fix(overlay-topics): read the uora anchor output exactly

[mo-jaber]

Kept in draft until hosted checks finish on this head.

Program and scope

• Tracker or issue: bsv-blockchain/dpp#12, the DPP standard repository (private while its draft is assembled)
• Program gate(s) advanced: none
• Why this change is needed: tm_uora_dpp read anchors through the generic PushDrop decoder, which admits a 65-byte uncompressed locking key push (attribution still matched after re-compression, so the acceptance was invisible), never validates the drop tail, and passes control characters as text. The format's reference reader refuses all three, and admission rules are version-sensitive across index deployments: a lenient instance would disagree with its peers about topic membership. No published anchor uses any of these shapes, so the tightening refuses nothing real.
• Explicitly out of scope: the anchor format itself, the lookup service's query surface, and the anchoring service's own verifier.
• Exact head SHA reviewed: dc2f556

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only through the release workflow after approval):

• @bsv/overlay-topics, patch. No export, type or schema changes; the exported readUoraAnchor now throws on the three shapes above, and the topic manager therefore admits fewer outputs. Admission is the trust boundary touched, and it only tightens. The package changelog carries the entry.

Verification

• Local commands and results, in a worktree from main 98734b07c: pnpm --filter '@bsv/overlay-topics^...' run build then pnpm --filter @bsv/overlay-topics build, clean; pnpm --filter @bsv/overlay-topics lint, zero warnings; pnpm exec prettier --check on the four changed files, clean; pnpm --filter @bsv/overlay-topics test:coverage: 44 suites, 541 tests passed, 1 todo.
• Hosted CI run: pending on this head.
• Conformance evidence: the two new fixture vectors are the standard's fixtures/anchor-v3.json uncompressedKey and malformedTail, copied verbatim into the shared fixture; the reference reader and the consuming application's copy refuse the same bytes.
• Coverage delta: every new line and branch is covered. anchorFormat.ts reports 98.24% statements, 97.14% branches, 100% functions, 98.91% lines; the one uncovered line is the pre-existing toUTF8 throw path in text.
• Lint/typecheck delta: none.
• Browser/mobile/packed-consumer evidence: not applicable, no runtime target or bundle entry changed.
• Performance or bundle-size delta: negligible; one small chunk reader replaces a decoder call.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

None: no dependency changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud