@bsv/overlay 2.3.0 → 2.6.1

package/dist/esm/src/Engine.js

@@ -1,18 +1,185 @@
-import { Transaction, MerklePath, isBroadcastFailure, SHIPBroadcaster, HTTPSOverlayBroadcastFacilitator, LookupResolver } from '@bsv/sdk';
+import { Transaction, MerklePath, isBroadcastFailure, isPublicNetworkAddress, SHIPBroadcaster, HTTPSOverlayBroadcastFacilitator, LookupResolver } from '@bsv/sdk';
 import { GASP } from '@bsv/gasp';
 import { OverlayGASPRemote } from './GASP/OverlayGASPRemote.js';
 import { OverlayGASPStorage } from './GASP/OverlayGASPStorage.js';
 import { BASM_ZERO_HASH, computeBasmRoot, computeTac, extractMerkleProofMetadata } from './BASM.js';
 import { BASMRemote } from './BASMRemote.js';
+import { basmHash, basmInteger, requireBASM } from './BASMValidation.js';
 import { serializeErrorForLog, serializeLogValue } from './SafeLog.js';
+import { decodeAndVerifyDiscoveryAdvertisement } from './DiscoveryAdvertisementValidation.js';
+import { assertHash, assertNonnegativeInteger, assertOutpoint, assertOutputIndex, assertRawTransactionMatches, assertRegistryName, assertTopic, assertTxidList, normalizePeerEndpoint, validateAdmittanceInstructions, MAX_GASP_PAGE_SIZE } from './RemoteSecurity.js';
+import { buildOverlayAdmissionPlan, getOverlayAdmissionHost, overlayAdmissionMode, selectNewAdmissionTopics, waitForAdmissionReceipt } from './EngineAdmission.js';
 const DEFAULT_GASP_SYNC_LIMIT = 10000;
 const DEFAULT_BASM_RANGE_LIMIT = 1024;
+// The public Overlay Express transport defaults to 1,000 anchors per request.
+const DEFAULT_BASM_SYNC_PAGE_SIZE = 1000;
+const MAX_SYNC_ENDPOINTS_PER_TOPIC = 128;
+const MAX_SUBMISSION_TOPICS = 128;
+const MAX_SUBMISSION_BEEF_BYTES = 64 * 1024 * 1024;
+const MAX_OFF_CHAIN_VALUES = 100_000;
+const MAX_EVICTION_OUTPUTS = 100_000;
+const MAX_EVICTION_REASON_BYTES = 1024;
+const MAX_UNPROVEN_CANDIDATES = 10_000;
+const MAX_UNPROVEN_THRESHOLD_BLOCKS = 10_000_000;
+const MAX_REORG_ORPHAN_HASHES = 10_000;
+const MAX_REORG_ROWS = 100_000;
+const MAX_REORG_DEPTH = 100_000;
+const MAX_BASM_ADMITTED_PER_BLOCK = 100_000;
+const MAX_HISTORY_PRUNE_OUTPUTS = 100_000;
+const MAX_OUTPUT_RELATIONS = 100_000;
+const MAX_PROOF_UPDATE_OUTPUTS = 100_000;
+const MAX_LOOKUP_FORMULAS = 100_000;
+const MAX_LOOKUP_HISTORY_DEPTH = 2048;
+const MAX_LOOKUP_HYDRATION_NODES = 100_000;
+const MAX_LOOKUP_STORAGE_ROWS = 100_000;
+const MAX_LOOKUP_CONTEXT_BYTES = 1024 * 1024;
+const MAX_LOOKUP_TOTAL_CONTEXT_BYTES = 16 * 1024 * 1024;
+const MAX_LOOKUP_TOTAL_BEEF_BYTES = 128 * 1024 * 1024;
+const MAX_STORED_OUTPUT_SCRIPT_BYTES = 64 * 1024 * 1024;
+const MAX_CURRENT_ADVERTISEMENTS = 10_000;
+const MAX_REGISTERED_COMPONENTS = 10_000;
+const MAX_COMPONENT_NAME_BYTES = 256;
+const MAX_COMPONENT_DESCRIPTION_BYTES = 4096;
+const MAX_COMPONENT_VERSION_BYTES = 128;
+const MAX_COMPONENT_URL_BYTES = 2048;
+const MAX_COMPONENT_DOCUMENTATION_BYTES = 1024 * 1024;
+function assertComponentText(value, label, maximumBytes, allowEmpty = false) {
+    if (typeof value !== 'string' ||
+        (!allowEmpty && value.length === 0) ||
+        new TextEncoder().encode(value).byteLength > maximumBytes ||
+        Array.from(value).some(character => {
+            const codePoint = character.codePointAt(0) ?? 0;
+            return codePoint <= 0x1f || codePoint === 0x7f;
+        })) {
+        throw new TypeError(`${label} is invalid`);
+    }
+}
+function readOwnComponentField(value, key, required) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined) {
+        if (required)
+            throw new TypeError(`Component metadata ${key} is required`);
+        return undefined;
+    }
+    if (!Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+        throw new TypeError(`Component metadata ${key} must be a data property`);
+    }
+    return descriptor.value;
+}
+function normalizeComponentURL(value, label) {
+    assertComponentText(value, label, MAX_COMPONENT_URL_BYTES);
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new TypeError(`${label} is invalid`);
+    }
+    if ((parsed.protocol !== 'https:' && parsed.protocol !== 'http:') ||
+        parsed.username !== '' ||
+        parsed.password !== '') {
+        throw new TypeError(`${label} is invalid`);
+    }
+    return parsed.toString();
+}
+function validateComponentMetadata(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new TypeError('Component metadata must be an object');
+    }
+    const name = readOwnComponentField(value, 'name', true);
+    const shortDescription = readOwnComponentField(value, 'shortDescription', true);
+    assertComponentText(name, 'Component metadata name', MAX_COMPONENT_NAME_BYTES);
+    assertComponentText(shortDescription, 'Component metadata shortDescription', MAX_COMPONENT_DESCRIPTION_BYTES, true);
+    const result = { name, shortDescription };
+    const iconURL = readOwnComponentField(value, 'iconURL', false);
+    if (iconURL !== undefined)
+        result.iconURL = normalizeComponentURL(iconURL, 'Component iconURL');
+    const version = readOwnComponentField(value, 'version', false);
+    if (version !== undefined) {
+        assertComponentText(version, 'Component metadata version', MAX_COMPONENT_VERSION_BYTES);
+        result.version = version;
+    }
+    const informationURL = readOwnComponentField(value, 'informationURL', false);
+    if (informationURL !== undefined) {
+        result.informationURL = normalizeComponentURL(informationURL, 'Component informationURL');
+    }
+    return result;
+}
+function validateComponentDocumentation(value) {
+    if (typeof value !== 'string' ||
+        new TextEncoder().encode(value).byteLength > MAX_COMPONENT_DOCUMENTATION_BYTES) {
+        throw new TypeError(`Component documentation must be a string of at most ${MAX_COMPONENT_DOCUMENTATION_BYTES} bytes`);
+    }
+    return value;
+}
+function copyRegistry(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new TypeError(`${label} must be an object`);
+    }
+    const names = Object.keys(value);
+    if (names.length > MAX_REGISTERED_COMPONENTS) {
+        throw new RangeError(`${label} cannot contain more than ${MAX_REGISTERED_COMPONENTS} entries`);
+    }
+    const result = Object.create(null);
+    for (const name of names) {
+        assertRegistryName(name, `${label} name`);
+        result[name] = value[name];
+    }
+    return result;
+}
+function copyBoundedStringList(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > MAX_SYNC_ENDPOINTS_PER_TOPIC) {
+        throw new TypeError(`${label} must be an array of at most ${MAX_SYNC_ENDPOINTS_PER_TOPIC} strings`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry !== 'string' ||
+            entry.length === 0 ||
+            new TextEncoder().encode(entry).byteLength > 2048 ||
+            Array.from(entry).some(character => {
+                const codePoint = character.codePointAt(0) ?? 0;
+                return codePoint <= 0x1f || codePoint === 0x7f;
+            })) {
+            throw new TypeError(`${label}[${index}] is invalid`);
+        }
+        return entry;
+    });
+}
+function copySyncConfiguration(value) {
+    const copied = copyRegistry(value ?? {}, 'Sync configuration');
+    const result = Object.create(null);
+    for (const name of Object.keys(copied)) {
+        const entry = copied[name];
+        if (entry === false || entry === 'SHIP') {
+            result[name] = entry;
+            continue;
+        }
+        const endpoints = copyBoundedStringList(entry, `Sync configuration ${name}`);
+        if (endpoints === undefined)
+            throw new TypeError(`Sync configuration ${name} is invalid`);
+        result[name] = endpoints;
+    }
+    return result;
+}
+function assertUnprovenThreshold(value) {
+    if (!Number.isSafeInteger(value) ||
+        value < 1 ||
+        value > MAX_UNPROVEN_THRESHOLD_BLOCKS) {
+        throw new TypeError(`Unproven thresholdBlocks must be an integer between 1 and ${MAX_UNPROVEN_THRESHOLD_BLOCKS}`);
+    }
+}
 function findSpendingInputIndex(tx, output) {
     return tx.inputs.findIndex(input => {
         const realSource = input.sourceTXID || input.sourceTransaction?.id('hex');
         return realSource === output.txid && input.sourceOutputIndex === output.outputIndex;
     });
 }
+function requireBASMDefined(value, aligned, message) {
+    requireBASM(aligned, message);
+    requireBASM(value !== undefined, message);
+    return value;
+}
 /**
  * An engine for running BSV Overlay Services (topic managers and lookup services).
  */
@@ -37,6 +204,8 @@ export class Engine {
     basmSyncEnabled;
     unprovenEvictionBlocks;
     maxLookupResults;
+    submissionTail = Promise.resolve();
+    basmFetchImpl;
     /**
      * Creates a new Overlay Services Engine
      * @param {[key: string]: TopicManager} managers - manages topic admittance
@@ -81,25 +250,43 @@ export class Engine {
         this.basmSyncEnabled = basmSyncEnabled;
         this.unprovenEvictionBlocks = unprovenEvictionBlocks;
         this.maxLookupResults = maxLookupResults;
-        if (maxLookupResults !== -1 && (!Number.isSafeInteger(maxLookupResults) || maxLookupResults < 1)) {
+        if (maxLookupResults !== -1 &&
+            (!Number.isSafeInteger(maxLookupResults) || maxLookupResults < 1)) {
             throw new TypeError('maxLookupResults must be -1 or a positive safe integer');
         }
+        assertUnprovenThreshold(unprovenEvictionBlocks);
+        // Registries cross configuration, HTTP dispatch, and JSON response
+        // boundaries. Own-property null-prototype copies prevent inherited entries
+        // and reserved object names from becoming executable services.
+        this.managers = copyRegistry(managers, 'Topic manager registry');
+        this.lookupServices = copyRegistry(lookupServices, 'Lookup service registry');
+        this.shipTrackers = copyBoundedStringList(this.shipTrackers, 'SHIP trackers');
+        this.slapTrackers = copyBoundedStringList(this.slapTrackers, 'SLAP trackers');
+        this.syncConfiguration = copySyncConfiguration(this.syncConfiguration);
         // To encourage synchronization of overlay services, the SHIP sync strategy is used by default for all overlay topics, except for 'tm_ship' and 'tm_slap'.
         // For these two topics, any existing trackers are combined with the provided shipTrackers and slapTrackers omitting any duplicates.
         this.syncConfiguration ??= {};
-        for (const managerName of Object.keys(managers)) {
-            if (managerName === 'tm_ship' && this.shipTrackers !== undefined && this.syncConfiguration[managerName] !== false) {
+        for (const managerName of Object.keys(this.managers)) {
+            if (managerName === 'tm_ship' &&
+                this.shipTrackers !== undefined &&
+                this.syncConfiguration[managerName] !== false) {
                 // Combine tm_ship trackers with preexisting entries if any
                 const combinedSet = new Set([
-                    ...(Array.isArray(this.syncConfiguration[managerName]) ? this.syncConfiguration[managerName] : []),
+                    ...(Array.isArray(this.syncConfiguration[managerName])
+                        ? this.syncConfiguration[managerName]
+                        : []),
                     ...this.shipTrackers
                 ]);
                 this.syncConfiguration[managerName] = Array.from(combinedSet);
             }
-            else if (managerName === 'tm_slap' && this.slapTrackers !== undefined && this.syncConfiguration[managerName] !== false) {
+            else if (managerName === 'tm_slap' &&
+                this.slapTrackers !== undefined &&
+                this.syncConfiguration[managerName] !== false) {
                 // Combine tm_slap trackers with preexisting entries if any
                 const combinedSet = new Set([
-                    ...(Array.isArray(this.syncConfiguration[managerName]) ? this.syncConfiguration[managerName] : []),
+                    ...(Array.isArray(this.syncConfiguration[managerName])
+                        ? this.syncConfiguration[managerName]
+                        : []),
                     ...this.slapTrackers
                 ]);
                 this.syncConfiguration[managerName] = Array.from(combinedSet);
@@ -126,7 +313,9 @@ export class Engine {
             return undefined;
         }
         try {
-            return await this.chainTracker.currentHeight();
+            const height = await this.chainTracker.currentHeight();
+            assertNonnegativeInteger(height, 'Current chain height');
+            return height;
         }
         catch (error) {
             this.logger.warn(`Unable to resolve current chain height for overlay metadata: ${error instanceof Error ? error.message : String(error)}`);
@@ -134,12 +323,27 @@ export class Engine {
         }
     }
     async resolveBlockHash(blockHeight, merkleRoot) {
+        assertNonnegativeInteger(blockHeight, 'BASM block height');
+        if (merkleRoot !== undefined)
+            assertHash(merkleRoot, 'BASM merkle root');
         try {
             const header = await this.topicAnchorHeaderResolver?.(blockHeight);
             if (header === undefined) {
                 return undefined;
             }
-            if (header.merkleRoot !== undefined && merkleRoot !== undefined && header.merkleRoot !== merkleRoot) {
+            if (typeof header !== 'object' || header === null) {
+                throw new TypeError('Header resolver returned an invalid header');
+            }
+            assertNonnegativeInteger(header.blockHeight, 'BASM header height');
+            assertHash(header.blockHash, 'BASM header block hash');
+            if (header.merkleRoot !== undefined)
+                assertHash(header.merkleRoot, 'BASM header merkle root');
+            if (header.blockHeight !== blockHeight) {
+                throw new TypeError('Header resolver returned a different block height');
+            }
+            if (header.merkleRoot !== undefined &&
+                merkleRoot !== undefined &&
+                header.merkleRoot.toLowerCase() !== merkleRoot.toLowerCase()) {
                 throw new Error(`Header merkle root ${header.merkleRoot} does not match proof root ${merkleRoot} at height ${blockHeight}`);
             }
             return header.blockHash;
@@ -174,7 +378,9 @@ export class Engine {
         const metadata = extractMerkleProofMetadata(txid, tx.merklePath);
         const [firstSeenHeight, blockHash] = await Promise.all([
             this.currentHeightOrUndefined(),
-            metadata === undefined ? undefined : this.resolveBlockHash(metadata.blockHeight, metadata.merkleRoot)
+            metadata === undefined
+                ? undefined
+                : this.resolveBlockHash(metadata.blockHeight, metadata.merkleRoot)
         ]);
         return {
             blockHeight: metadata?.blockHeight,
@@ -186,12 +392,20 @@ export class Engine {
         };
     }
     async recomputeTopicBlockAnchor(topic, blockHeight, blockHash) {
+        assertTopic(topic, 'BASM topic');
+        assertNonnegativeInteger(blockHeight, 'BASM block height');
+        if (blockHash !== undefined)
+            assertHash(blockHash, 'BASM block hash');
         if (typeof this.storage.findAdmittedTransactionsForBlock !== 'function' ||
             typeof this.storage.upsertTopicBlockAnchor !== 'function' ||
             typeof this.storage.findTopicBlockAnchor !== 'function') {
             return undefined;
         }
-        const anchorBlockHash = blockHash ?? (await this.storage.findTopicBlockAnchor(topic, blockHeight))?.blockHash;
+        const storedAnchor = await this.storage.findTopicBlockAnchor(topic, blockHeight);
+        if (storedAnchor !== undefined) {
+            this.assertTopicBlockAnchor(storedAnchor, topic, 'Stored BASM anchor', blockHeight);
+        }
+        const anchorBlockHash = blockHash ?? storedAnchor?.blockHash;
         if (anchorBlockHash === undefined) {
             return undefined;
         }
@@ -202,11 +416,17 @@ export class Engine {
         // an out-of-order proof (older height arriving after a newer one) can never
         // leave a gap that silently breaks the chain.
         const tip = await this.storage.findTopicAnchorTip?.(topic);
+        if (tip !== undefined)
+            this.assertTopicAnchorTip(tip, topic, 'Stored BASM tip');
         const tipHeight = tip !== undefined && tip.blockHeight >= 0 ? tip.blockHeight : undefined;
         const fromHeight = tipHeight === undefined ? blockHeight : Math.min(blockHeight, tipHeight + 1);
         const toHeight = tipHeight === undefined ? blockHeight : Math.max(blockHeight, tipHeight);
         await this.rebuildTopicAnchorChain(topic, fromHeight, toHeight, new Map([[blockHeight, anchorBlockHash]]));
-        return await this.storage.findTopicBlockAnchor(topic, blockHeight);
+        const rebuilt = await this.storage.findTopicBlockAnchor(topic, blockHeight);
+        if (rebuilt !== undefined) {
+            this.assertTopicBlockAnchor(rebuilt, topic, 'Rebuilt BASM anchor', blockHeight);
+        }
+        return rebuilt;
     }
     /**
      * Extends every configured topic's anchor chain forward with empty Topic Block
@@ -217,16 +437,21 @@ export class Engine {
      * unstarted (genesis is the topic's first admitted height).
