Repository navigation
Release v0.26.0 - #63
Merged
Merged
Conversation
Move the seven rows registered after match_origin_open_activation from gates_5.js into a new gates_6.js, loaded from the entry right after gates_5.js on the same line, so registration order and every row value are unchanged. Allow 23 part files in the assembler guard, re-pin protocol_changes in the carrier logic pin, and regenerate the consensus identity pin, where only the carrier logic digest moves.
Pin ordinary develop pre-flight checks to the reviewed SDK handler map so cross-repository landing order cannot change the verdict. Give each relay identity describe block its own schema so table fault and migration cases cannot leak ordering state.
Keep the terminal lifecycle coverage in the request-id split while dropping the redundant origin-monolith case and its unused connection binding.
Keep the origin lookup assertion while giving it a title distinct from the request-id split coverage.
A single-hub regtest stack seeds capability_snapshots with its own key under source seed:<pubkey> and weight 1. That key is never a BTC stakes_root leaf, so since the capability snapshot proof gate armed on regtest every LTC and DOGE indexer refused the row and no bridged credit could land. On an unpinned regtest venue the seeded row is now accepted when its key signed the snapshot checkpoint; testnet, mainnet and pinned regtest venues still refuse it.
A held capability_snapshots row stalls an LTC or DOGE indexer's block loop at the proof barrier, and nothing said why: a 404 or 503 from the hub, or a proof that does not verify. The reason is now logged once a minute per row. The verdict is unchanged.
# Conflicts: # bin/pins/at1-suite-titles.json # src/protocol_changes/gates_6.js # test/unit/consensus/capability_snapshot_proof/wiring.test.js
Point the mutation script at the relocated configuration while preserving its repository-root-relative paths.
Update usage text, source references, and unit test imports for the new executable paths.
… path resolves as written
… hub's BTC anchor The settle pass compared the hub's BTC-anchor snapshot_block with the origin checkpoint's block_index, so a lock from DOGE or LTC was proven against the oldest origin checkpoint and refused on every block. Behind BRIDGE_ESCROW_ANCHOR_MATCH_ACTIVATION (regtest at genesis, testnet and mainnet unarmed) those origins now take the first checkpoint whose snapshot_block is above the row's; the BTC-origin pick is unchanged. Fixes #62.
An origin node whose own state at a checkpoint height no longer reassembles to the signed state_root answered the divergence error until a later signed checkpoint matched its state. When the hub stops signing, that checkpoint never arrives, so the consumer deferred its block forever and every chain waiting on it stalled. The answer is now also released once the newest signed checkpoint the mirror holds is about a day of blocks below this node's tip (BTC 144, LTC 576, DOGE 1440): the node serves its envelope, the consumer refuses it, and the leg is skipped. A live stream keeps the error standing, so a node on a minority fork still holds its consumers while the hub signs. The divergence checks move into db/credits/escrow_divergence.js to keep bridge_reads.js under the file size limit.
Keep each block-loop waiter scoped to the proof holds present when it begins. Later capability snapshot rows remain held for later passes without extending an earlier wait forever.
Remove the renamed origin-lookup case from the monolith file instead of keeping it under a new title. Its assertion now runs inside the request-id split's terminal-state case, so the title exists once and the origin predicate keeps its coverage.
Allow admission-era call barriers to accept current stream coverage after the hub has published call height evidence. Missing admission evidence remains fail-closed and the call-specific watermark grace remains authoritative.
…les beside the runner-tracked files
Unset now means armed from genesis and a positive height arms at that height, matching the decoder and e2e readers.
Unset or empty arms regtest from genesis, a non-negative integer arms it at that height, and any other value stays unarmed, matching the decoder gate.
Carry the block protocol-change registry through both anchor reward mint paths, re-arm the testnet rule at the forward v0.25.0 instant, and cover the boundary with an unstubbed real-loop test.
Pin the regenerated flag-day reading and the public testnet history boundary used to choose it.
… the pre-flight map snapshot to the current SDK The hub retired src/db/schema/columns.js and its migrateAdmissionColumns map for ledgered .sql migrations, so the sibling case read a file that no longer exists. It now reads every admit_block ALTER in the hub migrations and requires exactly the manifest plus the hub-only set, each nullable. The drift gate ran against an SDK snapshot older than the reviewed batch handler pin, so it reported the batch handler as unreviewed drift.
Accumulate native fee and destination-keyed coin obligations in probe-local collectors. Surface those totals through dry-run preflight results while preserving the consensus value ledger, with focused acceptance coverage.
Preserve native fee and coin obligation totals in probe-local weak state, bypass missing COINPAY outputs only for public batch probes, and restore the SDK-mapped handler directories to their reviewed executable shape.
Fixes from a review pass:
- Hub floor ignores invalid/orphan heads by the same author even though the indexer's canonical-head pick for chunks is status-agnostic
- v1 archive heads have no same-author re-issue guard; only the hub's local floor prevents re-publishing different content under a spent seq
- archive_reissue.js header says 'Pure and unwired' but the module is wired into the v3 fold path
- checkReplayGuards comment still describes getNextBatchSeq as a three-table MAX+1
- Height-aware clear-instant helpers claim no clock instant exists above mirror admission, but five barrier predicates keep a stream-watermark clock ...
- Stale locations in header comments for the barrier block loop (protocol_time.js, hub_db_sync.js)
- mirror_barriers.js header says its barriers follow "the price pair"; three price-read barriers precede them
- barrier_mapping test pins only 7 of the 11 waiter-release calls in advanceWatermark and releaseHeightWaiters
- deferOnListShareSync silently skips the barrier when the consumer gate and mirror-admission gate disagree, with no skip-rail backstop
- Relay exactly-once docs claim rejected v3 rows are stored, but persistRelayRequest withholds them
- GenesisDump.scalar's >2^53 fail-fast never fires under the configured pool, so u64 BIGINT values enter the pinned dump already rounded
- Runner and migrate --status ignore ledger rows with no file, so a rename without a registry entry silently re-applies the file
- Stale 'Mirrors ...' pointers between the indexer and decoder migration runners name files that no longer hold the logic
- XSNAPCKPT snapshot-checkpoint canonical twin (indexer→hub) has no CI cross-repo guard: only the indexer pins literal bytes, every hub test checks t...
- AIRDROP review count and 'This airdrop pays N' ignore the token's ALLOW_LIST/BLOCK_LIST, but the indexer credits and prices only approved recipients
- Dry-run surfaces ignore the mainnet pre-launch admission gate, so pre-flight says `valid` for a tx the chain never indexes
- Comments in the dry-run and dispatch code name pre-refactor module files (`batch.js`, `dispenser.js`, `order.js`, `swap.js`, `order_match.js`) that...
- nativeFeeMandatory re-implements detectFeePaymentMode's chain rule instead of sharing it; pre-flight fee mode can silently drift on a flag day
- mirror_tables.js tells maintainers to add new retractable tables to `quorumClass`, which is now a boolean; the real list is QUORUM_CLASS_TABLES
- Orphaned 'signed-retraction verification helpers' comment in watermark_config.js describes a canonical that is not in that file
- Comment on the capability_snapshots trust boundary says non-BTC mirror rows are never checked, but the code now checks them once the activation gat...
- Twin drift-lock checks gathering methods in declaration order but never pins the preimage object's key names or order
- Frozen index-id assignment rule leaves out the transaction-level destination, which processTransaction interns between SOURCE and the value-sorted ...
