jdogresorg · Oct 17, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -1,5 +1,9 @@
 <!-- Thanks for contributing to XChain Platform. -->
 
+## Base branch
+
+- [ ] This pull request targets `develop`. `master` only takes release merges, and a pull request into it from a fork cannot be merged.
+
 ## What this changes
 
 <!-- One or two sentences on what changed and why. Link an issue if there is one. -->

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ on:
     # so the merge commit a release tag points at has its own green run.
     branches: [master, develop]
   pull_request:
-    branches: [master]
+    branches: [master, develop]
 
 jobs:
   ci:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-10-17
+
+### Added
+- Scoped module database and user names to a non-default node prefix and proved the scope end to end.
+- Showed NOT READY in the process list from the indexer and decoder readiness verdicts.
+
+### Changed
+- Defaulted the bundled MariaDB buffer pool to 1G and kept it overridable.
+- Refused cross-major release downgrades and decoder or indexer setups that would share the default external database name.
+
+### Fixed
+- Built and signed the DOGE signer's reveal before broadcasting its commit, and kept the signed reveal when only its broadcast fails.
+- Classified containers by name only and preserved unreadable command locks.
+
+### Security
+- Replaced vulnerable Bitcoin signing dependencies and bumped js-yaml and brace-expansion.
+
+### Changed
+- Started the bundled MariaDB with a 1G InnoDB buffer pool by default, settable with `XCHAIN_NODE_DB_BUFFER_POOL_SIZE`.
+
 ## [0.23.0] - 2026-10-11
 
 ### Added

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -112,6 +112,8 @@ Match the existing log style: a concise subject line, then a short body explaini
 
 ## Pull requests
 
+Fork the repository, branch off `develop`, and open your pull request against `develop`. Keep history linear (rebase, don't merge). `master` is what production runs and only ever receives release merges from `develop`; a pull request into `master` from a fork or any other branch fails the `base-branch guard` check and cannot be merged.
+
 CI is the unit gate. Before opening a PR:
 
 1. Run the no-external-services tiers (`npm run ci`, `npm run test:security`) and confirm they pass.

diff --git a/README.md b/README.md
@@ -111,7 +111,7 @@ membership on the explorer, is `xchain-documentation/operations/run-a-validator.
 
 ## Host environment variables
 
-Five env vars override where xchain-node stores its filesystem state. Set them in the shell or systemd unit before running `xchain-node install`. Each falls back to a path inside this repo if unset, so existing installs are unaffected.
+Six env vars override where xchain-node stores its filesystem state. Set them in the shell or systemd unit before running `xchain-node install`. The data, temporary, modules, crypto-node, and config directories fall back to paths inside this repo if unset, so existing installs are unaffected. The command lock defaults to `~/.xchain-node/command.lock`.
 
 | Variable | What goes here |
 |---|---|
@@ -120,31 +120,32 @@ Five env vars override where xchain-node stores its filesystem state. Set them i
 | `XCHAIN_NODE_MODULES_DIR` | Git clones of sibling xchain-* repos |
 | `XCHAIN_NODE_CRYPTO_NODES_DIR` | Downloaded coin-node binaries |
 | `XCHAIN_NODE_CONFIG_DIR` | Generated per-service `.env` files |
+| `XCHAIN_NODE_LOCK_DIR` | Directory for the cross-process command lock (`command.lock` and its reclaim marker) |
 
 On boxes with a small `/` partition and a large data volume (e.g., OVH RISE-3 with `/misc`), point `DATA_DIR` and `TMP_DIR` at the large volume before installing. Full docs in [CONFIGURATION.md](https://github.com/XChain-Platform/xchain-documentation/blob/master/components/node/configuration.md).
 