      */
     async advanceTopicAnchorChains(toHeight) {
+        if (toHeight !== undefined)
+            assertNonnegativeInteger(toHeight, 'BASM target height');
         if (typeof this.storage.findTopicAnchorTip !== 'function' ||
             typeof this.storage.upsertTopicBlockAnchor !== 'function') {
             return;
         }
-        const targetHeight = toHeight ?? await this.currentHeightOrUndefined();
+        const targetHeight = toHeight ?? (await this.currentHeightOrUndefined());
         if (targetHeight === undefined) {
             return;
         }
+        assertNonnegativeInteger(targetHeight, 'BASM target height');
         for (const topic of Object.keys(this.managers)) {
             const tip = await this.storage.findTopicAnchorTip(topic);
+            if (tip !== undefined)
+                this.assertTopicAnchorTip(tip, topic, 'Stored BASM tip');
             if (tip === undefined || tip.blockHeight < 0 || tip.blockHeight >= targetHeight) {
                 continue;
             }
@@ -242,6 +467,20 @@ export class Engine {
      * contiguity instead of leaving a hole.
      */
     async rebuildTopicAnchorChain(topic, fromHeight, toHeight, blockHashHints = new Map(), forceResolve = false) {
+        assertTopic(topic, 'BASM topic');
+        assertNonnegativeInteger(fromHeight, 'BASM range start');
+        assertNonnegativeInteger(toHeight, 'BASM range end');
+        if (!(blockHashHints instanceof Map))
+            throw new TypeError('BASM block hash hints must be a Map');
+        if (typeof forceResolve !== 'boolean')
+            throw new TypeError('BASM forceResolve must be a boolean');
+        for (const [height, hash] of blockHashHints) {
+            assertNonnegativeInteger(height, 'BASM block hash hint height');
+            assertHash(hash, 'BASM block hash hint');
+            if (height < fromHeight || height > toHeight) {
+                throw new TypeError('BASM block hash hint is outside the rebuild range');
+            }
+        }
         if (typeof this.storage.findAdmittedTransactionsForBlock !== 'function' ||
             typeof this.storage.upsertTopicBlockAnchor !== 'function' ||
             typeof this.storage.findTopicBlockAnchor !== 'function' ||
@@ -253,16 +492,22 @@ export class Engine {
             this.logger.warn(`[BASM] capping anchor chain extension: topic=${serializeLogValue(topic)} limit=${serializeLogValue(DEFAULT_BASM_RANGE_LIMIT)} requestedFrom=${serializeLogValue(fromHeight)} requestedTo=${serializeLogValue(toHeight)}; will continue on the next pass`);
             toHeight = fromHeight + DEFAULT_BASM_RANGE_LIMIT - 1;
         }
-        const previousAnchor = fromHeight > 0
-            ? await this.storage.findTopicBlockAnchor(topic, fromHeight - 1)
-            : undefined;
+        const previousAnchor = fromHeight > 0 ? await this.storage.findTopicBlockAnchor(topic, fromHeight - 1) : undefined;
+        if (previousAnchor !== undefined) {
+            this.assertTopicBlockAnchor(previousAnchor, topic, 'Previous BASM anchor', fromHeight - 1);
+        }
         let prevTac = previousAnchor?.tac ?? BASM_ZERO_HASH;
         for (let height = fromHeight; height <= toHeight; height++) {
-            const admitted = await this.storage.findAdmittedTransactionsForBlock(topic, height);
+            const admitted = await this.storage.findAdmittedTransactionsForBlock(topic, height, undefined, MAX_BASM_ADMITTED_PER_BLOCK + 1);
             const existing = await this.storage.findTopicBlockAnchor(topic, height);
+            if (existing !== undefined) {
+                this.assertTopicBlockAnchor(existing, topic, 'Stored BASM anchor', height);
+            }
             // On a reorg rebuild the existing anchor's block hash is stale, so force
             // canonical re-resolution from the header resolver instead of reusing it.
-            const blockHash = blockHashHints.get(height) ?? (forceResolve ? undefined : existing?.blockHash) ?? await this.resolveBlockHash(height);
+            const blockHash = blockHashHints.get(height) ??
+                (forceResolve ? undefined : existing?.blockHash) ??
+                (await this.resolveBlockHash(height));
             if (blockHash === undefined) {
                 this.logger.warn(`[BASM] unable to resolve block hash: topic=${serializeLogValue(topic)} height=${serializeLogValue(height)}; halting chain extension`);
                 return;
@@ -292,6 +537,29 @@ export class Engine {
      * SSE reconnect, and poll.
      */
     async handleReorg(input) {
+        return await this.reconcileReorg(input, new Set());
+    }
+    async reconcileReorg(input, independentlyInvalidProofRows) {
+        if (typeof input !== 'object' ||
+            input === null ||
+            !Array.isArray(input.orphanedBlockHashes) ||
+            input.orphanedBlockHashes.length > MAX_REORG_ORPHAN_HASHES) {
+            throw new TypeError('Invalid or oversized reorg input');
+        }
+        assertNonnegativeInteger(input.rebuildFromHeight, 'Reorg rebuild start');
+        assertNonnegativeInteger(input.newTipHeight, 'Reorg new tip height');
+        if (input.rebuildFromHeight > input.newTipHeight ||
+            input.newTipHeight - input.rebuildFromHeight + 1 > MAX_REORG_DEPTH) {
+            throw new TypeError(`Reorg rebuild ranges are capped at ${MAX_REORG_DEPTH} heights`);
+        }
+        const orphanedHashes = new Set();
+        for (const hash of input.orphanedBlockHashes) {
+            assertHash(hash, 'Reorg orphaned block hash');
+            const canonical = hash.toLowerCase();
+            if (orphanedHashes.has(canonical))
+                throw new TypeError('Reorg block hashes must be unique');
+            orphanedHashes.add(canonical);
+        }
         const report = { perTopic: [] };
         if (typeof this.storage.findProvenAppliedTransactionsByBlockHash !== 'function' ||
             typeof this.storage.demoteAppliedTransactionToUnproven !== 'function' ||
@@ -302,25 +570,94 @@ export class Engine {
         // 1) Demote proven admissions whose block was orphaned. Hashes are
         //    normalized to lower-case display hex to match stored block hashes
         //    (go-sdk chainhash.Hash marshals as reversed display hex).
-        const demotedByTopic = new Map();
-        for (const rawHash of input.orphanedBlockHashes) {
-            const blockHash = rawHash.toLowerCase();
-            const rows = await this.storage.findProvenAppliedTransactionsByBlockHash(blockHash);
-            for (const row of rows) {
-                await this.storage.demoteAppliedTransactionToUnproven(row.txid, row.topic);
-                const list = demotedByTopic.get(row.topic) ?? [];
-                list.push(row.txid);
-                demotedByTopic.set(row.topic, list);
+        const rowsToDemote = [];
+        const seenRows = new Set();
+        for (const blockHash of orphanedHashes) {
+            const remaining = MAX_REORG_ROWS - rowsToDemote.length;
+            const rows = await this.storage.findProvenAppliedTransactionsByBlockHash(blockHash, remaining + 1);
+            if (!Array.isArray(rows) || rows.length > remaining) {
+                throw new TypeError('Storage returned an invalid or oversized reorg transaction set');
+            }
+            for (const [index, row] of rows.entries()) {
+                if (typeof row !== 'object' || row === null) {
+                    throw new TypeError(`Storage returned an invalid reorg transaction at index ${index}`);
+                }
+                assertHash(row.txid, `Reorg transaction[${index}] txid`);
+                assertTopic(row.topic, `Reorg transaction[${index}] topic`);
+                assertNonnegativeInteger(row.blockHeight, `Reorg transaction[${index}] height`);
+                if (row.blockHeight < input.rebuildFromHeight || row.blockHeight > input.newTipHeight) {
+                    throw new TypeError('Storage returned a reorg transaction outside the rebuild range');
+                }
+                const key = `${row.txid.toLowerCase()}.${row.topic}`;
+                if (seenRows.has(key))
+                    throw new TypeError('Storage returned duplicate reorg transactions');
+                seenRows.add(key);
+                rowsToDemote.push({ ...row, reportedBlockHash: blockHash });
+            }
+        }
+        // The event stream is an acceleration hint, not independent chain-state
+        // authority. Before any durable mutation, corroborate every claimed
+        // orphaned block against the configured canonical header resolver. A
+        // missing answer fails closed; a hash that is still canonical proves the
+        // stream claim is stale or hostile.
+        const canonicalByHeight = new Map();
+        const authorizedRowsToDemote = [];
+        for (const row of rowsToDemote) {
+            let canonical = canonicalByHeight.get(row.blockHeight);
+            if (canonical === undefined) {
+                canonical = (await this.resolveBlockHash(row.blockHeight))?.toLowerCase() ?? null;
+                canonicalByHeight.set(row.blockHeight, canonical);
+            }
+            const rowKey = `${row.txid.toLowerCase()}\0${row.topic}`;
+            const independentlyInvalid = independentlyInvalidProofRows.has(rowKey);
+            if (canonical === null && !independentlyInvalid) {
+                throw new Error('Unable to corroborate a reported reorg before mutating state');
+            }
+            if (canonical === row.reportedBlockHash.toLowerCase() && !independentlyInvalid) {
+                if (independentlyInvalidProofRows.size > 0)
+                    continue;
+                throw new Error('Reported orphaned block is still canonical');
             }
+            authorizedRowsToDemote.push(row);
+        }
+        const demotedByTopic = new Map();
+        for (const row of authorizedRowsToDemote) {
+            await this.storage.demoteAppliedTransactionToUnproven(row.txid, row.topic);
+            const list = demotedByTopic.get(row.topic) ?? [];
+            list.push(row.txid);
+            demotedByTopic.set(row.topic, list);
         }
         // 2) Rebuild every topic anchor chain that intersects the reorged range,
         //    forcing canonical block-hash re-resolution so stale hashes are replaced.
         for (const topic of Object.keys(this.managers)) {
-            const existing = await this.storage.findTopicBlockAnchors(topic, input.rebuildFromHeight, input.newTipHeight);
+            const existing = await this.storage.findTopicBlockAnchors(topic, input.rebuildFromHeight, input.newTipHeight, MAX_REORG_DEPTH + 1);
+            if (!Array.isArray(existing) || existing.length > MAX_REORG_DEPTH) {
+                throw new TypeError('Storage returned an invalid or oversized reorg anchor set');
+            }
             if (existing.length === 0) {
                 continue;
             }
-            const startHeight = Math.min(...existing.map(anchor => anchor.blockHeight));
+            let startHeight = input.newTipHeight;
+            const seenHeights = new Set();
+            for (const [index, anchor] of existing.entries()) {
+                if (typeof anchor !== 'object' || anchor === null) {
+                    throw new TypeError(`Storage returned an invalid reorg anchor at index ${index}`);
+                }
+                assertTopic(anchor.topic, `Reorg anchor[${index}] topic`);
+                assertNonnegativeInteger(anchor.blockHeight, `Reorg anchor[${index}] height`);
+                if (anchor.topic !== topic ||
+                    anchor.blockHeight < input.rebuildFromHeight ||
+                    anchor.blockHeight > input.newTipHeight ||
+                    seenHeights.has(anchor.blockHeight)) {
+                    throw new TypeError('Storage returned an unbound or duplicate reorg anchor');
+                }
+                assertHash(anchor.blockHash, `Reorg anchor[${index}] block hash`);
+                assertHash(anchor.basmRoot, `Reorg anchor[${index}] BASM root`);
+                assertHash(anchor.tac, `Reorg anchor[${index}] TAC`);
+                assertNonnegativeInteger(anchor.admittedCount, `Reorg anchor[${index}] admitted count`);
+                seenHeights.add(anchor.blockHeight);
+                startHeight = Math.min(startHeight, anchor.blockHeight);
+            }
             await this.rebuildTopicAnchorChain(topic, startHeight, input.newTipHeight, new Map(), true);
             report.perTopic.push({
                 topic,
@@ -341,10 +678,11 @@ export class Engine {
      * treated as orphaned and reconciled via {@link handleReorg}.
      */
     async isProvenAnchorStale(row, chainTracker) {
+        let rootInvalid = false;
         if (row.merkleRoot !== undefined) {
             try {
-                if (!(await chainTracker.isValidRootForHeight(row.merkleRoot, row.blockHeight))) {
-                    return true;
+                if ((await chainTracker.isValidRootForHeight(row.merkleRoot, row.blockHeight)) !== true) {
+                    rootInvalid = true;
                 }
             }
             catch (error) {
@@ -353,9 +691,15 @@ export class Engine {
             }
         }
         const canonical = await this.resolveBlockHash(row.blockHeight);
-        return canonical !== undefined && canonical.toLowerCase() !== row.blockHash?.toLowerCase();
+        if (canonical !== undefined && canonical.toLowerCase() !== row.blockHash?.toLowerCase()) {
+            return 'stale-block';
+        }
+        return rootInvalid ? 'invalid-proof' : false;
     }
     async revalidateRecentAnchors(depth = 3) {
+        if (!Number.isSafeInteger(depth) || depth < 1 || depth > MAX_REORG_DEPTH) {
+            throw new TypeError(`Reorg revalidation depth must be between 1 and ${MAX_REORG_DEPTH}`);
+        }
         const chainTracker = this.chainTracker;
         if (chainTracker === 'scripts only') {
             this.logger.warn('[BASM] revalidation sweep requires a ChainTracker; skipping');
@@ -368,28 +712,58 @@ export class Engine {
         if (tip === undefined) {
             return undefined;
         }
+        assertNonnegativeInteger(tip, 'Current chain height');
         const fromHeight = Math.max(0, tip - depth + 1);
-        const rows = await this.storage.findProvenAppliedTransactionsInRange(fromHeight, tip);
+        const rows = await this.storage.findProvenAppliedTransactionsInRange(fromHeight, tip, undefined, MAX_REORG_ROWS + 1);
+        if (!Array.isArray(rows) || rows.length > MAX_REORG_ROWS) {
+            throw new TypeError('Storage returned an invalid or oversized revalidation set');
+        }
         const orphaned = new Set();
+        const independentlyInvalidProofRows = new Set();
         let minAffected = Number.POSITIVE_INFINITY;
-        for (const row of rows) {
+        const seenRows = new Set();
+        for (const [index, row] of rows.entries()) {
+            if (typeof row !== 'object' || row === null) {
+                throw new TypeError(`Storage returned an invalid revalidation row at index ${index}`);
+            }
+            assertHash(row.txid, `Revalidation row[${index}] txid`);
+            assertTopic(row.topic, `Revalidation row[${index}] topic`);
+            assertNonnegativeInteger(row.blockHeight, `Revalidation row[${index}] height`);
+            if (row.blockHeight < fromHeight || row.blockHeight > tip) {
+                throw new TypeError('Storage returned a revalidation row outside the requested range');
+            }
+            if (row.blockHash !== undefined)
+                assertHash(row.blockHash, `Revalidation row[${index}] block hash`);
+            if (row.merkleRoot !== undefined)
+                assertHash(row.merkleRoot, `Revalidation row[${index}] Merkle root`);
+            const key = `${row.txid.toLowerCase()}.${row.topic}`;
+            if (seenRows.has(key))
+                throw new TypeError('Storage returned duplicate revalidation rows');
+            seenRows.add(key);
             if (row.blockHash === undefined) {
                 continue;
             }
             const stale = await this.isProvenAnchorStale(row, chainTracker);
-            if (stale === true) {
-                orphaned.add(row.blockHash.toLowerCase());
+            if (stale !== false && stale !== undefined) {
+                const blockHash = row.blockHash.toLowerCase();
+                orphaned.add(blockHash);
+                if (stale === 'invalid-proof') {
+                    independentlyInvalidProofRows.add(`${row.txid.toLowerCase()}\0${row.topic}`);
+                }
+                if (orphaned.size > MAX_REORG_ORPHAN_HASHES) {
+                    throw new TypeError('Revalidation produced too many orphaned block hashes');
+                }
                 minAffected = Math.min(minAffected, row.blockHeight);
             }
         }
         if (orphaned.size === 0) {
             return { perTopic: [] };
         }
-        return await this.handleReorg({
+        return await this.reconcileReorg({
             orphanedBlockHashes: Array.from(orphaned),
             rebuildFromHeight: minAffected,
             newTipHeight: tip
-        });
+        }, independentlyInvalidProofRows);
     }
     async validateTopicSubmission(topic, context) {
         const { tx, txid, beef, offChainValues, mode, dupeTopics, failedTopics } = context;
@@ -400,6 +774,9 @@ export class Engine {
             this.startTime(`dupCheck_${txid.substring(0, 10)}`);
             const isDupe = await this.storage.doesAppliedTransactionExist({ txid, topic });
             this.endTime(`dupCheck_${txid.substring(0, 10)}`);
+            if (typeof isDupe !== 'boolean') {
+                throw new TypeError('Storage returned an invalid applied-transaction verdict');
+            }
             if (isDupe) {
                 dupeTopics.add(topic);
                 return {
@@ -415,16 +792,22 @@ export class Engine {
                 const previousTXID = input.sourceTXID ?? input.sourceTransaction?.id('hex');
                 if (previousTXID === undefined)
                     return null;
-                const output = await this.storage.findOutput(previousTXID, input.sourceOutputIndex, topic);
-                if (output !== undefined && output !== null)
+                const output = await this.storage.findOutput(previousTXID, input.sourceOutputIndex, topic, false);
+                if (output !== undefined && output !== null) {
+                    this.assertStoredOutputMatches(output, { txid: previousTXID, outputIndex: input.sourceOutputIndex, topic }, 'Previous topical output');
+                    if (output.spent !== false) {
+                        throw new TypeError('Storage returned a spent output for an unspent topical query');
+                    }
                     previousCoins.push(inputIndex);
+                }
                 return output ?? null;
             });
             this.startTime(`previousOutputQuery_${txid.substring(0, 10)}`);
             const previousOutputs = await Promise.all(outputPromises);
