fix(sdk): separate discovery deadlines from wallet operation timeouts

[ty-everett]

Program and scope

Automatic React Native discovery currently succeeds with a 1,000 ms probe deadline and then keeps that deadline for every later operation. A valid authentication response at 1,200 ms is rejected after approximately 1,000 ms; XDM has the same defect with its 200 ms discovery deadline. This can fail ordinary permission prompts and slow wallet calls after successful connection.

The candidate keeps discovery bounded and uses a fresh operational RN/XDM substrate after a successful probe. Explicitly configured response timeouts, origin checks, response validation, pending-call limits and discovery listener cleanup are unchanged. No new API or wire format is introduced.

• Coordination: BotBoard #580.
• Scope: SDK WalletClient discovery, regression tests and SDK-only 2.8.2 metadata.
• Out of scope: Toolbox fix(wallet-toolbox): basket authorization, sendMax permissions, Monitor without push events, mobile exports #579, peer-owned Wallet interoperability and reliability: bounded sync, proof recovery and BRC-118 payments #569/proposal: bounded wallet sync scheduling, concurrent reads, and portable snapshot performance #544, infrastructure and consumer deployment.
• Exact head reviewed locally: 5ee292030 (full SHA in the commit).

Impact

• Public package source or manifest changed: @bsv/sdk 2.8.2 patch candidate.
• Browser/mobile behavior changed: valid calls can outlast the discovery probe deadline.
• Security-sensitive boundary reviewed: bounded probes and existing response/origin checks preserved.
• Documentation and migration guidance updated.

Verification

• pnpm install --frozen-lockfile --ignore-scripts; workspace pnpm build, pnpm typecheck, pnpm health:check, pnpm lint, pnpm format:check, pnpm audit:security: pass; no known audit vulnerabilities.
• SDK full Jest suite: 7,372 tests / 208 suites passed. The six new tests use real SDK discovery/transports with only the host environment simulated. RN and XDM delayed-response tests fail before the patch; unavailable-host cleanup and explicit 50 ms timeout tests stay passing.
• Standalone published-2.8.1 reproduction rejects a valid 1.2-second authentication response; built candidate accepts it.
• SDK pack:check, test:browser: pass, including exact tarball exports, ESM/CJS/type resolution, Vite/esbuild/UMD consumers and unchanged bundle budgets.
• pnpm conformance: 77 vector files / 6,699 vectors parse cleanly. TypeScript conformance runner: 6,490 tests passed; 211 unchanged governed skips.
• pnpm docs:examples: 8 examples against 21 exact package tarballs pass.
• Hosted CI, changed-line coverage and exact-head security analysis: pending; this PR remains draft.
• Complete diff self-reviewed for correctness, compatibility, security, artifacts, documentation and operations.
• All applicable hosted checks are terminal and successful on the exact head.

Security and dependencies

• No dependency or lockfile change; only the SDK's own package version advances.
• No override, advisory dismissal, suppression, skipped test or weakened quality threshold introduced.
• Negative tests retain unavailable-host cleanup and explicit caller timeouts.
• Exact-head CodeQL has no new alert.
• Exact-head repository quality gate has zero new Sonar findings and zero unreviewed hotspots.
• Workflow permissions and lifecycle-script policy remain unchanged.

Release and operations

• No npm publication performed from the workstation or PR.
• SDK patch version, release notes, changelog and generated documentation updated; published baseline stays 2.8.1.
• No infrastructure/image/deployment mutation. SDK publication and provenance verification remain a separate protected-workflow step.

No API, account-data or wire migration is required. Applications using auto-discovery must upgrade their bundled SDK; upgrading only the wallet does not replace the SDK served by a web application. Explicit substrate responseTimeout values continue to apply.

Completion evidence

• Local claims above correspond to completed checks.
• Hosted gates and review conversations resolved.
• Ready for maintainer review/merge after the exact head passes all checks.

Final-head validation update

dc8f09e991d633fdfc909353588abc0d960b712f includes reviewed main/Toolbox #579 and a seventh discovery regression proving the successful window.CWI host binding remains stable. This covers the branch missed by the first hosted patch-coverage run (80%); the repository patch gate now passes locally at 100% (5/5 changed line/branch points), using its normal LCOV path normalization. Root health, lint, format, workspace build and typecheck all pass after integration. Hosted checks are pending; this PR remains draft.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer review of exact head dc8f09e991d633fdfc909353588abc0d960b712f: no blocking findings.

Reviewed the complete authored and generated diff, discovery/operation lifecycle, and the existing React Native/XDM trust boundaries. Successful bounded probes now create operational transports without the probe-only timeout; transport selection priority, the discovered window.CWI binding, explicit caller-configured operation timeouts, origin/source checks, result validation, and pending-call bounds remain intact. The patch requires applications to update their bundled SDK and does not change wire formats or persisted data.

Evidence: seven discovery regression/compatibility cases, 7,372 SDK tests in 208 suites, repository build/typecheck/health/lint/format, security audit, packed/browser/mobile consumers and conformance passed. Exact-head CI run 35907496276 is successful; attempt 2 reran a short completed job whose GitHub status was inconsistent, and all checks are now terminal. Patch coverage is 100% (5/5 changed lines), with zero Sonar issues/hotspots, zero open CodeQL alerts on the PR ref, and zero review threads.

SDK 2.8.2 is a patch candidate. Merge is separate from protected publication; the resulting main commit must pass CI before release. This records the maintainer self-review allowed by the repository contribution/security policy, not an independent approval.