 ### Bundled MariaDB tuning
 
-When xchain-node manages its own MariaDB container, these optional env vars override server defaults. They are applied as `mysqld` startup args at install time, so they **persist across a container recreate** (a `conf.d` file edited inside a running container does not). Each is unset by default so image defaults remain unchanged. Set them before `xchain-node install`.
+When xchain-node manages its own MariaDB container, these optional env vars override server defaults. They are applied as `mysqld` startup args at install time, so they **persist across a container recreate** (a `conf.d` file edited inside a running container does not). Each is unset by default so image defaults remain unchanged, except `XCHAIN_NODE_DB_BUFFER_POOL_SIZE`, which defaults to `1G` (a value that is not digits with an optional `K`, `M` or `G` suffix logs a warning and falls back to `1G`), and `XCHAIN_NODE_DB_MAX_CONNECTIONS`, which defaults to `1000`. Set them before `xchain-node install`.
 
 | Variable | mysqld setting | When to set |
 |---|---|---|
 | `XCHAIN_NODE_DB_DATA_DIR` | datadir bind-mount (`-v <dir>:/var/lib/mysql`) | Pin the datadir to a fast NVMe mount instead of the Docker data-root |
-| `XCHAIN_NODE_DB_BUFFER_POOL_SIZE` | `innodb-buffer-pool-size` (e.g. `16G`) | Large/multi-DB hosts where the stock 128 MB thrashes on multi-GB datasets |
+| `XCHAIN_NODE_DB_BUFFER_POOL_SIZE` | `innodb-buffer-pool-size` (e.g. `16G`) | Hosts that need more (or less) than the 1G default; the stock 128 MB thrashes on multi-GB datasets |
 | `XCHAIN_NODE_DB_MAX_CONNECTIONS` | `max-connections` (e.g. `300`) | Many connection pools against one DB (replicas, shared services) |
 | `XCHAIN_NODE_DB_FLUSH_LOG_AT_TRX_COMMIT` | `innodb-flush-log-at-trx-commit` (e.g. `2`) | Replica/cache DBs where a 1-second crash window is acceptable for speed |
 
 ## Autoheal (restart-on-unhealthy)
 
 Every persistent service container carries a Docker healthcheck, but Docker itself takes no action on the `unhealthy` state (`--restart unless-stopped` only fires when the process exits). An alive-but-stalled service would otherwise stay wedged until an operator notices it in `docker ps`. `xchain-node autoheal` closes that loop: it restarts containers that have been continuously unhealthy past a grace window, for services opted in via `autoheal: true` in the healthcheck table (currently the decoder and indexer; the utxo-tracker is deliberately excluded because it halts on purpose rather than exiting, and a restart would just re-halt it; the encoder is deliberately excluded because its health probe reports utxo-tracker readiness (unreachable, halted, lagging or mempool not ready), which restarting the encoder cannot clear).
 
-The command is one-shot and never prompts or daemonizes. Unattended remediation requires wiring it to a cron entry or systemd timer, e.g. `*/5 * * * * xchain_node autoheal`. Detection-to-restart latency is the timer interval plus the health retry budget plus the grace window. Use `--dry-run` to see restart candidates without acting. Exit code is non-zero only when a restart was attempted and failed.
+The command is one-shot and never prompts or daemonizes. Unattended remediation requires wiring it to a cron entry or systemd timer, e.g. `*/5 * * * * xchain_node autoheal`. Detection-to-restart latency is the timer interval plus the health retry budget plus the grace window. Use `--dry-run` to see restart candidates without acting. Exit codes: `1` when a restart was attempted and failed, `2` when a container has been restarted twice this episode without recovering (a wedge restarts are not clearing; investigate), and `0` otherwise. The escalation also logs a warning on stderr, so a systemd `OnFailure=` hook trips on it and cron mails it even when stdout is discarded. It repeats on every pass until the container recovers.
 
