MetaFlux 0.8.12 — The token registry reported no EVM contract for any token, including the four that have one

This release is live. MetaFlux 0.8.12 swapped in at block height 18,520,000 on chain 114514. It corrects a read that was wrong for every token, opens spot TWAP and spot chase orders, and makes the MIP-3 deployer oracle reachable from both client SDKs.

The token registry reported no EVM contract for any token, including the four that have one — Every token in the market metadata read carried `evm_contract: null`, while the binding registry named a real contract for BTC, ETH, SOL and PUMP. Anyone integrating from the token registry concluded the chain binds nothing and the chain credited the contract anyway. The cause: the read served a field the deployer supplies at token registration, which nothing validates and no transfer path consults. It now serves the contract the chain will actually credit, taken from the same predicate a Core-to-EVM transfer asks. A token whose deployer declared a contract that was never bound now reports null, which is the truth. The `evm_extra_wei_decimals` value beside it is also deployer-declared and does not change a credit — a credit lands in the token's `wei_decimals`, the field next to it.

Spot TWAP and spot chase orders open — Both order types previously refused a spot pair. They now accept one. A TWAP whose slice would fall under the pair's minimum notional is refused at admission rather than burning its schedule with zero fills, and a halted spot pair pauses its schedule and its chase leg with escrow retained, resuming when the pair un-halts. The dead-man sweep widens in the same block, so a cancelled account cannot leave a spot TWAP parent still firing.

A MIP-3 deployer can now feed their market from their own price source — The action has been on the chain for some time, but no client could sign it, so the capability was unreachable. Both SDKs now sign it, and the price string is signed exactly as sent: a relay can neither reprice a push nor re-target it at another market. Only the market's deployer or a registered sub-deployer may sign one. The feed is load-bearing rather than advisory — a stale price turns the market reduce-only, and the first push moves existing cross positions on that market into their own isolated buckets.

Liquidations stop looking like ordinary trades in history — The fill stream that feeds historical reads wrote constants where the attribution belongs: no forced-close flag, no counterparty, no mark price, no broker, no parent TWAP, and an empty hash on the resting side. Every liquidation reached history indistinguishable from a normal fill. Both sides of a fill now carry the real values. The absorbing side names the account that was force-closed, not itself, because that is the point of the field.

The node no longer serves a `candles` channel — Aggregating bars is the serving layer's work, not a consensus machine's. Nothing changes for anyone connecting to the public endpoint: candles are served there exactly as before, built from the trade stream. Only a direct connection to a node loses the channel, and it is refused clearly rather than accepted and left silent.

A node advertises a reachable address — The peer discovery read published the address a validator dials internally, which no outside caller can reach. It now publishes an address that resolves from outside, so a new operator has something they can actually connect to.