+            previousCoins.sort((left, right) => left - right);
             this.endTime(`previousOutputQuery_${txid.substring(0, 10)}`);
             this.startTime(`identifyAdmissibleOutputs_${txid.substring(0, 10)}`);
-            const admissibleOutputs = await this.managers[topic].identifyAdmissibleOutputs(beef, previousCoins, offChainValues, mode);
+            const admissibleOutputs = validateAdmittanceInstructions(await this.managers[topic].identifyAdmissibleOutputs(beef, previousCoins, offChainValues, mode), tx, previousCoins);
             this.endTime(`identifyAdmissibleOutputs_${txid.substring(0, 10)}`);
             return {
                 topic,
@@ -447,10 +830,11 @@ export class Engine {
         }
     }
     isTopicSubmissionAccepted(validation, failedTopics) {
-        return !failedTopics.has(validation.topic) && (validation.isDupe ||
-            validation.admissibleOutputs.outputsToAdmit.length > 0 ||
-            validation.admissibleOutputs.coinsToRetain.length > 0 ||
-            validation.previousCoins.length > 0);
+        return (!failedTopics.has(validation.topic) &&
+            (validation.isDupe ||
+                validation.admissibleOutputs.outputsToAdmit.length > 0 ||
+                validation.admissibleOutputs.coinsToRetain.length > 0 ||
+                validation.previousCoins.length > 0));
     }
     async broadcastAcceptedSubmission(tx, txid, mode, anyTopicAccepted) {
         this.startTime(`broadcast_${txid.substring(0, 10)}`);
@@ -483,6 +867,22 @@ export class Engine {
         }
         this.endTime(`broadcast_${txid.substring(0, 10)}`);
     }
+    async abortProvisionalAdmissions(validations, failedTopics, beef) {
+        await Promise.all(validations.map(async (validation) => {
+            if (validation.isDupe || failedTopics.has(validation.topic))
+                return;
+            const outputs = validation.admissibleOutputs.outputsToAdmit;
+            const abort = this.managers[validation.topic].abortAdmissibleOutputs;
+            if (outputs.length === 0 || abort === undefined)
+                return;
+            try {
+                await abort.call(this.managers[validation.topic], beef, outputs);
+            }
+            catch (error) {
+                this.logger.error(`Error aborting provisional topic admission: topic=${serializeLogValue(validation.topic)} error=${serializeErrorForLog(error)}`);
+            }
+        }));
+    }
     async notifyOutputSpent(lookupService, tx, txid, output, topic, offChainValues) {
         if (typeof lookupService.outputSpent !== 'function')
             return;
@@ -534,29 +934,24 @@ export class Engine {
     async markPreviousOutputSpent(output, topic, tx, txid, offChainValues) {
         if (output === null)
             return;
-        try {
-            await this.storage.markUTXOAsSpent(output.txid, output.outputIndex, topic);
-            await Promise.all(Object.values(this.lookupServices).map(async (lookupService) => {
-                try {
-                    await this.notifyOutputSpent(lookupService, tx, txid, output, topic, offChainValues);
-                }
-                catch (error) {
-                    this.logger.error('Error in lookup service for outputSpent:', error);
-                }
-            }));
-        }
-        catch (error) {
-            this.logger.error('Error marking UTXO as spent:', error);
-        }
+        await this.storage.markUTXOAsSpent(output.txid, output.outputIndex, topic, txid);
+        await Promise.all(Object.values(this.lookupServices).map(async (lookupService) => {
+            try {
+                await this.notifyOutputSpent(lookupService, tx, txid, output, topic, offChainValues);
+            }
+            catch (error) {
+                this.logger.error('Error in lookup service for outputSpent:', error);
+            }
+        }));
     }
     async markPreviousOutputsSpent(validations, failedTopics, tx, txid, offChainValues) {
-        await Promise.all(validations.map(async (validation) => {
+        for (const validation of validations) {
             if (validation.isDupe || failedTopics.has(validation.topic))
-                return;
-            await Promise.all(validation.previousOutputs.map(async (output) => {
+                continue;
+            for (const output of validation.previousOutputs) {
                 await this.markPreviousOutputSpent(output, validation.topic, tx, txid, offChainValues);
-            }));
-        }));
+            }
+        }
     }
     classifyPreviousCoins(tx, validation) {
         const outputsConsumed = [];
@@ -586,8 +981,10 @@ export class Engine {
         this.startTime(`lookForStaleOutputs_${txid.substring(0, 10)}`);
         await Promise.all(outputs.map(async (coin) => {
             const output = await this.storage.findOutput(coin.txid, coin.previousOutputIndex, topic);
-            if (output !== undefined && output !== null)
+            if (output !== undefined && output !== null) {
+                this.assertStoredOutputMatches(output, { txid: coin.txid, outputIndex: coin.previousOutputIndex, topic }, 'Stale topical output');
                 await this.deleteUTXODeep(output);
+            }
         }));
         this.endTime(`lookForStaleOutputs_${txid.substring(0, 10)}`);
     }
@@ -650,7 +1047,17 @@ export class Engine {
         const storedOutput = await this.storage.findOutput(output.txid, output.outputIndex, topic);
         if (storedOutput === undefined || storedOutput === null)
             return;
-        const consumedBy = [...new Set([...newUTXOs, ...storedOutput.consumedBy])];
+        this.assertStoredOutputMatches(storedOutput, { ...output, topic }, 'Consumed topical output');
+        const consumedByMap = new Map();
+        for (const [index, relation] of [...storedOutput.consumedBy, ...newUTXOs].entries()) {
+            assertHash(relation.txid, `Consumed topical output relation[${index}] txid`);
+            assertOutputIndex(relation.outputIndex, `Consumed topical output relation[${index}] output index`);
+            consumedByMap.set(this.toOutputCacheKey(relation.txid, relation.outputIndex), relation);
+        }
+        if (consumedByMap.size > MAX_OUTPUT_RELATIONS) {
+            throw new RangeError('Consumed topical output relations exceeded their work budget');
+        }
+        const consumedBy = Array.from(consumedByMap.values());
         await this.storage.updateConsumedBy(output.txid, output.outputIndex, topic, consumedBy);
     }
     async applyTopicStorageMutation(validation, steak, tx, txid, beef, offChainValues) {
@@ -659,7 +1066,7 @@ export class Engine {
         await this.removeStaleOutputs(outputsToMarkStale, topic, txid);
         steak[topic].coinsRemoved = outputsToMarkStale.map(output => output.inputIndex);
         const newUTXOs = [];
-        await Promise.all(validation.admissibleOutputs.outputsToAdmit.map(async (outputIndex) => {
+        for (const outputIndex of validation.admissibleOutputs.outputsToAdmit) {
             await this.admitOutput(outputIndex, {
                 tx,
                 txid,
@@ -669,7 +1076,7 @@ export class Engine {
                 newUTXOs,
                 offChainValues
             });
-        }));
+        }
         this.startTime(`outputConsumed_${txid.substring(0, 10)}`);
         const appliedRecord = await this.buildAppliedTransactionRecord(tx);
         await this.recordTransactionData(tx, beef, appliedRecord.blockHash);
@@ -690,20 +1097,14 @@ export class Engine {
             const topic = validation.topic;
             if (dupeTopics.has(topic) || failedTopics.has(topic))
                 continue;
-            try {
-                await this.applyTopicStorageMutation(validation, steak, tx, txid, beef, offChainValues);
-            }
-            catch (error) {
-                this.logger.error('Error updating storage and notifying lookup services for topic', topic, error);
-            }
+            await this.applyTopicStorageMutation(validation, steak, tx, txid, beef, offChainValues);
         }
     }
     async propagateSubmission(taggedBEEF, steak, dupeTopics, tx, txid) {
         this.startTime(`transactionPropagation_${txid.substring(0, 10)}`);
         const relevantTopics = taggedBEEF.topics.filter(topic => steak[topic] !== undefined &&
             !dupeTopics.has(topic) &&
-            (steak[topic].outputsToAdmit.length !== 0 ||
-                steak[topic].coinsRemoved?.length !== 0));
+            (steak[topic].outputsToAdmit.length !== 0 || steak[topic].coinsRemoved?.length !== 0));
         if (relevantTopics.length === 0) {
             this.endTime(`transactionPropagation_${txid.substring(0, 10)}`);
             return;
@@ -717,8 +1118,8 @@ export class Engine {
                 resolver: new LookupResolver(resolverConfig)
             };
         }
-        const shipBroadcaster = new SHIPBroadcaster(relevantTopics, customBroadcasterConfig);
         try {
+            const shipBroadcaster = new SHIPBroadcaster(relevantTopics, customBroadcasterConfig);
             await shipBroadcaster.broadcast(tx);
         }
         catch (error) {
@@ -726,6 +1127,68 @@ export class Engine {
         }
         this.endTime(`transactionPropagation_${txid.substring(0, 10)}`);
     }
+    assertSupportedTopics(topics) {
+        for (const topic of topics) {
+            if (this.managers[topic] === undefined || this.managers[topic] === null) {
+                throw new Error(`This server does not support this topic: ${topic}`);
+            }
+        }
+    }
+    shouldSkipPropagation(mode) {
+        return (this.advertiser === undefined || mode === 'historical-tx' || mode === 'historical-tx-no-spv');
+    }
+    notifySteakReady(callback, steak) {
+        if (callback === undefined)
+            return;
+        try {
+            callback(steak);
+        }
+        catch (error) {
+            this.logger.error('Error in onSteakReady callback:', error);
+        }
+    }
+    async acknowledgeOverlayAdmission(context) {
+        const admissionHost = getOverlayAdmissionHost(this.storage);
+        if (admissionHost === undefined)
+            return undefined;
+        const { taggedBEEF, steak, tx, txid, mode, offChainValues, validations, failedTopics, anyTopicAccepted, onSteakReady } = context;
+        if (!anyTopicAccepted) {
+            this.notifySteakReady(onSteakReady, steak);
+            return steak;
+        }
+        // A topic counts toward `anyTopicAccepted` when it is a dupe (so the
+        // caller still gets broadcast/propagation for a retried submission), but
+        // a dupe must never be resubmitted for admission: it was already
+        // committed under a (possibly different) operation, and re-including it
+        // here would make commitAdmission reject the whole plan. When nothing
+        // left over is a genuinely new admission, skip the plan/commit entirely
+        // and hand back the STEAK already computed from validation — it reports
+        // each dupe topic as accepted-with-nothing-new, same as the classic
+        // (non-admission) storage path does.
+        if (selectNewAdmissionTopics(validations, failedTopics).length === 0) {
+            this.notifySteakReady(onSteakReady, steak);
+            return steak;
+        }
+        const applied = await this.buildAppliedTransactionRecord(tx);
+        const buildPlan = async () => await buildOverlayAdmissionPlan({
+            host: admissionHost,
+            tx,
+            txid,
+            beef: taggedBEEF.beef,
+            topics: taggedBEEF.topics,
+            mode: overlayAdmissionMode(mode),
+            offChainValues,
+            validations,
+            failedTopics,
+            lookupServices: this.lookupServices,
+            includePropagation: !this.shouldSkipPropagation(mode),
+            applied
+        });
+        const committed = await waitForAdmissionReceipt(admissionHost.admission, await buildPlan(), buildPlan);
+        const acknowledged = JSON.parse(committed.receipt.steak);
+        this.notifySteakReady(onSteakReady, acknowledged);
+        return acknowledged;
+    }
     /**
      * Submits a transaction for processing by Overlay Services.
      * @param {TaggedBEEF} taggedBEEF - The transaction to process
@@ -733,20 +1196,68 @@ export class Engine {
      * @param {string} mode — Indicates the submission behavior, whether historical or current. Historical transactions are not broadcast or propagated.
      * @param {number[]} offChainValues — Values necessary to evaluate topical admittance that are not stored on-chain.
      *
-     * The optional callback function should be used to get STEAK when ready, and avoid waiting for broadcast and transaction propagation to complete.
+     * The optional callback is invoked after any required transaction broadcast and
+     * local storage mutations have completed, but before peer-to-peer propagation.
      *
      * @returns {Promise<STEAK>} The submitted transaction execution acknowledgement
      */
     async submit(taggedBEEF, onSteakReady, mode = 'current-tx', offChainValues) {
-        for (const t of taggedBEEF.topics) {
-            if (this.managers[t] === undefined || this.managers[t] === null) {
-                throw new Error(`This server does not support this topic: ${t}`);
-            }
+        const previous = this.submissionTail;
+        let release;
+        this.submissionTail = new Promise(resolve => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await this.submitUnlocked(taggedBEEF, onSteakReady, mode, offChainValues);
+        }
+        finally {
+            release();
+        }
+    }
+    async submitUnlocked(taggedBEEF, onSteakReady, mode = 'current-tx', offChainValues) {
+        if (typeof taggedBEEF !== 'object' ||
+            taggedBEEF === null ||
+            !Array.isArray(taggedBEEF.beef) ||
+            !Array.isArray(taggedBEEF.topics)) {
+            throw new TypeError('Tagged BEEF must contain byte and topic arrays');
+        }
+        if (taggedBEEF.beef.length === 0 ||
+            taggedBEEF.beef.length > MAX_SUBMISSION_BEEF_BYTES ||
+            taggedBEEF.beef.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+            throw new TypeError(`Tagged BEEF must contain between 1 and ${MAX_SUBMISSION_BEEF_BYTES} bytes`);
         }
+        if (taggedBEEF.topics.length === 0 || taggedBEEF.topics.length > MAX_SUBMISSION_TOPICS) {
+            throw new TypeError(`Tagged BEEF must contain between 1 and ${MAX_SUBMISSION_TOPICS} topics`);
+        }
+        if (!['historical-tx', 'current-tx', 'historical-tx-no-spv'].includes(mode)) {
+            throw new TypeError('Invalid overlay submission mode');
+        }
+        if (onSteakReady !== undefined && typeof onSteakReady !== 'function') {
+            throw new TypeError('onSteakReady must be a function');
+        }
+        if (offChainValues !== undefined &&
+            (!Array.isArray(offChainValues) ||
+                offChainValues.length > MAX_OFF_CHAIN_VALUES ||
+                offChainValues.some(value => !Number.isSafeInteger(value)))) {
+            throw new TypeError('offChainValues must be a bounded array of safe integers');
+        }
+        const uniqueTopics = new Set();
+        for (const topic of taggedBEEF.topics) {
+            assertTopic(topic, 'Tagged BEEF topic');
+            if (uniqueTopics.has(topic))
+                throw new TypeError('Tagged BEEF contains duplicate topics');
+            uniqueTopics.add(topic);
+        }
+        this.assertSupportedTopics(taggedBEEF.topics);
         // Validate the transaction SPV information
         const tx = Transaction.fromBEEF(taggedBEEF.beef);
         const txid = tx.id('hex');
         this.startTime(`submit_${txid}`);
+        // Every submission is SPV-verified except 'historical-tx-no-spv', which is
+        // reserved for callers that have already proven inclusion independently
+        // (GASP graph finalization and BASM reconciliation). 'historical-tx' is a
+        // public submission mode, so it keeps the full SPV check.
         if (mode !== 'historical-tx-no-spv') {
             this.startTime(`chainTracker_${txid.substring(0, 10)}`);
             const txValid = await tx.verify(this.chainTracker);
@@ -788,31 +1299,56 @@ export class Engine {
         // abort/release their held inputs, so broadcasting it anyway would
         // desync their wallets from the chain.
         const anyTopicAccepted = validations.some(validation => this.isTopicSubmissionAccepted(validation, failedTopics));
-        await this.broadcastAcceptedSubmission(tx, txid, mode, anyTopicAccepted);
-        // Call the callback function with STEAK if it is provided (before storage mutations)
-        if (onSteakReady !== undefined) {
-            onSteakReady(steak);
+        try {
+            await this.broadcastAcceptedSubmission(tx, txid, mode, anyTopicAccepted);
         }
-        // ===================================================================
-        // PHASE 3: MUTATE STORAGE (only after broadcast succeeded)
-        // ===================================================================
-        // Mark previous outputs as spent and notify lookup services
-        await this.markPreviousOutputsSpent(validations, failedTopics, tx, txid, offChainValues);
-        await this.applyStorageMutations(validations, {
-            dupeTopics,
-            failedTopics,
+        catch (error) {
+            await this.abortProvisionalAdmissions(validations, failedTopics, taggedBEEF.beef);
+            throw error;
+        }
+        const admissionSteak = await this.acknowledgeOverlayAdmission({
+            taggedBEEF,
             steak,
             tx,
             txid,
-            beef: taggedBEEF.beef,
-            offChainValues
+            mode,
+            offChainValues,
+            validations,
+            failedTopics,
+            anyTopicAccepted,
+            onSteakReady
         });
+        if (admissionSteak !== undefined)
+            return admissionSteak;
+        // ===================================================================
+        // PHASE 3: MUTATE STORAGE (only after broadcast succeeded)
+        // ===================================================================
+        // Mark previous outputs as spent and notify lookup services
+        try {
+            await this.markPreviousOutputsSpent(validations, failedTopics, tx, txid, offChainValues);
+            await this.applyStorageMutations(validations, {
+                dupeTopics,
+                failedTopics,
+                steak,
+                tx,
+                txid,
+                beef: taggedBEEF.beef,
+                offChainValues
+            });
+        }
+        catch (error) {
+            await this.abortProvisionalAdmissions(validations, failedTopics, taggedBEEF.beef);
+            throw error;
+        }
+        // A STEAK is only ready after the corresponding local state is durable.
+        // This prevents a callback from reporting success for a storage mutation
+        // that later fails.
