---
title: "Pricing Pipeline Changelog"
canonical: "https://pharos.watch/methodology/pricing-pipeline-changelog/archive/v6/"
description: "Pricing Pipeline Changelog - Pharos methodology version history."
---

# Pricing Pipeline Changelog

[All versions](https://pharos.watch/methodology/pricing-pipeline-changelog/)

<a id="changelog-v-6-53"></a>

## v6.53 - Depth-gated native Hive HBD market cross-rate

**Effective:** 2026-10-19

Pricing v6.53 admits a bounded HBD/HIVE order-book midpoint crossed with an independently fresh CoinGecko HIVE/USD parent through ordinary primary consensus, without protocol parity or independent CoinGecko votes.

- HBD/USD = HIVE/USD / midpoint(HBD/HIVE). Admission requires at least 500 HBD per side within 2% of midpoint, spread at most 1%, at least 1,000 HBD non-self trailing-day turnover, a trade within 15 minutes and within 2% of the book, and fresh non-regressing node heads. Capped or duplicate-ambiguous evidence proves only a conservative lower bound.
- The exact hive parent rides the existing CoinGecko simple-price batch, requires its original upstream clock within 300 seconds and at most 60 seconds future skew, and is never a stablecoin candidate. The derived local-fetch clock is the earlier of book retrieval and parent observation; source age remains capped at 900 seconds.
- hive-native-cg is a soft-aggregator-tier derived source, weight 2, sharing the coingecko family. Equal tier/weight avoids an out-of-bounds direct CG HBD quote erasing the native candidate before peg validation; near-par direct CG can still win over a native depeg. One family remains single-source and confirm_required, never hard depeg authority, replay safety or a validation/pool-challenge exemption.
- Public-node reads are serial after existing primary providers: at most ten RPCs across two nodes, three seconds per RPC, twenty seconds overall, and one MiB per body under inherited cancellation. Failed gates omit only the native candidate with generation-linked evidence. Supply, reserves, low-volume fallback and historical observations are unchanged; no backfill or schema migration.
- Activation: 2026-10-19 00:00 UTC (release date; 1792368000). Production acceptance requires the first actual public sync-stablecoins execution and a full 24-hour capture under unchanged policy. Temporary HBD price-gap acknowledgement is retained until observed acceptance or its existing expiry.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-52"></a>

## v6.52 - Quarter-hour refresh for short-lived fallback prices

**Effective:** 2026-10-16

Pricing v6.52 reobserves eligible DefiLlama contract and Jupiter fallback quotes on the existing quarter-hour refresh instead of relying on hourly discovery to keep a fifteen-minute quote available.

- The :09/:24/:39/:54 refresh runs the existing DefiLlama contract and Jupiter passes serially after exact-address coverage and before DexScreener, with an independent 25-second envelope per pass. Active missing-price rows and current source-owned rows are eligible; M and XO remain missing-price recovery candidates.
- Reviewed missing-price gaps stay on hourly discovery unless a publishable current quote is already owned by that source, including a composite source. A stale source label without a publishable price cannot admit a reviewed gap to quarter-hour probing.
- Provider identity, original upstream or slot clocks, freshness budgets, liquidity and plausibility gates, circuit ownership, fallback confidence and depeg authority remain unchanged. Refresh observations are staged for the existing publication path rather than published directly.
- Dated satUSD/Arbitrum and EURS/Polygon collapse reviews use the existing reviewed-release mechanism. Release requires an observed list current and a review at or after this quarantine's first detection, no later than the run clock; omitted chains and later incidents cannot inherit an older review. This chronology guard changes supply admission without adding supply or overriding the DefiLlama aggregate.
- Activation is provisionally 2026-10-17 00:00 UTC (1792195200), following the next-UTC-midnight convention; re-date effectiveAt at release. Fresh admitted producer publication is required to establish recovery; this record does not claim production acceptance.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-51"></a>

## v6.51 - Source-bound consensus inputs and reviewed USDFC price recovery

**Effective:** 2026-10-15

Pricing v6.51 prevents supplemental prices from re-entering consensus as DefiLlama list observations and admits USDFC to the existing reviewed low-volume CoinGecko fallback.

- DefiLlama list intake accepts only an absent legacy source label, defillama or defillama-list, while retaining the existing exclusion of CoinGecko-fallback supply rows. A carried or supplemental price cannot acquire a second provider identity merely because it is present on the intake row.
- Missing USDFC prices may recover through its reviewed CoinGecko identity after earlier fallback passes fail. The seven-day age budget, 120-second future-skew bound, peg validation, fallback confidence and original upstream observation clock remain unchanged.
- Consensus weights, depeg authority and supply admission are unchanged. Fixed-clock admitted-input comparison and fresh producer observations remain release requirements; no production recovery or replay equivalence is claimed.
- Activation is provisionally 2026-10-16 00:00 UTC (1792108800), following the next-UTC-midnight convention; re-date effectiveAt at release.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-50"></a>

## v6.50 - Reviewed BRLV low-volume price recovery

**Effective:** 2026-10-13

Crown BRLV joins the existing scoped CoinGecko low-volume fallback after a production audit found its sparse crown-brlv quote inside the seven-day budget while CG-only intake withheld the stale market cap and the carried row lost its native-implied price.

- Only a missing BRLV price can use the reviewed crown-brlv CoinGecko identity after earlier fallback passes fail. Admitted quotes retain fallback confidence, the original upstream observation clock and BRL peg validation; carried supply is unchanged.
- The seven-day age limit, 120-second future-skew limit, primary consensus, native-implied freshness and address-provider liquidity floors remain unchanged. Expired or invalid observations remain unavailable.
- Historical version lookup activates at the next UTC midnight (2026-10-14), preserving earlier publications. Recovery requires a fresh production publication; local source evidence and tests do not establish production recovery.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-49"></a>

## v6.49 - Reviewed NXUSD and Hermetica USDh low-volume price recovery

**Effective:** 2026-10-12

NXUSD and Hermetica USDh join the existing scoped CoinGecko low-volume fallback after a production audit found real upstream quotes inside the seven-day budget but outside primary consensus freshness.

- Only missing NXUSD and Hermetica USDh prices can use their reviewed nxusd and hermetica-usdh CoinGecko identities after earlier fallback passes fail. Admitted quotes retain fallback confidence and the original upstream observation clock; Hubble USDH and Native Markets USDH are distinct identities.
- The seven-day age limit, 120-second future-skew limit, peg validation, primary consensus and admitted supply remain unchanged. Expired or invalid observations remain unavailable.
- Historical version lookup activates at the next UTC midnight (2026-10-13), preserving earlier publications. Recovery requires a fresh production publication; local source evidence and tests do not establish production recovery.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-48"></a>

## v6.48 - Observed SOFID consensus without nominal-par override

**Effective:** 2026-10-11

Pricing v6.48 retires SOFID's nominal protocol-par route so its existing exact-identity CoinGecko/Kraken market consensus can reach price and peg consumers. Source weights, freshness budgets and depeg confirmation rules are unchanged.

- Observed SOFID discounts and premiums retain their original consensus value and observation clock instead of being replaced by a $1 nominal reference. No new provider or ticker-identity exception is admitted.
- Kraken midpoint evidence remains local-fetch and confirm_required, not independently authoritative for depeg detection. Missing quotes and carried nominal SOFID references publish unavailable, never par or zero.
- Other registered nominal routes retain their existing non-observed classification. Fresh producer publication is required before this source cutover can close a production peg-data gap; local source observations are not production acceptance.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-47"></a>

## v6.47 - Conserved historical missing-chain attribution

**Effective:** 2026-10-11

CoinGecko missing-chain gap-fill now attributes a historical remainder only when every existing chain has an observed bucket and their sum conserves the DefiLlama aggregate baseline. Unavailable or non-conserving history publishes the missing chain's bucket as null with explicit provenance, without changing admitted aggregate supply.

- ADR-8 conservation and audit finding V-04 require the historical chain packet to conserve its aggregate, not just the current packet. Each 1d/7d/30d baseline uses the same tolerance as current supply: max($0.01, DefiLlama bucket × 1e-6).
- Complete, conserving historical chain baselines retain the CoinGecko-minus-DefiLlama remainder. Otherwise the missing chain's historical bucket is null and supplyGapFill.withheldHistoricalBuckets names day, week or month. Existing observed chain values are never scaled.
- Some missing-chain historical buckets and their dependent chain-local comparisons become unavailable rather than publishing a numeric mismatch. Current supply, admitted CoinGecko aggregate history, ratio bounds, hysteresis, consensus weights and scoring formulas are unchanged.
- A valid-JSON non-object CoinGecko simple-price root is unavailable supplemental evidence, logged as non-object-root and routed through the existing no-decision/carry path instead of aborting healthy DefiLlama publication.
- Activation is provisionally 2026-10-12 00:00 UTC (1791763200); re-date effectiveAt at release

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-46"></a>

## v6.46 - Complete supply evidence and original-clock price admission

**Effective:** 2026-10-10

Pricing and supply publication preserve unavailable values, complete accounting, and original observation clocks across fallbacks and history. Missing chain rows cannot release a material supply quarantine, USDC-denominated redemption prices use observed USDC/USD, and historical chart buckets remain nullable when their contributors cannot be evidenced.

- Material chain-dropout quarantine remains sticky when a known chain disappears from the provider row. Ordinary CoinGecko fallback retains aggregate provenance but publishes old chain current as unavailable rather than fresh supply.
- Supply admission rejects partially invalid bucket records. Market-cap exposures and exports distinguish known subtotals from complete totals; dated observed zero remains zero, while missing supply remains unavailable.
- Historical chart cohorts require complete peg-bucket evidence and structural supplemental observations within the existing 14-day as-of budget. Prehistory, future points, expired contributions, and malformed chart bases withhold dependent buckets rather than creating zero-valued or complete-looking totals.
- Generic historical on-chain fallback requires exactly one eligible EVM deployment in the complete roster. Joined circulation and escrow accounting use fresh canonical block evidence. CoinGecko historical valuation must match its supply timestamp; 7D/30D comparisons use the current observation clock and paired native supply, not a silently longer window.
- Cap cUSD and infiniFi iUSD redemption ratios are valued with trusted live USDC/USD and timestamp-aligned historical USDC/USD, not assumed par. Solayer NAV uses canonical SPL accrual. Reserve-NAV inputs reject superseded semantic bindings while retaining current successful Chainlink and Superstate evidence after a failed refresh.
- Jupiter V3 quotes can be admitted without optional liquidity metadata. Verified CMC continuity no longer suppresses eligible hourly collection, and definitive exact-route misses invalidate only matching hints.
- Missing-only cached vault-rate rescue remains bounded when live RPC circuits are open, without manufacturing a successful live probe. Gap-fill restores retain original-clock ceilings and existing publication limits; a permitted undated carry acquires an aging clock on later cache loading.
- FX carry-forward and overlays preserve explicit source cadence and original observation provenance, with legacy-only inference at hydration. Partial primary FX publication is explicitly incomplete and partial historical coverage remains recoverable. Future chart and low-volume observations fail admission without changing freshness or skew budgets.
- Coverage and replay provenance follow admitted publication rows rather than rejected candidates. Consensus weights, supply gap-fill bounds, and current scoring formulas are unchanged; fixed-clock price, supply, and coverage comparison remains a release prerequisite.
- Activation is provisionally 2026-10-11 00:00 UTC (1791676800); re-date effectiveAt at release

Origin: Contemporaneous release record

Commits: `3a6be6e0d`, `e684e542b`, `f56e2cce1`, `6cc896454`, `3e280b982`, `718253076`, `17a2569d8`, `c8d085f00`, `6c403ce8b`

<a id="changelog-v-6-45"></a>

## v6.45 - Sticky chain-dropout guard for DefiLlama list supply

**Effective:** 2026-10-09

A positive DefiLlama list row whose chain current collapses to zero, null or at most half of a persisted vetted per-chain baseline no longer publishes that collapse as supply. The chain is repaired from a reviewed issuer-native on-chain read or DefiLlama's per-chain daily chart, published as unavailable, or, when the deficit is material, the asset is quarantined until the collapse is corroborated.

- Trigger: on 2026-10-09 the DefiLlama list served zero current supply on about twenty chains while their previous-day values and DefiLlama's own per-chain daily charts stayed correct. Published supply fell about $9.6B; USDG $3.10B to $1.645B (X Layer 1,409M on-chain), USDC by $7.5B (Hyperliquid L1), and USDY, USDT, satUSD and others fell too. No existing lane fired: explicit zero was admitted as observed, CoinGecko gap-fill only covers absent chains, and history/on-chain repair only covers whole-asset zero
- `CHAIN_DROPOUT_POLICY` flags a chain when its baseline is at least $1M and current is null or at most 0.5x baseline. The baseline is the persisted state (cache `sync-stablecoins:chain-dropout-state`), else a reviewed 2026-10-08 incident seed valid until 2026-11-09, else the payload's chain previous-day value. A flagged baseline is frozen, so a continuing zero that ages into previous-day zero stays flagged
- A repaired chain replaces its current value and adds only the repaired-minus-list difference to the aggregate (`supplySource = defillama-chain-repair`). Repair comes from a reviewed issuer-native totalSupply read (USDG on X Layer and Ink) or a DefiLlama per-chain daily point at most 48h old above 0.5x baseline. Chart fetches are sequential, body-consumed, capped at eight per run and hourly per pair. An unrepaired chain publishes null, never zero
- An unrepaired deficit of at least 2% of the asset quarantines it with `supplyRestored`: frozen vetted baselines are carried for at most the existing 7-day restore ceiling, then the asset publishes as unavailable. Elapsed time never accepts a collapse; only list recovery, on-chain corroboration or a dated reviewed release can. Immaterial dropouts keep the DefiLlama aggregate, publish the chain as null, and release once DefiLlama's daily chart records the lower level after first detection
- Conservation: an on-chain read that corroborates a collapse publishes the native amount, not the contradicted list value. When any of the asset's healthy chains gained in the same run, the drop may be a bridge representation reattributed to its source, so additive repairs and carries are withheld rather than scaled. The dropped chains publish null, and a material drop holds the vetted pre-gain whole-asset total until the chains recover. Confirmed low baselines persist instead of rebooting from the seed
- Every guarded row carries `supplyChainGuard` provenance (status, per-chain baseline/source/resolution). Run metadata reports flagged, repaired, quarantined and unavailable counts. Daily `supply_history` skips quarantined rows without blocking coverage, and chain history defers chains with an unavailable contributor. DefiLlama remains the supply source; prices, consensus and the CoinGecko gap-fill band are unchanged
- Activation is provisionally 2026-10-10 00:00 UTC (1791590400); re-date effectiveAt at release

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-44"></a>

## v6.44 - Price-only ticker admission and observed-flow weights

**Effective:** 2026-10-08

CoinGecko discovery tickers enter the hourly price bridge independently of pool TVL, weighted by observed USD flow times source confidence instead of synthetic orderbook TVL. They attribute zero liquidity TVL and cannot independently clear unchanged primary, display or depeg trust gates.

- Non-stale, non-anomalous USD-equivalent tickers with positive finite price and at least $1,000 reported USD flow are aggregated per exchange. Registry price evidence must remain non-future and within 24 hours of the frozen registry-read evaluation clock; peg-aware plausibility is required. Registry admission uses the unchanged original refresh timestamp. Price publication does not renew registry freshness; the aggregate row uses the publication generation's timestamp and does not expose per-ticker observation clocks.
- Price eligibility now requires at least $1,000 finite observed USD flow rather than $50,000 synthetic TVL. Median weights are observed flow times the existing cg_tickers confidence (0.55), never volume times three, depth-capped flow or legacy stored TVL/depth. Genuine pool admission and TVL-times-confidence weighting are unchanged
- New normalized ticker registry records store null TVL and no depth/pool model; requests no longer ask for depth. Stored legacy ticker rows use the same price-only path. Liquidity v6.93 separately removes all ticker-derived TVL, volume, pools, source mix, caps, coverage and orderbook diagnostics
- A price-only dex_prices publication can have source_total_tvl = 0; that field sums actual retained pool TVL only. Its source_pool_count retains the existing count of price observations, including exchange evidence, rather than a liquidity pool count. Primary-missing, outlier, peg-deviation and display-ratio publication guards remain fail closed, and ticker-only zero-TVL prices cannot satisfy the unchanged UI/primary/depeg DEX trust floors
- This changes the discovery ticker bridge, not the separate curated Kinesis cg-ticker primary source or direct CEX source weights. Mixed aggregates retain genuine pool support; observed exchange flow cannot substitute for trust TVL or an execution certificate. Safety formula is unchanged and improved Safety Score stability is unmeasured
- Activation is provisionally 2026-10-09 00:00 UTC (1791504000); re-date effectiveAt at release

Origin: Contemporaneous release record

Commits: `b762a4034`, `573140c03`, `56c49e154`

<a id="changelog-v-6-43"></a>

## v6.43 - Unconditional pinned native-share admission for JLTXX

**Effective:** 2026-10-08

JLTXX admission requires a complete pinned native-share evidence pass regardless of a positive CoinGecko market cap; staged bootstrap evidence cannot activate the asset or publish scores.

- Remove the positive-CoinGecko-market-cap bypass. Native circulating shares require EIP-1898 finalized raw totalSupply, observed decimals, canonical block hash and original block time; issuer class assets remain diagnostic, never token circulation.
- Compare the original dated JPMorgan transaction NAV with the native-share block under a source-reviewed temporal policy and legal tokenized/untokenized share perimeter. Missing approval or mismatched current fingerprint/attempt fails closed.
- The authenticated staged bootstrap captures evidence only and does not mutate active-roster or accepted-generation state. JLTXX remains quarantined with its existing October 10 review deadline until an explicit approved decision and real runtime price/market-cap PASS.
- Ordinary exchange prices, unrelated supplemental assets and generic supply accounting are unchanged. No successful bootstrap, runtime PASS, reactivation or production observation is claimed.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-42"></a>

## v6.42 - Scoped single-source parent inheritance for Sentora pathUSD

**Effective:** 2026-10-06

Sentora pathUSD's reviewed ERC-4626 NAV route can inherit a fresh replay-safe single-source pathUSD market quote while retaining that source's confidence and observation time.

- Only senpathusd-sentora opts into the existing single-source parent policy. Its exact Tempo vault convertToAssets(1 share) read still supplies the live assets-per-share rate; live enrichment and pre-intake supply valuation share the route. The parent source, single-source confidence and original observation time are preserved rather than promoted to protocol authority. Stale, fallback, cached and non-replay-safe single-source parents remain inadmissible
- The reviewed CoinGecko low-volume fallback cohort also gains USDKG, CHFAU and Freedom Dollar after observed quotes passed the existing seven-day budget. This curation retains upstream timestamps, fallback confidence, peg bounds and supply provenance; it changes no freshness limit, source weight or depeg-authority rule

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-41"></a>

## v6.41 - Reviewed pricing routes and fiat references for expanded asset coverage

**Effective:** 2026-10-03

Universal USD gains a guarded Uniswap v3 missing-price route, and JLTXX uses exact-class JPMorgan NAV telemetry. CZK, PLN and AED become first-class FX pegs. Reviewed ERC-4626 vaults share live and pre-intake NAV valuation, while ONED and PYUSDx gain issuer-conversion references that preserve fresh own market prices.

- USDU recovery binds the exact Ethereum USDU/USDT 0.01% pool, canonical factory and QuoterV2, reviewed runtime hashes and USDU implementation slot. Pinned 1,000- and 100,000-USDU sell quotes must agree within 5%, move price in the correct direction and fit actual token inventory. Both inventories must meet 10,000-token floors and normalized TVL must clear $50,000; token pause/blacklist and closing canonical-block checks remain mandatory
- USDU proceeds use a fresh trusted tracked USDT price. Both block and parent are newer than five minutes; provenance uses their older timestamp. `uniswap-v3-exact` remains fallback-confidence, non-replay-safe and non-depeg-authoritative, retains severe-downside and temporal-jump publication guards, and never replaces a publishable incumbent. No synthetic historical par or replay route is introduced. Serial body-consumed RPC batches do not increase the trigger-wide connection peak
- `jpmorgan-nav` joins primary reserve-NAV telemetry at weight 3 through matched successful snapshots and the shared `reserve-nav-price.ts` decoder. Exact JLTXX Token Class identity, positive transaction NAV and a matching valid dealing date are required; fetch age and upstream source age are checked independently under the five-day business-day NAV policy. Positive native supply can be valued before a previous cache row exists; issuer class assets remain diagnostic, not circulating supply or independent portfolio assurance
- CZK and PLN use business-daily ECB/Frankfurter quotes; AED uses calendar-daily secondary currency-API quotes, with existing full-set recovery and OXR overlay support. All references are USD per currency unit. Canonical fiat_fx peg types and native CoinGecko quotes are supported. No-reference USD price bands are CZK [0.02, 0.1], PLN [0.1, 0.5] and AED [0.2, 0.35]; FX bands are CZK [0.02, 0.1], PLN [0.1, 0.5] and AED [0.25, 0.3]. These are validation bands, never replacement prices or hardcoded AED parity
- Reviewed ERC-4626 NAV routes cover additional vaults on Ethereum, Base, Tempo, Arc, Robinhood and Monad, including distinct Legacy Spark USDC with 18-decimal shares and 6-decimal assets. Live pricing and pre-intake supply valuation use the same NAV allowlist and fresh trusted tracked-parent denomination, including EURCV; missing or untrusted parents fail closed. Supplemental intake forwards the existing configured `chainRpcs` map so Robinhood's keyed Dwellir route is available without adding an endpoint
- ONED inherits a reviewed one-for-one USDC issuer-conversion reference and PYUSDx a reviewed one-for-one PYUSD issuer-conversion reference. Fresh admitted own market prices take precedence, including discounts. These references do not establish direct-wrapper classifications or guaranteed liquid market pegs, and historical replay remains on each asset's own market-price sources rather than synthesized parent history

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-40"></a>

## v6.40 - DEX aggregate leg bounded by the primary freshness budget

**Effective:** 2026-09-28

The hourly DEX aggregate (`dex-promoted`) joins a primary consensus beside other legs only while its row is at most `DEPEG_PRIMARY_PRICE_MAX_AGE_SEC` (30 minutes) old. Consensus stamps a cluster with its oldest agreeing leg, so a DEX row inside its own 75-minute window but older than 30 minutes had been ageing fresh CEX and oracle agreement past the primary budget. As the sole admissible leg it keeps its 75-minute window and publishes as single-source.

- `worker/src/cron/sync-stablecoins/enrich-prices-primary-consensus.ts`: an eligible DEX aggregate row older than 1,800 s is left out when any other primary leg survives source building. The row's own eligibility is unchanged: `isTrustedDexPriceRow` depeg tier, 75-minute age, $1M TVL (VUSD keeps the UI tier). Promoted per-protocol DEX legs are unchanged
- Why: the DEX liquidity stage runs at xx:10. It admits a tracked price as a pool quote leg only when `classifyPrimaryDepegTrust` rates it `authoritative` or it has fresh multi-source agreement, both within 30 minutes. For 28 assets (USDC, USDT, DAI, USDe, PYUSD, GHO, …) the xx:01 cache carried the previous DEX run's aggregate as an agreeing leg, stamped exactly one run (3,600 s) before the next stage. That stage then rejected those quote legs: at 2026-09-28 21:10 UTC only 36 of 567 prices survived and Aerodrome Sugar retained 20 pools instead of 364. The DEX price publication from that run dropped the USDC and USDT rows (20 rows remained). The following syncs therefore had no DEX leg, the next stage trusted the majors again, and the rows came back. The result was a self-sustaining two-hour cycle. The measured-execution target inventory alternated between 761–766 and 648–651 targets (Aerodrome 120 ↔ 9), and SBC's only comparable exit route, an Aerodrome measured quote, alternated with it (Safety Score 65 B- ↔ 51 C-)
- Effect: on the hourly cadence the xx:01 cache that the DEX stage reads never carries a DEX leg older than 30 minutes, so the majors' primary clock comes from their fresh CEX, oracle and CoinGecko legs. Every stage admits them as quote legs, and the DEX price publication keeps their rows. Assets whose cluster was CoinGecko or Curve plus the DEX aggregate publish from their remaining legs once the DEX leg passes 30 minutes. With no other leg, the DEX aggregate still publishes alone as single-source

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-39"></a>

## v6.39 - Observed prices replace nominal par for CHFAU, CADD and JPYm

**Effective:** 2026-09-28

Three assets leave the nominal-par scope because each now has observed price evidence. CHFAU and CADD publish their ordinary primary consensus: fresh CoinGecko quotes backed by live DEX venues. JPYm moves to the guarded Mento FPMM lane, an executable on-chain sell quote into USDm. `protocol-par` remains only for usbd-bima, usdq-quill, zarm-mento and xofm-mento; sofid-sofi is configured but quarantined.

- Through 6.37 the par override replaced any market price for these three assets. Under 6.38 par still displaced every quote the depeg detector does not rate `authoritative`, so their observed evidence was never published. CHFAU (`allunity-chf`) and CADD (`cad-digital`) had fresh CoinGecko quotes at review: 1.2039 USD, +14 bps against CHF FX, and 0.7061 USD, +2 bps against CAD FX. CoinGecko's tickers for both trade on DEX pools of the tracked contracts: CHFAU/USDC on Raydium, Uniswap v3 and Aerodrome (about $104K to $108K each), and CADD on Curve (CADD/frxUSD about $222K), Aerodrome and Hydrex. These rows now publish their primary consensus under the unchanged guards, pool challenge and weights. With no admissible quote the row is missing, with no nominal fallback
- `worker/src/lib/authoritative-price-sources/mento-fpmm.ts` becomes a reviewed route table. CHFm is unchanged. JPYm uses FPMM `0x9861f6d2fe392b934c86ec89d2886ceb772b2b41`, with the same pinned pool and StableTokenV3 implementations, 30 bps fees, a JPY-scaled 20,000-JPYm impact quote and a 200,000-JPYm inventory floor (CHFm's USD scale). The quote on 2026-09-28 was 0.006334 USDm per JPYm. CoinGecko `celo-japanese-yen` has been stale since 2026-08-19
- XOFm stays on nominal par because its only observed quote (Mento Broker, 200 bps spread) publishes about −225 bps against the XOF reference, beyond the 150 bps non-USD depeg threshold, which would present a spread as an off-peg reading
- The Mento FPMM lane keeps its existing policy: missing-price-only, fallback confidence, not replay-safe, not depeg-authoritative, with a five-minute lifetime and a fresh trusted USDm parent. Mento's weekend FX closure makes the JPYm quote revert with `FXMarketClosed` (verified at 2026-09-26 and 2026-09-27 12:00 UTC). JPYm therefore publishes as missing on weekends, not as nominal par. A dated price-gap review acknowledges this gap, as for CHFm and COPm
- Downstream: on weekdays the three rows count as observed in price coverage, so `nominalReferenceIds` shrinks from seven to four (usdq-quill, usbd-bima, zarm-mento, xofm-mento). Historical replay for the three no longer resolves to an empty `protocol-par` series. It uses the default market-history path, like other market-priced assets. Safety Score inputs change without a Safety Score methodology change: the peg rows lose nominal provenance, so `missing-peg-input` stops binding on CADD and JPYm, and the ZCHF→CHFAU StablecoinBridge route regains its CHFAU output valuation. Replaying the 2026-09-28 20:30 UTC capture with the new peg rows gives cadd-cad-digital 60 → 65, jpym-mento 60 → 70 and zchf-frankencoin 80 → 81 (exit 90.67 → 94.95). A weekend variant with JPYm unpriced gives the same scores

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-38"></a>

## v6.38 - Nominal par references and trusted-market precedence

**Effective:** 2026-09-28

The reviewed direct-redemption par routes (usbd-bima, usdq-quill, chfau-allunity, cadd-cad-digital, jpym-mento, zarm-mento, xofm-mento; sofid-sofi is configured but not scheduled while quarantined) no longer publish par as a high-confidence `protocol-redeem` observation stamped with the sync clock. Par is now a separate `nominalPriceReference` under the non-observed `protocol-par` source; a fresh market quote that the depeg detector rates `authoritative` wins, and otherwise the published price is par with `priceObservedAtMode: "nominal_reference"`, no observation time and no confidence.

- New registry source `protocol-par` (trust tier `nominal_reference`): never replay-safe, never depeg-authoritative, no freshness budget. Overrides carry `confidence: null`, `observedAt: null` and `observedAtMode: "nominal_reference"`; non-USD par still needs a fresh or static FX reference, but the FX clock is no longer presented as the token's observation time. It is recorded on the reference instead as `fxReferenceType` (`fresh`/`static`) and `fxObservedAt` (the FX reference's per-peg source time, `null` for static FX)
- Trusted-market precedence (`isTrustedMarketQuote` in `worker/src/cron/sync-stablecoins/pricing.ts`) admits the incumbent only when `classifyPrimaryDepegTrust` rates it `authoritative` and it has no protocol-override provenance: observed within `DEPEG_PRIMARY_PRICE_MAX_AGE_SEC`, not cached/fallback/low, and backed by registry depeg-authoritative sources (two at `high` confidence, or one with upstream observation time; a single-source-authoritative source at `single-source`). Soft aggregators are never depeg-authoritative, so single aggregator marks and CoinGecko + DefiLlama list agreement do not displace par, nor do stale quotes, cached/fallback fills or legacy `protocol-redeem` par rows. The gate has no liquidity or venue-depth threshold of its own. The rule is re-applied after post-enrichment validation and cached fallback, so a rejected market quote falls back to par, not to a fallback mark
- Every published row for these assets carries this run's `nominalPriceReference` (`{ price, source: "protocol-par", mode: "nominal_reference" }`, plus `fxReferenceType`/`fxObservedAt` for non-USD par). References and nominal prices are derived per run and never carried forward: an asset whose route cannot produce par (e.g. no usable FX reference) publishes neither
- Depeg consequences: a nominal price is not an observation, so it can neither open nor confirm depeg events, is excluded from observed-price coverage (nominal-only assets are reported in the separate `nominalReferenceCount`/`nominalReferenceIds`/`nominalReferenceMarketCapUsd` category with reason `reviewed-nominal-reference`, not as missing), and is never staged to the replay `price_cache`. Pre-6.38 `protocol-redeem` par rows remain in `price_cache` but can be republished by cached fallback only inside the 15-minute `protocol-redeem` budget measured from their last write. A trusted market discount is published and evaluated like any other trusted primary price, so a real market depeg is no longer masked by par
- Depeg replay no longer synthesizes USD 1.0 history, and non-USD routes no longer replay unadmitted market history: every configured route resolves to `protocol-par` with no series, so backfill preserves existing event rows. Historical rows published before this version keep their `protocol-redeem` provenance and remain attributable to v6.37

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-37"></a>

## v6.37 - Bounded CoinGecko supply gap-fill and per-asset supply admission

**Effective:** 2026-09-27

The CoinGecko aggregate gap-fill for a DefiLlama-backed asset with one missing deployment is kept but bounded: it admits CoinGecko/DefiLlama ratios only inside a reviewed band with hysteresis, takes every published bucket from one CoinGecko series, and records `supplyGapFill` provenance. Malformed or supply-invalid rows are quarantined per asset instead of stalling or crashing the whole list. Empty chain buckets stay unavailable in memory during the run, but public surfaces still read the legacy zero in Release A; the public null arrives in Release B.

- `COINGECKO_GAP_FILL_POLICY` in `worker/src/cron/sync-stablecoins/supply-gap-reconciliation.ts`: entry needs 1.05 < ratio <= 1.45, a row gap-filled in the previous publication is retained while 1.02 < ratio <= 1.50, and 1.50 is a hard ceiling at current and at every compared 1d/7d/30d bucket DefiLlama also observed. The per-bucket `max(DL, CG)` splice is gone. Availability failures, candidate-cap deferrals and DefiLlama fallback runs carry the prior coherent value and provenance for at most two consecutive publications, marked restored; they cannot admit a new fill
- Observed first-run impact (2026-09-27): feUSD $74.9M → $9.79M (7.65x), USDXL $3.19M → $0.113M (28.3x), scUSD $1.91M → $0.641M (2.99x), BtcUSD $8.48M → $5.12M (1.66x), and wCOP $196K → $185K (history-ratio-above-bound) are rejected; reUSD is retained (1.0504x). USDXL and scUSD fall below the $1M live-depeg floor and lose live detection; any open event closes as coverage-lost-supply. These one-time history steps are methodology changes, not redemptions. The bound still requires recorded owner approval
- Intake validates the DefiLlama envelope (`peggedAssets` must be an array; otherwise the DefiLlama circuit records a failure and the CoinGecko fallback runs) and quarantines null/primitive rows before the frozen-snapshot merge, then rows with absent, non-finite, negative or overflowing current aggregate buckets; an explicit zero is still admitted. Publication validates each row against the published schema and quarantines invalid rows, holding the whole list only for an invalid envelope, duplicate ids, or a cohort below the 50-row floor
- Chain normalization preserves unavailable observations as null in memory. Release A projects canonical stablecoins storage, the response-ready companion, and immutable public datasets to the legacy 0 wire for rollback safety; Release B removes these projections

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-36"></a>

## v6.36 - Hard CEX ticker coverage for MXNB and AUDD

**Effective:** 2026-09-27

Kraken MXNB/USD and Coinbase AUDD-USDC join the hard CEX ticker rosters as evidence-verified, identity-pinned markets, restoring multi-source high-confidence publication for two pool-challenge-downgraded CoinGecko single-source rows.