 | Variable | Default | What it controls |
 |---|---|---|
 | `XCHAIN_NODE_AUTOHEAL_GRACE_MS` | `120000` | How long a container must be continuously unhealthy before a restart is considered |
 | `XCHAIN_NODE_AUTOHEAL_COOLDOWN_MS` | `600000` | Base wait before autoheal restarts the same container again (anti-flap). The first retry waits this long; each further restart of a container that has not recovered doubles the wait, up to `XCHAIN_NODE_AUTOHEAL_COOLDOWN_CEILING_MS` (with defaults: 10m, 20m, 40m and so on, capped at 6h). The doubling resets once the container recovers |
-| `XCHAIN_NODE_AUTOHEAL_COOLDOWN_CEILING_MS` | `21600000` | Upper bound on the doubled cooldown. A container that never recovers settles at one restart per ceiling; there is no attempt cap, and every skipped pass logs an "investigate" line |
+| `XCHAIN_NODE_AUTOHEAL_COOLDOWN_CEILING_MS` | `21600000` | Upper bound on the doubled cooldown. A container that never recovers settles at one restart per ceiling; there is no attempt cap, and from the second unrecovered restart on every pass logs an "investigate" warning and exits `2` |
 | `XCHAIN_NODE_AUTOHEAL_PROBATION_MS` | `150000` | How long after an autoheal restart a passing health probe counts as that restart's own artifact rather than recovery, so it does not reset the backoff. If you widen a service's start period with `XCHAIN_NODE_HEALTH_START_PERIOD_<SERVICE>`, widen this to match (start period plus interval times retries, plus margin) |
 | `XCHAIN_NODE_AUTOHEAL_STATE_DIR` | `~/.xchain-node` | Where the state file (`autoheal-state.json`) lives: last restart times, unhealthy onsets and the per-container restart count that drives the backoff. Falls back to `XCHAIN_NODE_LOCK_DIR` when that is set, otherwise `~/.xchain-node` |
 