+        this.notifySteakReady(onSteakReady, steak);
         // If we don't have an advertiser or we are dealing with historical transactions, just return the steak
-        if (this.advertiser === undefined || mode === 'historical-tx' || mode === 'historical-tx-no-spv') {
+        if (this.shouldSkipPropagation(mode)) {
             return steak;
         }
         await this.propagateSubmission(taggedBEEF, steak, dupeTopics, tx, txid);
-        // Immediately return from the function without waiting for the promises to resolve.
         return steak;
     }
     /**
@@ -821,13 +1357,23 @@ export class Engine {
      * @returns The answer to the question
      */
     async lookup(lookupQuestion) {
+        if (typeof lookupQuestion !== 'object' || lookupQuestion === null) {
+            throw new TypeError('Lookup question must be an object');
+        }
+        assertRegistryName(lookupQuestion.service, 'Lookup service name');
         // Validate a lookup service for the provider is found
-        const lookupService = this.lookupServices[lookupQuestion.service];
+        const lookupService = Object.prototype.hasOwnProperty.call(this.lookupServices, lookupQuestion.service)
+            ? this.lookupServices[lookupQuestion.service]
+            : undefined;
         if (lookupService === undefined || lookupService === null)
             throw new Error(`Lookup service not found for provider: ${lookupQuestion.service}`);
         const lookupResult = await lookupService.lookup(lookupQuestion);
-        if (this.maxLookupResults !== -1 && lookupResult.length > this.maxLookupResults) {
-            throw new RangeError(`Lookup returned ${lookupResult.length} results; maximum is ${this.maxLookupResults}`);
+        this.assertLookupFormula(lookupResult);
+        const configuredLimit = this.maxLookupResults === -1
+            ? MAX_LOOKUP_FORMULAS
+            : Math.min(this.maxLookupResults, MAX_LOOKUP_FORMULAS);
+        if (lookupResult.length > configuredLimit) {
+            throw new RangeError(`Lookup returned ${lookupResult.length} results; maximum is ${configuredLimit}`);
         }
         const hydrationContext = this.createUTXOHistoryHydrationContext();
         await this.preloadOutputsWithBEEF(lookupResult.map(({ txid, outputIndex }) => ({ txid, outputIndex })), hydrationContext);
@@ -848,9 +1394,7 @@ export class Engine {
             };
         })))
             .filter((output) => output !== null)
-            .map(({ beef, outputIndex, context }) => (context === undefined
-            ? { beef, outputIndex }
-            : { beef, outputIndex, context }));
+            .map(({ beef, outputIndex, context }) => context === undefined ? { beef, outputIndex } : { beef, outputIndex, context });
         return {
             type: 'output-list',
             outputs: hydratedOutputs
@@ -858,11 +1402,88 @@ export class Engine {
     }
     createUTXOHistoryHydrationContext() {
         return {
-            outputCache: new Map()
+            outputCache: new Map(),
+            budgetedOutputs: new Set(),
+            hydratedNodes: 0,
+            relationCount: 0,
+            totalBeefBytes: 0
         };
     }
     toOutputCacheKey(txid, outputIndex) {
-        return `${txid}:${outputIndex}`;
+        return `${txid.toLowerCase()}:${outputIndex}`;
+    }
+    assertLookupFormula(value) {
+        if (!Array.isArray(value))
+            throw new TypeError('Lookup service must return an array');
+        if (value.length > MAX_LOOKUP_FORMULAS) {
+            throw new RangeError(`Lookup returned more than ${MAX_LOOKUP_FORMULAS} results`);
+        }
+        let totalContextBytes = 0;
+        for (const [index, entry] of value.entries()) {
+            if (typeof entry !== 'object' || entry === null) {
+                throw new TypeError(`Lookup result[${index}] is invalid`);
+            }
+            assertHash(entry.txid, `Lookup result[${index}] txid`);
+            assertOutputIndex(entry.outputIndex, `Lookup result[${index}] output index`);
+            if (entry.history !== undefined &&
+                typeof entry.history !== 'function' &&
+                (!Number.isSafeInteger(entry.history) ||
+                    entry.history < -1 ||
+                    entry.history > MAX_LOOKUP_HISTORY_DEPTH)) {
+                throw new TypeError(`Lookup result[${index}] history must be -1 through ${MAX_LOOKUP_HISTORY_DEPTH}, or a function`);
+            }
+            if (entry.context !== undefined) {
+                if (!Array.isArray(entry.context) || entry.context.length > MAX_LOOKUP_CONTEXT_BYTES) {
+                    throw new TypeError(`Lookup result[${index}] context must be bounded bytes`);
+                }
+                for (let byteIndex = 0; byteIndex < entry.context.length; byteIndex++) {
+                    const byte = entry.context[byteIndex];
+                    if (!Object.prototype.hasOwnProperty.call(entry.context, byteIndex) ||
+                        !Number.isInteger(byte) ||
+                        byte < 0 ||
+                        byte > 255) {
+                        throw new TypeError(`Lookup result[${index}] context must be bounded bytes`);
+                    }
+                }
+                totalContextBytes += entry.context.length;
+                if (totalContextBytes > MAX_LOOKUP_TOTAL_CONTEXT_BYTES) {
+                    throw new RangeError('Lookup result contexts exceeded their total byte budget');
+                }
+            }
+        }
+    }
+    validateLookupOutput(value, label, expected, context) {
+        this.assertStoredOutputRelations(value, label);
+        if (expected !== undefined &&
+            (value.txid.toLowerCase() !== expected.txid.toLowerCase() ||
+                value.outputIndex !== expected.outputIndex)) {
+            throw new TypeError(`${label} does not match the requested outpoint`);
+        }
+        if (value.beef === undefined)
+            return;
+        if (!Array.isArray(value.beef) ||
+            value.beef.length === 0 ||
+            value.beef.length > MAX_SUBMISSION_BEEF_BYTES ||
+            value.beef.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+            throw new TypeError(`${label} has invalid or oversized transaction BEEF`);
+        }
+        const transaction = Transaction.fromBEEF(value.beef);
+        if (transaction.id('hex').toLowerCase() !== value.txid.toLowerCase()) {
+            throw new TypeError(`${label} BEEF does not match its transaction ID`);
+        }
+        if (value.outputIndex >= transaction.outputs.length) {
+            throw new TypeError(`${label} index is outside its transaction`);
+        }
+        if (context !== undefined) {
+            const key = this.toOutputCacheKey(value.txid, value.outputIndex);
+            if (!context.budgetedOutputs.has(key)) {
+                context.budgetedOutputs.add(key);
+                context.totalBeefBytes += value.beef.length;
+                if (context.totalBeefBytes > MAX_LOOKUP_TOTAL_BEEF_BYTES) {
+                    throw new RangeError('Lookup transaction BEEF exceeded its total byte budget');
+                }
+            }
+        }
     }
     async preloadOutputsWithBEEF(outpoints, context) {
         if (outpoints.length === 0) {
@@ -871,6 +1492,8 @@ export class Engine {
         const deduped = [];
         const seen = new Set();
         for (const outpoint of outpoints) {
+            assertHash(outpoint.txid, 'Lookup outpoint txid');
+            assertOutputIndex(outpoint.outputIndex, 'Lookup outpoint output index');
             const cacheKey = this.toOutputCacheKey(outpoint.txid, outpoint.outputIndex);
             if (seen.has(cacheKey)) {
                 continue;
@@ -883,12 +1506,25 @@ export class Engine {
         if (deduped.length === 0) {
             return;
         }
+        if (context.outputCache.size + deduped.length > MAX_LOOKUP_HYDRATION_NODES) {
+            throw new RangeError('Lookup output traversal exceeded its work budget');
+        }
         const findOutputsByOutpoints = this.storage.findOutputsByOutpoints;
         if (typeof findOutputsByOutpoints === 'function') {
             const outputs = await findOutputsByOutpoints.call(this.storage, deduped, true);
+            if (!Array.isArray(outputs) || outputs.length > MAX_LOOKUP_STORAGE_ROWS) {
+                throw new TypeError('Storage returned invalid or oversized batched lookup outputs');
+            }
+            const requestedKeys = new Set(deduped.map(outpoint => this.toOutputCacheKey(outpoint.txid, outpoint.outputIndex)));
             const outputsByKey = new Map();
-            for (const output of outputs) {
-                outputsByKey.set(this.toOutputCacheKey(output.txid, output.outputIndex), output);
+            for (const [index, output] of outputs.entries()) {
+                this.validateLookupOutput(output, `Batched lookup output[${index}]`);
+                const key = this.toOutputCacheKey(output.txid, output.outputIndex);
+                if (!requestedKeys.has(key)) {
+                    throw new TypeError('Storage returned an output that was not requested');
+                }
+                if (!outputsByKey.has(key))
+                    outputsByKey.set(key, output);
             }
             for (const outpoint of deduped) {
                 const cacheKey = this.toOutputCacheKey(outpoint.txid, outpoint.outputIndex);
@@ -909,43 +1545,80 @@ export class Engine {
             context.outputCache.set(cacheKey, cached);
         }
         const output = await cached;
+        if (output !== null && output !== undefined) {
+            this.validateLookupOutput(output, 'Lookup output', { txid, outputIndex }, context);
+        }
         return output ?? null;
     }
-    async hydrateUTXOHistoryNode(output, historySelector, currentDepth, context) {
-        if (output.beef === undefined) {
-            throw new Error('Output must have associated transaction BEEF!');
-        }
+    async hydrateUTXOHistoryNode(output, historySelector, currentDepth, context, ancestors = new Set()) {
         let shouldTraverseHistory;
         if (typeof historySelector === 'number') {
             shouldTraverseHistory = currentDepth <= historySelector;
         }
         else {
+            if (currentDepth > MAX_LOOKUP_HISTORY_DEPTH) {
+                throw new RangeError('Lookup history exceeded its maximum depth');
+            }
+            if (output.beef === undefined) {
+                throw new Error('Output must have associated transaction BEEF!');
+            }
             shouldTraverseHistory = await historySelector(output.beef, output.outputIndex, currentDepth);
+            if (typeof shouldTraverseHistory !== 'boolean') {
+                throw new TypeError('Lookup history selector must return a boolean');
+            }
         }
         if (shouldTraverseHistory === false) {
             return undefined;
         }
-        await this.preloadOutputsWithBEEF(output.outputsConsumed, context);
-        const childNodes = (await Promise.all(output.outputsConsumed.map(async (outputIdentifier) => {
-            const childOutput = await this.loadOutputWithBEEF(outputIdentifier.txid, outputIdentifier.outputIndex, context);
-            if (childOutput === null) {
-                return undefined;
-            }
-            return await this.hydrateUTXOHistoryNode(childOutput, historySelector, currentDepth + 1, context);
-        }))).filter((node) => node !== undefined);
+        if (currentDepth > MAX_LOOKUP_HISTORY_DEPTH) {
+            throw new RangeError('Lookup history exceeded its maximum depth');
+        }
+        this.validateLookupOutput(output, 'Lookup history output', undefined, context);
+        if (output.beef === undefined) {
+            throw new Error('Output must have associated transaction BEEF!');
+        }
+        const outputKey = this.toOutputCacheKey(output.txid, output.outputIndex);
+        if (ancestors.has(outputKey))
+            throw new TypeError('Lookup history contains a cycle');
+        context.hydratedNodes += 1;
+        context.relationCount += output.outputsConsumed.length;
+        if (context.hydratedNodes > MAX_LOOKUP_HYDRATION_NODES ||
+            context.relationCount > MAX_OUTPUT_RELATIONS) {
+            throw new RangeError('Lookup history traversal exceeded its work budget');
+        }
         const tx = Transaction.fromBEEF(output.beef);
         const inputIndexBySource = new Map();
         tx.inputs.forEach((candidateInput, index) => {
             const sourceTXID = candidateInput.sourceTXID !== undefined && candidateInput.sourceTXID !== ''
                 ? candidateInput.sourceTXID
                 : candidateInput.sourceTransaction?.id('hex');
-            if (sourceTXID === undefined) {
+            if (sourceTXID === undefined)
                 return;
+            const key = this.toOutputCacheKey(sourceTXID, candidateInput.sourceOutputIndex);
+            if (inputIndexBySource.has(key)) {
+                throw new TypeError('Lookup history transaction contains duplicate source outpoints');
             }
-            inputIndexBySource.set(`${sourceTXID}:${candidateInput.sourceOutputIndex}`, index);
+            inputIndexBySource.set(key, index);
         });
+        for (const relation of output.outputsConsumed) {
+            if (!inputIndexBySource.has(this.toOutputCacheKey(relation.txid, relation.outputIndex))) {
+                throw new TypeError('Lookup history relation is not an input of its transaction');
+            }
+        }
+        await this.preloadOutputsWithBEEF(output.outputsConsumed, context);
+        const nextAncestors = new Set(ancestors);
+        nextAncestors.add(outputKey);
+        const childNodes = [];
+        for (const outputIdentifier of output.outputsConsumed) {
+            const childOutput = await this.loadOutputWithBEEF(outputIdentifier.txid, outputIdentifier.outputIndex, context);
+            if (childOutput === null)
+                continue;
+            const childNode = await this.hydrateUTXOHistoryNode(childOutput, historySelector, currentDepth + 1, context, nextAncestors);
+            if (childNode !== undefined)
+                childNodes.push(childNode);
+        }
         for (const child of childNodes) {
-            const inputIndex = inputIndexBySource.get(`${child.output.txid}:${child.output.outputIndex}`);
+            const inputIndex = inputIndexBySource.get(this.toOutputCacheKey(child.output.txid, child.output.outputIndex));
             if (inputIndex === -1 || inputIndex == null) {
                 continue;
             }
@@ -977,6 +1650,54 @@ export class Engine {
      * @throws Will throw an error if there are issues during the advertisement synchronization process.
      * @returns {Promise<void>} A promise that resolves when the synchronization process is complete.
