleet's own indexer push and replay traffic.
+# HUB_AUTH_RATE_LIMIT_RPM=60000
 # Optional: requests per minute per client on /hub-db/snapshot/* (default 600).
 # A mirroring indexer bootstrapping from id 0 spends about 30 page reads per
 # table set, in a burst, and it must not compete with ordinary polling for the
 # budget above; that is what wedged the testnet mirrors on 2026-09-16.
 # HUB_SNAPSHOT_RATE_LIMIT_RPM=600
-# Optional: maximum JSON-RPC calls in one batch array (default 20). The limit
-# above charges a whole batch ONE token while the router dispatches every
-# element concurrently, so without this cap one request fans out into hundreds
-# of handlers on the shared DB pool. Over the cap the hub answers 400 / -32600.
+# Optional: maximum JSON-RPC calls in one batch array (default 20). The router
+# dispatches every element concurrently, so without this cap one request fans
+# out into hundreds of handlers on the shared DB pool. Over the cap the hub answers 400 / -32600.
 # HUB_MAX_RPC_BATCH=20
 # Optional: allowed CORS origin(s) (default disabled). `*` allows any origin;
 # otherwise give one origin, or a comma-separated allowlist matched per-origin.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.1] - 2026-09-23
+
+### Fixed
+- Re-slid BTC/DOGE testnet activations with LTC inert; canonical admission is non-throwing, and INERT legacy-signature mismatches stay on the invalid-row path.
+
+
+### Changed
+- The attestation batch publisher's `quarantinedWindows` statistic now counts only quarantines inside the current catch-up horizon. Dashboards keyed to the previous all-history count may see a one-time decrease after upgrade.
+
 ## [0.20.0] - 2026-09-17
 
 ### Changed

diff --git a/CONFIGURATION.md b/CONFIGURATION.md
@@ -84,10 +84,11 @@ signatures.
 | `HUB_API_KEY` | **Prod** | _empty_ | API key required on write requests and WS upgrades when set. **Empty means the hub refuses to boot unless `HUB_ALLOW_UNAUTHENTICATED=true` - see above.** |
 | `HUB_ALLOW_UNAUTHENTICATED` | No | _unset_ | Declares that this hub knowingly runs with an unauthenticated write surface. Only consulted when `HUB_API_KEY` is empty. |
 | `HUB_CONSENSUS_INPUT_ALERT_AFTER` | No | `3` | Consecutive consensus-input fetch failures before the hub alerts and `/health` reports degraded. |
-| `HUB_RATE_LIMIT_RPM` | No | `100` | Requests per minute per client IP, on every route EXCEPT `/hub-db/snapshot/*` (see below). Over the limit the hub answers `429` with a JSON-RPC error body (code `-32029`) naming the limit, the window and the wait, alongside `Retry-After` and `RateLimit-*` headers. |
+| `HUB_RATE_LIMIT_RPM` | No | `100` | The PUBLIC budget: requests per minute per client IP for callers without a hub key, on every route EXCEPT `/hub-db/snapshot/*` (see below), on every role including a validator hub. A JSON-RPC batch costs one token per call, not one per HTTP request. Over the limit the hub answers `429` with a JSON-RPC error body (code `-32029`) naming the limit, the window and the wait, alongside `Retry-After` and `RateLimit-*` headers. |
+| `HUB_AUTH_RATE_LIMIT_RPM` | No | `60000` | The AUTHENTICATED budget: requests per minute per client IP for callers whose `x-api-key` matches `HUB_API_KEY`, `HUB_REORG_API_KEY` or `HUB_CONFIG_SECRETS_API_KEY`, metered in its own bucket so the fleet's indexer push and replay traffic keeps the fleet value without lifting the throttle for keyless callers. A wrong key is metered as public. Batches are charged per call here too. Never defaults below `HUB_RATE_LIMIT_RPM`; an unparseable or non-positive value keeps the default. A keyless hub has no authenticated tier. |
 | `HUB_SNAPSHOT_RATE_LIMIT_RPM` | No | `600` | Requests per minute per client IP on the mirror-bootstrap routes `/hub-db/snapshot/*`, metered in their OWN bucket so a bootstrapping indexer and ordinary polling cannot starve each other. Sized to the measured drain: about 30 page reads for one mirror's full ten-table bootstrap, about 96 for three mirrors behind one address, retried every 30s while any mirror is still draining. Over the limit the hub answers `429` in the `{ "error": ... }` shape these REST routes already use. An unparseable or non-positive value keeps the default. |
 | `HUB_RATE_LIMIT_EXEMPT_LOCAL` | No | `true` | Exempts loopback and private-range (RFC1918 / IPv6 ULA / link-local) callers from the per-IP limit, so a node's own indexer can rebuild price history from the chain at the shipped default instead of needing the limit raised by hand. Keyed on the post-`trust proxy` client IP, so a public caller behind a private-IP proxy is still limited. Set `false` to enforce the cap on every caller. |
-| `HUB_MAX_RPC_BATCH` | No | `20` | Maximum JSON-RPC calls in one batch array. The router dispatches every element concurrently while the rate limit above charges the whole batch one token, so an uncapped batch amplifies one request into hundreds of DB-touching handlers. Over the cap the hub answers `400` with JSON-RPC error `-32600`. An unparseable or non-positive value keeps the default. |
+| `HUB_MAX_RPC_BATCH` | No | `20` | Maximum JSON-RPC calls in one batch array. The router dispatches every element concurrently, so an uncapped batch amplifies one request into hundreds of DB-touching handlers; the rate limits above charge each element, and this caps the count outright. Over the cap the hub answers `400` with JSON-RPC error `-32600`. An unparseable or non-positive value keeps the default. |
 | `CORS_ORIGIN` | No | `false` | Allowed CORS origin(s); unset disables cross-origin requests. `*` allows any origin, or give one origin or a comma-separated allowlist matched per-origin (browser wallet shells each send a different origin). A stray `*` inside a list is not a wildcard, so the grant fails closed. |
 
 ## Database (MariaDB)

diff --git a/Dockerfile b/Dockerfile
@@ -1,8 +1,8 @@
-# Pinned to node:22-bookworm, the tag .nvmrc and the sibling service images
-# already declare. `node:latest` floats: a rebuild silently moves the runtime
-# off the declared Node 22, so the image and the repo's pin drift apart with
-# no signal anywhere.
-FROM node:22-bookworm
+# Pinned by digest to the node:22.23.2-bookworm build whose V8/ICU match
+# xchain-vm's consensus runtime pin: the floating node:22-bookworm tag moved
+# to a Node patch that fails that check, so a tag alone can silently drift
+# the image off the runtime the fleet requires.
+FROM node:22.23.2-bookworm@sha256:dd5847a04b0deee391fa145f1f4c6d214196668b6bcc7988ebed67249f226844
 
 RUN mkdir /XChainHub/
 COPY ./package.json /XChainHub/package.json

diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@
 # XChain Platform Hub
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.20.0-blue" alt="Version">
+  <img src="https://img.shields.io/badge/version-0.20.1-blue" alt="Version">
   <img src="https://img.shields.io/badge/tests-7%2C342%2B%20passing-brightgreen" alt="Tests">
   <img src="https://img.shields.io/badge/node-%3E%3D22-green" alt="Node">
   <img src="https://img.shields.io/badge/license-AGPL--3.0--or--later-blue" alt="License">

diff --git a/bin/ci-full.sh b/bin/ci-full.sh
@@ -74,7 +74,36 @@ SELF="$(pwd)"
 SIB="$(cd .. && pwd)"
 
 FAILED=""
+# >>> ci-tier (generated block; re-run the tier wirer to update) >>>
+# Tier classes. A push grades the FAST tier only: the unit job, the pin and
+# drift guards, and the structure and hygiene checks the hook runs before it
+# dispatches. The tiers named below (coverage re-runs, perf scenarios) are
+# skipped when the gate sets CI_TIER=fast, and each skip is recorded so the
+# closing verdict can never claim a green it did not earn. Nothing stops
+# being graded: a scheduled sweep re-runs this same script with CI_TIER=full
+# on every repo every three hours and before any release or deploy, and a
+# red there is tracked down and fixed first. CI_TIER is unset for a hand
+# run, so a bare `npm run ci:full` still runs every tier as it always did.
+CI_TIER_FULL_ONLY=(
+  "perf (test:perf)"
+  "coverage ratchet (coverage:check)"
+)
+DEFERRED=""
+ci_tier_deferred() {
+  [ "${CI_TIER:-full}" = "fast" ] || return 1
+  local t
+  for t in ${CI_TIER_FULL_ONLY[@]+"${CI_TIER_FULL_ONLY[@]}"}; do
+    if [ "$t" = "$1" ]; then
+      DEFERRED="$DEFERRED [$1]"
+      echo; echo "ci:full ===== $1 DEFERRED (CI_TIER=fast, runs in the full sweep) ====="
+      return 0
+    fi
+  done
+  return 1
+}
+# <<< ci-tier <<<
 run_tier() {
+  ci_tier_deferred "$1" && return 0  # ci-tier guard (generated)
   local name="$1"; shift
   echo; echo "ci:full ===== $name ====="
   if "$@"; then
@@ -122,7 +151,7 @@ run_tier "measurement tools (bin/test)" \
   npx mocha 'bin/test/**/*.test.js' --no-config --timeout 120000 --recursive --exit
 
 # --- job: ci (XChain-Platform/.github ci-reusable.yml -> npm run ci) -------
-run_tier "ci" npm run ci
+run_tier "ci" env XCHAIN_REQUIRE_SIBLINGS=1 npm run ci
 
 # --- job: perf -------------------------------------------------------------
 # The workflow gives this job its own MariaDB service container; here the DB is
@@ -159,11 +188,24 @@ run_tier "drift: vendored observability shim vs canonical (six consumers)" \
   npm run check:observability-sync
 
 # --- job: coverage ---------------------------------------------------------
-run_tier "coverage ratchet (coverage:check)" npm run coverage:check
+run_tier "coverage ratchet (coverage:check)" \
+  env XCHAIN_REQUIRE_SIBLINGS=1 npm run coverage:check
 
 echo
+# >>> ci-tier summary (generated) >>>
+echo "ci:full: tier class ${CI_TIER:-full}"
+if [ -n "${DEFERRED:-}" ]; then
+  echo "ci:full: DEFERRED to the full sweep:$DEFERRED"
+fi
+# <<< ci-tier summary <<<
 if [ -n "$FAILED" ]; then
   echo "ci:full: RED tiers:$FAILED"
   exit 1
 fi
-echo "ci:full: all tiers green (same set GitHub CI runs)"
+# >>> ci-tier verdict (generated) >>>
+if [ "${CI_TIER:-full}" = "fast" ]; then
+  echo "ci:full: all FAST tiers green; the DEFERRED tiers above were NOT graded here"
+else
+  echo "ci:full: all tiers green (same set GitHub CI runs)"
+fi
+# <<< ci-tier verdict <<<