v0.16.0

XChain Platform v0.16.0.

A minor train. Eleven components move to 0.16.0: xchain-node, xchain-hub, xchain-indexer, xchain-sync, xchain-explorer, xchain-decoder, xchain-encoder, xchain-utxo-tracker, xchain-sdk, xchain-e2e-test and xchain-documentation; xchain-vm, xchain-contracts and xchain-regtest-miner keep the v0.15.0 tags they shipped under. src/release-manifest.json at this tag pins the resolved set; the signed artifact set and SHA256SUMS.asc are attached.

Activation

Two new consensus rails are armed on Bitcoin testnet by height, both AHEAD of the chain at cut time so that every testnet indexer and hub can be updated before either fires:

Rail	Testnet height	Mainnet
Zero-confirmation ATTEST service (ATTEST_ZERO_CONF_ACTIVATION)	151800	unratified, unchanged
ROLLCALL v1 consensus gates (ROLLCALL_GATES_ACTIVATION)	152208 (an epoch boundary)	unratified, unchanged

Regtest arms both from genesis. Because both change what state is derived from existing bytes above their heights, every testnet indexer must run this release before block 151800 and every testnet hub before the first epoch closing at or above 152208. Update indexers before hubs, and finish the whole fleet inside one roll-call epoch, never across one.

Zero-confirmation attestation service

A hub used to wait for an ATTEST request to be buried before serving it, so a contract saw its callback four blocks after asking. Above the height a hub serves a request in the block it is mined in, the responsible set carries one headroom slot from the start, the indexer's mirror applier falls through an inert response to the next candidate instead of stalling the request, and the fee is split among the signers who actually fulfilled it. A hub also refuses to re-pay its provider for a request it has already finalized. The pending-request poll runs every 3 seconds.

ROLLCALL v1 gates and the rules-aware attestation set

Above the gates height a validator's roll call carries the list of consensus gates its build knows, the indexer verifies that list against the v1 canonical and records it per epoch in a new rollcall_gates table, and an attestation request is routed only to validators whose recorded list covers every gate active at the request block. A validator on an outdated build is therefore never drawn into a round it cannot complete, and a request without enough qualifying validators is refused at admission with a named reason. The indexer schema version moves to 9 for the sync follower; the explorer shows the gates list on a v1 roll call's detail page.

One-command install and update

xchain-node update with no arguments moves a release node to the latest published release, fully pinned: the CLI verifies the signed tag against the shipped release key, moves itself first, then every installed service, hub first. install xchain-hub on a fresh box stages the hub from the release manifest. Every command prints a one-line notice when a newer release exists. A CLI older than v0.16.0 does not know how to move itself; bring it forward once by hand (git fetch --tags origin && git checkout v0.16.0 && npm install) and it self-updates from then on.

Also in this train

• The decoder and utxo-tracker wait on a coin node that is still in initial block download instead of reading its low tip as a reorg, refuse a node-tip gap deeper than their undo windows before touching a row, and publish the wait so xchain-node ps can show it; a durable REORG_HALT marker can be cleared with an audited clear-reorg-halt command.
• Bootstrap archives carry their end height and a fresh install compares it with the coin node before restoring.
• Every utxo-tracker container gets a memory limit derived from the host and the chains it shares it with.
• The hub sheds buffered PRICE rounds once their batch lands and asks the chain (getpricebatches) before re-proposing, and stops archiving chain-derived anchor reward rows.
• Every explorer and encoder rate limiter logs one counter line per window when it refuses, naming the knob to raise; /api/action/{index} answers 404 for an index the chain has no action at; the completing chunk of a chunked deploy shows its constructor gas and deploy card.
• The SDK honours Retry-After on a 429 and surfaces a surviving one as SDKRateLimitedError; @dankest-llc/xchain-sdk and xchain-mcp publish at 0.16.0.
• The e2e suite gains the zero-confirmation and roll-call gates drills, a venue tool that ages a stale roll-call absence out of the streak window, and opt-in sibling staging for the SDK suites.
• The documentation set carries the protocol pages for both rails, their activation heights, the deferred chunked-DEPLOY assembly pages, the REORG_HALT operations page and the one-command update guides.

Verifying this release

gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

The signing key is published at xchain-documentation/operations/release-signing.md and in tools/release/ in every train repo. Any other key is not an official release.

Installing this exact set

xchain-node install v0.16.0 <service> <coin> <network>

What is in this train

Component	Version
xchain-node	0.16.0
xchain-hub	0.16.0
xchain-indexer	0.16.0
xchain-explorer	0.16.0
xchain-decoder	0.16.0
xchain-encoder	0.16.0
xchain-sync	0.16.0
xchain-utxo-tracker	0.16.0
xchain-sdk	0.16.0
xchain-e2e-test	0.16.0
xchain-vm	0.15.0 (unchanged)
xchain-contracts	0.15.0 (unchanged)
xchain-regtest-miner	0.15.0 (unchanged)

Upgrade notes

Roll indexers before hubs on every venue, and every origin sync server before any follower: the sync follower's schema version is 9 for the new rollcall_gates table. Roll indexers before the explorer, which reads the gates column unconditionally. An indexer on this release declares a hub floor of 0.16.0 (xchainRequiresHub), so the skew guard refuses to update an indexer under a hub still on 0.15.x.

Full per-component detail is in each repository's CHANGELOG at its tag.