diff --git a/bin/pins/at1-suite-titles.json b/bin/pins/at1-suite-titles.json
@@ -772,12 +772,6 @@
       "validator stake free-key rules resolves the reuse gate COIN:network first, then the bare network",
       "validator stake free-key rules sums amounts exactly in 1e-8 units and refuses to guess on a malformed one"
     ],
-    "332b1a20f0f85580": [
-      "ValidatorService coin wallets the emitted signer marks post-funding failures does not tag a successful two-phase publish",
-      "ValidatorService coin wallets the emitted signer marks post-funding failures is valid JavaScript once the template literal is expanded",
-      "ValidatorService coin wallets the emitted signer marks post-funding failures leaves a pre-funding failure untagged, so the round stays retryable",
-      "ValidatorService coin wallets the emitted signer marks post-funding failures tags a definitive phase-2 rejection with fundsCommitted and the phase-1 txid"
-    ],
     "332bea463a49f99c": [
       "Regression Suite [regression:p0] Security R-SEC-001: branch name with shell metacharacters rejected",
       "Regression Suite [regression:p0] Security R-SEC-002: branch name with backticks and $() rejected",
@@ -1490,6 +1484,18 @@
       "makeBootstrap() consults the source health gate gates the utxo-tracker BEFORE stopping its container, so a refusal costs no downtime",
       "makeBootstrap() consults the source health gate still rejects an unsupported module before consulting the gate"
     ],
+    "55d86c81bb4903d3": [
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast broadcasts nothing when the encoder refuses the reveal",
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast broadcasts nothing when the reveal cannot be signed",
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast builds no reveal for a single-transaction encoding",
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast builds the reveal from the signed commit, then broadcasts the commit and the reveal",
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast hands back the signed reveal when its broadcast fails after the commit",
+      "ValidatorService coin wallets the emitted signer builds and signs the reveal before the commit broadcast leaves a commit broadcast failure untagged for the hub to classify",
+      "ValidatorService coin wallets the emitted signer marks post-funding failures does not tag a successful two-phase publish",
+      "ValidatorService coin wallets the emitted signer marks post-funding failures is valid JavaScript once the template literal is expanded",
+      "ValidatorService coin wallets the emitted signer marks post-funding failures marks a pre-funding failure neverSent and not fundsCommitted, so the round stays retryable",
+      "ValidatorService coin wallets the emitted signer marks post-funding failures tags a definitive phase-2 rejection with fundsCommitted, the phase-1 txid and the signed reveal"
+    ],
     "56897dc4174a8788": [
       "Chaos: Download Resilience Experiment 8c: SHA-256 hash mismatch succeeds when hash matches exactly",
       "Chaos: Download Resilience Experiment 8c: SHA-256 hash mismatch throws with expected vs actual hash on mismatch"
@@ -5112,7 +5118,7 @@
         "test/unit/validator_service.test/11_validator_dir.test.js": "26f27dbd3b14ec37",
         "test/unit/validator_service.test/12_coin_wallets.test.js": "6d7114a33630b804",
         "test/unit/validator_service.test/13_coin_wallet_options_and_mounts.test.js": "3670f7eb60a0bd6e",
-        "test/unit/validator_service.test/14_emitted_signer_post_funding_failures.test.js": "332b1a20f0f85580",
+        "test/unit/validator_service.test/14_emitted_signer_post_funding_failures.test.js": "55d86c81bb4903d3",
         "test/unit/validator_service.test/15_hub_env_wiring.test.js": "1dc33a33679f1947",
         "test/unit/validator_service.test/16_rollcall_status_reporting.test.js": "cb99d238d302d2c2",
         "test/unit/validator_service.test/17_capability_drift_probe.test.js": "1ee619322512f5f5",
@@ -5536,7 +5542,7 @@
         "test/unit/validator_service.test/11_validator_dir.test.js": "26f27dbd3b14ec37",
         "test/unit/validator_service.test/12_coin_wallets.test.js": "6d7114a33630b804",
         "test/unit/validator_service.test/13_coin_wallet_options_and_mounts.test.js": "3670f7eb60a0bd6e",
-        "test/unit/validator_service.test/14_emitted_signer_post_funding_failures.test.js": "332b1a20f0f85580",
+        "test/unit/validator_service.test/14_emitted_signer_post_funding_failures.test.js": "55d86c81bb4903d3",
         "test/unit/validator_service.test/15_hub_env_wiring.test.js": "1dc33a33679f1947",
         "test/unit/validator_service.test/16_rollcall_status_reporting.test.js": "cb99d238d302d2c2",
         "test/unit/validator_service.test/17_capability_drift_probe.test.js": "1ee619322512f5f5",

diff --git a/bin/pins/identity.json b/bin/pins/identity.json
@@ -2,8 +2,8 @@
   "repo": "xchain-node",
   "vendored": "src/coins (sync-coins.sh)",
   "files": {
-    "src/coins/BTC.js": "182baf5173e3846b94a5edc1ae15913a54fb266addfc45a3cf9a013bd9ec16c6",
-    "src/coins/DOGE.js": "4659b45fb7a5c959ce2777ab9d5e7c193f3515f03cdd8cd23bb6b9c4d012fc11",
+    "src/coins/BTC.js": "6868afc2d18911ba112234c980c094fda71cfc3e744a00f493def781c7610f8d",
+    "src/coins/DOGE.js": "29ac02299b0c779f4e3eda579eeaa9f673c454b73cfe9978a35f03f0e9aed33c",
     "src/coins/LTC.js": "6155195bfa5fdfeab77dec3802ce67b5cc47a77695e81a4a5545d980e4c421dd",
     "src/coins/consensus_pin.js": "342bf7af224a19ea0a98ff9cfb2c9a70b3fd5be75de7ecef2db05936f82baa63",
     "src/coins/index.js": "08b678d934fa647d3c7d14dc5ccdaeb86722ee32a3662de69e4a31cd7b09234c"