- ATTESTATION.PROVIDERS overlay feeds consensus decisions but is outside the CONSENSUS_CONFIG_PIN subset
- state_hash comments describe the index-map class as flag-day gated, but the code always includes it (gate retired)
- Time-table comments still say testnet is unarmed for rows that arm testnet
- price_scale_gate.js header still describes a gated legacy pattern after PRICE_SCALE_ACTIVATION was removed
- validator_rewards amount persisted via BigNumber.toString(): sub-1e-7 attest fee shares stored in exponent form ("5e-8")
- getAddressBalances accepts a `tick` argument but ignores it, so single-tick lookups still load the whole ledger
- Auto-migration safety check blocks known-bad SQL commands but lets any unlisted command through as auto-safe
- An auto migration can drop a UNIQUE or PRIMARY key that src/sql still declares, and nothing compares the drop against the declared schema
- bridge_transfers.sql header claims a byte-consistent CREATE TABLE with the 2026-09-12 migration, which later migrations made untrue
- LIST_OWNER_ACTIVATION mainnet moved from the UNARMED sentinel to 0 with no dated ruling or measurement
- changes_5.js comments say 'Unarmed on every network' / 'unarmed on testnet' while the testnet column is armed at 1792303200
- flag_times.js says 'both production networks stay inert' for HOST_CALL_BOUNDS / PER_ELEMENT_METER / STRING_RECEIVER_METER while testnet is armed
- setAttestationResponseBatchIndex adds the batch link to rejected v1 rows, not just the mirror-applied response
- Chunk-columns migration header says the batch columns hash nothing, but a gated state-hash section reads them
- feequotedryrun on a BATCH reports the last sub-command's STATUS (or the first filled match's), not the BATCH row the chain indexes
- withVoteBindingDryRunRefusal only partly mirrors the handler's guard-inert rule (version parse, contract parse, activation gate, earlier rejections)
- setActionParamHandler comment says SWEEP and ISSUE use bespoke parsing, but both parse with util.setActionParams
- Stale prose around the dry-run engine: dryRunAction return doc omits fields; fee_probe pointer names the wrong home
- readBatchResponses filters the hub attestation_responses mirror on batch_action_index, which no index covers, on a public detail path
- Policy-layer code comments that cite controller-bound-tokens.md say ISSUE format 7 and leave out the `all` class
# Conflicts: # bin/pins/at1-suite-titles.json # src/actions/actions_class/quote_surfaces.js
Create the index for fresh and migrated databases, refresh the generated suite-title pin, and align nearby synchronization and schema invariant documentation with the current implementation.
The required fast CI gate passes on the existing tree. The linked workflow test job also passed when rerun at the same source revision, so no production change is required.
Restore the synchronization and schema comments that were outside the batch lookup index fix.
Distinguish an absent optional hub checkout from a supplied checkout that is missing the snapshot checkpoint canonical module. This prevents the reciprocal drift guard from silently skipping an incomplete cross-repo rollout.
When a clean adjacent SDK checkout is behind its remote-tracking develop branch, run the pre-flight drift check from an archived origin/develop snapshot. Keep equal, ahead, and divergent checkouts on the live path.
Restore the canonical twin test policy to its existing behavior so this change only selects the current SDK map for the local drift gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this release carries
Added
Changed
Fixed
Testnet activation
BRIDGE_ESCROW_ANCHOR_MATCH_ACTIVATIONonBTC:testnetat height157235BRIDGE_ESCROW_ANCHOR_MATCH_ACTIVATIONonLTC:testnetat height4930600BRIDGE_ESCROW_ANCHOR_MATCH_ACTIVATIONonDOGE:testnetat height68012800BRIDGE_ANCHOR_PROOF_READY_ACTIVATIONonBTC:testnetat height157235BRIDGE_ANCHOR_PROOF_READY_ACTIVATIONonLTC:testnetat height4930600BRIDGE_ANCHOR_PROOF_READY_ACTIVATIONonDOGE:testnetat height68012800EXACT_INTEGER_EXPIRATION_ACTIVATIONonBTC:testnetat block time1792605600EXACT_INTEGER_EXPIRATION_ACTIVATIONonLTC:testnetat block time1792605600EXACT_INTEGER_EXPIRATION_ACTIVATIONonDOGE:testnetat block time1792605600DISPENSER_WIDE_EXPIRATION_GATESonBTC:testnetat block time1792605600DISPENSER_WIDE_EXPIRATION_GATESonLTC:testnetat block time1792605600DISPENSER_WIDE_EXPIRATION_GATESonDOGE:testnetat block time1792605600Release v0.26.0
Base:
masterat64a281981203572c3e1f85f43150b9dcf224f2f5Head:
release/v0.26.0at33ef89d5137e44960aa4b84e2329fb1c28324ec6Landed refs