      */
+    validateCurrentAdvertisements(value, protocol, advertiser) {
+        if (!Array.isArray(value) || value.length > MAX_CURRENT_ADVERTISEMENTS) {
+            throw new TypeError('Advertiser returned an invalid or oversized advertisement set');
+        }
+        let totalBeefBytes = 0;
+        return value.map((candidate, index) => {
+            if (typeof candidate !== 'object' || candidate === null) {
+                throw new TypeError(`Advertisement[${index}] is invalid`);
+            }
+            const advertisement = candidate;
+            if (advertisement.protocol !== protocol) {
+                throw new TypeError(`Advertisement[${index}] has the wrong protocol`);
+            }
+            assertRegistryName(advertisement.topicOrService, `Advertisement[${index}] name`);
+            if (typeof advertisement.identityKey !== 'string' ||
+                !/^(?:02|03)[0-9a-fA-F]{64}$/.test(advertisement.identityKey) ||
+                typeof advertisement.domain !== 'string' ||
+                !this.isValidUrl(advertisement.domain) ||
+                !Array.isArray(advertisement.beef) ||
+                advertisement.beef.length === 0 ||
+                advertisement.beef.length > MAX_SUBMISSION_BEEF_BYTES ||
+                advertisement.beef.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+                throw new TypeError(`Advertisement[${index}] has invalid identity, domain, or BEEF`);
+            }
+            assertOutputIndex(advertisement.outputIndex, `Advertisement[${index}] output index`);
+            totalBeefBytes += advertisement.beef.length;
+            if (totalBeefBytes > MAX_LOOKUP_TOTAL_BEEF_BYTES) {
+                throw new RangeError('Advertisement BEEF exceeded its total byte budget');
+            }
+            const transaction = Transaction.fromBEEF(advertisement.beef);
+            if (advertisement.outputIndex >= transaction.outputs.length) {
+                throw new TypeError(`Advertisement[${index}] output index is outside its transaction`);
+            }
+            const parsed = advertiser.parseAdvertisement(transaction.outputs[advertisement.outputIndex].lockingScript);
+            if (parsed.protocol !== advertisement.protocol ||
+                parsed.identityKey.toLowerCase() !== advertisement.identityKey.toLowerCase() ||
+                parsed.topicOrService !== advertisement.topicOrService ||
+                normalizePeerEndpoint(parsed.domain) !== normalizePeerEndpoint(advertisement.domain)) {
+                throw new TypeError(`Advertisement[${index}] metadata does not match its BEEF`);
+            }
+            return {
+                ...advertisement,
+                identityKey: advertisement.identityKey.toLowerCase(),
+                domain: normalizePeerEndpoint(advertisement.domain),
+                beef: [...advertisement.beef]
+            };
+        });
+    }
     async syncAdvertisements() {
         if (this.advertiser === undefined ||
             typeof this.hostingURL !== 'string' ||
@@ -985,6 +1706,7 @@ export class Engine {
             return;
         }
         const advertiser = this.advertiser;
+        const normalizedHostingURL = normalizePeerEndpoint(this.hostingURL);
         // Step 1: Retrieve Current Configuration
         let configuredTopics = Object.keys(this.managers);
         let configuredServices = Object.keys(this.lookupServices);
@@ -994,13 +1716,13 @@ export class Engine {
             configuredServices = configuredServices.filter(service => service !== 'ls_ship' && service !== 'ls_slap');
         }
         // Step 2: Fetch Existing Advertisements
-        const currentSHIPAdvertisements = await advertiser.findAllAdvertisements('SHIP');
-        const currentSLAPAdvertisements = await advertiser.findAllAdvertisements('SLAP');
+        const currentSHIPAdvertisements = this.validateCurrentAdvertisements(await advertiser.findAllAdvertisements('SHIP'), 'SHIP', advertiser);
+        const currentSLAPAdvertisements = this.validateCurrentAdvertisements(await advertiser.findAllAdvertisements('SLAP'), 'SLAP', advertiser);
         // Step 3: Compare and Determine Actions
         const requiredSHIPAdvertisements = new Set(configuredTopics);
         const requiredSLAPAdvertisements = new Set(configuredServices);
-        const shipsToCreate = Array.from(requiredSHIPAdvertisements).filter(topicOrService => !currentSHIPAdvertisements.some(x => x.topicOrService === topicOrService && x.domain === this.hostingURL));
-        const slapsToCreate = Array.from(requiredSLAPAdvertisements).filter(topicOrService => !currentSLAPAdvertisements.some(x => x.topicOrService === topicOrService && x.domain === this.hostingURL));
+        const shipsToCreate = Array.from(requiredSHIPAdvertisements).filter(topicOrService => !currentSHIPAdvertisements.some(x => x.topicOrService === topicOrService && x.domain === normalizedHostingURL));
+        const slapsToCreate = Array.from(requiredSLAPAdvertisements).filter(topicOrService => !currentSLAPAdvertisements.some(x => x.topicOrService === topicOrService && x.domain === normalizedHostingURL));
         const shipsToRevoke = currentSHIPAdvertisements.filter(ad => !requiredSHIPAdvertisements.has(ad.topicOrService));
         const slapsToRevoke = currentSLAPAdvertisements.filter(ad => !requiredSLAPAdvertisements.has(ad.topicOrService));
         // Create needed SHIP/SLAP advertisements
@@ -1026,7 +1748,10 @@ export class Engine {
         // Revoke all advertisements to revoke
         try {
             if (shipsToRevoke.length > 0 || slapsToRevoke.length > 0) {
-                const taggedBEEF = await advertiser.revokeAdvertisements([...shipsToRevoke, ...slapsToRevoke]);
+                const taggedBEEF = await advertiser.revokeAdvertisements([
+                    ...shipsToRevoke,
+                    ...slapsToRevoke
+                ]);
                 await this.submit(taggedBEEF);
             }
         }
@@ -1064,6 +1789,7 @@ export class Engine {
         this.logger.info(`[GASP SYNC] Starting sync for topic "${topic}" with peer "${endpoint}"`);
         try {
             const lastInteraction = await this.storage.getLastInteraction(endpoint, topic);
+            assertNonnegativeInteger(lastInteraction, 'Stored GASP last interaction');
             const gasp = new GASP(new OverlayGASPStorage(topic, this), new OverlayGASPRemote(endpoint, topic), lastInteraction, `[GASP Sync of ${topic} with ${endpoint}]`, true, true);
             await gasp.sync(endpoint, DEFAULT_GASP_SYNC_LIMIT);
             if (gasp.lastInteraction > lastInteraction) {
@@ -1097,84 +1823,241 @@ export class Engine {
             });
             const endpointSet = new Set();
             if (lookupAnswer.type === 'output-list') {
-                lookupAnswer.outputs.forEach(output => {
+                for (const output of lookupAnswer.outputs) {
                     try {
                         const tx = Transaction.fromBEEF(output.beef);
-                        const advertisement = this.advertiser?.parseAdvertisement(tx.outputs[output.outputIndex].lockingScript);
-                        if (advertisement?.protocol === 'SHIP') {
-                            endpointSet.add(advertisement.domain);
+                        assertOutputIndex(output.outputIndex, 'SHIP advertisement output index');
+                        if (output.txid !== undefined &&
+                            (typeof output.txid !== 'string' ||
+                                output.txid.toLowerCase() !== tx.id('hex').toLowerCase())) {
+                            throw new TypeError('SHIP advertisement transaction ID does not match its BEEF');
                         }
+                        const selectedOutput = tx.outputs[output.outputIndex];
+                        if (selectedOutput == null || selectedOutput.satoshis !== 1) {
+                            throw new TypeError('SHIP advertisement must identify a one-satoshi output');
+                        }
+                        const advertisement = await decodeAndVerifyDiscoveryAdvertisement(selectedOutput.lockingScript, 'SHIP');
+                        if (advertisement.topicOrService !== topic) {
+                            throw new TypeError('SHIP advertisement does not match the requested topic');
+                        }
+                        endpointSet.add(advertisement.domain);
                     }
                     catch (error) {
                         this.logger.error(advertisementErrorMessage, error);
                     }
-                });
+                }
             }
             syncEndpoints = Array.from(endpointSet);
         }
         if (!Array.isArray(syncEndpoints)) {
             return [];
         }
-        return syncEndpoints.filter(endpoint => endpoint !== this.hostingURL);
+        const normalizedHostingURL = typeof this.hostingURL === 'string'
+            ? (() => {
+                try {
+                    return normalizePeerEndpoint(this.hostingURL);
+                }
+                catch {
+                    return this.hostingURL;
+                }
+            })()
+            : undefined;
+        const validated = new Set();
+        for (const endpoint of syncEndpoints) {
+            try {
+                const normalized = normalizePeerEndpoint(endpoint);
+                if (normalized !== normalizedHostingURL)
+                    validated.add(normalized);
+            }
+            catch (error) {
+                this.logger.error(`[OVERLAY SYNC] Ignoring unsafe peer endpoint ${serializeLogValue(endpoint)}: ${serializeErrorForLog(error)}`);
+            }
+            if (validated.size >= MAX_SYNC_ENDPOINTS_PER_TOPIC)
+                break;
+        }
+        return [...validated];
+    }
+    assertSupportedBASMTopic(topic) {
+        assertTopic(topic, 'BASM topic');
+        if (this.managers[topic] === undefined || this.managers[topic] === null) {
+            throw new Error(`This server does not support this topic: ${topic}`);
+        }
+    }
+    assertTopicAnchorTip(value, topic, label) {
+        if (typeof value !== 'object' || value === null)
+            throw new TypeError(`${label} is invalid`);
+        const tip = value;
+        assertTopic(tip.topic, `${label} topic`);
+        if (tip.topic !== topic)
+            throw new TypeError(`${label} does not match the requested topic`);
+        if (!Number.isSafeInteger(tip.blockHeight) || tip.blockHeight < -1) {
+            throw new TypeError(`${label} height is invalid`);
+        }
+        assertHash(tip.tac, `${label} TAC`);
+        if (tip.blockHash !== undefined)
+            assertHash(tip.blockHash, `${label} block hash`);
+        if (tip.basmRoot !== undefined)
+            assertHash(tip.basmRoot, `${label} BASM root`);
+        if (tip.admittedCount !== undefined) {
+            assertNonnegativeInteger(tip.admittedCount, `${label} admitted count`);
+            if (tip.admittedCount > MAX_BASM_ADMITTED_PER_BLOCK) {
+                throw new RangeError(`${label} admitted count is too large`);
+            }
+        }
+    }
+    assertTopicBlockAnchor(value, topic, label, expectedHeight, expectedBlockHash) {
+        if (typeof value !== 'object' || value === null)
+            throw new TypeError(`${label} is invalid`);
+        const anchor = value;
+        assertTopic(anchor.topic, `${label} topic`);
+        if (anchor.topic !== topic)
+            throw new TypeError(`${label} does not match the requested topic`);
+        assertNonnegativeInteger(anchor.blockHeight, `${label} height`);
+        if (expectedHeight !== undefined && anchor.blockHeight !== expectedHeight) {
+            throw new TypeError(`${label} does not match the requested height`);
+        }
+        assertHash(anchor.blockHash, `${label} block hash`);
+        if (expectedBlockHash !== undefined &&
+            anchor.blockHash.toLowerCase() !== expectedBlockHash.toLowerCase()) {
+            throw new TypeError(`${label} does not match the requested block hash`);
+        }
+        assertHash(anchor.basmRoot, `${label} BASM root`);
+        assertHash(anchor.tac, `${label} TAC`);
+        assertNonnegativeInteger(anchor.admittedCount, `${label} admitted count`);
+        if (anchor.admittedCount > MAX_BASM_ADMITTED_PER_BLOCK) {
+            throw new RangeError(`${label} admitted count is too large`);
+        }
     }
     async provideTopicAnchorTip(topic) {
+        if (typeof this.storage.findTopicAnchorTip !== 'function') {
+            throw Object.assign(new TypeError('Storage does not support BASM topic anchor tips'), {
+                code: 'BASM_UNSUPPORTED'
+            });
+        }
         const tip = await this.storage.findTopicAnchorTip?.(topic);
-        return tip ?? {
+        if (tip !== undefined) {
+            this.assertTopicAnchorTip(tip, topic, 'Stored BASM tip');
+            return tip;
+        }
+        return {
             topic,
             blockHeight: -1,
             tac: BASM_ZERO_HASH
         };
     }
     async provideTopicAnchorRange(topic, fromHeight, toHeight) {
+        this.assertSupportedBASMTopic(topic);
         if (typeof this.storage.findTopicBlockAnchors !== 'function') {
-            throw new TypeError('Storage does not support BASM topic anchor ranges');
+            throw Object.assign(new TypeError('Storage does not support BASM topic anchor ranges'), {
+                code: 'BASM_UNSUPPORTED'
+            });
         }
-        if (!Number.isInteger(fromHeight) || !Number.isInteger(toHeight) || fromHeight < 0 || toHeight < fromHeight) {
+        if (!Number.isSafeInteger(fromHeight) ||
+            !Number.isSafeInteger(toHeight) ||
+            fromHeight < 0 ||
+            toHeight < fromHeight) {
             throw new Error('Invalid topic anchor range');
         }
         if (toHeight - fromHeight + 1 > DEFAULT_BASM_RANGE_LIMIT) {
             throw new Error(`Topic anchor range is capped at ${DEFAULT_BASM_RANGE_LIMIT} heights`);
         }
-        return {
-            topic,
-            anchors: await this.storage.findTopicBlockAnchors(topic, fromHeight, toHeight)
-        };
+        const anchors = await this.storage.findTopicBlockAnchors(topic, fromHeight, toHeight, toHeight - fromHeight + 2);
+        if (!Array.isArray(anchors) || anchors.length > toHeight - fromHeight + 1) {
+            throw new TypeError('Storage returned an invalid or oversized BASM anchor range');
+        }
+        let previousHeight = -1;
+        for (const anchor of anchors) {
+            this.assertTopicBlockAnchor(anchor, topic, 'Stored BASM anchor');
+            if (anchor.blockHeight < fromHeight ||
+                anchor.blockHeight > toHeight ||
+                anchor.blockHeight <= previousHeight) {
+                throw new TypeError('Storage returned an unbound or unordered BASM anchor range');
+            }
+            previousHeight = anchor.blockHeight;
+        }
+        return { topic, anchors };
     }
     async provideAdmittedList(topic, blockHeight, blockHash) {
+        this.assertSupportedBASMTopic(topic);
         if (typeof this.storage.findAdmittedTransactionsForBlock !== 'function') {
-            throw new TypeError('Storage does not support BASM admitted lists');
+            throw Object.assign(new TypeError('Storage does not support BASM admitted lists'), {
+                code: 'BASM_UNSUPPORTED'
+            });
+        }
+        assertNonnegativeInteger(blockHeight, 'BASM admitted-list height');
+        if (blockHash !== undefined)
+            assertHash(blockHash, 'BASM admitted-list block hash');
+        const admitted = await this.storage.findAdmittedTransactionsForBlock(topic, blockHeight, blockHash, MAX_BASM_ADMITTED_PER_BLOCK + 1);
+        if (!Array.isArray(admitted) || admitted.length > MAX_BASM_ADMITTED_PER_BLOCK) {
+            throw new RangeError('Storage returned an invalid or oversized BASM admitted list');
+        }
+        const seen = new Set();
+        const seenBlockIndexes = new Set();
+        for (const [index, item] of admitted.entries()) {
+            if (typeof item !== 'object' || item === null)
+                throw new TypeError(`Invalid BASM admission at index ${index}`);
+            assertHash(item.txid, `BASM admission[${index}] txid`);
+            assertNonnegativeInteger(item.blockIndex, `BASM admission[${index}] block index`);
+            const canonical = item.txid.toLowerCase();
+            if (seen.has(canonical))
+                throw new TypeError('Storage returned duplicate BASM admissions');
+            if (seenBlockIndexes.has(item.blockIndex)) {
+                throw new TypeError('Storage returned duplicate BASM block indexes');
+            }
+            seen.add(canonical);
+            seenBlockIndexes.add(item.blockIndex);
         }
         return {
             topic,
             blockHeight,
             blockHash,
-            admitted: await this.storage.findAdmittedTransactionsForBlock(topic, blockHeight, blockHash)
+            admitted
         };
     }
     async provideCompoundMerklePath(topic, blockHeight, txids) {
+        this.assertSupportedBASMTopic(topic);
         if (typeof this.storage.findTransactionMerklePaths !== 'function') {
-            throw new TypeError('Storage does not support direct Merkle path lookup');
-        }
-        if (txids.length === 0) {
-            throw new Error('At least one txid is required');
+            throw Object.assign(new TypeError('Storage does not support direct Merkle path lookup'), {
+                code: 'BASM_UNSUPPORTED'
+            });
         }
-        const admitted = await this.storage.findAdmittedTransactionsForBlock?.(topic, blockHeight);
+        assertNonnegativeInteger(blockHeight, 'BASM compound-path height');
+        assertTxidList(txids, 'BASM compound-path txids');
+        const admitted = await this.storage.findAdmittedTransactionsForBlock?.(topic, blockHeight, undefined, MAX_BASM_ADMITTED_PER_BLOCK + 1);
         if (admitted !== undefined) {
-            const admittedSet = new Set(admitted.map(item => item.txid));
-            const missingAdmissions = txids.filter(txid => !admittedSet.has(txid));
+            if (!Array.isArray(admitted) || admitted.length > MAX_BASM_ADMITTED_PER_BLOCK) {
+                throw new TypeError('Storage returned an invalid or oversized BASM admitted list');
+            }
+            computeBasmRoot(admitted);
+            const admittedSet = new Set(admitted.map(item => item.txid.toLowerCase()));
+            const missingAdmissions = txids.filter(txid => !admittedSet.has(txid.toLowerCase()));
             if (missingAdmissions.length > 0) {
                 throw new Error(`Requested txids are not admitted to topic ${topic} at height ${blockHeight}: ${missingAdmissions.join(',')}`);
             }
         }
         const proofs = await this.storage.findTransactionMerklePaths(txids);
-        const proofByTxid = new Map(proofs.map(proof => [proof.txid, proof]));
-        const missing = txids.filter(txid => !proofByTxid.has(txid));
+        if (!Array.isArray(proofs) || proofs.length > txids.length) {
+            throw new TypeError('Storage returned an invalid BASM proof set');
+        }
+        const requested = new Set(txids.map(txid => txid.toLowerCase()));
+        const proofByTxid = new Map();
