fix(wallet): bootstrap ChainTracks from genesis

[ty-everett]

Summary

• allow an empty ChainTracks bulk store to initialize only from a height-zero batch
• retain continuity, chainwork, proof-of-work, file-integrity, and exact-network genesis validation
• add manager and real Arcade-ingestor/in-memory-storage regressions
• stage lockstep @bsv/wallet-toolbox{,-client,-mobile}@2.6.1 patch releases
• preserve browser/mobile contracts; raise the esbuild gzip ratchet by only 100 bytes for the six-byte measured growth

Root cause

The credential-free Arcade path introduced by #429 correctly fetched genesis headers, but BulkFileDataManager.mergeIncrementalBlockHeaders required a pre-existing bulk file before accepting any incremental batch. Fresh stores therefore rejected the valid first Arcade batch as not extending existing bulk headers.

Validation

• 188 Wallet Toolbox suites: 1,702 passed, 1 governed skip
• focused bootstrap suites: 21 passed
• repository patch coverage: 91.67% (22/24; target 90%)
• Wallet Toolbox build, typecheck, lint
• browser build/typecheck/lint/Vitest/platform/artifact contract
• mobile build/typecheck/lint/Vitest/Metro/Hermes/artifact contract
• repository health: 0 findings, 0 control errors
• dependency/release governance and generated docs
• pnpm audit: no high/critical vulnerabilities
• packed 2.6.1 standalone smoke with CDN empty, no WoC key, and WoC disabled:
  • authentic Arcade mainnet sync advanced from genesis without the 2.6.0 extension error
  • bounded fixture Arcade service reached listening height 99
  • root/prefixed health 200, readiness 200, v2 network/tip/genesis 200

Dependency evidence

• Release notes and necessity: Release governance and the Wallet Toolbox changelog document the patch. Published 2.6.0 is immutable and cannot initialize a fresh keyless Arcade-backed bulk store.
• Runtime, build, and peer compatibility: Node, browser, and React Native builds and consumers pass. No peer range, API, persisted format, explicit-client behavior, legacy v1 behavior, or CDN-backed behavior changes.
• Deduplicated lockfile: No dependency graph or workspace lockfile change is required; only lockstep package identities advance from 2.6.0 to 2.6.1.
• Audit and CodeQL: pnpm audit --audit-level=high reports no known vulnerabilities; hosted CodeQL is required before merge.
• Package and consumer tests: All 188 Wallet Toolbox suites, focused real-storage bootstrap coverage, browser/mobile tests, clean packed consumers, and a packed standalone server smoke pass.
• Bundle and performance impact: The browser esbuild artifact grows by six gzip bytes (330,006); the ratchet increases only 100 bytes to 330,100. Other browser, Metro, Hermes, raw, Brotli, and runtime contracts remain within their existing budgets. Header request cadence and rate limits are unchanged.
• Affected public package versions: @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile advance from 2.6.0 to 2.6.1.

Release ordering

Do not merge generated sync PR #433 first. Merge this hotfix after exact-head CI, run the protected npm cascade to publish the three 2.6.1 wallet artifacts, then let release automation rewrite #433 to the final verified locks before any infrastructure image is published.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud