v0.16.3

Patch train. xchain-node and xchain-hub move to 0.16.3; xchain-indexer keeps the 0.16.1 it shipped under in v0.16.1, and every other component keeps its v0.16.0 (or v0.15.0) tag.

What changed

Every silent oracle round exit leaves a structured round_lost record. Rounds 1318, 1549 and 1710 and a 118-round outage vanished from price_snapshots on every testnet validator with 37 submission rows, no snapshot row, no skipped row and no log line. Three exits were silent: the wall-clock round-number fence burned numbers across a clock step without a tick, a restart between submission and finalization dropped the armed finalization timer with nothing to rehydrate it, and every seat return past the gates in finalizeRound was bare. Each now records a round_lost diagnostic carrying round, phase and cause, and writes a skipped price_snapshots row (a scheduler gap is recorded once by range, anchored at each round's nominal start so every hub writes the same row), so a round with no snapshot row is explained instead of missing.

A catch-up sweep wire may spend the change of a wire the same publish pass already sent. A sweep queues several PRICE batch wires and broadcasts them inside one second. Each spends a confirmed output and leaves its change unconfirmed, so under the confirmed-inputs-only rule the wires past the address's confirmed-output count saw dust alone, priced their fee above it and failed with insufficient funds: measured on a testnet validator as 8 failures in 8 hours while the address held ample funds. Confirmed-inputs-only stays the rule; the one exception is a wire spending the change of a wire this pass broadcast, bounded four ways: only txids this publisher broadcast in the running pass, depth-bounded by the new ORACLE_PUBLISH_SELF_CHAIN_MAX_DEPTH (default 4, documented in the hub configuration reference), only below the encoder UTXO cap where the forwarded array is the encoder's candidate set, and disabled outright when any output arrives without a readable confirmations field.

The pushed-tip block-gap line logs at info. The line past MAX_TIP_AGE_S was a warn; 570 of them in 24h on one hub were all real Bitcoin block gaps on which the hub correctly took the direct indexer path. It now logs at info with wording that names the gap. The no-block_time case and the direct-path halt stay warn.

Who needs this

Every hub that publishes PRICE batches or seats oracle rounds benefits; a testnet validator with a buffered publish backlog needs the sweep change to drain it. Nothing changes derived state, no activation height moves, and the upgrade needs no coordination window.

Verifying this release

Every tarball is built from its signed component tag with git archive, and SHA256SUMS.asc is a detached signature over SHA256SUMS by the platform release key (1DA7C4896F56EA22CF491EDF4361611A82F90B70). See Release Signing.

Component set

Component	Version
xchain-node	0.16.3
xchain-hub	0.16.3
xchain-indexer	0.16.1
xchain-sync	0.16.0
xchain-explorer	0.16.0
xchain-decoder	0.16.0
xchain-encoder	0.16.0
xchain-utxo-tracker	0.16.0
xchain-sdk	0.16.0
xchain-e2e-test	0.16.0
xchain-vm	0.15.0
xchain-contracts	0.15.0
xchain-regtest-miner	0.15.0