+        for (const proof of proofs) {
+            assertHash(proof.txid, 'BASM proof txid');
+            const canonical = proof.txid.toLowerCase();
+            if (!requested.has(canonical) ||
+                proofByTxid.has(canonical) ||
+                typeof proof.merklePath !== 'string') {
+                throw new TypeError('Storage returned an unexpected or duplicate BASM proof');
+            }
+            proofByTxid.set(canonical, proof);
+        }
+        const missing = txids.filter(txid => !proofByTxid.has(txid.toLowerCase()));
         if (missing.length > 0) {
             throw new Error(`No direct Merkle path found for txids: ${missing.join(',')}`);
         }
         let compound;
         for (const txid of txids) {
-            const proof = proofByTxid.get(txid);
+            const proof = proofByTxid.get(txid.toLowerCase());
             if (proof === undefined)
                 continue;
             const path = MerklePath.fromHex(proof.merklePath);
@@ -1198,15 +2081,43 @@ export class Engine {
             merklePath: compound.toHex()
         };
     }
-    async provideRawTransactions(txids) {
+    async provideRawTransactions(txids, topic) {
         if (typeof this.storage.findRawTransactions !== 'function') {
-            throw new TypeError('Storage does not support raw transaction lookup');
+            throw Object.assign(new TypeError('Storage does not support raw transaction lookup'), {
+                code: 'BASM_UNSUPPORTED'
+            });
+        }
+        assertTxidList(txids, 'BASM raw-transaction txids');
+        if (topic === undefined) {
+            throw new TypeError('A BASM topic is required for raw transaction lookup');
+        }
+        this.assertSupportedBASMTopic(topic);
+        const authorizedTxids = (await Promise.all(txids.map(async (txid) => {
+            const authorized = await this.storage.doesAppliedTransactionExist({ txid, topic });
+            if (typeof authorized !== 'boolean') {
+                throw new TypeError('Storage returned an invalid BASM authorization verdict');
+            }
+            return { txid, authorized };
+        })))
+            .filter(entry => entry.authorized)
+            .map(entry => entry.txid);
+        const transactions = await this.storage.findRawTransactions(authorizedTxids);
+        if (!Array.isArray(transactions) || transactions.length > authorizedTxids.length) {
+            throw new TypeError('Storage returned an invalid BASM raw-transaction set');
+        }
+        const requested = new Set(authorizedTxids.map(txid => txid.toLowerCase()));
+        const found = new Set();
+        for (const transaction of transactions) {
+            assertRawTransactionMatches(transaction.txid, transaction.rawTx);
+            const canonical = transaction.txid.toLowerCase();
+            if (!requested.has(canonical) || found.has(canonical)) {
+                throw new TypeError('Storage returned an unexpected or duplicate BASM raw transaction');
+            }
+            found.add(canonical);
         }
-        const transactions = await this.storage.findRawTransactions(txids);
-        const found = new Set(transactions.map(tx => tx.txid));
         return {
             transactions,
-            missing: txids.filter(txid => !found.has(txid))
+            missing: txids.filter(txid => !found.has(txid.toLowerCase()))
         };
     }
     async startBASMSync() {
@@ -1232,40 +2143,122 @@ export class Engine {
             fetchedTxCount: 0
         };
         try {
-            const remote = new BASMRemote(endpoint, topic);
+            const remote = new BASMRemote(endpoint, topic, this.basmFetchImpl);
             const [localTip, remoteTip] = await Promise.all([
                 this.provideTopicAnchorTip(topic),
                 remote.requestTopicAnchorTip()
             ]);
             report.localTip = localTip;
             report.remoteTip = remoteTip;
+            await this.requireMatchingRemoteBASMTip(remote, remoteTip);
             if (localTip.blockHeight >= remoteTip.blockHeight) {
-                report.status = localTip.tac === remoteTip.tac && localTip.blockHeight === remoteTip.blockHeight ? 'matched' : 'diverged';
-                report.message = report.status === 'matched'
-                    ? 'Topic anchor tips match'
-                    : 'Remote tip is not ahead; historical divergence needs manual or binary-search reconciliation';
-                return report;
+                return await this.finishBASMWhenRemoteIsNotAhead(topic, localTip, remoteTip, report);
             }
-            const fromHeight = Math.max(localTip.blockHeight + 1, remoteTip.blockHeight - DEFAULT_BASM_RANGE_LIMIT + 1, 0);
-            const range = await remote.requestTopicAnchorRange(fromHeight, remoteTip.blockHeight);
-            for (const remoteAnchor of range.anchors) {
-                await this.reconcileRemoteAnchor(topic, remote, remoteAnchor, report);
-            }
-            const refreshedTip = await this.provideTopicAnchorTip(topic);
-            report.localTip = refreshedTip;
-            report.status = refreshedTip.blockHeight >= remoteTip.blockHeight && refreshedTip.tac === remoteTip.tac ? 'matched' : 'advanced';
-            return report;
+            return await this.advanceBASMWithRemoteAnchors(topic, remote, localTip, remoteTip, report);
         }
         catch (error) {
-            report.status = 'error';
-            report.message = error instanceof Error ? error.message : String(error);
-            this.logger.error(`[BASM SYNC] Sync failed for topic "${topic}" with peer "${endpoint}"`, error);
-            return report;
+            return this.markBASMPeerSyncError(report, topic, endpoint, error);
+        }
+    }
+    async requireMatchingRemoteBASMTip(remote, remoteTip) {
+        if (remoteTip.blockHeight < 0) {
+            return;
+        }
+        const tipRange = await remote.requestTopicAnchorRange(remoteTip.blockHeight, remoteTip.blockHeight);
+        const remoteTipAnchor = tipRange.anchors[0];
+        const tipAnchor = requireBASMDefined(remoteTipAnchor, remoteTipAnchor?.tac === remoteTip.tac, 'BASM tip does not match its anchor');
+        for (const field of ['blockHash', 'basmRoot', 'admittedCount']) {
+            requireBASM(remoteTip[field] === undefined || remoteTip[field] === tipAnchor[field], 'BASM tip metadata does not match its anchor');
+        }
+        await this.requireCanonicalBASMAnchor(tipAnchor);
+    }
+    async finishBASMWhenRemoteIsNotAhead(topic, localTip, remoteTip, report) {
+        const tipsMatch = localTip.tac === remoteTip.tac && localTip.blockHeight === remoteTip.blockHeight;
+        if (localTip.blockHeight >= 0 && tipsMatch) {
+            const localAnchor = await this.storage.findTopicBlockAnchor?.(topic, localTip.blockHeight);
+            await this.requireCanonicalBASMAnchor(requireBASMDefined(localAnchor, localAnchor?.tac === localTip.tac, 'Local BASM tip lacks its anchor'));
+        }
+        report.status = tipsMatch ? 'matched' : 'diverged';
+        report.message = tipsMatch
+            ? 'Topic anchor tips match'
+            : 'Remote tip is not ahead; historical divergence needs manual or binary-search reconciliation';
+        return report;
+    }
+    requireBASMRangePrefix(localTip, remoteTip, fromHeight, toHeight, anchors) {
+        requireBASM(anchors.length > 0 && anchors.at(-1)?.blockHeight === toHeight, 'BASM range omits its requested target');
+        requireBASM(localTip.blockHeight < 0 || anchors[0].blockHeight === fromHeight, 'BASM range omits its next height');
+        let previousTac = localTip.tac;
+        for (const anchor of anchors) {
+            requireBASM(anchor.tac === computeTac(previousTac, anchor.blockHash, anchor.basmRoot), 'BASM range TAC is inconsistent with its prefix');
+            previousTac = anchor.tac;
+        }
+        if (toHeight === remoteTip.blockHeight)
+            requireBASM(previousTac === remoteTip.tac, 'BASM range differs from its tip');
+    }
+    async advanceBASMWithRemoteAnchors(topic, remote, localTip, remoteTip, report) {
+        const fromHeight = localTip.blockHeight < 0
+            ? Math.max(remoteTip.blockHeight - DEFAULT_BASM_SYNC_PAGE_SIZE + 1, 0)
+            : localTip.blockHeight + 1;
+        const toHeight = Math.min(fromHeight + DEFAULT_BASM_SYNC_PAGE_SIZE - 1, remoteTip.blockHeight);
+        const range = await remote.requestTopicAnchorRange(fromHeight, toHeight);
+        this.requireBASMRangePrefix(localTip, remoteTip, fromHeight, toHeight, range.anchors);
+        for (const remoteAnchor of range.anchors) {
+            await this.reconcileRemoteAnchor(topic, remote, remoteAnchor, report);
+            if (report.status === 'diverged')
+                return report;
+        }
+        const finalRemoteTip = await remote.requestTopicAnchorTip();
+        requireBASM(finalRemoteTip.blockHeight === remoteTip.blockHeight && finalRemoteTip.tac === remoteTip.tac, 'BASM peer history changed during reconciliation');
+        const refreshedTip = await this.provideTopicAnchorTip(topic);
+        report.localTip = refreshedTip;
+        report.status =
+            refreshedTip.blockHeight === remoteTip.blockHeight && refreshedTip.tac === remoteTip.tac
+                ? 'matched'
+                : 'advanced';
+        return report;
+    }
+    markBASMPeerSyncError(report, topic, endpoint, error) {
+        report.status = 'error';
+        if (error instanceof Error && 'code' in error && typeof error.code === 'string')
+            report.errorCode = error.code;
+        report.message = error instanceof Error ? error.message : String(error);
+        this.logger.error(`[BASM SYNC] Sync failed for topic "${topic}" with peer "${endpoint}"`, error);
+        return report;
+    }
+    async requireCanonicalBASMAnchor(anchor, proofRoot) {
+        if (this.chainTracker === 'scripts only' || this.topicAnchorHeaderResolver === undefined) {
+            throw new Error('BASM reconciliation requires a ChainTracker and canonical header resolver');
+        }
+        const resolvedHeader = await this.topicAnchorHeaderResolver(anchor.blockHeight);
+        const header = requireBASMDefined(resolvedHeader, resolvedHeader?.blockHeight === anchor.blockHeight, 'BASM canonical header is unavailable or has the wrong height');
+        requireBASM(basmHash(header.blockHash.toLowerCase(), 'canonical block hash') === anchor.blockHash, 'BASM anchor block hash is not canonical');
+        if (proofRoot !== undefined && header.merkleRoot !== undefined) {
+            requireBASM(header.merkleRoot.toLowerCase() === proofRoot, 'BASM proof root differs from its canonical header');
+        }
+        if (header.blockTransactionCount !== undefined) {
+            basmInteger(header.blockTransactionCount, 'canonical block transaction count', 1);
+            requireBASM(anchor.admittedCount <= header.blockTransactionCount, 'BASM admitted count exceeds canonical block transaction count');
+        }
+        return header;
+    }
+    validateBASMProofPositions(path, admitted, count) {
+        requireBASM(admitted.every(item => item.blockIndex < count), 'BASM admitted index exceeds canonical block transaction count');
+        let width = count;
+        for (let height = 0; height < path.path.length; height++) {
+            requireBASM(height === 0 || width > 1, 'BASM proof exceeds canonical tree depth');
+            for (const node of path.path[height]) {
+                requireBASM(node.duplicate === true ? width % 2 === 1 && node.offset === width : node.offset < width, 'BASM proof node is outside canonical block positions');
+            }
+            width = Math.ceil(width / 2);
         }
     }
     async reconcileRemoteAnchor(topic, remote, remoteAnchor, report) {
+        await this.requireCanonicalBASMAnchor(remoteAnchor);
         report.checkedHeights.push(remoteAnchor.blockHeight);
         const localAnchor = await this.storage.findTopicBlockAnchor?.(topic, remoteAnchor.blockHeight, remoteAnchor.blockHash);
+        if (localAnchor !== undefined) {
+            this.assertTopicBlockAnchor(localAnchor, topic, 'Stored local BASM anchor', remoteAnchor.blockHeight, remoteAnchor.blockHash);
+        }
         if (localAnchor?.tac === remoteAnchor.tac) {
             return;
         }
@@ -1275,60 +2268,119 @@ export class Engine {
             admittedResponse.admitted.length !== remoteAnchor.admittedCount) {
             throw new Error(`Peer ${report.endpoint} supplied an admitted list inconsistent with its anchor at height ${remoteAnchor.blockHeight}`);
         }
-        const localAdmitted = await this.storage.findAdmittedTransactionsForBlock?.(topic, remoteAnchor.blockHeight, remoteAnchor.blockHash) ?? [];
+        const localAdmitted = (await this.storage.findAdmittedTransactionsForBlock?.(topic, remoteAnchor.blockHeight, remoteAnchor.blockHash)) ?? [];
+        // BRC-136: an empty topic at a height has k = 0 and R = 32 zero bytes, which
+        // the root/count check above has already enforced. There is no transaction
+        // to bind to a proof or to fetch, so the height is checked without a proof
+        // round trip; it only diverges when this node admitted something there.
+        if (admittedResponse.admitted.length === 0) {
+            if (localAdmitted.length > 0)
+                report.status = 'diverged';
+            return;
+        }
         const localTxids = new Set(localAdmitted.map(item => item.txid));
         const missingTxids = admittedResponse.admitted
             .map(item => item.txid)
             .filter(txid => !localTxids.has(txid));
         report.missingTxids.push(...missingTxids);
+        // The BASM root only commits to txid order. Bind claimed original indices to
+        // the compound path even when every remote txid is already local.
+        const assurance = await this.fetchBASMMissingTransactions(remote, topic, remoteAnchor, admittedResponse.admitted, missingTxids);
+        if (report.positionValidation !== 'encoded-offset-only')
+            report.positionValidation = assurance;
         if (missingTxids.length === 0) {
             report.status = 'diverged';
             return;
         }
-        await this.fetchBASMMissingTransactions(remote, topic, remoteAnchor, missingTxids);
         report.fetchedTxCount += missingTxids.length;
     }
-    async fetchBASMMissingTransactions(remote, topic, anchor, txids) {
+    async fetchBASMMissingTransactions(remote, topic, anchor, admitted, txids) {
         if (this.chainTracker === 'scripts only') {
             throw new Error('BASM reconciliation requires a ChainTracker capable of validating BUMP proofs');
         }
-        const proofResponse = await remote.requestCompoundMerklePath(anchor.blockHeight, txids);
+        // Validate the whole claimed ordered subset, including entries already local:
+        // the BASM root alone does not bind the peer's claimed original positions.
+        const proofResponse = await remote.requestCompoundMerklePath(anchor.blockHeight, admitted.map(item => item.txid));
         const compoundPath = MerklePath.fromHex(proofResponse.merklePath);
-        for (const txid of txids) {
-            const valid = await compoundPath.verify(txid, this.chainTracker);
-            if (!valid) {
-                throw new Error(`Peer supplied invalid compound Merkle path for ${txid} at height ${anchor.blockHeight}`);
-            }
+        requireBASM(compoundPath.blockHeight === anchor.blockHeight, 'BASM proof height does not match its anchor');
+        requireBASM(compoundPath.toHex() === proofResponse.merklePath.toLowerCase(), 'BASM proof is not canonically encoded');
+        const proofRoot = compoundPath.computeRoot();
+        const proofHeader = await this.requireCanonicalBASMAnchor(anchor, proofRoot);
+        if (proofHeader.blockTransactionCount !== undefined) {
+            this.validateBASMProofPositions(compoundPath, admitted, proofHeader.blockTransactionCount);
+        }
+        for (const { txid, blockIndex } of admitted) {
+            const leaf = compoundPath.path[0]?.find(item => item.hash === txid);
+            requireBASM(leaf?.offset === blockIndex, 'BASM proof does not bind the admitted block index');
+            requireBASM(compoundPath.path[0].length !== 1 || compoundPath.path.length !== 1 || blockIndex === 0, 'BASM singleton proof has a nonzero block index');
+            requireBASM(compoundPath.computeRoot(txid) === proofRoot, 'BASM proof root does not match the admitted transaction');
+        }
+        // Inclusion is root/height, not coinbase maturity. MerklePath.verify also
+        // applies the 100-block spendability rule at offset 0.
+        const valid = await this.chainTracker.isValidRootForHeight(proofRoot, compoundPath.blockHeight);
+        if (!valid) {
+            throw new Error(`Peer supplied invalid compound Merkle path at height ${anchor.blockHeight}`);
+        }
+        if (txids.length === 0) {
+            return proofHeader.blockTransactionCount === undefined
+                ? 'encoded-offset-only'
+                : 'canonical-count';
         }
         const rawResponse = await remote.requestRawTransactions(txids);
         if (rawResponse.missing.length > 0) {
             throw new Error(`Peer did not return raw transactions for txids: ${rawResponse.missing.join(',')}`);
         }
-        for (const record of rawResponse.transactions) {
+        const transactions = rawResponse.transactions.map(record => {
             const tx = Transaction.fromHex(record.rawTx);
-            if (tx.id('hex') !== record.txid) {
+            if (tx.id('hex') !== record.txid || tx.toHex() !== record.rawTx.toLowerCase()) {
                 throw new Error(`Raw transaction txid mismatch: expected ${record.txid}, got ${tx.id('hex')}`);
             }
-            try {
-                tx.merklePath = compoundPath.extract([record.txid]);
-            }
-            catch {
-                tx.merklePath = compoundPath;
-            }
-            await this.submit({ beef: tx.toBEEF(), topics: [topic] }, undefined, 'historical-tx');
+            tx.merklePath = compoundPath.extract([record.txid]);
+            return tx;
+        });
+        const refreshedAnchor = (await remote.requestTopicAnchorRange(anchor.blockHeight, anchor.blockHeight)).anchors[0];
+        requireBASM(refreshedAnchor?.blockHash === anchor.blockHash &&
+            refreshedAnchor?.basmRoot === anchor.basmRoot &&
+            refreshedAnchor?.admittedCount === anchor.admittedCount &&
+            refreshedAnchor?.tac === anchor.tac, 'BASM peer anchor changed before admission');
+        const commitHeader = await this.requireCanonicalBASMAnchor(anchor, proofRoot);
+        requireBASM(commitHeader.blockTransactionCount === proofHeader.blockTransactionCount, 'BASM canonical block transaction count changed before admission');
+        // Apply in the independently checked block order, regardless of raw response order.
+        // Admit with 'historical-tx-no-spv': inclusion is already proven above by
+        // isValidRootForHeight plus the canonical-header binding. Re-running
+        // Transaction.verify would apply MerklePath.verify's coinbase 100-block
+        // spendability rule and reject an admitted coinbase from a recent block.
+        const transactionById = new Map(transactions.map(tx => [tx.id('hex'), tx]));
+        for (const txid of txids) {
+            const tx = transactionById.get(txid);
+            requireBASM(tx !== undefined, 'BASM raw response omits a requested transaction');
+            await this.submit({ beef: tx.toBEEF(), topics: [topic] }, undefined, 'historical-tx-no-spv');
         }
+        const finalHeader = await this.requireCanonicalBASMAnchor(anchor, proofRoot);
+        requireBASM(finalHeader.blockTransactionCount === proofHeader.blockTransactionCount, 'BASM canonical block transaction count changed during admission');
+        return proofHeader.blockTransactionCount === undefined
+            ? 'encoded-offset-only'
+            : 'canonical-count';
     }
     async evictUnprovenTransactions(options = {}) {
         if (typeof this.storage.findUnprovenAppliedTransactions !== 'function') {
             throw new TypeError('Storage does not support unproven transaction eviction');
         }
+        if (typeof this.storage.deleteAppliedTransaction !== 'function') {
+            throw new TypeError('Storage does not support applied transaction eviction');
+        }
         if (this.chainTracker === 'scripts only') {
             throw new Error('Unproven eviction requires a ChainTracker to determine block age');
         }
+        if (options.topic !== undefined)
+            assertTopic(options.topic, 'Unproven eviction topic');
         const thresholdBlocks = options.thresholdBlocks ?? this.unprovenEvictionBlocks;
+        assertUnprovenThreshold(thresholdBlocks);
         const currentHeight = await this.chainTracker.currentHeight();
+        assertNonnegativeInteger(currentHeight, 'Current chain height');
         const cutoffHeight = currentHeight - thresholdBlocks;
-        const candidates = await this.storage.findUnprovenAppliedTransactions(cutoffHeight, options.topic);
+        const candidates = await this.storage.findUnprovenAppliedTransactions(cutoffHeight, options.topic, { maxCandidates: MAX_UNPROVEN_CANDIDATES, maxOutputs: MAX_EVICTION_OUTPUTS });
+        this.validateUnprovenCandidates(candidates, cutoffHeight, options.topic);
         let evictedOutputs = 0;
         for (const candidate of candidates) {
             for (const output of candidate.outputs) {
@@ -1343,7 +2395,7 @@ export class Engine {
                 await this.storage.deleteOutput(output.txid, output.outputIndex, candidate.topic);
                 evictedOutputs++;
             }
-            await this.storage.deleteAppliedTransaction?.(candidate.txid, candidate.topic);
+            await this.storage.deleteAppliedTransaction(candidate.txid, candidate.topic);
         }
         return {
             cutoffHeight,
@@ -1359,10 +2411,20 @@ export class Engine {
         if (this.chainTracker === 'scripts only') {
             throw new Error('Unproven proof refresh requires a ChainTracker to determine block age');
         }
+        if (typeof options !== 'object' ||
+            options === null ||
+            typeof options.proofProvider !== 'function') {
+            throw new TypeError('Unproven proof refresh requires a proofProvider');
+        }
+        if (options.topic !== undefined)
+            assertTopic(options.topic, 'Unproven refresh topic');
         const thresholdBlocks = options.thresholdBlocks ?? this.unprovenEvictionBlocks;
+        assertUnprovenThreshold(thresholdBlocks);
         const currentHeight = await this.chainTracker.currentHeight();
+        assertNonnegativeInteger(currentHeight, 'Current chain height');
         const cutoffHeight = currentHeight - thresholdBlocks;
-        const candidates = await this.storage.findUnprovenAppliedTransactions(cutoffHeight, options.topic);
+        const candidates = await this.storage.findUnprovenAppliedTransactions(cutoffHeight, options.topic, { maxCandidates: MAX_UNPROVEN_CANDIDATES, maxOutputs: MAX_EVICTION_OUTPUTS });
+        this.validateUnprovenCandidates(candidates, cutoffHeight, options.topic);
         const txids = [...new Set(candidates.map(candidate => candidate.txid))];
         let refreshedTransactions = 0;
         let missingProofs = 0;
@@ -1382,7 +2444,7 @@ export class Engine {
                 failedProofs++;
                 failures.push({
                     txid,
-                    error: error instanceof Error ? error.message : String(error)
+                    error: (error instanceof Error ? error.message : String(error)).slice(0, 1024)
                 });
             }
         }
@@ -1395,6 +2457,57 @@ export class Engine {
             failures
         };
     }
+    validateUnprovenCandidates(candidates, cutoffHeight, requestedTopic) {
+        if (!Array.isArray(candidates) || candidates.length > MAX_UNPROVEN_CANDIDATES) {
+            throw new TypeError('Storage returned an invalid or oversized unproven candidate set');
+        }
+        const seenCandidates = new Set();
+        const seenOutputs = new Set();
+        let outputCount = 0;
+        for (const [candidateIndex, candidate] of candidates.entries()) {
+            if (typeof candidate !== 'object' ||
+                candidate === null ||
+                !Array.isArray(candidate.outputs)) {
+                throw new TypeError(`Storage returned an invalid unproven candidate at index ${candidateIndex}`);
+            }
+            assertHash(candidate.txid, `Unproven candidate[${candidateIndex}] txid`);
+            assertTopic(candidate.topic, `Unproven candidate[${candidateIndex}] topic`);
+            if (requestedTopic !== undefined && candidate.topic !== requestedTopic) {
+                throw new TypeError('Storage returned an unproven candidate for a different topic');
+            }
+            if (candidate.firstSeenHeight === undefined) {
+                throw new TypeError('Storage returned an unproven candidate without an age anchor');
+            }
+            assertNonnegativeInteger(candidate.firstSeenHeight, `Unproven candidate[${candidateIndex}] firstSeenHeight`);
+            if (candidate.firstSeenHeight > cutoffHeight) {
+                throw new TypeError('Storage returned an unproven candidate newer than the cutoff');
+            }
+            const candidateKey = `${candidate.txid.toLowerCase()}.${candidate.topic}`;
+            if (seenCandidates.has(candidateKey)) {
+                throw new TypeError('Storage returned duplicate unproven candidates');
+            }
+            seenCandidates.add(candidateKey);
+            outputCount += candidate.outputs.length;
+            if (outputCount > MAX_EVICTION_OUTPUTS) {
+                throw new TypeError('Storage returned too many unproven outputs');
+            }
+            for (const [outputIndex, output] of candidate.outputs.entries()) {
+                if (typeof output !== 'object' || output === null) {
+                    throw new TypeError(`Storage returned an invalid unproven output at ${candidateIndex}.${outputIndex}`);
+                }
+                assertHash(output.txid, `Unproven output[${candidateIndex}.${outputIndex}] txid`);
+                assertOutputIndex(output.outputIndex, `Unproven output[${candidateIndex}.${outputIndex}] index`);
+                if (output.txid.toLowerCase() !== candidate.txid.toLowerCase()) {
+                    throw new TypeError('Storage returned an unproven output for a different transaction');
+                }
+                const outputKey = `${candidateKey}.${output.outputIndex}`;
+                if (seenOutputs.has(outputKey)) {
+                    throw new TypeError('Storage returned duplicate unproven outputs');
+                }
+                seenOutputs.add(outputKey);
+            }
+        }
+    }
     async maintainUnprovenTransactions(options) {
         const refresh = await this.refreshUnprovenTransactionProofs(options);
         const eviction = await this.evictUnprovenTransactions({
@@ -1407,7 +2520,34 @@ export class Engine {
         if (typeof this.storage.deleteAppliedTransaction !== 'function') {
             throw new TypeError('Storage does not support applied transaction eviction');
         }
-        const outputs = await this.storage.findOutputsForTransaction(txid);
+        assertHash(txid, 'Evicted transaction txid');
+        if (options.topic !== undefined)
+            assertTopic(options.topic, 'Eviction topic');
+        if (options.reason !== undefined &&
+            (typeof options.reason !== 'string' ||
+                new TextEncoder().encode(options.reason).byteLength > MAX_EVICTION_REASON_BYTES)) {
+            throw new TypeError('Eviction reason must be a bounded string');
+        }
+        const outputs = await this.storage.findOutputsForTransaction(txid, false, MAX_EVICTION_OUTPUTS + 1);
+        if (!Array.isArray(outputs) || outputs.length > MAX_EVICTION_OUTPUTS) {
+            throw new TypeError('Storage returned an invalid or oversized eviction output set');
+        }
+        const seenOutputs = new Set();
+        for (const [index, output] of outputs.entries()) {
+            if (typeof output !== 'object' || output === null) {
+                throw new TypeError(`Storage returned an invalid eviction output at index ${index}`);
+            }
+            assertHash(output.txid, `Eviction output[${index}] txid`);
+            assertOutputIndex(output.outputIndex, `Eviction output[${index}] index`);
+            assertTopic(output.topic, `Eviction output[${index}] topic`);
+            if (output.txid.toLowerCase() !== txid.toLowerCase()) {
+                throw new TypeError('Storage returned an eviction output for a different transaction');
+            }
+            const key = `${output.txid.toLowerCase()}.${output.outputIndex}.${output.topic}`;
+            if (seenOutputs.has(key))
+                throw new TypeError('Storage returned duplicate eviction outputs');
+            seenOutputs.add(key);
+        }
         const filtered = options.topic === undefined
             ? outputs
             : outputs.filter(output => output.topic === options.topic);
@@ -1447,13 +2587,42 @@ export class Engine {
      * @returns A promise that resolves to a GASPInitialResponse containing the list of UTXOs and the provided min block height.
      */
     async provideForeignSyncResponse(initialRequest, topic) {
-        const outputs = await this.storage.findUTXOsForTopic(topic, initialRequest.since, initialRequest.limit);
-        return {
-            UTXOList: outputs.map(output => ({
+        this.assertSupportedBASMTopic(topic);
+        if (typeof initialRequest !== 'object' ||
+            initialRequest === null ||
+            initialRequest.version !== 1) {
+            throw new TypeError('Unsupported or invalid GASP request version');
+        }
+        assertNonnegativeInteger(initialRequest.since, 'GASP request since');
+        const limit = initialRequest.limit ?? 1000;
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_GASP_PAGE_SIZE) {
+            throw new TypeError(`GASP request limit must be between 1 and ${MAX_GASP_PAGE_SIZE}`);
+        }
+        const outputs = await this.storage.findUTXOsForTopic(topic, initialRequest.since, limit);
+        if (!Array.isArray(outputs) || outputs.length > limit) {
+            throw new TypeError('Storage returned an invalid or oversized GASP UTXO list');
+        }
+        const seen = new Set();
+        const UTXOList = outputs.map((output, index) => {
+            this.assertStoredOutputRelations(output, `GASP UTXO[${index}]`);
+            if (output.topic !== topic)
+                throw new TypeError('Storage returned a cross-topic GASP UTXO');
+            assertNonnegativeInteger(output.score ?? 0, `GASP UTXO[${index}] score`);
+            if ((output.score ?? 0) < initialRequest.since) {
+                throw new TypeError('Storage returned a GASP UTXO below the requested score');
+            }
+            const outpoint = `${output.txid.toLowerCase()}.${output.outputIndex}`;
+            if (seen.has(outpoint))
+                throw new TypeError('Storage returned duplicate GASP UTXOs');
+            seen.add(outpoint);
+            return {
                 txid: output.txid,
                 outputIndex: output.outputIndex,
                 score: output.score ?? 0
-            })),
+            };
+        });
+        return {
+            UTXOList,
             since: initialRequest.since
         };
     }
@@ -1466,51 +2635,91 @@ export class Engine {
      * @returns A promise that resolves to a GASPNode containing the raw transaction and other optional data.
      * @throws An error if no output is found for the given transaction ID and output index.
      */
-    async provideForeignGASPNode(graphID, txid, outputIndex) {
-        const hydrator = async (output) => {
-            if (output?.beef === undefined) {
-                throw new Error('No matching output found!');
+    async provideForeignGASPNode(graphID, txid, outputIndex, topic) {
+        assertOutpoint(graphID, 'GASP graphID');
+        assertHash(txid, 'GASP txid');
+        assertOutputIndex(outputIndex, 'GASP output index');
+        if (topic !== undefined)
+            this.assertSupportedBASMTopic(topic);
+        const searchedOutputs = new Set();
+        let searchedTransactions = 0;
+        let totalBeefBytes = 0;
+        const hydrator = async (output, expected, depth, ancestors) => {
+            if (output === null)
+                return undefined;
+            this.validateLookupOutput(output, 'Stored GASP output', expected);
+            if (output.beef === undefined)
+                throw new Error('Stored GASP output has no transaction BEEF');
+            if (topic !== undefined && output.topic !== topic) {
+                throw new Error('Requested GASP output is not admitted to this topic');
+            }
+            if (depth > 2048 || searchedOutputs.size >= 2048) {
+                throw new Error('GASP ancestry search exceeded its resource limit');
+            }
+            const outputID = this.toOutputCacheKey(output.txid, output.outputIndex);
+            if (ancestors.has(outputID))
+                throw new Error('Cycle detected in stored GASP ancestry');
+            if (searchedOutputs.has(outputID))
+                return undefined;
+            searchedOutputs.add(outputID);
+            totalBeefBytes += output.beef.length;
+            if (totalBeefBytes > MAX_LOOKUP_TOTAL_BEEF_BYTES) {
+                throw new Error('GASP transaction BEEF exceeded its resource limit');
             }
             const rootTx = Transaction.fromBEEF(output.beef);
             let correctTx;
-            const searchInput = (tx) => {
-                if (tx.id('hex') === txid) {
-                    correctTx = tx;
+            const transactionStack = [rootTx];
+            const visitedTransactions = new Set();
+            while (transactionStack.length > 0) {
+                const candidate = transactionStack.pop();
+                const candidateTxid = candidate.id('hex');
+                if (visitedTransactions.has(candidateTxid))
+                    continue;
+                searchedTransactions += 1;
+                if (searchedTransactions > 2048)
+                    throw new Error('GASP transaction ancestry exceeded its resource limit');
+                visitedTransactions.add(candidateTxid);
+                if (candidateTxid.toLowerCase() === txid.toLowerCase()) {
+                    correctTx = candidate;
+                    break;
                 }
-                else {
-                    // For each input, look it up and recurse.
-                    for (const input of tx.inputs) {
-                        // We should always have a source transaction
-                        if (input.sourceTransaction === undefined) {
-                            throw new Error('Incomplete SPV data!');
-                        }
-                        else {
-                            searchInput(input.sourceTransaction);
+                for (const input of candidate.inputs) {
+                    if (input.sourceTransaction !== undefined) {
+                        if (transactionStack.length + searchedTransactions >= 2048) {
+                            throw new Error('GASP transaction ancestry exceeded its resource limit');
                         }
+                        transactionStack.push(input.sourceTransaction);
                     }
                 }
-            };
-            searchInput(rootTx);
+            }
             if (correctTx === undefined) {
-                // Recursively try to find a matching output
-                let foundNode;
-                for (const currentOutput of output.outputsConsumed) {
-                    try {
-                        const outputFound = await this.storage.findOutput(currentOutput.txid, currentOutput.outputIndex, undefined, undefined, true);
-                        foundNode = await hydrator(outputFound);
-                        break;
-                    }
-                    catch (error) {
-                        // Best-effort: output may not be found or hydration fails for this candidate; try the next one
-                        this.logger.debug(`Unable to hydrate output ${currentOutput.txid}.${currentOutput.outputIndex}: ${error}`);
-                        continue;
+                if (output.outputsConsumed.length > 2048) {
+                    throw new Error('Stored GASP ancestry fan-out exceeded its resource limit');
+                }
+                const sourceOutpoints = new Set();
+                for (const input of rootTx.inputs) {
+                    const sourceTXID = input.sourceTXID ?? input.sourceTransaction?.id('hex');
+                    if (sourceTXID !== undefined) {
+                        sourceOutpoints.add(this.toOutputCacheKey(sourceTXID, input.sourceOutputIndex));
                     }
                 }
-                if (foundNode !== undefined) {
-                    return foundNode;
+                const nextAncestors = new Set(ancestors);
+                nextAncestors.add(outputID);
+                for (const currentOutput of output.outputsConsumed) {
+                    const relationKey = this.toOutputCacheKey(currentOutput.txid, currentOutput.outputIndex);
+                    if (!sourceOutpoints.has(relationKey)) {
+                        throw new TypeError('Stored GASP ancestry relation is not a transaction input');
+                    }
+                    const outputFound = await this.storage.findOutput(currentOutput.txid, currentOutput.outputIndex, topic, undefined, true);
+                    const foundNode = await hydrator(outputFound, currentOutput, depth + 1, nextAncestors);
+                    if (foundNode !== undefined)
+                        return foundNode;
                 }
             }
             else {
+                if (outputIndex >= correctTx.outputs.length) {
+                    throw new Error('Requested GASP output index does not exist');
+                }
                 const rawTx = correctTx.toHex();
                 const node = {
                     rawTx,
@@ -1522,11 +2731,16 @@ export class Engine {
                 }
                 return node;
             }
-            throw new Error('Unable to find output associated with your request!');
+            return undefined;
         };
-        const [rootTxid, rootOutputIndex] = graphID.split('.');
-        const output = await this.storage.findOutput(rootTxid, Number(rootOutputIndex), undefined, undefined, true);
-        return await hydrator(output);
+        const separator = graphID.lastIndexOf('.');
+        const rootTxid = graphID.slice(0, separator);
+        const rootOutputIndex = Number(graphID.slice(separator + 1));
+        const output = await this.storage.findOutput(rootTxid, rootOutputIndex, topic, undefined, true);
+        const node = await hydrator(output, { txid: rootTxid, outputIndex: rootOutputIndex }, 0, new Set());
+        if (node === undefined)
+            throw new Error('Unable to find output associated with your request!');
+        return node;
     }
     /**
      * Traverse and return the history of a UTXO.
@@ -1542,8 +2756,19 @@ export class Engine {
      * @param {number} [currentDepth=0] - The current depth of the traversal relative to the top-level UTXO.
      *
      * @returns {Promise<Output | undefined>} - A promise that resolves to the output history if found, or undefined if not.
-    */
+     */
     async getUTXOHistory(output, historySelector, currentDepth = 0, context = this.createUTXOHistoryHydrationContext()) {
+        assertNonnegativeInteger(currentDepth, 'Lookup history current depth');
+        if (currentDepth > MAX_LOOKUP_HISTORY_DEPTH) {
+            throw new RangeError('Lookup history current depth is too large');
+        }
+        if (historySelector !== undefined &&
+            typeof historySelector !== 'function' &&
+            (!Number.isSafeInteger(historySelector) ||
+                historySelector < -1 ||
+                historySelector > MAX_LOOKUP_HISTORY_DEPTH)) {
+            throw new TypeError(`Lookup history must be -1 through ${MAX_LOOKUP_HISTORY_DEPTH}, or a function`);
+        }
         // If we have an output but no history selector, just return the output.
         if (historySelector === undefined) {
             return output;
@@ -1576,43 +2801,114 @@ export class Engine {
      */
     async deleteUTXODeep(output) {
         try {
-            // Delete the current output IFF there are no references to it
-            if (output.consumedBy.length === 0) {
-                await this.storage.deleteOutput(output.txid, output.outputIndex, output.topic);
-                // Notify the lookup services of the UTXO being deleted
-                for (const l of Object.values(this.lookupServices)) {
+            const queue = [output];
+            const processed = new Set();
+            let relationCount = 0;
+            for (let cursor = 0; cursor < queue.length; cursor++) {
+                if (queue.length > MAX_HISTORY_PRUNE_OUTPUTS) {
+                    throw new RangeError('Historical output pruning exceeded its work budget');
+                }
+                const current = queue[cursor];
+                this.assertStoredOutputRelations(current, 'Historical output');
+                const currentKey = `${current.txid.toLowerCase()}.${current.outputIndex}.${current.topic}`;
+                if (processed.has(currentKey))
+                    continue;
+                processed.add(currentKey);
+                // A retained descendant still depends on this output and therefore on
+                // its ancestors. Do not prune through a node that remains referenced.
+                if (current.consumedBy.length !== 0)
+                    continue;
+                await this.storage.deleteOutput(current.txid, current.outputIndex, current.topic);
+                for (const lookupService of Object.values(this.lookupServices)) {
                     try {
-                        await l.outputNoLongerRetainedInHistory?.(output.txid, output.outputIndex, output.topic);
+                        await lookupService.outputNoLongerRetainedInHistory?.(current.txid, current.outputIndex, current.topic);
                     }
-                    catch (e) {
-                        // Best-effort notification; lookup service failure must not abort UTXO deletion
-                        this.logger.debug(`outputNoLongerRetainedInHistory notification failed for ${output.txid}.${output.outputIndex}: ${e}`);
+                    catch (error) {
+                        this.logger.debug(`outputNoLongerRetainedInHistory notification failed for ${current.txid}.${current.outputIndex}: ${error}`);
                     }
                 }
-            }
-            // If there are no more consumed utxos, return
-            if (output.outputsConsumed.length === 0) {
-                return;
-            }
-            // Delete any stale outputs that were consumed as inputs
-            await Promise.all(output.outputsConsumed.map(async (outputIdentifier) => {
-                const staleOutput = await this.storage.findOutput(outputIdentifier.txid, outputIdentifier.outputIndex, output.topic);
-                // Make sure an output was found
-                if (staleOutput === null || staleOutput === undefined) {
-                    return undefined;
-                }
-                // Parse out the existing data, then concat the new outputs with no duplicates
-                if (staleOutput.consumedBy.length !== 0) {
-                    staleOutput.consumedBy = staleOutput.consumedBy.filter(x => x.txid !== output.txid && x.outputIndex !== output.outputIndex);
-                    // Update with the new consumedBy data
-                    await this.storage.updateConsumedBy(outputIdentifier.txid, outputIdentifier.outputIndex, output.topic, staleOutput.consumedBy);
+                for (const outputIdentifier of current.outputsConsumed) {
+                    relationCount++;
+                    if (relationCount > MAX_OUTPUT_RELATIONS) {
+                        throw new RangeError('Historical output pruning exceeded its relation budget');
+                    }
+                    const staleOutput = await this.storage.findOutput(outputIdentifier.txid, outputIdentifier.outputIndex, current.topic);
+                    if (staleOutput === null || staleOutput === undefined)
+                        continue;
+                    this.assertStoredOutputRelations(staleOutput, 'Historical ancestor output');
+                    if (staleOutput.txid.toLowerCase() !== outputIdentifier.txid.toLowerCase() ||
+                        staleOutput.outputIndex !== outputIdentifier.outputIndex ||
+                        staleOutput.topic !== current.topic) {
+                        throw new TypeError('Storage returned an unbound historical ancestor output');
+                    }
+                    const remainingReferences = staleOutput.consumedBy.filter(reference => reference.txid.toLowerCase() !== current.txid.toLowerCase() ||
+                        reference.outputIndex !== current.outputIndex);
+                    // If the current output was not a recorded consumer, it has no
+                    // authority to prune this ancestor or any of its dependencies.
+                    if (remainingReferences.length === staleOutput.consumedBy.length)
+                        continue;
+                    await this.storage.updateConsumedBy(staleOutput.txid, staleOutput.outputIndex, staleOutput.topic, remainingReferences);
+                    staleOutput.consumedBy = remainingReferences;
+                    if (remainingReferences.length === 0)
+                        queue.push(staleOutput);
                 }
-                // Find previousUTXO history
-                return await this.deleteUTXODeep(staleOutput);
-            }));
+            }
         }
         catch (error) {
-            throw new Error(`Failed to delete all stale outputs: ${error} `);
+            throw new Error('Failed to delete all stale outputs', { cause: error });
+        }
+    }
+    assertStoredOutputRelations(value, label) {
+        if (typeof value !== 'object' || value === null)
+            throw new TypeError(`${label} is invalid`);
+        const candidate = value;
+        assertHash(candidate.txid, `${label} txid`);
+        assertOutputIndex(candidate.outputIndex, `${label} output index`);
+        assertTopic(candidate.topic, `${label} topic`);
+        if (!Array.isArray(candidate.outputScript) ||
+            candidate.outputScript.length > MAX_STORED_OUTPUT_SCRIPT_BYTES ||
+            candidate.outputScript.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255) ||
+            !Number.isSafeInteger(candidate.satoshis) ||
+            candidate.satoshis < 0 ||
+            typeof candidate.spent !== 'boolean') {
+            throw new TypeError(`${label} has invalid output data`);
+        }
+        if (candidate.blockHeight !== undefined) {
+            assertNonnegativeInteger(candidate.blockHeight, `${label} block height`);
+        }
+        if (candidate.score !== undefined) {
+            assertNonnegativeInteger(candidate.score, `${label} score`);
+        }
+        if (!Array.isArray(candidate.consumedBy) ||
+            candidate.consumedBy.length > MAX_OUTPUT_RELATIONS ||
+            !Array.isArray(candidate.outputsConsumed) ||
+            candidate.outputsConsumed.length > MAX_OUTPUT_RELATIONS) {
+            throw new TypeError(`${label} has invalid or oversized relations`);
+        }
+        for (const [relationType, relations] of [
+            ['consumedBy', candidate.consumedBy],
+            ['outputsConsumed', candidate.outputsConsumed]
+        ]) {
+            const seen = new Set();
+            for (const [index, relation] of relations.entries()) {
+                if (typeof relation !== 'object' || relation === null) {
+                    throw new TypeError(`${label} ${relationType}[${index}] is invalid`);
+                }
+                assertHash(relation.txid, `${label} ${relationType}[${index}] txid`);
+                assertOutputIndex(relation.outputIndex, `${label} ${relationType}[${index}] output index`);
+                const key = `${relation.txid.toLowerCase()}.${relation.outputIndex}`;
+                if (seen.has(key))
+                    throw new TypeError(`${label} has duplicate ${relationType} relations`);
+                seen.add(key);
+            }
+        }
+    }
+    assertStoredOutputMatches(value, expected, label) {
+        this.assertStoredOutputRelations(value, label);
+        if (value.txid.toLowerCase() !== expected.txid.toLowerCase() ||
+            value.outputIndex !== expected.outputIndex ||
+            value.topic !== expected.topic) {
+            throw new TypeError(`${label} does not match the requested outpoint and topic`);
         }
     }
     /**
@@ -1625,47 +2921,104 @@ export class Engine {
      * @param proof for txid
      */
     updateInputProofs(tx, txid, proof) {
-        if (tx.id('hex') === txid) {
-            // Update the merkle path to handle potential reorgs
-            tx.merklePath = proof;
-            return;
-        }
-        // A mined transaction's source graph is no longer part of its BEEF. Do not
-        // replace an unrelated transaction's proof with the proof for an ancestor.
-        if (tx.merklePath !== undefined)
-            return;
-        for (const input of tx.inputs) {
-            // All inputs must have sourceTransactions
-            const stx = input.sourceTransaction;
-            if (typeof stx !== 'object')
+        const pending = [tx];
+        const visited = new WeakSet();
+        let found = false;
+        for (let cursor = 0; cursor < pending.length; cursor++) {
+            if (pending.length > MAX_PROOF_UPDATE_OUTPUTS) {
+                throw new RangeError('Merkle-proof source traversal exceeded its work budget');
+            }
+            const current = pending[cursor];
+            if (visited.has(current))
                 continue;
-            this.updateInputProofs(stx, txid, proof);
+            visited.add(current);
+            if (current.id('hex') === txid) {
+                current.merklePath = proof;
+                found = true;
+                continue;
+            }
+            // A mined transaction's source graph is no longer part of its BEEF. Do
+            // not replace an unrelated transaction's proof with an ancestor proof.
+            if (current.merklePath !== undefined)
+                continue;
+            for (const input of current.inputs) {
+                if (typeof input.sourceTransaction === 'object') {
+                    if (pending.length >= MAX_PROOF_UPDATE_OUTPUTS) {
+                        throw new RangeError('Merkle-proof source traversal exceeded its work budget');
+                    }
+                    pending.push(input.sourceTransaction);
+                }
+            }
         }
+        return found;
     }
-    /**
-     * Recursively updates beefs (merkle proofs) of this output and its consumedBy lineage.
-     *
-     * @param output - An output derived from txid which may benefit from new proof.
-     * @param txid - The txid for which proof is a valid merkle path.
-     * @param proof - The merklePath proving txid is a mined transaction hash
-     */
-    async updateMerkleProof(output, txid, proof) {
-        if (output.beef === undefined) {
-            throw new Error('Output must have associated transaction BEEF!');
+    prepareMerkleProofUpdate(output, txid, proof) {
+        this.assertStoredOutputRelations(output, 'Merkle-proof output');
+        if (!Array.isArray(output.beef) ||
+            output.beef.length === 0 ||
+            output.beef.length > MAX_SUBMISSION_BEEF_BYTES ||
+            output.beef.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+            throw new TypeError('Merkle-proof output must have bounded transaction BEEF');
         }
         const tx = Transaction.fromBEEF(output.beef);
-        // Update this transaction, or recursively update the matching source
-        // transaction. This also persists replacement proofs after a reorg.
-        this.updateInputProofs(tx, txid, proof);
-        // Update the output's BEEF in the storage DB
-        await this.storage.updateTransactionBEEF(output.txid, tx.toBEEF());
-        // Recursively update the consumedBy outputs
-        for (const consumingOutput of output.consumedBy) {
-            const consumedOutputs = await this.storage.findOutputsForTransaction(consumingOutput.txid, true);
-            for (const consumedOutput of consumedOutputs) {
-                await this.updateMerkleProof(consumedOutput, txid, proof);
+        if (tx.id('hex').toLowerCase() !== output.txid.toLowerCase()) {
+            throw new TypeError('Stored Merkle-proof output BEEF does not match its transaction ID');
+        }
+        if (output.outputIndex >= tx.outputs.length) {
+            throw new TypeError('Stored Merkle-proof output index is outside its transaction');
+        }
+        if (!this.updateInputProofs(tx, txid, proof)) {
+            throw new TypeError('Stored descendant BEEF does not contain the proven transaction');
+        }
+        return tx.toBEEF();
+    }
+    async collectMerkleProofOutputs(initialOutputs) {
+        if (initialOutputs.length > MAX_PROOF_UPDATE_OUTPUTS) {
+            throw new RangeError('Merkle-proof output set exceeded its work budget');
+        }
+        const pending = [...initialOutputs];
+        const collected = [];
+        const seenOutputs = new Set();
+        const fetchedTransactions = new Set();
+        let totalBeefBytes = 0;
+        for (let cursor = 0; cursor < pending.length; cursor++) {
+            if (pending.length > MAX_PROOF_UPDATE_OUTPUTS) {
+                throw new RangeError('Merkle-proof descendant traversal exceeded its work budget');
+            }
+            const output = pending[cursor];
+            this.assertStoredOutputRelations(output, 'Merkle-proof output');
+            const key = `${output.txid.toLowerCase()}.${output.outputIndex}.${output.topic}`;
+            if (seenOutputs.has(key))
+                continue;
+            seenOutputs.add(key);
+            if (!Array.isArray(output.beef)) {
+                throw new TypeError('Merkle-proof graph output is missing transaction BEEF');
+            }
+            totalBeefBytes += output.beef.length;
+            if (totalBeefBytes > MAX_LOOKUP_TOTAL_BEEF_BYTES) {
+                throw new RangeError('Merkle-proof graph BEEF exceeded its total byte budget');
+            }
+            collected.push(output);
+            for (const relation of output.consumedBy) {
+                const transactionKey = relation.txid.toLowerCase();
+                if (fetchedTransactions.has(transactionKey))
+                    continue;
+                fetchedTransactions.add(transactionKey);
+                const remaining = MAX_PROOF_UPDATE_OUTPUTS - pending.length;
+                const descendants = await this.storage.findOutputsForTransaction(relation.txid, true, remaining + 1);
+                if (!Array.isArray(descendants) || descendants.length > remaining) {
+                    throw new TypeError('Storage returned an invalid or oversized proof descendant set');
+                }
+                for (const descendant of descendants) {
+                    this.assertStoredOutputRelations(descendant, 'Merkle-proof descendant output');
+                    if (descendant.txid.toLowerCase() !== transactionKey) {
+                        throw new TypeError('Storage returned an unbound Merkle-proof descendant output');
+                    }
+                    pending.push(descendant);
+                }
             }
         }
+        return collected;
     }
     /**
      * Recursively prune UTXOs when an incoming Merkle Proof is received.
@@ -1675,17 +3028,49 @@ export class Engine {
      * @param blockHeight - The block height associated with the incoming merkle proof.
      */
     async handleNewMerkleProof(txid, proof, blockHeight) {
-        const outputs = await this.storage.findOutputsForTransaction(txid, true);
-        if (outputs === undefined || outputs.length === 0) {
-            throw new Error('Could not find matching transaction outputs for proof ingest!');
+        assertHash(txid, 'Merkle proof transaction ID');
+        if (this.chainTracker === 'scripts only') {
+            throw new Error('Merkle proof ingestion requires a ChainTracker');
+        }
+        if (blockHeight !== undefined) {
+            assertNonnegativeInteger(blockHeight, 'Merkle proof block height');
+            if (blockHeight !== proof.blockHeight) {
+                throw new Error('Merkle proof block height does not match the supplied proof');
+            }
         }
         const proofMetadata = extractMerkleProofMetadata(txid, proof);
+        if (proofMetadata === undefined) {
+            throw new Error('Merkle proof does not contain the claimed transaction');
+        }
+        if (!(await proof.verify(txid, this.chainTracker))) {
+            throw new Error('Merkle proof is not valid for the claimed block height');
+        }
+        const outputs = await this.storage.findOutputsForTransaction(txid, true, MAX_PROOF_UPDATE_OUTPUTS + 1);
+        if (!Array.isArray(outputs) ||
+            outputs.length === 0 ||
+            outputs.length > MAX_PROOF_UPDATE_OUTPUTS) {
+            throw new Error('Could not find matching transaction outputs for proof ingest!');
+        }
+        for (const output of outputs) {
+            this.assertStoredOutputRelations(output, 'Merkle-proof root output');
+            if (output.txid.toLowerCase() !== txid.toLowerCase()) {
+                throw new TypeError('Storage returned an unbound Merkle-proof root output');
+            }
+        }
+        const graphOutputs = await this.collectMerkleProofOutputs(outputs);
+        const preparedUpdates = graphOutputs.map(output => ({
+            output,
+            beef: this.prepareMerkleProofUpdate(output, txid, proof)
+        }));
+        for (const update of preparedUpdates) {
+            await this.storage.updateTransactionBEEF(update.output.txid, update.beef);
+            update.output.beef = update.beef;
+        }
         const resolvedBlockHeight = blockHeight ?? proofMetadata?.blockHeight;
         const resolvedBlockHash = resolvedBlockHeight === undefined
             ? undefined
             : await this.resolveBlockHash(resolvedBlockHeight, proofMetadata?.merkleRoot);
         for (const output of outputs) {
-            await this.updateMerkleProof(output, txid, proof);
             // Add the associated blockHeight
             if (resolvedBlockHeight !== undefined) {
                 output.blockHeight = resolvedBlockHeight;
@@ -1693,7 +3078,6 @@ export class Engine {
             }
             if (output.beef !== undefined) {
                 const tx = Transaction.fromBEEF(output.beef);
-                this.updateInputProofs(tx, txid, proof);
                 await this.recordTransactionData(tx, tx.toBEEF(), resolvedBlockHash);
             }
             if (resolvedBlockHeight !== undefined) {
@@ -1717,10 +3101,10 @@ export class Engine {
      * @returns {Promise<Record<string, { name: string; shortDescription: string; iconURL?: string; version?: string; informationURL?: string; }>>} - Supported topic managers and their metadata
      */
     async listTopicManagers() {
-        const result = {};
-        for (const t in this.managers) {
+        const result = Object.create(null);
+        for (const t of Object.keys(this.managers)) {
             try {
-                result[t] = await this.managers[t].getMetaData();
+                result[t] = validateComponentMetadata(await this.managers[t].getMetaData());
             }
             catch (e) {
                 this.logger.warn(`Unable to get metadata for topic manager: ${t}: ${e}`);
@@ -1738,10 +3122,10 @@ export class Engine {
      * @returns {Promise<Record<string, { name: string; shortDescription: string; iconURL?: string; version?: string; informationURL?: string; }>>} - Supported lookup services and their metadata
      */
     async listLookupServiceProviders() {
-        const result = {};
-        for (const ls in this.lookupServices) {
+        const result = Object.create(null);
+        for (const ls of Object.keys(this.lookupServices)) {
             try {
-                result[ls] = await this.lookupServices[ls].getMetaData();
+                result[ls] = validateComponentMetadata(await this.lookupServices[ls].getMetaData());
             }
             catch (e) {
                 this.logger.warn(`Unable to get metadata for lookup service: ${ls}: ${e}`);
@@ -1759,8 +3143,13 @@ export class Engine {
      * @returns {Promise<string>} - the documentation for the topic manager
      */
     async getDocumentationForTopicManager(manager) {
-        const documentation = await this.managers[manager]?.getDocumentation?.();
-        return documentation ?? 'No documentation found!';
+        const service = typeof manager === 'string' && Object.prototype.hasOwnProperty.call(this.managers, manager)
+            ? this.managers[manager]
+            : undefined;
+        const documentation = await service?.getDocumentation?.();
+        return documentation === undefined
+            ? 'No documentation found!'
+            : validateComponentDocumentation(documentation);
     }
     /**
      * Run a query to get the documentation for a particular lookup service
@@ -1768,8 +3157,14 @@ export class Engine {
      * @returns {Promise<string>} -  the documentation for the lookup service
      */
     async getDocumentationForLookupServiceProvider(provider) {
-        const documentation = await this.lookupServices[provider]?.getDocumentation?.();
-        return documentation ?? 'No documentation found!';
+        const service = typeof provider === 'string' &&
+            Object.prototype.hasOwnProperty.call(this.lookupServices, provider)
+            ? this.lookupServices[provider]
+            : undefined;
+        const documentation = await service?.getDocumentation?.();
+        return documentation === undefined
+            ? 'No documentation found!'
+            : validateComponentDocumentation(documentation);
     }
     /**
      * Validates a URL to ensure it does not match disallowed patterns:
@@ -1783,17 +3178,16 @@ export class Engine {
      */
     isValidUrl(url) {
         try {
-            const parsedUrl = new URL(url);
-            // Disallow http:
-            if (parsedUrl.protocol === 'http:') {
-                return false;
-            }
+            const parsedUrl = new URL(normalizePeerEndpoint(url));
             // Disallow localhost with or without a port
             if (/^localhost(:\d+)?$/i.test(parsedUrl.hostname)) {
                 return false;
             }
             // Disallow internal and non-routable IP addresses
             const ipAddress = parsedUrl.hostname;
+            const literal = /^[\d.]+$/.test(ipAddress) || ipAddress.includes(':');
+            if (literal && !isPublicNetworkAddress(ipAddress))
+                return false;
             // Regex for non-routable IPv4 IPs
             const nonRoutableIpv4Patterns = [
                 /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, // Loopback IPs
@@ -1803,7 +3197,7 @@ export class Engine {
                 /^0\.0\.0\.0$/ // Non-routable address
             ];
             // Check for IPv4 matches
-            if (nonRoutableIpv4Patterns.some((pattern) => pattern.test(ipAddress))) {
+            if (nonRoutableIpv4Patterns.some(pattern => pattern.test(ipAddress))) {
                 return false;
             }
             // Check for non-routable IPv6 addresses explicitly