fix(overlay-topics): read the uora anchor output exactly

[mo-jaber]

Program and scope

Align the UORA v3 reader with the versioned format: compressed locking keys, exact drop tails and printable UTF-8 fields. Preserve valid anchor bytes, signatures, topic membership, exports and lookup shapes. Document coordinated reader upgrades and review previously indexed nonconforming outputs before rebuilding the topic.

Impact

• Public source/manifest and documentation changed: @bsv/overlay-topics 1.7.2.
• Admission validation is a security-sensitive boundary.
• No new wire prefix, persisted schema or encoding. No normalization of Unicode text.
• The previous claim that no historical anchor uses a rejected shape has been removed: fixture compatibility is proved, but a complete deployed-chain inventory is not claimed.

Verification

• Exact head reviewed: 80fbdff (refreshed through chore(deps): align Vitest and coverage providers at 4.1.11 #522).
• Local pnpm health:check, pnpm lint, pnpm format:check, full pnpm build, pnpm typecheck, and pnpm audit:security passed.
• Overlay Topics coverage: 44 suites, 542 passed, one pre-existing todo. Reader coverage: 98.24% statements / 97.14% branches / 100% functions / 98.91% lines.
• Positive compatibility includes the existing signed v3 anchor, printable Unicode and exact field-length boundaries; negative fixtures exercise key, tail, field and signature validation.
• All 14 shared fixture fields match the independent DPP format fixture at commit 8f912f902f69898116052891f03cf4432c957307. The legacy UORA v3 format was reviewed at that same revision.
• Packed artifact, strict types and clean ESM consumer checks passed. Conformance structure validation: 77 files / 6694 vectors, zero parse or structure errors.
• Complete diff self-reviewed for correctness, compatibility, security, package artifacts and documentation.
• All applicable hosted checks terminal and successful on this head; zero new Sonar findings/hotspots and CodeQL alerts.

Security and dependencies

• No dependency change or new override, suppression, advisory dismissal or skipped test.
• Audit passed with only existing governed patched image-size exclusions.
• Review conversations resolved on the final head.

Release and operations

• Package version, release ledger, changelog, migration guidance and generated facts are current.
• No workstation publication or deployed service change.
• Reader rollout coordination is required wherever older nodes may have indexed nonconforming anchors.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ckages/overlays/topics/src/uoradpp/anchorFormat.ts	96.55%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!