Add dynamic overlay lookup discovery and bounded host scheduling

packages/helpers/simple/browser-budget.json

@@ -25,9 +25,9 @@
   ],
   "maximumBytes": {
     "vite": {
-      "raw": 750000,
+      "raw": 755000,
       "gzip": 185000,
-      "brotli": 150000
+      "brotli": 151500
     },
     "esbuild": {
       "raw": 585000,

packages/sdk/CHANGELOG.md

@@ -270,9 +270,26 @@ All notable changes to this project will be documented in this file. The format
 - Add `LookupResolver.queryDetailed()` and per-outcome host-settlement counts
   so security-sensitive callers can distinguish authoritative empty answers
   from partial availability.
+- Add bounded LookupResolver discovery: later SLAP tracker advertisements can
+  join an active query, hosts are scheduled fairly under concurrency and byte
+  limits, and HTTP bodies are read incrementally. Raw `query$` output remains
+  unverified; `onEvidence` is the C02 intake seam. Existing 2s host / 5s
+  tracker delays, reputation/backoff, freeform answers, and CORS/public
+  lookup request headers are unchanged.
 
 ### Changed
 
+- LookupResolver host cache no longer lets a tighter-limit discovery satisfy a
+  later larger query, and `query()` still throws the historical no-competent-hosts
+  error when a deadline expires before any host is admitted.
+- `LookupResolver.query()` and `queryDetailed()` now reject with an `AbortError`
+  when the caller's `options.signal` cancels the attempt, at any host count,
+  instead of flattening a cancelled run into an empty output list. `query$()`
+  still reports the cancellation as a `terminalReason: 'cancelled'` snapshot.
+- A lookup that exhausts a client resource budget during SLAP discovery, before
+  any host is admitted, now throws `LookupResourceLimitError` naming the limit
+  instead of the historical no-competent-hosts error. That message is reserved
+  for a deadline or a settled attempt that genuinely found no host.
 - Batch BEEF mutation bookkeeping and reuse compound Merkle intermediate hashes.
   The optional asynchronous P2PKH backend now forwards its already validated
   compressed public key directly into the unlocking script. Existing BEEF
@@ -388,6 +405,12 @@ All notable changes to this project will be documented in this file. The format
 
 ### Security
 
+- `HTTPSOverlayLookupFacilitator` now issues lookup and SLAP tracker discovery
+  requests with `redirect: 'error'`. A SLAP-advertised host can no longer
+  redirect the serialized lookup body to an origin that the advertised-host
+  scheme and credential checks never saw, such as `http:`, loopback, or
+  link-local. A redirected response is recorded as an ordinary availability
+  failure for the advertised host.
 - Treat cryptographic verification as successful only when it returns an
   affirmative result: `GlobalKVStore` rejects forged controller-signed overlay
   values, and `IdentityClient` refuses to publish signature-invalid identity

packages/sdk/browser-budget.json

@@ -21,7 +21,7 @@
       "brotli": 165000
     },
     "esbuild": {
-      "raw": 590000,
+      "raw": 600000,
       "gzip": 180000,
       "brotli": 150000
     }
@@ -30,7 +30,7 @@
     "path": "dist/umd/bundle.js",
     "global": "bsv",
     "maximumBytes": {
-      "raw": 590000,
+      "raw": 594000,
       "gzip": 172000,
       "brotli": 145000
     }