Gate alias HTTP lifecycle and fix topic-scoped BEEF hydration [OPL-4473]

[rohenaz]

Populated alias lookup failed because formula hydration requested an output without a topic. Bind that read to the module engine’s single topic, with an isolation regression for overlapping outpoints.

Pin the merged upstream revision v1.3.5-0.20260906191948-e58da23b6c44. It contains both the empty-query fix (#365) and existing GASP isolation fixes, combined through #366. No local override or fork module path is needed.

Add a real HTTP lifecycle gate for submission, historical import, alias/domain/empty queries, BEEF decoding, conflicts, pagination, invalid queries, spend eviction, custom routes, and reopen persistence. An optional Bun test runs the actual TypeScript SDK client over TCP against populated results.

Validation with committed dependencies: full go test ./..., scoped go vet, and server build pass. The TypeScript TCP gate passes with the SDK #41 checkout. Chain roots and the broadcaster are synthetic; real-chain recovery, operator custody, complete PostgreSQL engine isolation, and authoritative reorg tests remain separate rollout work.

Linear: OPL-4473.

[linear]

OPL-4473

[rohenaz]

Updated after Dave confirmed deployment at api.1sat.app:

• Both ecosystem-alias capability listings respond successfully at /1sat/ecosystemalias/overlay.
• Read-only alias=sigma, domain=sigmaidentity.com, and skip=0/limit=1 queries return HTTP 200 with no outputs. Explicit query={} returns HTTP 400 before provider dispatch. This reproduces upstream go-overlay-services #365 on the live endpoint.
• The actual TypeScript SDK client from 1sat-sdk Apply deprecated listing filters consistently (follow-up to #40) #41 handles those empty responses correctly. No live populated-output hydration claim is made: no claim was returned.
• Retargeted this PR to master after Wire the ecosystem-alias overlay module and settings [OPL-4463] #30 merged, and merged current master into this branch.
• Added an opt-in real-TCP Bun/TypeScript SDK gate to the existing Go lifecycle harness. It imports synthetic confirmed fixtures through historical mode, then checks populated alias/domain/empty/paged queries, no-match results, output indices, and txids reconstructed from Atomic BEEF. It passes with the temporary pinned-engine-plus-#365 override; the normal dependency still fails the {} regression as expected.

The PR remains draft pending a compatible dependency update containing #365. There are no committed dependency overrides, live submissions, broadcasts, or claim changes. Remaining launch evidence: existing-claim historical import and full resolution, SHIP/SLAP discovery, and operational recovery/custody checks.

[rohenaz]

Upstream #365 is merged. Stack cannot switch directly to master because it would lose the GASP traversal-isolation fixes already pinned from #361.

Opened upstream #366 targeting gasp-graph-isolation with the exact two-file #365 patch. Engine/GASP/HTTP tests and the full stack suite, including the real TCP TypeScript SDK gate, pass with this compatible combination using a test-only module override.

The fork commit is not yet resolvable under the official Go module path. Production dependencies remain unchanged. Once #366 lands upstream, consume the compatible immutable revision and rerun without the override. This PR remains draft until that gate passes.

bsv-blockchain/go-overlay-services#366

[rohenaz]

The upstream dependency blocker is resolved. This PR now pins the official revision v1.3.5-0.20260906191948-e58da23b6c44, which includes both the GASP fixes and empty-query fix. Full Go tests, the TypeScript client over real TCP, scoped vet, and server build pass without a local dependency override. The PR is ready for review.

A separate Sigma-side validation found the existing on-chain claim uses the legacy before-position script. It cannot be historically imported under the current decoder. Sigma #383 corrects future alias creation/readers and includes a synthetic single-transaction migration rehearsal; no live claim was spent or submitted. This does not require broadening the overlay's accepted script template.