- `shared/lib/pricing-provider-config.ts` adds `{ symbol: "MXNB", requestPair: "MXNBUSD", responseKeys: ["MXNBUSD"] }` to `KRAKEN_MARKETS` and `{ symbol: "AUDD", productId: "AUDD-USDC" }` to `COINBASE_PRODUCTS`; this is roster config inside the already-registered adapter families, with weights, trust tiers, and freshness semantics unchanged (Kraken stays one batched ticker request; Coinbase products are serial and gain one request)
- `mxnb-juno` had been downgraded to `low` by the Trader Joe Avalanche pool challenge (364 bps divergence on the 300 bps non-USD threshold); the live Kraken MXNB/USD mid (0.0566, 41 bps from CoinGecko) corroborates as a pool-challenge-exempt hard market, so the row publishes `coingecko+kraken` at `high` confidence instead of a single-source CoinGecko print
- `audd-novatti` had been downgraded to `low` by an XDC curve-family pool challenge (868 bps divergence); Coinbase's AUDD-USDC `fx_stablecoin` book pins to the tracked Novatti AUDD Ethereum contract `0x4cCe605eD955295432958d8951D0B176C10720d5`, quotes USDC at USD par, and publishes `coinbase+coingecko` at `high` confidence while the pair's last trade is inside the 10-minute hard-market admission window — outside that window the row reverts to its previous single-source behavior

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-35"></a>

## v6.35 - Solayer sUSD Token-2022 NAV pricing

**Effective:** 2026-09-27

`susd-solayer` is priced from its on-chain Token-2022 interest-bearing exchange rate after DefiLlama's stablecoins list stopped returning a price for asset 216, CoinGecko kept only a stale thin-market ticker ($12/day, ~16 h old), and the asset's single ~$7.8K-liquidity DEX pool sat below the $50K Jupiter/DEX floors.

- `worker/src/lib/authoritative-price-sources/susd-solayer.ts` reads the confirmed jsonParsed mint account and its block time in two serial body-consumed Solana RPCs (registry routes, then public fallbacks), validates Token-2022 program ownership, mint type, 6 decimals, and a complete interestBearingConfig, and computes the exact SPL exchange rate including the on-chain whole-bps average-rate rounding (observed 1.1555805 at slot 450811104; DefiLlama circulating 732,710.146212 / raw supply 634,202.057862 = 1.15533 cross-checks it within 0.02%)
- The result publishes as high-confidence `protocol-redeem` observed at the block time inside the existing hard-protocol registry policy (replay-safe, 15-minute trusted age, depeg-authoritative-capable but not single-source); NAV band 0.5–10, fixed `susd-nav:*` rejection codes, and a dedicated `susd-solayer-nav` circuit (`CIRCUIT_SOURCE.SUSD_SOLAYER_NAV`) fail closed without touching the grouped EVM `protocol-redeem` breaker. No liquidity floor or admissibility rule changed
- Block times older than 5 minutes or more than 60 seconds in the future, future-dated rate updates, and incomplete interest configs are rejected, so the route fails closed to missing, never to a wrong price; the mint's authority-set accrual rate (3091 bps current vs 6.84% lifetime average) stays bounded by the NAV band and the non-single-source depeg corroboration policy

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-34"></a>

## v6.34 - Curve on-chain quote sizing

**Effective:** 2026-09-27

Curve `get_dy` quotes are now sized so the floored integer output spans at least 10,000 quanta, after the 2-decimal GUSD metapool output turned a 1-unit quote into a systematic 1.0101 print.

- `getDyQuoteAmount` (`worker/src/lib/curve-onchain.ts`) replaces the fixed 1-unit input: units = max(1, ceil(10_000 / 10^outputDecimals)), so a 2-decimal output quotes 100 input units while pools with at least 6-decimal outputs keep byte-identical 1-unit calldata (GUSD is the only one of 36 configured pools with outputDecimals < 6)
- get_dy floors its return to whole output quanta, so the GUSD/3Crv metapool (`useUnderlying`, USDC in) quoted 1 USDC as raw 99 = 0.99 GUSD and published 1/0.99 = 1.0101010101 (production `price_cache` `gusd-gemini`, source `curve-onchain`, confidence `low`; reproduced on-chain at Ethereum block 26064625, where a 100-unit quote prices 100/99.97 = 1.0003, the true pool price including the 0.04% fee)
- Pool admission, corroboration, and sanity validation are unchanged; residual floor bias at the sized quote is under 0.01%, the trade stays negligible against StableSwap pool depth, and the next publication restores multi-source agreement for `gusd-gemini` (coingecko/cmc re-join `agree_sources` and confidence leaves `low`)

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-33"></a>

## v6.33 - No-candidate DEX refresh recovery

**Effective:** 2026-09-24

The 15-minute narrow DEX refresh now applies the exact pass's documented no-candidate recovery instead of short-circuiting its own breaker gate. A run whose candidate plan is empty closes a non-closed `dexscreener-prices-refresh` breaker without spending a half-open probe or recording a provider verdict, so a temporarily empty cohort can no longer pin the refresh circuit open until candidates happen to return.

- `runPriceDexRefresh` (`worker/src/cron/sync-stablecoins/price-dex-refresh.ts`) calls `recoverProviderOnNoCandidates` — the same authority the hourly DexScreener exact, Jupiter, and CMC passes use — whenever `planDexRefresh` returns no batch. The half-open probe gate (`shouldAttemptFetch`) and the once-per-run `recordProviderOutcomeSafe` verdict are consulted only when a batch exists, so an empty plan neither consumes the probe interval nor records an upstream success or failure
- Price semantics are unchanged: candidate selection, the 30-address batch limit, the seven-batch/45-second envelope, pacing, the `rate-limited` and `circuit-open` degradation classes, and the staged `price:dex-refresh:v1` payload an empty run still writes are untouched
- Observed 2026-09-24: `dexscreener-prices-refresh` opened at 05:39:51 UTC after three throttled slots and stayed open for 59m46s. The 06:24 slot ran after the 30-minute probe interval had elapsed and completed its staging write, but its batch plan was empty, so the short-circuited gate never transitioned the breaker to half-open and nothing was recorded against it; the 06:39 slot's one-candidate cohort then closed it through an admitted probe. The empty-cohort recovery closes the breaker in the first empty slot instead of waiting for candidates to return

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-32"></a>

## v6.32 - Pool-challenge replacement cannot be carried by a diverging protocol minority

**Effective:** 2026-09-24

The ≥2-independent-protocol pool-challenge replacement no longer fires when the diverging protocol medians are outnumbered by the challenger protocols that corroborate the selected price, because the replacement weight is provider-reported challenger TVL and a dormant pool keeps its last traded price behind a large nominal reserve. The same precedence test now also skips the confidence downgrade when at least two independent protocol medians corroborate the selected price, so a losing diverging minority can no longer strip the tier the depeg recovery gate consumes.

- `selectReplacementProtocolGroups` in `worker/src/cron/sync-stablecoins/enrich-prices-primary-hardening.ts` now also requires the diverging protocol count to be greater than or equal to the count of protocol medians that agree with the selected price before that path returns a replacement. The guard is a precedence test over protocol medians: it neither reads nor re-weights challenger TVL, and the per-pool $100K admission floor, `DEX_FRESHNESS_SEC` freshness window, peg-aware `dex_observation` validation, and the `≥2 protocols` / 500-bps (USD) / 300-bps (non-USD) thresholds are unchanged
- Confidence downgrades only while the divergence is unresolved: the `downgrades` path is skipped when at least two independent protocol medians corroborate the selected price and strictly outnumber the diverging set (`corroboratingProtocolGroupsOutvote`, one authority with `divergingProtocolGroupsOutvote` in `worker/src/lib/constants.ts`). A tie, a diverging majority, or a single corroborating protocol still downgrades to `low` exactly as before, and any replacement that does happen still downgrades because DEX evidence displaced the consensus. A corroborated-majority asset therefore keeps the confidence tier that depeg recovery, confirmation, and peg-summary read instead of inheriting `low` from a dormant minority
- The high-TVL multi-protocol path (at least `$5M` per protocol median, directional coherence, hard-candidate agreement) and `preserveCorroboratedSevereDownside` keep replacing or preserving as before, so a genuine multi-million-dollar DEX dislocation still overrides a near-peg soft result
- Incident: `vchf-vnx` published 1.2887194119 on 2026-09-24 (status `coingeckoPriceDiff` mismatch, CoinGecko 1.2193769497, `pool-tvl-weighted`, `low`). The replacement was carried by the Celo Uniswap v3 `VCHF/USD₮` pool `0x899f68521196b4db5e3525e8ce1695efa9b05533` — whose last trade was 2026-03-15 and whose on-chain reserves hold 70.69 USDT plus 57.06 VCHF against a provider-reported $4.7M reserve and zero 24h volume — plus the ICP kongswap VCHF/ICP median, against four protocols (icpswap, raydium, aerodrome, meteora) between 1.2000 and 1.2211 and an ECB franc rate of 1.2152. The asset returns to its CoinGecko consensus with its confidence tier intact instead of a dormant pool's mark

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-31"></a>

## v6.31 - Cross-source price provenance and CMC publication trust window

**Effective:** 2026-09-23

DEX price publication now attributes and confidence-weights a retained pool's cross-source price by the family that actually observed it, with the TVL weight capped at the price row's own claim; and the CoinMarketCap publication trust window now covers the v6.29 calibrated admission windows so a bridged verified quote survives the observation handoff to the next publication.

- A cg_onchain/gecko_terminal/dexscreener price attached to a trusted dl or direct_api value row is weighted at its own family confidence (0.85x/0.55x) rather than 1.0x and at min(retained TVL, price-row TVL), so a compromised fallback provider can no longer borrow trusted-source median weight; price_sources_json attribution names the observing family, and the auxiliary staged evidence lane still admits only exact direct_api supplemental evidence
- The CoinMarketCap registry entry's maxTrustedAgeSec rises from one hour to 8,400 s: the verified-cache bridge (two fetch cadences plus five-minute grace, 7,500 s) plus one 15-minute publication slot for the :09 staging to :15 publication handoff, so a CMC-only asset no longer stays missing between a rotation-skipped fetch and its next targeted refresh
- Live targeted and category admission (3,900 s), the verified-cache identity guards, observed-timestamp preservation, fallback confidence, and non-depeg-authoritative status are unchanged; CMC remains non-replay-safe, so price_cache replay continuity is unaffected

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-30"></a>

## v6.30 - Coherence-guarded pool admission and fail-closed DEX publication

**Effective:** 2026-09-23

GeckoTerminal and CoinGecko Onchain pool admission now rejects rows whose tracked-leg USD price is incoherent with the pool's own pair ratio and the counter-leg's USD price, and DEX price publication withholds a row instead of running its primary-anchored guards against a NULL primary.

- One policy module owns the thresholds and rejection vocabulary for both admission paths (`POOL_PRICE_COHERENCE_POLICY` in `worker/src/cron/dex-liquidity/pool-price-coherence.ts`): the tracked leg's USD price must agree with the pool's own pair ratio times the counter-leg's USD price within `maxPairDivergenceBps = 500`, and the provider broken-price signature — leg USD prices published while every pair-ratio input is null or `0.0` — is rejected with reason `pool-pair-ratio-unavailable` (a usable but conflicting ratio uses `pool-pair-price-incoherent`)
- The whole pool is rejected, not just its price: a broken row stages nothing and emits no price observation or challenger row, because the same break also invalidates its `reserve_in_usd`. Rejections are counted per machine-readable reason and emitted as one warn summary per crawl run. The pre-ship dry-run over the 483 published guard-scope challenger rows rejects 24 (422 admitted, no threshold tuning) — the two Sophon USN/sUSN rows plus 21 further provider-broken GT rows across 20 tracked assets — so the DEX evidence those rows carried is removed rather than re-weighted; the retention and liquidity consequence is recorded in the liquidity-score changelog
- Zero volume and zero transactions are never rejection inputs — pool prices derive from reserves and quiet pools are legitimate — and rows whose payload omits every pair-ratio field are admitted unchecked so the guard stays inert for transports that do not carry the fields
- `dex_prices` publication fails closed when the preloaded trusted map has no usable primary: the row is withheld before staging with machine-readable reason `primary-missing` in the new `withheldByStablecoin` / `truncatedWithheldStablecoins` diagnostics, and the pre-median outlier filter, `deviation_from_primary_bps`, and display-ratio band now structurally require the primary instead of silently degrading to no-ops
- navToken measured-execution input legs price from the guarded ERC-4626 NAV override: a navToken whose published price is a high-confidence protocol-redeem override observed within the depeg primary freshness window enters the trusted quote-leg map (`isGuardedNavReferencePrice`), while a missing or stale NAV stays unpriced and never falls back to a peg or generic reference print

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-29"></a>

## v6.29 - CMC verified-quote staleness calibrated to the fetch cadence

**Effective:** 2026-09-23

The CoinMarketCap fallback's freshness windows now exceed the producer cadence instead of equaling it, so a single missed hourly quote roll or one rotation-skipped fetch hour no longer blanks otherwise priceable assets such as usdn-smardex.

- Live targeted and category quotes remain admissible for one fetch cadence plus a five-minute grace, because CMC rolls `last_updated` hourly and the consumer fetch lands just after each roll boundary
- The identity-verified targeted cache bridges up to two fetch cadences plus grace, covering the 25-slug request-cap rotation that leaves each slug unfetched for an hour when more than 25 candidates remain
- Identity, active-status, positive-volume, peg-bound, fallback-confidence, and non-depeg-authoritative guards are unchanged, observed timestamps are never refreshed, and quotes older than the bridge still go missing instead of publishing stale

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-28"></a>

## v6.28 - USDaf guarded Uniswap v4 recovery route

**Effective:** 2026-09-23

USDaf can recover a missing price from a reviewed Ethereum Uniswap v4 USDaf/USDT sell quote, so a DexScreener transport outage no longer blanks the asset.

- Only the exact reviewed USDaf/USDT pool `0xcd799508ddaa319e608547d3291a1a512da9a9acdd40599d89019ec82e3cf1e8` — recomputed from the reviewed token addresses, 500 fee units, tick spacing 10 and no hooks — is eligible, and canonical PoolManager, Quoter and ReservesLens runtime code must match reviewed hashes
- Trusted-USDT-normalized TVL from tick-integrated pool principal must clear the unchanged $50,000 DEX observation floor; token decimals and the USDT pause/blacklist state must validate, and fee-inclusive 1- and 1,000-USDaf sell quotes must agree within 5% and fit output reserves
- The pinned block and the trusted USDT parent must both remain newer than five minutes, the closing canonical block hash is rechecked, and provenance uses the older observation time
- `uniswap-v4-exact` stays fallback-confidence, non-replay-safe and non-depeg-authoritative, retains every generic soft-source severe-downside and temporal-jump publication guard, and never replaces a usable price

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-27"></a>

## v6.27 - Verified legacy USDv direct-route recovery

**Effective:** 2026-09-22

Legacy USDv can recover a missing price from a reviewed Jupiter direct sell quote backed by independently verified Meteora pool state.

- Only the exact tracked legacy mint, USDC mint and reviewed Meteora pool are eligible; pool identity, enabled state, legacy SPL vaults and active-bin inventory must validate
- Small and depth sell quotes must agree with each other and on-chain bin price, while Solana slot timestamps and the trusted USDC parent must all remain fresh
- The quote stays fallback-confidence, non-replay-safe and non-depeg-authoritative in the Meteora source family, with no exemption from soft-source severe-downside guards

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-26"></a>

## v6.26 - Guarded live price recovery routes

**Effective:** 2026-09-22

BD can recover missing prices through a verified Aerodrome sell route, and AUDm joins the reviewed Mento Broker routes.

- The BD route verifies reviewed runtime code, exact pool and token identity, canonical block state, transferable reserves, bounded fees and sell-quote depth before multiplying by a fresh trusted USDC price
- AUDm uses the existing Mento Broker implementation and its unchanged oracle, breaker, permission, trading-limit and depth checks
- These routes publish short-lived fallback confidence with the older parent or chain observation timestamp and never overwrite a usable current price
- No peg-price substitution, source-authority elevation, severe-downside exemption, or liquidity threshold relaxation is introduced

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-25"></a>

## v6.25 - Candidate-scoped promoted DEX corroboration

**Effective:** 2026-09-22

Promoted DEX protocol lanes now enter primary consensus only when that individual lane agrees with a hard source or an independent DEX lane.

- A corroborated promoted DEX lane no longer admits divergent sibling lanes into the published consensus candidate set
- Two promoted DEX lanes must agree within the existing divergence threshold before they corroborate each other
- Rejected lanes retain explicit lacked-corroboration telemetry, while the overlapping aggregate DEX candidate remains withheld when protocol lanes are present

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-24"></a>

## v6.24 - CoinGecko CLP native-peg coverage

**Effective:** 2026-09-21

The active non-USD peg registry is now guarded against drift in the CoinGecko native-peg currency map, adding direct CLP coverage for Ripio wCLP.

- `wclp-ripio` can receive a direct CoinGecko `clp` native quote during live price corroboration and native-peg backfill
- The native-peg map is checked against every active non-USD registry peg, with explicitly documented exceptions for currencies CoinGecko does not serve
- The native-peg deviation threshold is unchanged; `wclp-ripio`'s published deviation may legitimately change basis once the native quote is available

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-23"></a>

## v6.23 - Fail-closed DEX corroboration and liquidity evidence

**Effective:** 2026-09-17

A lone promoted DEX protocol can no longer enter primary consensus without an agreeing hard source, and unreviewed exact-address quotes now require parseable liquidity.

- Zero validated non-DEX sources no longer act as implicit corroboration for a single promoted DEX protocol; the candidate is rejected with explicit lacked-corroboration telemetry
- CoinGecko Onchain quotes for unreviewed targets are rejected when total reserve liquidity is missing, malformed, or below the existing $50K floor; the reviewed VUSD override remains scoped to its verified deployment
- Kraken API error arrays are provider failures rather than healthy empty coverage, and direct CEX orderbook responses are endpoint-size bounded

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-22"></a>

## v6.22 - Guarded Mento price recovery

**Effective:** 2026-09-15

CHFm, CADm and COPm can recover missing prices from verified Mento sell routes and a fresh trusted USDm price.

- The CHFm-only route verifies pool identity, fresh pinned state, synchronized reserves and balances, bounded fees, quote depth, trading-limit headroom, and the pool's swap-value constraints before admitting a quote
- CADm and COPm use verified Broker routes with oracle, bidirectional breaker, trading-limit, token permission, depth and price-impact checks
- The USD price uses the current trusted USDm price, never assumed dollar parity, and preserves the older parent or block observation time
- The mento-fpmm and mento-broker sources remain fallback-confidence, non-replay-safe, non-depeg-authoritative evidence with a five-minute lifetime and no exemption from soft-source publication safeguards
- Existing prices, source-admission thresholds, supply accounting, and the shared live-override request budget are unchanged; unavailable or unsafe pool state leaves the affected asset missing

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-215"></a>

## v6.215 - Scoped M0 inheritance and VUSD retained-DEX recovery

**Effective:** 2026-09-03

M and its USDN child can reuse a genuinely single-source replay-safe wM mark, while VUSD can publish its reviewed liquid retained-DEX aggregate without weakening global depeg trust.

- `m-m0` may inherit a fresh replay-safe `wm-m0` parent only when the parent itself reports single-source confidence; the result preserves the parent source and single-source provenance, and the existing same-run chain can then repair `usdn-noble`
- A high-confidence wM composite padded by a non-replay-safe address source remains ineligible for M inheritance, and cached, stale, fallback, low-confidence, or provenance-less parent marks remain rejected
- `vusd-virtue` alone may admit a fresh retained DEX aggregate with at least $250K TVL as the existing soft `dex-promoted` primary-publication voice; unreviewed assets retain the $1M aggregate floor
- The global $1M depeg-trust floor, exact-address provider liquidity floor, DEX freshness checks, and severe-downside corroboration gate are unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-214"></a>

## v6.214 - Canonical sUSDS and sUSDe vault NAV coverage

**Effective:** 2026-09-01

Sky sUSDS and Ethena sUSDe can publish authoritative NAV prices from their canonical Ethereum ERC-4626 vaults and tracked parent assets.

- `susds-sky` resolves `convertToAssets(1 share)` from the canonical Ethereum vault and multiplies the USDS-denominated rate by the fresh trusted `usds-sky` price
- `susde-ethena` resolves `convertToAssets(1 share)` from the canonical Ethereum staking vault and multiplies the USDe-denominated rate by the fresh trusted `usde-ethena` price
- The existing parent-provenance gate, 0.5-10 assets-per-share bounds, 24-hour last-good rate cache, publication priority, and circuit semantics are unchanged
- Neither wrapper receives a synthetic par price: a missing or untrusted parent, invalid vault rate, or unavailable live/cache quote fails closed and leaves the asset unpriced
- `steakusdc-steakhouse` remains on its healthy pre-existing ERC-4626 registration; this revision does not add or alter its source route

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-213"></a>

## v6.213 - NAV supply valuation from the protocol-redeem route

**Effective:** 2026-08-30

Supplemental NAV/yield-bearing vault tokens that lose every market price source can value their on-chain supply through the existing protocol-redeem vault route instead of dropping out of publication.

- `sbold-k3-capital` and `eearn-ember` re-enter active publication after CoinGecko and DefiLlama dropped their market rows: intake now resolves `convertToAssets(1 share)` x the trusted tracked parent price (BOLD and USDC respectively) for supply valuation only
- The pre-intake resolver reuses the unchanged parent-trust gate against the previous published payload's parent row, the live on-chain rate read, and the bounded 24-hour cached-rate degradation lane; no freshness policy is relaxed
- The resolved NAV never publishes as the asset's price: the row enters with a missing price and the live protocol-redeem override stage re-prices it in the same run
- NAV/yield-bearing assets remain never par-valued: without a trusted NAV the asset stays out of the payload and continues to report as dropped tracked coverage

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-212"></a>

## v6.212 - Reviewed exact-address request-cap reservation

**Effective:** 2026-08-27

CoinGecko Onchain now reserves a network request for an eligible reviewed exact-address override before applying its five-request cap.

- The verified VUSD IOTA-EVM target remains inside the bounded request set even when the durable fairness cursor places five other networks ahead of it
- Reservation is limited to exact entries in the reviewed override table; ordinary missing-price and source-depth targets retain their existing cohort order and cursor fairness
- The five-request cap, 30-address batch size, metadata identity gate, $50K liquidity floor, soft-source trust, and fail-closed publication policy are unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-211"></a>

## v6.211 - Reviewed VUSD IOTA-EVM exact-address recovery

**Effective:** 2026-08-27

VUSD exact-address recovery now uses its verified, liquid IOTA-EVM deployment without spending that asset's CoinGecko Onchain target on the non-traded native IOTA coin type.

- IOTA EVM maps to CoinGecko Onchain's verified `iota-evm` network identifier, making exact token-address requests eligible on the production provider
- A provider-specific reviewed override narrows `vusd-virtue` to `0x10740259a1860af3327dd0642ee35d6e8e7143ff` only while that exact deployment remains in current stablecoin metadata and the provider still supports its chain
- A stale or mismatched override emits no target rather than synthesizing an address; request caps, the $50K liquidity floor, soft-source trust, depeg authority, contracts metadata, and supply calculation remain unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-21"></a>

## v6.21 - Reviewed HCHF low-volume price recovery

**Effective:** 2026-08-27

HCHF can recover a missing live price from its verified CoinGecko identity when the upstream quote remains inside the existing low-volume freshness and peg-validation guards.

- `hchf-hedera-swiss-franc` joins the scoped `coingecko-low-volume` allowlist after Pharos and DefiLlama both resolved the asset to CoinGecko id `hedera-swiss-franc`
- The fallback still runs only after earlier recovery passes fail, fills only a missing price, and publishes with fallback confidence
- The existing seven-day source-age ceiling, CHF peg-aware bounds, non-replay-safe treatment, and confirm-required depeg trust remain unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-209"></a>

## v6.209 - Retired Pyth lane and partial-success DEX breaker healing

**Effective:** 2026-08-26

The Pyth Hermes hard-oracle lane is retired after Pyth's 2026-08-26 API-key mandate, while DexScreener discovery now heals its aggregate breaker after a partially successful crawl despite a later WAF refusal.

- Pyth's free tier no longer provides API access, so primary consensus runs without the Pyth weight-2 oracle lane and new stablecoin metadata no longer carries `pythFeedId` values
- The retired Pyth registry key remains available only for historical provenance, so prior `pyth` price-source rows remain renderable without reactivating the provider
- DexScreener discovery records a successful aggregate `dexscreener-liquidity` breaker outcome when at least one request in the crawl succeeds; a later HTTP 429 or WAF 1015 still stops subsequent requests but no longer converts that partial-success run into a failure
- A DexScreener crawl with zero successful requests still records a breaker failure, preserving hard-refusal protection when the provider is unreachable for the full run

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-208"></a>

## v6.208 - Protocol-diverse DEX challenger retention

**Effective:** 2026-08-14

DEX challenger snapshots now preserve qualifying protocol diversity before applying their TVL coverage target, allowing the existing multi-protocol guard to replace an incorrect soft aggregator price.

- Challenger selection first retains the highest-TVL qualifying pool from each protocol, ordered by total qualifying protocol TVL, before filling remaining rows toward the existing 95% TVL coverage target
- When more than 50 protocols qualify, the existing hard cap retains representatives from the 50 largest protocol groups; filtering, pool deduplication, freshness, and the per-pool TVL floor are unchanged
- The existing requirement for at least two independently named divergent protocols remains unchanged, as do source weights, CoinGecko handling, DEX price calculation, validation bounds, and depeg-authority policy

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-207"></a>

## v6.207 - DEX discovery and guarded-quote circuit alignment

**Effective:** 2026-08-07

DexScreener discovery now uses the provider's complete single-token pool endpoint, while guarded AZND no-quote results no longer count as provider outages.

- The isolated DEX discovery crawl uses `/token-pairs/v1/{chainId}/{tokenAddress}` so one-token discovery receives the complete advertised pool set; batched price lookup remains on `/tokens/v1/{chainId}/{addresses}`
- Existing DexScreener pacing, no-retry discovery policy, hard-refusal containment, pool validation, and run-level circuit accounting remain unchanged
- AZND still requires the exact reviewed Curve pool identity, fresh block, minimum balances, and bounded quote impact; a guard rejection remains an explicit missing price instead of incrementing the provider circuit
- Thrown, timed-out, or aborted AZND provider requests still record circuit failures, and the route remains fallback-confidence, non-replay-safe, and non-depeg-authoritative

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-206"></a>

## v6.206 - DexScreener WAF refusal containment

**Effective:** 2026-07-27

DexScreener exact-price recovery now batches same-chain targets, while all token-pool lanes stop immediately on provider-side 429 or Cloudflare 1015 refusals.

- The late exact-price fallback makes one request for up to 30 same-chain addresses per run instead of up to 10 single-address requests, with quarter-hour chain rotation and bounded within-chain rotation preserving coverage
- DexScreener discovery records one source-wide outcome per full run rather than one per coin; a hard refusal is recorded immediately so the overlapping liquidity stage sees the open circuit
- Discovery and liquidity fallback stop sending later token-pool requests after a hard refusal, and a refusal overrides earlier partial success for breaker accounting
- Price validation, exact address matching, source confidence, and successful quote selection remain unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-205"></a>

## v6.205 - Thin Curve quote corroboration guard

**Effective:** 2026-07-20

AZND Curve exact-pool fallback quotes now remain subject to soft-source corroboration before publishing severe fixed-peg downside or large temporal jumps.

- `curve-thin-onchain` still requires the asset-specific Curve identity, freshness, balance, and quote-impact checks before producing fallback evidence
- The source no longer bypasses severe fixed-peg downside corroboration or temporal-jump withholding solely because the route-level checks passed
- A single thin-pool AZND quote remains non-replay-safe, non-depeg-authoritative, and insufficient by itself to publish a severe or jumpy fixed-peg price

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-204"></a>

## v6.204 - Full-precision CoinGecko simple prices

**Effective:** 2026-07-20

All Worker CoinGecko simple-price requests now ask for full precision so peg and depeg decisions consume the unrounded upstream quote.

- A shared request-path helper forces `precision=full` while preserving every caller's existing ids, quote currencies, market-cap fields, and freshness parameters
- Primary, supplemental, native-fiat, pending-confirmation, supply-gap, status, and auxiliary yield price paths use the same precision policy
- CoinGecko `last_updated_at` freshness checks and all existing validation, consensus, and source-weight rules remain unchanged

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-203"></a>

## v6.203 - Cached-rate degradation for vault NAV routes

**Effective:** 2026-07-19

Parent-derived vault routes now persist their last-good on-chain rate and can publish cached-rate × fresh trusted parent price under an explicit low-confidence source when the live rate read fails, instead of leaving the asset without an active price.

- Successful ERC-4626 convertToAssets, Aave previewRedeem, and Idle CDO virtualPrice reads persist their assets-per-share rate to a durable vault-rate cache
- When the live rate read fails for an asset without a publishable current price, the route publishes cached rate × fresh trusted parent price as `protocol-redeem-cached-rate` with low confidence; rates older than 24 hours or outside the vault sanity bounds never publish
- The cached lane still requires the same trusted parent as the live route, never replaces a publishable incumbent price, is never replay-safe or depeg-authoritative, and carries the rate and its observation time in override metadata
- When neither a live rate nor a trusted cached rate exists, the route fails exactly as before, including grouped-circuit failure accounting
- Cron metadata counts cached-rate fallbacks and the attempt ledger records them as resolved `protocol-redeem-cached-rate` attempts for per-run visibility

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-202"></a>

## v6.202 - Composite parent-trust monotonicity

**Effective:** 2026-07-19

Parent-derived pricing routes and replay-cache admission now judge composite provenance on its replay-safe core, so an agreeing non-replay-safe corroborator joining a consensus label can no longer strip trust from a high-confidence parent price.

- Authoritative parent trust accepts a high-confidence composite whose replay-safe core keeps at least two members, as if agreeing soft corroborators such as exact-address augmentation lanes were absent
- A single replay-safe core member padded to high confidence by soft corroborators is admitted only under the existing scoped single-source opt-in and keeps single-source provenance, so padding can neither downgrade nor upgrade parent trust
- Replay-cache admission computes the trusted window over the replay-safe core; core-less labels, unknown source keys, and cached-replay lineage still never replay
- Exact-address augmentation no longer targets assets with three or more consensus sources and healthy confidence merely because a short-window composite member makes their observation expire before the next generation; expiring observations only order priority among already-eligible thin-coverage targets
- Authoritative attempts rejected by parent trust are ledgered as `untrusted-parent` with the parent id and rejection reason instead of an opaque missing quote

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-201"></a>

## v6.201 - Fair active-price recovery scheduling

**Effective:** 2026-07-19

Live recovery now treats provenance-less numeric prices as unresolved and bounds each override candidate so one stalled wrapper cannot consume the full active-price repair budget.

- Authoritative live overrides and exact-address augmentation classify a current price as usable only when it is positive and carries publishable source plus observation-time provenance
- Missing-only routes such as AZND can still run when an incumbent numeric value lacks provenance that would survive publication
- Each live override candidate receives a bounded timeout inside the unchanged ten-second shared budget, so a slow protocol-redeem candidate fails its own attempt instead of skipping the remaining active gaps
- Candidate-local timeout failures are recorded as asset-attributable timeout attempts without exhausting the shared stage budget or poisoning the grouped recovery circuit

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-200"></a>

## v6.200 - Persistent active-price recovery priority

**Effective:** 2026-07-19

Persistent active price gaps now run ahead of refresh-oriented pricing work, and reviewed AZND Curve exact-pool quotes can publish after route-level checks pass.

- Authoritative live overrides schedule alert-eligible current missing assets first and keep every current missing candidate ahead of already-priced refresh candidates
- Exact-address provider targeting now uses previous active-price coverage streaks, pinning alert-eligible gaps ahead of current misses, recent misses, expiring observations, low-depth priced rows, and broad priced refreshes
- `curve-thin-onchain` remains fallback-confidence, non-replay-safe, and non-depeg-authoritative, but it bypasses generic soft-source publication corroboration after the identity-bound Curve route has passed freshness, balance, and impact checks
- Authoritative override candidates that resolve but fail publication validation now append asset-attributable rejection records to the existing price-source attempt ledger

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-199"></a>

## v6.199 - CMC truncated-category validation hardening

**Effective:** 2026-07-19

CoinMarketCap fallback now ignores truncated category rows and requires unresolved configured slugs to pass the exact targeted quote validation lane.

- CMC category responses with an unseen tail remain visible as truncated-response diagnostics, but their returned rows no longer resolve prices
- Configured CMC slugs that remain missing after a truncated category response must pass exact slug and symbol, active-record, positive-volume, configured-contract, freshness, and peg-aware checks before publishing
- This preserves complete-category fallback behavior while preventing spoofed truncated category rows from suppressing the safer targeted quote path

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-198"></a>

## v6.198 - Quarter-hour pricing headroom guard

**Effective:** 2026-07-18

Production stablecoin pricing now disables optional exact-address primary augmentation and lowers primary-provider fanout so the quarter-hour Worker can complete core price publication under heap pressure.

