fix(messagebox): consume SDK 2.8.3 and document proxy contracts

[ty-everett]

Program and scope

Complete the consumer bookkeeping for SDK 2.8.3 publication and prepare the Message Box 1.1.45 image from #588. The service now locks the published SDK patch that repairs originator discovery, browser fetch binding and signed action history. The SDK migration ledger records the verified publication; other package release entries remain unchanged.

The deployer guide documents polling affinity compatible with credential-free clients and proxy idle-connection retirement before the server's five-second close. These settings avoid process-local Engine.IO session loss and upstream reuse at the close boundary. Payment request retries are not a substitute. No application API, wire, account-data or CORS migration is introduced.

• Tracker: fix(sdk): preserve BRC100 discovery and signed action history #587 and fix(messagebox): migrate durable HTTP authentication replay claims #588; BotBoard [BotBoard][closed] ty-everett / Codex — SDK explicit-originator discovery compatibility #586, coordinated with [BotBoard][closed] ty-everett / Codex — PR 569 review and main integration #585.
• Out of scope: Wallet interoperability and reliability: bounded sync, proof recovery and BRC-118 payments #569 candidate features and other package release entries.
• Exact head: recorded by the commit and CI checks below; draft until hosted gates pass.

Impact

• No public package source or manifest changed
• Infrastructure dependency and operational documentation changed
• Documentation and generated migration ledger changed

The existing unpublished Message Box 1.1.45 candidate contains this dependency change. SDK 2.8.3 was already published from main cba5bc2d5dcfcf525ba604e7f1081f04daca88d9 by protected run 35950850386; registry bytes, GitHub provenance and post-release verification all passed. No additional npm release is needed here.

Verification

• Root pnpm health:check, pnpm lint, pnpm format:check, pnpm build, pnpm typecheck: passed.
• Message Box npm run build, npm run typecheck, npm run lint, npm run format:check, npm test -- --runInBand: passed, 227 tests / 27 suites.
• Message Box npm audit --audit-level=high: zero vulnerabilities.
• pnpm docs:facts regenerated the ledger; root health validates deterministic outputs.
• Existing fix(messagebox): migrate durable HTTP authentication replay claims #588 tests retain the two-replica durable HTTP authentication/replay regression. No executable service source changes in this follow-up.
• Complete diff self-reviewed for security, compatibility, dependency graph, artifacts and operations.
• All applicable hosted checks terminal and successful on the exact head.

Security and dependencies

• SDK changelog, runtime/peer compatibility, complete lockfile and audit reviewed.
• Only the SDK artifact changes in the dependency graph. The lock also records the existing SQLite dependency's install-script metadata after its explicit native rebuild.
• SDK 2.8.3 preserves BRC100 calls and historical valid wire bytes; old/new signed-history evidence from fix(sdk): preserve BRC100 discovery and signed action history #587 records 32 unchanged valid cases and the eight repaired 2.8.1/2.8.2 negative-history failures.
• No override, advisory dismissal, quality suppression or skipped test added.
• Exact-head CodeQL has no new alerts.
• Exact-head repository gate confirms zero new Sonar findings and unreviewed hotspots.
• No workflow or lifecycle-script policy changes. Server bundle performance is covered by hosted infrastructure/runtime checks; no new direct/transitive dependency introduced.

Release and operations

• No workstation npm or image publication performed by this PR.
• Existing service patch version 1.1.45 is appropriate; no additional package bump required.
• Publish only through the protected infrastructure release workflow after merge and exact-main verification, then verify immutable image digest, signature, provenance and SBOM before staging-first rollout.
• Apply fix(messagebox): migrate durable HTTP authentication replay claims #588's additive replay migration before HTTP auth acceptance; preserve populated claims on recovery. Polling and WebSocket acceptance are separate. Proxy settings are vendor-neutral recommendations, not automatic source deployment.

Completion evidence

Hosted CI, final maintainer review and resolved conversations will be recorded before marking ready. Publication bookkeeping is complete; this PR does not claim the pending 1.1.45 image or downstream wallet releases are delivered.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​sdk@​2.8.3

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer review of exact head fbff7da1853302905f599d358feb68346ce96438 completed by the authoring agent under ty-everett's maintainer authorization; this is not an independent second-person review.

The SDK ledger matches the independently verified 2.8.3 registry artifact and green release run 35950850386. Only its ledger entry changes. Message Box consumes the same published SDK integrity; no other dependency version changes. The existing SQLite install-script metadata is accurate and does not change the governed lifecycle-script policy. Service version 1.1.45 is still unpublished, so no additional bump is needed. No BRC100 API, signed preimage, stored data or credential-free CORS change is introduced.

The deployment guidance correctly distinguishes process-local polling affinity from authentication/failover and idle upstream connections from active requests/WebSockets. It does not prescribe retrying paid requests. Existing migration/replay tests remain intact. All local controls and 227 service tests pass; service audit has zero findings.

All exact-head applicable checks are now terminal and successful: CI 35953265684 (including merge gate, service checks and zero-new-Sonar gate), runtime 35953265723, CodeQL 35953265751 and dependency/security checks. Scope-based skips are validated by the successful merge gate. The review-thread query returned zero threads and no next page. No blocking findings remain. Proceeding with the operator-authorized integration; image publication and downstream rollout remain separate gates.