feat: harden service resources and refresh ChainTracks resilience

[ty-everett]

Program and scope

This PR combines the reviewed official-service resource hardening program with
the ChainTracks resiliency refresh requested before #429 merges.

The existing program adds bounded, operator-configurable edge/resource policy
to all seven official service contexts, stable health/readiness contracts,
shared-state controls, measured resource profiles, Message Box BRC-105
monetization, and focused autoscaling guidance. It preserves an explicit
operator opt-out while closing caller-controlled memory and fan-out growth.

The ChainTracks refresh removes a WhatsOnChain key as a default availability
dependency, adds resilient Arcade/go-chaintracks bulk and SSE sources, and makes
network selection exact across mainnet, testnet, STN, TerraTestNet, and Terra
Scaling TestNet.

ChainTracks root cause and design

The Tempo Key Server alert path was a configured WhatsOnChain credential being
rejected while ChainTracks treated WoC as an operational dependency. Current
WhatsOnChain documentation says authentication
is not required for public traffic up to three requests per second and documents
public mainnet/testnet surfaces only. ChainTracks therefore no longer needs a
key to operate.

The refreshed source model is:

1. checked local ChainTracks storage and last-good height/data;
2. the existing Babbage bulk CDN on mainnet/testnet when enabled;
3. Arcade/go-chaintracks v2 bounded bulk HTTP plus reconnecting SSE, with public
   credential-free defaults for mainnet, testnet, and TerraTestNet;
4. a serialized keyless WhatsOnChain fallback on mainnet/testnet, below the
   documented public rate. A rejected configured key retries ChainTracks
   header/info requests anonymously.

STN and Terra Scaling TestNet intentionally fail closed without an explicit
operator endpoint (STN_CHAINTRACKS_URL / TSTN_CHAINTRACKS_URL, or the
matching Arcade URL). They are never silently aliased to testnet. Arcade is the
browser-safe HTTPS/SSE gateway for Teranode-backed header data; direct Teranode
P2P is not added to browser/mobile packages.

Remote batches pass local serialization, hash, continuity, and genesis checks.
The implementation rejects wrong-network and incomplete responses, bounds batch
size and timeouts, reconnects SSE with capped backoff, falls through failed
sources, reports last-observed source health, and continues serving synchronized
last-good local data during provider outages.

Compatibility

• Existing positional ChainTracks factory arguments are unchanged; source
  controls are an appended optional argument.
• Existing explicit ChaintracksClientApi injection and legacy v1 endpoints
  remain supported. URLs ending in /v2 use the go-chaintracks client.
• Browser/mobile use only fetch, Web Streams, AbortController, TextDecoder, and
  SSE-compatible HTTP. No filesystem, Node Buffer, or direct P2P dependency was
  added to those artifacts.
• The standalone service preserves v1 routes, adds go-chaintracks-compatible v2
  height/bulk/SSE routes, respects ROUTING_PREFIX, and exposes /healthz plus
  /readyz in Docker and Compose health checks.
• Mainnet, testnet, STN, TerraTestNet, and Terra Scaling TestNet have isolated
  in-memory state and exact serialized genesis headers.

Impact and versions

• Public package source/manifests changed
• Infrastructure source, image, and deployment configuration changed
• Public exports/types and browser/mobile behavior changed additively
• Security-sensitive request, rate, and source-failover boundaries changed
• Documentation, changelogs, migration notes, and operations guidance changed

Release candidates relevant to this refresh:

• @bsv/wallet-toolbox 2.6.0
• @bsv/wallet-toolbox-client 2.6.0
• @bsv/wallet-toolbox-mobile 2.6.0
• chaintracks-server image 1.1.0

The other package and service candidates already coordinated by #429 remain
unchanged.

Verification

Local verification on Node 24.18.0:

• root build, typecheck, lint, full test suite, formatting, repository health,
  docs/facts, service operations, and security audit all pass;
• all 6,681 conformance vectors parse and pass (the TS runner executes 6,470
  and retains 211 governed skips);
• Wallet Toolbox: 188 suites, 1,699 passed, one governed skip;
• ChainTracks-focused failure/network/keyless/genesis/bulk/SSE suites pass,
  including provider failover and shutdown races;
• browser: Vite 1,538,253 raw / 360,678 gzip / 283,821 brotli bytes; esbuild
  1,201,206 raw / 329,933 gzip / 265,380 brotli bytes, with the expected
  browser-only dependency composition;
• mobile: Metro 1,599,461 raw / 403,088 gzip / 313,828 brotli bytes; Hermes
  3,228,178 raw / 1,283,672 gzip / 1,011,761 brotli bytes;
• all three 2.6.0 package artifact/consumer contracts pass;
• the aggregate patch-coverage gate replays at 93.52% (1,789/1,913 points), with mobile/type-only LCOV records included;
• ChainTracks server build/lint, Compose parsing, prefixed health/v2/SSE smoke,
  and clean SIGINT shutdown pass;
• pnpm audit --audit-level=high: no known vulnerabilities;
• live public Arcade /network, /height, and SSE surfaces were checked for
  mainnet, testnet, and TerraTestNet; the Babbage CDN exists for mainnet/testnet
  and correctly has no default STN/TTN/TSTN resource.

Hosted exact-head checks for b1e4c8ea6e540425a1324da148a23ec7c49dc808 are terminal: 80 successful and two expected policy-selected empty-matrix skips. Codecov patch coverage is 90.01%. No unresolved review thread is being carried forward.

Dependency evidence

• Release notes and necessity: Coordinated minor releases are required for the reviewed service resource controls and additive ChainTracks network, source-failover, browser/mobile, and server APIs. No third-party dependency version is changed by this PR.
• Runtime, build, and peer compatibility: Node 22+ public package support and the governed Node 24 build/container runtime remain unchanged; existing positional factories, explicit client injection, legacy v1 routes, and peer ranges remain compatible.
• Deduplicated lockfile: The workspace lock is unchanged; the standalone ChainTracks npm lock changes only its own version from 1.0.17 to 1.1.0 and retains the published Wallet Toolbox 2.5 dependency until the protected post-release lock reconciliation.
• Audit and CodeQL: Local high-severity audit reports no known vulnerabilities; exact-head CodeQL, Socket, dependency review, and Sonar gates are required before merge.
• Package and consumer tests: Full workspace tests, typecheck, build, package artifact consumers, browser/mobile contracts, ChainTracks focused tests, and the standalone Node 24 server build/lint/smoke pass locally.
• Bundle and performance impact: Browser and mobile artifacts remain inside governed budgets; measured Vite, esbuild, Metro, and Hermes sizes are recorded above with expected browser-only composition.
• Affected public package versions: @bsv/message-box-client 2.3.0, @bsv/auth-express-middleware 2.2.0, @bsv/overlay 2.3.0, @bsv/overlay-express 2.5.0, @bsv/wallet-toolbox 2.6.0, @bsv/wallet-toolbox-client 2.6.0, and @bsv/wallet-toolbox-mobile 2.6.0.

Release sequence

1. Merge only after exact-head CI, CodeQL, Sonar, dependency review, coverage,
   conformance, platform, mutation, and all official-image runtime contracts are
   green.
2. Run the protected npm release workflow from main; publish the Wallet
   Toolbox trio at 2.6.0 with the repository SBOM/provenance/verification path.
3. Merge the protected dependency-lock reconciliation produced after npm
   publication and revalidate ChainTracks against the published 2.6.0 package.
4. Only then run the protected infrastructure release for chaintracks-server
   1.1.0. Do not publish an image whose lock still resolves Wallet Toolbox 2.5.

No workstation publication or image build is used. Live deployment, DNS,
secrets, and downstream cutover remain separate post-release operational work.

Review checklist

• Complete local diff reviewed for correctness, compatibility, security,
  browser/mobile composition, dependencies, docs, and operations
• No secret or credential material added
• No advisory dismissal, quality suppression, or unregistered skipped test
• Workflow permissions and release provenance remain governed
• No unresolved review conversation exists
• Exact-head hosted checks terminal and successful

[ty-everett]

Final exact-head status for 6144aba0343a84eedab75748b3419dbecbc7d9fc:

• All 80 reported checks pass; the two expected skips are empty matrices selected by policy.
• Repository patch coverage is 93.82%; Codecov patch coverage is 91.57%.
• Both CodeQL analyses pass with zero open exact-head alerts; Sonar reports zero issues and zero unreviewed security hotspots.
• All seven runtime contracts and all seven official-image build/start/health/scan paths pass.

This draft now contains the complete implementation and remains draft for maintainer review. Publication, deployment, and downstream image cutover remain intentionally out of scope for this PR.

[codecov]

Codecov Report

❌ Patch coverage is 90.01314% with 76 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ges/overlays/overlay-express/src/OverlayExpress.ts	83.56%	15 Missing and 20 partials ⚠️
...c/services/chaintracker/chaintracks/Chaintracks.ts	83.54%	11 Missing and 2 partials ⚠️
...ssaging/message-box-client/src/MessageBoxClient.ts	85.71%	3 Missing and 5 partials ⚠️
...verlays/overlay-express/src/security/edgePolicy.ts	92.07%	0 Missing and 8 partials ⚠️
...ntracker/chaintracks/GoChaintracksServiceClient.ts	92.85%	0 Missing and 6 partials ⚠️
packages/overlays/overlay/src/Engine.ts	66.66%	1 Missing and 1 partial ⚠️
...tracker/chaintracks/Ingest/WhatsOnChainServices.ts	91.66%	1 Missing and 1 partial ⚠️
...ges/overlays/overlay-express/src/JanitorService.ts	97.50%	0 Missing and 1 partial ⚠️
packages/wallet/wallet-toolbox/src/sdk/types.ts	75.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.3% Duplication on New Code

See analysis details on SonarQube Cloud