Wave 37: close non-QA quality, release, and runtime gaps

[ty-everett]

Program and scope

• Tracker or issue: [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324
• Program gate(s) advanced: sections 11 (final two open infrastructure items), 12.1 (remaining actionable repository findings), and 13 (persistent dependency/release governance), plus documentation alignment and safe duplication/TODO disposition.
• Why this change is needed: Close the remaining non-release, non-manual-QA backlog with durable controls, remove the hundreds-long actionable Sonar tail without public-behavior changes, and make real Linux container lifecycle contracts and dependency/release reconciliation repeatable.
• Explicitly out of scope: Sonar administration changes; npm publication; tags/releases; image pushes; deployment; draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306; the retained final manual/fuzz/coverage QA phase; the 20 governed public/cryptographic/consensus compatibility findings.

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only
through the release workflow after approval):

• @bsv/wallet-relay 0.3.2
• @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile 2.4.18
• Chaintracks Server 1.0.13
• Message Box Server 1.1.18
• Overlay Server 2.1.21
• UHRP Server Basic 0.1.14
• UHRP Server Cloud Bucket 0.2.16
• WAB 1.4.15
• Wallet Infrastructure 2.0.17

Verification

• Local commands and results: pnpm build, pnpm typecheck, pnpm lint, repository-wide format:check, pnpm health:check, pnpm docs:examples, pnpm audit:security, pnpm check-versions, pnpm license:pack-check, full recursive tests, Wallet Toolbox rerun (178 suites / 1,533 passed / one governed skip), SDK (148 suites / 5,814 passed), and Wallet Relay packed artifact/CLI consumers all pass. YAML parsing and git diff --check pass.
• Hosted CI run: Pending on this exact PR head.
• Conformance evidence: JavaScript runner parsed 74 files / 6,650 vectors with zero errors; TypeScript runner passed 6,439 required cases with 211 registered unsupported cases.
• Coverage delta: No coverage scope, exclusion, or threshold is weakened; hosted aggregate and patch coverage are required before merge.
• Lint/typecheck delta: Zero warnings/errors; all 43 native compiler profiles, 121 governed tsconfig files, and repository typecheck pass.
• Browser/mobile/packed-consumer evidence: Wallet Relay exact packed ESM/CJS/type/CLI/scaffold consumers pass; unchanged broader browser/mobile contracts remain required in hosted CI.
• Performance or bundle-size delta: No public runtime dependency or bundle-loading behavior changes; benchmark documentation now matches the 12 real SDK programs. Existing bundle/performance gates remain unchanged.

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head repository quality gate reports zero new Sonar findings
  (including accepted or false-positive issue states) and zero unreviewed hotspots;
  Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date,
  and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

Complete every field when a dependency manifest, lockfile, container base, code
generator dependency, Dependabot configuration, or pinned workflow action
changes. Use “Not applicable — ” only when the reason is concrete.

• Release notes and necessity: Dependabot routine maintenance is consolidated monthly while security updates stay independent; all 19 unavoidable substitutions are exact, advisory/upstream-linked, owned, expiring, and removal-tested. Five unnecessary service overrides were removed.
• Runtime, build, and peer compatibility: Frozen workspace/service builds, full tests, typechecks, and clean packed consumers pass. Message Box and Overlay graceful shutdown use published public surfaces with automatic delegation to future native close methods.
• Deduplicated lockfile: Each of the seven standalone service locks was regenerated from its exact manifest; the root frozen graph remains internally consistent and all cross-package references are current.
• Audit and CodeQL: Local high/critical audit reports no known vulnerabilities; hosted dependency review, CodeQL security-extended, strict Sonar, and image scanning remain required.
• Package and consumer tests: Full recursive package tests pass after the corrected matcher migration; 30 public package tarballs retain the canonical license and Wallet Relay exact packed consumers pass.
• Bundle and performance impact: No dependency-driven bundle growth or runtime hot-path change is introduced. Existing size/performance budgets are retained.
• Affected public package versions: @bsv/wallet-relay@0.3.2 and Wallet Toolbox lockstep 2.4.18; publication is deliberately held.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the
  controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

This PR only creates source candidates and a no-push hosted Linux/amd64 runtime
contract. It does not publish packages, push images, create tags/releases, or
deploy. The existing protected OIDC/provenance release workflows remain the
only authorized publication path.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code,
  passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• One qualified maintainer approval is sufficient; no last-pusher
  restriction is assumed

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...llet-toolbox/src/storage/methods/generateChange.ts	50.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud