XChain Platform v0.19.0

XChain Platform v0.19.0.

The first major train, across thirteen components: every code component except
xchain-contracts moves to 0.19.0, xchain-documentation included. It carries the XBRIDGE
cross-chain bridge (the action handler, the federation settle pass and a per-chain flag day),
the platform code-structure passes that landed on every repository since v0.18.0, the
barrier family's canon constants (inert), and the September rollcall and tracker fixes.
Because the bridge changes what a node derives from a block, this train is
consensus-breaking above its boundary: src/release-manifest.json at this tag carries a
trainActivation block that arms the 0.19.0 rule set on testnet at Bitcoin height 152787,
and the manifest is classified major. The mainnet hub stays under the standing write hold,
so nothing here reaches a mainnet writer until that hold lifts. The signed artifact set and
SHA256SUMS.asc are attached.

Activation

Below every height in this table a node derives exactly what v0.18.0 derives. Two rules
arm on testnet; nothing arms on mainnet:

Rule	Mainnet	Testnet	Regtest
Platform-train boundary (TRAIN_ACTIVATION['0.19.0'])	unarmed (sentinel)	BTC 152787	genesis
XBRIDGE cross-chain bridge (XCHAIN_BRIDGE_ACTIVATION, per chain)	unarmed, every coin	BTC 152929, LTC 4887898, DOGE 67902062	genesis
Token-bridge ISSUE (TOKEN_BRIDGE_ACTIVATION)	unarmed	unarmed	genesis
Token policy inheritance (TOKEN_POLICY_INHERITANCE_ACTIVATION)	unarmed	unarmed	genesis
Mirror admission, producer and consumer (MIRROR_ADMISSION_ACTIVATION, MIRROR_ADMISSION_CONSUMER_ACTIVATION)	inert	inert	armed only by an explicit venue setting
Anchor-attest barrier bound (ANCHOR_ATTEST_BARRIER_ACTIVATION)	inert	inert	armed only by an explicit venue setting

Every testnet node must run v0.19.0 before Bitcoin testnet height 152787. The train
boundary is the halt line: a v0.18.0 indexer or sync follower that reaches it stops with a
durable TRAIN_ACTIVATION_HALT marker instead of applying the block under the old rules,
and a Litecoin or Dogecoin reader without a Bitcoin clock halts as soon as its manifest
names a rule set it does not carry. Below the boundary the new binary runs the old rules,
which is the rolling-upgrade window. The four testnet heights were sized on 2026-09-16 from
the chain tips read at 16:33Z and the cadence measured over the preceding 99 blocks on each
chain: the boundary is TBTC 152716 plus 71 blocks (about ten hours at 508.8 s per block),
the Litecoin and Dogecoin bridge heights are TLTC 4887644 plus 254 and TDOGE 67900748 plus
1314 (about ten hours each at 141.8 s and 27.4 s per block), and the Bitcoin bridge height
is TBTC 152716 plus 213 (about thirty hours). The destinations arm first and Bitcoin, the
origin of a v0 lock, arms last, so no lock can be admitted that no destination will credit;
every bridge height sits above the train boundary on the same Bitcoin clock, so a node
lacking the rule set halts before it can grade a bridge action. An activation already in
the past when you read this is not a flag day for a node that already runs this release.

The XBRIDGE cross-chain bridge

XBRIDGE moves an XChain token between Bitcoin, Litecoin and Dogecoin as one supply. The
origin chain locks the balance in a protocol escrow address (or burns it on the way back),
the validator federation signs the transfer record through the hub, and the destination
chain credits it as an ordinary protocol action in an ordinary transaction: no wrapped
asset and no custodian. Each transfer leg is gated on its own chain's activation height,
a source leg finalizes as exactly one transfer however many snapshot heights it spans, the
ledger applies at most one settlement per source leg, and a source-chain reorg that orphans
a lock or burn retracts the transfer on the hub instead of minting on the destination. The
bridge is armed on the three testnet chains only. In this first release the record that
authorizes a destination credit and the validator roster that verifies it both reach the
indexer through the federation hub mirror, so a cross-chain credit rests on the hub until
the checkpoint cross-check ships; mainnet stays unarmed until then. Token-bridge ISSUE and
policy inheritance ship in the code behind their own sentinels on every network.

The code-structure passes

Every train repository was restructured under the platform code-structure standard:
feature directories, snake_case files, split test suites, restored comments. That changed
layout, not behaviour, and the claim is proven rather than asserted. The indexer's
consensus identity was pinned before the pass and measured byte-identical after it
(armed-map fingerprint 55891dfd, consensus rules digest 26ba9cce), a from-genesis
regtest reindex on the restructured tree replayed the pinned state hash, and the full
bitcoin end-to-end matrix on the release branch registered its action suites at the
measured baseline of the last green pre-pass run (273 passing, 32 pending, 0 failing). The
only consensus-identity movement in this train is the one the cut makes on purpose: the
activation rows above and the consensus version, with every pin re-derived to match. One
split that had moved awaits inside the hub's attestation and DEX PBFT handlePropose was
caught by that discipline and restored to its synchronous ordering with a regression test
per site.

Hub

The hub carries the cross-chain bridge engine with quorum-signed transfer and
policy-snapshot tables, moves its schema version to 6, and exposes a bridge invariant read.
A hub whose signing key is outside the chain-effective signer set no longer broadcasts into
rounds it cannot sign or opens checkpoint rounds it cannot lead, and says so once per set
change while it keeps receiving, relaying and serving. The PRICE v0 payload builder accepts
a coinPair-keyed pair the same as a pair-keyed one, matching the other two v0 copies byte
for byte. The barrier family's plumbing ships inert behind the mirror-admission activation:
a per-table per-chain admission watermark on the mirror heartbeat and every snapshot page,
an admission map carried through PRICE rounds and batches, and followers that bound a
proposed map against their own tips. The roll order is hub first: the indexer's
xchainRequiresHub reads 0.19.0 and the schema-mirror check is strict equality in both
directions.

Also in this train

• The indexer applies a NODEPROOF verdict at the buried height the hub locked its claimant
  set at, renames the leg-ordinal migration past every later one so it applies in dated
  order, reads the escrow-proof checkpoint through the hub-mirror handle, and admits
  mirrored rows by a per-chain height watermark (inert until the barrier family is sized).
• xchain-sync halts at a train boundary whose rule set it lacks before writing the
  boundary block, mirrors the bridge lifecycle table and its rollback twin at indexer
  schema 11, and finishes both replica key rebuilds in one start.
• The explorer renders bridge and policy panels on the token and action pages and serves
  the four bridge columns on the token read.
• The SDK encodes XBRIDGE, adds a bridge builder, prices XBRIDGE and predicts the
  bridge-era ISSUE and DESTROY pre-flight rules, and accepts a caret ticker reference on
  every ISSUE format the way consensus resolves it. @dankest-llc/xchain-sdk and
  xchain-mcp publish at 0.19.0.
• The decoder and encoder recognize the XBRIDGE action name and its escrow role
  addresses; the UTXO tracker and the regtest miner re-vendor the shared coin bundles for
  the escrow roles.
• The UTXO tracker sizes its reorg undo window per coin and network (every testnet 120
  blocks) and persists a halt marker with its reason, height and time, published on
  /status.
• xchain-node refuses to bring up a bitcoin indexer or a validator-mode hub on a
  roll-call-armed network with no Dogecoin read, ps shows a stalled indexer or a halted
  tracker beside the decoder's halt, the advisory remote-version check no longer aborts a
  deploy when unreachable, and the e2e container receives the hub API key on a keyed host.
• The documentation publishes the XBRIDGE protocol, the 0.19.0 train row and the per-chain
  testnet bridge heights, the barrier family's canon constants, and the tracker's
  per-network undo-window and halted-state pages.
• The end-to-end suite drills the settle path across the hub and indexer canonicals and the
  full distribution rail from a mint through a lock to an airdrop, and funds gas off
  Bitcoin by bridging.
• Audited transitive packages move to their patched releases (lockfile only) in every
  repository that carried them.

Verifying this release

gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

The signing key is published at xchain-documentation/operations/release-signing.md and in
tools/release/ in every train repo. Any other key is not an official release.

Installing this exact set

xchain-node install v0.19.0 <service> <coin> <network>

What is in this train

Component	Version
xchain-node	0.19.0
xchain-hub	0.19.0
xchain-indexer	0.19.0
xchain-sync	0.19.0
xchain-explorer	0.19.0
xchain-decoder	0.19.0
xchain-encoder	0.19.0
xchain-utxo-tracker	0.19.0
xchain-sdk	0.19.0
xchain-e2e-test	0.19.0
xchain-vm	0.19.0
xchain-contracts	0.17.0 (unchanged)
xchain-regtest-miner	0.19.0
xchain-documentation	0.19.0