- Checked-in production Worker config pins `ADDRESS_PRICE_PROVIDERS_ENABLED=none`; exact-address providers remain documented and available only through an explicit future re-enable
- Primary provider collection now runs two provider fetches concurrently instead of four, preserving connection-budget compliance while reducing simultaneous response and consensus assembly memory
- The late bounded fallback passes, authoritative live routes, DEX bridge, CEX/oracle/aggregator providers, and depeg guardrails remain unchanged
- This trades optional source-depth augmentation for reliable active-price publication until Worker memory headroom is re-audited

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-197"></a>

## v6.197 - PHPm Broker-only recovery

**Effective:** 2026-07-18

PHPm live recovery returns to the exact Celo Mento Broker route only, retiring the heavier dual-pool DEX fallback while keeping dedicated circuit isolation and fail-closed coverage.

- The PHPm authoritative provider no longer imports the Celo Uniswap V3 factory and Quoter path into the quarter-hour stablecoin pricing sync
- PHPm still requires one fresh Celo block, exact Broker and BiPool identities, a 1,000 PHPm quote, at least 1 million USDm of counter-bucket capacity, and a current trusted USDm dependency
- If the Broker route fails or returns no accepted quote, PHPm receives no authoritative override and remains an explicit active-price coverage gap instead of falling through to a secondary DEX route
- The dedicated `phpm-price-route` circuit remains isolated from the grouped `protocol-redeem` breaker, and optional refresh failures stay neutral while a usable incumbent price exists

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-196"></a>

## v6.196 - Active-scope pricing and deterministic PHPm recovery

**Effective:** 2026-07-18

Live recovery budgets now serve only active assets, while a reviewed dual-pool Celo route restores PHPm when its preferred Mento quote is unavailable without weakening price provenance or depeg guardrails.

- Authoritative live-override candidates are restricted to the exact active registry, so frozen or quarantined assets cannot consume the shared ten-second budget ahead of active missing-price work
- When the preferred PHPm Mento Broker route does not produce an accepted quote and no usable price already exists, the worker binds the exact PHPm/USDT and PHPm/USDC pools through the official Celo Uniswap V3 factory and quotes both routes at one fresh block
- Both PHPm routes must pass 1,000- and 10,000-token impact checks and agree after trusted USDT/USDC normalization; the `uniswap-v3-exact` result remains fallback-confidence, non-replay-safe, and non-depeg-authoritative
- The combined PHPm route uses its own recovery circuit, and optional refresh failures remain neutral while an incumbent price is usable so they cannot suppress later missing-price recovery
- PHPm zero-supply collapse can use the reviewed Celo total-supply repair only after a successful on-chain read and current PHP FX normalization; MNEE, VEUR, and KRWO remain explicit fail-closed coverage gaps

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-195"></a>

## v6.195 - Reviewed-route recovery and long-tail provider repair

**Effective:** 2026-07-18

Reviewed exact-market quotes and circuit-backed protocol probes now retain priority over lower-fidelity duplicate rows and shared-budget starvation, while dEURO returns to its positive CoinGecko supply and bounded low-volume price path.

- An eligible exact direct-API pool with a reviewed quote dependency can replace a unique derived-identity DefiLlama duplicate even when the hosted API reports zero 24-hour volume, so the exact USP Balancer quote reaches retained-pool pricing without double-counting liquidity
- Circuit-backed live routes run before ordinary authoritative candidates and started probes finalize their circuit outcome on shared-budget abort, preventing recovered half-open routes from remaining stranded behind unrelated work
- USX on-chain quotes use independent Optimism and Base RPC fallbacks while preserving the existing two-route agreement, reserve-depth, block-freshness, and trusted-USDC dependency checks
- dEURO uses CoinGecko as its runtime admission provider while retaining its DefiLlama identity for capture, and its audited CoinGecko row can fill a still-missing price through the existing fallback-confidence seven-day low-volume lane
- AZND and Mento continue to fail closed when their reviewed market depth or protocol oracle is unavailable; no threshold, freshness window, or nominal peg fill was relaxed

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-194"></a>

## v6.194 - Exact retained-pool price evidence join

**Effective:** 2026-07-17

Exact direct-API price evidence can now survive physical-pool dedup when the same canonical pool remains on the final retained scoring surface.

- A direct quote discarded as an exact duplicate can contribute to `dex_prices` only when its canonical pool id matches a final retained pool for the same asset
- Both the retained pool and the exact evidence must independently clear the existing $50,000 price-observation floor; joined weight is capped at the smaller TVL
- Derived identities, mismatched pool ids, sub-threshold evidence, and raw observations without a retained pool still fail closed
- The reviewed Balancer USP route can reach the pricing bridge without double-counting the pool or weakening retained-pool admission

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-193"></a>

## v6.193 - Missing-price coverage and deterministic route hardening

**Effective:** 2026-07-16

Active-price coverage now degrades health independently of row publication, while reviewed protocol and exact-market routes recover long-tail assets without relaxing global freshness, replay, or depeg-authority rules.

- Cron metadata and public health identify active assets with unusable prices, affected raw USD circulating value, missing-generation streaks, last accepted provenance, and current rejection context while cache publication continues; a two-generation gap emits an asset-specific delivery-deduplicated alert
- Already-missing and soon-expiring assets retain priority access to bounded provider budgets instead of being rotated behind breadth-oriented already-priced assets, and asset-level route attempts remain available through metadata compaction
- sAID, sYUSD, Kava USDX, PHPm, and USX use narrowly scoped protocol or executable-pool routes with current dependency, identity, depth, freshness, and route-agreement checks
- JUSD uses a funded, publicly executable Citrea bridge burn path behind a dedicated circuit, while USP uses a reviewed Balancer SOR route whose USDC quote must be converted by an independently authoritative current USDC price
- KRWO corrects Pancake V3 pair orientation, and every DEX aggregate now passes peg-aware validation before it can replace or enter `dex_prices`
- Configured unresolved CoinMarketCap slugs use a rotating exact-identity targeted quote pass; verified results preserve their original upstream time through the hourly quota cooldown, while inactive, stale, zero-volume, wrong-contract, and peg-impossible quotes remain missing
- The exact AZND Curve route is published only with fallback confidence after fresh-block identity, balance, and bounded-impact checks, so a thin display quote cannot independently become depeg-authoritative evidence or replay-safe cache state
- MNEE, VEUR, and NXUSD remain explicit coverage failures when reviewed sources are inactive, depleted, stale, or non-executable; the pipeline does not replace those gaps with nominal peg values
- Royal RUSD and REUR leave active pricing scope after primary evidence showed their public venue and withdrawals closed; no nominal par prices replace the discontinued market

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-192"></a>

## v6.192 - Independent-source consensus and missing-price scheduling

**Effective:** 2026-07-15

Pricing now counts independent provider families once, gives missing assets fair access to bounded recovery lanes, and re-resolves local dependency chains after fallback enrichment.

- Repeated chain or contract quotes from one provider are collapsed before consensus, and correlated source labels sharing one registered family contribute only one independent voice
- Authoritative live candidates prioritize missing prices globally and round-robin provider families so one large ERC-4626 cohort cannot consume the full shared wall-clock budget
- Registry-derived sGHO and sAID vault configs recover current ERC-4626 NAV prices without duplicating contract addresses in pricing code
- A cheap local-only post-fallback authoritative pass lets dependent assets such as Noble USDN inherit a parent repaired during the same sync without repeating RPC-backed probes
- DexScreener exact fallback rotates candidates and deployments while attempting one deployment per asset before second deployments, and unusable final prices publish only explicit `missing` provenance
- Status diagnostics warn when DEX observations cross the 35-minute pricing-admission limit even if the longer-lived public DEX cache remains display-healthy
- Post-enrichment validation retains same-run primary quote evidence when fallback recovery replaces the selected price, so independently corroborated severe depegs publish while single-source and list-only evidence remains withheld
- Live CEX provider rosters follow active listing eligibility, removing delisted BFUSD from Binance collection and depeg confirmation while retaining the generic stable-quote conversion contract

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-191"></a>

## v6.191 - Missing-price recovery for audited low-volume and NAV assets

**Effective:** 2026-06-27

Expanded targeted missing-price recovery without relaxing global freshness or depeg guardrails.

- `autoUSD` and `sYUSD` now use authoritative ERC-4626 `convertToAssets(1 share)` NAV pricing against their trusted parent assets
- ERC-4626 NAV overrides run before lower-priority RPC-backed override families so missing wrapper prices are less likely to be skipped by the shared live override budget
- `usdn-noble` now inherits fresh replay-safe tracked `m-m0` pricing as an M0-backed rebasing Noble unit
- `usdk-kast` and `xo-exodus` can inherit a fresh replay-safe single-source `wm-m0` parent price while still rejecting cached, stale, fallback, and untrusted parents
- `usdn-smardex` and `cadm-mento` join the scoped `coingecko-low-volume` fallback allowlist when CoinGecko has a near-peg quote inside the relaxed low-volume freshness window

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-19"></a>

## v6.19 - Authoritative override budget prioritization

**Effective:** 2026-06-24

Live authoritative protocol overrides now attempt cache/local repairs before RPC-backed probes and prioritize still-missing prices within each provider tier.

- Local protocol-par and inherited tracked-base overrides can no longer be skipped behind slower ERC-4626 or redeem-preview RPC calls when the 10-second live override budget is exhausted
- RPC-backed override candidates that are still missing a price are attempted before already-priced wrapper candidates in the same cost tier
- The override registry remains stable for ties, preserving existing provider order when priority and missing-price state are equal

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-18"></a>

## v6.18 - Fiat FX upside validation parity

**Effective:** 2026-06-23

Fresh or static fiat FX peg references now use the same upside tolerance ratio as USD pegs, while commodity references keep their broader 2x validation band.

- EUR, JPY, GBP, and other fiat FX pegs now reject reference-backed upside prints at the USD-band ratio instead of allowing prices up to 2x the FX reference
- Gold and silver commodity pegs retain the existing 2x reference band because their token prices scale with volatile metal spot references and `commodityOunces`
- Authoritative downside modes remain unchanged, so protocol redemption and historical backfill paths can still admit deep downside when that mode explicitly allows it

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-17"></a>

## v6.17 - DEX aggregate and high-TVL outlier guards

**Effective:** 2026-06-19

Primary pricing now withholds the aggregate `dex-promoted` fallback whenever a promoted protocol DEX candidate exists, and the high-TVL pool challenge can ignore incoherent same-direction outliers when a coherent multi-protocol subset still corroborates the depeg.

- `dex-promoted` can no longer re-enter consensus as an aggregate fallback after the same bridge row produced a promoted protocol candidate that was rejected for registry, freshness, TVL, or corroboration reasons
- The aggregate DEX fallback remains available only when no promoted protocol candidate exists for the asset and the Binance overlap guard is clear
- High-TVL directional pool challenge now selects the largest coherent same-direction protocol subset, so one incoherent outlier no longer vetoes otherwise corroborated DEX replacement evidence

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-16"></a>

## v6.16 - DEX pool replacement price validation

**Effective:** 2026-06-14

Pool-challenge protocol medians must now pass the same peg-aware DEX observation validation used by DEX liquidity before they can downgrade or replace a primary price.

- Inverse or otherwise implausible commodity pool marks are ignored before pool-challenge divergence and replacement checks
- `pool-tvl-weighted` can still publish corroborated DEX replacements when the protocol medians are plausible for the asset's peg and denomination
- Commodity tokens such as one-ounce gold assets can no longer be published at near-zero inverse prices from malformed challenger rows

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-15"></a>

## v6.15 - DexScreener liquidity breaker isolation

**Effective:** 2026-06-07

Optional DexScreener liquidity and discovery pool lookups now use their own circuit breaker, preserving the exact-address stablecoin price fallback when liquidity recovery is slow or unavailable.

- `dexscreener-prices` now protects only the exact token-address stablecoin pricing fallback
- `dexscreener-liquidity` protects optional DEX liquidity and discovery pool lookups and is excluded from public-impact breaker counts
- `sync-dex-liquidity` records one aggregate DexScreener fallback outcome per run, so target-level failures or budget exhaustion cannot trip a source breaker multiple times in one run

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-14"></a>

## v6.14 - Depeg-sized hard-corroborated DEX replacement

**Effective:** 2026-06-06

Pool challenge can now replace a depeg-sized soft consensus price when a high-TVL DEX protocol median agrees with a hard primary candidate.

- The single-protocol replacement exception no longer requires the published soft result itself to be inside the peg depeg threshold
- The replacement still requires at least $5M of protocol-level DEX TVL, depeg-sized DEX evidence, material divergence from the published soft result, and hard market/oracle/protocol candidate agreement
- Uncorroborated single-protocol divergence, same-protocol noisy pools, and incoherent cross-protocol DEX prices still preserve the original price while downgrading confidence

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-13"></a>

## v6.13 - RedStone stablecoin-id attribution

**Effective:** 2026-06-06

RedStone oracle quotes are now attributed by configured canonical stablecoin id before primary consensus, preventing same-symbol assets from sharing one hard-oracle feed.

- Each `REDSTONE_SYMBOL_CONFIG` entry declares the stablecoin id that may consume that feed
- Consensus looks up RedStone quotes by stablecoin id, not by bare asset symbol
- The live RedStone `USDH` feed is pinned to Native Markets USDH because its source set is Hyperliquid/HypEVM-specific, so Hubble USDH no longer receives that quote

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-12"></a>

## v6.12 - High-TVL directional DEX pool challenge

**Effective:** 2026-06-05

Pool challenge can now replace a recovered soft consensus price when multiple high-TVL DEX protocol medians coherently show the same depeg direction.

- The standard replacement path still replaces when at least two protocol medians diverge beyond the peg-aware pool threshold
- A high-TVL multi-protocol path now also replaces a near-peg soft result when at least two protocol medians each carry at least $5M TVL, cross the peg depeg threshold in the same direction, diverge from the soft result by at least the depeg threshold, and agree with each other inside the existing pool-challenge bps band
- The single-protocol exception remains hard-corroborated only; same-protocol noisy-pool protection and incoherent cross-protocol prices still preserve the original price while downgrading confidence

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-11"></a>

## v6.11 - High-TVL hard-corroborated pool challenge

**Effective:** 2026-06-05

Pool challenge can now replace a recovered soft consensus price when a high-TVL DEX protocol median is depeg-sized and agrees with a hard primary candidate.

- The standard replacement path still requires at least two independent diverging DEX protocols
- A single-protocol replacement is now allowed only when the protocol median carries at least the existing $5M high-TVL threshold, the published price is still inside the peg depeg threshold, and a hard market/oracle/protocol candidate agrees with that DEX mark
- This keeps same-protocol noisy-pool protection while allowing APXUSD-style Curve on-chain plus Curve DEX evidence to override a near-peg soft cluster

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-1"></a>

## v6.1 - DEX pricing source utilization expansion

**Effective:** 2026-05-24

Primary pricing now uses more of the existing DEX surface through additional hard Curve routes, Uniswap V3/V4 protocol lanes, restored aggregate fallback behavior, and low-depth exact-address/Jupiter augmentation.

- Hard Curve on-chain coverage now includes audited direct pools plus explicit opt-in one-hop and chained-hop routes that fail closed on missing dependencies or cycles
- `uniswap-v3-dex` and `uniswap-v4-dex` can enter consensus as soft DEX lanes when `dex_prices.price_sources_json` publishes corroborated protocol evidence
- At v6.1, `dex-promoted` was withheld only when a promoted protocol DEX lane was actually admitted, so rejected lone protocol candidates did not suppress the aggregate DEX voice
- Exact-address providers prioritize missing and low-depth priced assets, report request-cap skips, and Jupiter can append bounded soft evidence to agreeing low-depth Solana prices without replacing the primary price

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-09"></a>

## v6.09 - Weak address-provider depeg withholding

**Effective:** 2026-05-24

Single-source fallback/search-family address quotes can no longer publish fixed-peg depeg-sized prices without corroboration.

- Exact-address augmentation can still fill or corroborate near-peg prices for thin assets
- A fallback/search-family source such as CoinGecko Onchain address pricing is rejected when it is at least 500 bps from a fixed peg and no stronger source corroborates the move
- Rejected weak address-provider candidates fall through to later enrichment, allowing exact DefiLlama contract fallback to repair assets such as Tangent USG when that contract quote remains near peg

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-08"></a>

## v6.08 - Scoped live-parent wrapper price repair

**Effective:** 2026-05-24

Audited wrapper assets can use fresh high-confidence live parent prices even when the parent consensus includes address-derived providers.

- sBOLD and yBOLD can publish ERC-4626 NAV prices from BOLD when BOLD's same-run consensus is fresh and high-confidence
- KAST USDK and XO Cash can inherit fresh high-confidence wM pricing as scoped M0 extension units

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-07"></a>

## v6.07 - Curated production price-gap closure

**Effective:** 2026-05-24

Audited production gaps now recover through scoped CoinGecko, FX-par, and curated on-chain repair paths.

- MNEE and VEUR join the allowlisted `coingecko-low-volume` fallback
- CADD and Mento JPY/ZAR/XOF stables can use FX-par `protocol-redeem` pricing plus fail-closed on-chain zero-supply repair

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-06"></a>

## v6.06 - DexScreener symbol-search retirement

**Effective:** 2026-05-22

The last-resort DexScreener symbol-search fallback is retired after production probes showed Worker-side upstream refusals and no live price recoveries.

- `dexscreener-search` remains visible as a legacy circuit key, but new stablecoin sync runs no longer call `/latest/dex/search`
- DexScreener exact-address fallback remains available through the separate `dexscreener-prices` lane
- Addressless assets that cannot resolve through DefiLlama, CoinMarketCap, Jupiter, CoinGecko low-volume recovery, or an exact tracked deployment now remain explicitly missing instead of probing noisy symbol search

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-05"></a>

## v6.05 - DexScreener address breaker hardening

**Effective:** 2026-05-20

DexScreener exact-address primary augmentation is now explicit opt-in, and address-provider circuit accounting ignores blocked or locally skipped runs.

- `dexscreener-address` remains available as a weight-1 soft primary-consensus source when operators explicitly include it in `ADDRESS_PRICE_PROVIDERS_ENABLED`
- Unset address-provider configuration now defaults to DexPaprika plus configured key-backed providers, avoiding quarter-hourly calls to DexScreener's Cloudflare/WAF-protected public token endpoint
- Open address-provider circuits no longer accumulate additional failures from skipped blocked runs; only actual upstream attempts can fail the provider breaker

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-04"></a>

## v6.04 - DexScreener address augmentation throttle

**Effective:** 2026-05-18

DexScreener exact-address primary augmentation now limits itself to one token batch per stablecoin sync and stops immediately on hard upstream refusal.

- `dexscreener-address` remains a weight-1 soft primary-consensus source, but its public `/tokens/v1/{chain}/{addresses}` lane is now explicitly opportunistic under the 15-minute sync cadence
- A DexScreener `429` / Cloudflare 1015 response no longer causes the same sync run to send the remaining address batches, reducing repeated source-wide breaker opens
- Valid empty DexScreener token-batch responses still count as healthy coverage misses, so thin or unindexed addresses do not poison breaker state

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-03"></a>

## v6.03 - XOF secondary FX peg support

**Effective:** 2026-05-14

West African CFA franc pegs now have explicit XOF metadata, secondary daily FX references, chart reconciliation, and deterministic validation bounds.

- `xofm-mento` can be tracked as an active XOF-pegged stablecoin instead of being forced into OTHER or rejected by peg metadata validation
- `peggedXOF` uses the same dated `fawazahmed0/currency-api` secondary FX cadence as CNH, RUB, UAH, ARS, KGS, NGN, and VND for live sync, realtime fallbacks, and historical backfills
- Price validation now classifies XOF as `fiat_fx` with explicit USD/XOF hardcoded bounds for no-reference guardrails
- The CoinGecko native-peg lane remains disabled for XOF because CoinGecko does not currently expose a usable `xof` simple-price quote

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-02"></a>

## v6.02 - Derivative and redemption-par gap closure

**Effective:** 2026-05-13

Active assets with observable supply but missing market prices can now resolve through guarded parent inheritance, fee-adjusted redemption inheritance, or scoped redemption-par references.

- `m-m0` inherits the tracked `wm-m0` live price through the same trusted-parent gate used by downstream M0 extension units
- `weusd-picwe` inherits tracked `usdc-circle` pricing with the documented 1% redemption-fee haircut, so market cap reflects the bounded USDC exit rather than a missing secondary-market quote
- `sofid-sofi`, `usbd-bima`, and `usdq-quill` can publish nominal `protocol-redeem` USD parity when active supply is observable and the redemption path is already source-reviewed in the backstop registry
- `chfau-allunity` can publish `protocol-redeem` CHF parity only when the current CHF/USD FX reference is fresh or static; stale or absent FX data fails closed

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-01"></a>

## v6.01 - Composite-parent NAV inheritance freshness

**Effective:** 2026-05-13

Protocol-backed NAV wrappers can now inherit from fresh same-run high-confidence composite parent prices even when the composite's oldest component timestamp is older than one short-window source.

- `gtusdc-gauntlet` recovers its ERC-4626 `protocol-redeem` price from on-chain `convertToAssets(1 share)` times the tracked `usdc-circle` parent instead of publishing a weak DEX/GeckoTerminal market price
- The fallback applies only to replay-safe composite parents with a fresh `priceSyncedAt`; low-confidence, stale-sync, cached, single-source, or non-replay-safe parent prices still cannot upgrade into child `protocol-redeem` prices
- The CoinGecko drift status comparison explicitly ignores frozen archive rows, so discontinued assets such as BUCK do not dominate the active price-drift watchlist

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="changelog-v-6-0"></a>

## v6.0 - Moralis quota-bounded exact-address augmentation

**Effective:** 2026-05-13

Moralis exact-address augmentation now uses the documented 100-token batch size and a smaller per-run request cap so the 15-minute sync cadence stays inside the provider's free daily compute-unit envelope.

- `moralis-address` remains a weight-1 soft primary-consensus candidate and is still optional through `ADDRESS_PRICE_PROVIDERS_ENABLED`
- The Moralis pass is capped at 3 batch requests per sync, down from 10 smaller batches, reducing worst-case daily usage from about 96k CUs/day to about 28.8k CUs/day at the current 15-minute cadence
- CoinGecko-only detail pages now record circuit health from upstream transport success instead of stale or empty per-asset history, so expected history gaps fall back to local supply history without opening the source-wide breaker

Origin: Contemporaneous release record

Commits: Commit provenance not recorded