Consolidates the reviewed transaction, migration-crash, universal-wallet, TON, Iroha, signing, and CI hardening into one production candidate. The Core Data boundary registers a bounded secure fail-closed transformer before startup, distinguishes corrupt persisted archives from legitimate nil, and lets existing migration sanitizers durably repair affected arrays without changing model hashes or weakening tests.

Current immutable candidate:

• head 2e45e55dc03ad904598e730cfb5994fb5c1072dc
• tree 2a07bae502b5b2d232856d53182147001baa0b1c
• parent 0fd6fd2f0a0eafa8e4e6b4d84678b985d7633467

The first hosted consolidated run exposed two real ChainRegistryTests observer-registration races. Parent 0fd6fd2f0a0eafa8e4e6b4d84678b985d7633467 replaced that ambiguous Core Data fixture with an isolated in-memory repository plus a condition-bound observable, retained the real registry/connection-pool assertions, and passed 100/100 repeated executions.

A subsequent complete local run found a second real compatibility defect: Foundation's JSONEncoder.sortedKeys orders quotedFeeNanotons and quoteEndpointOrigin differently across supported OS versions. The same test binary produced legacy SHA-256 b3d3d3d094dd14e4990e20f2ae569af11c02c50d6d9269d773ff591d1cda4500 on iOS 17.2 and current SHA-256 3238980e4f69c2fdd20fa2666a713771b4bec2ee4154255f154f827679a05067 on iOS 26.2. That could make a persisted signed-bearer journal fail closed after an OS upgrade.

This successor removes runtime-dependent serialization. New records use an explicit UTF-8 byte comparator and deterministic JSON escaping. Decode accepts exactly the current canonical form or the one observed iOS 17 legacy ordering, then still reconstructs and validates every quote, BOC, address, message hash, and Ed25519 signature. Unknown fields, duplicate/noncanonical encodings, arbitrary key permutations, cross-sender records, and corrupt bearer material remain rejected.

Exact verification completed locally:

• Swift parse, SwiftFormat, and diff checks pass
• all 4 journal tests pass on iOS 17.2 and iOS 26.2
• 50 iterations on each runtime: 400/400 test executions pass
• exact current and legacy known-answer hashes pass
• arbitrary-order, Unicode/quote/backslash/slash, nil-field, oversize, corruption, cross-sender, invalid-signature, conflict, and Keychain-failure cases pass
• transaction coverage audit passes
• audit self-test passes all 128 destructive fixtures

The prior full local run was 1000/1001 solely because it exposed this OS-dependent journal hash. A complete exact-successor rerun and hosted checks are in progress and are not pre-claimed here.

Earlier verification retained by this successor includes an optimized Release suite (412/412), focused corrupt-archive and migration suite (20/20), Core Data gate (6 positive + 47 adversarial), simulator rehearsal (2 positive + 39 adversarial), TestFlight publication audit (1 positive + 69 adversarial), and signing/entitlements/project-structure/TODO/branch gates.

The App-Store-signed 4.2.0 (2026.7.28) archive is bound to ancestor 57002dfb474e52df223fa07be476a15990e8fccb; it predates this production journal fix and is superseded. A new exact signed archive, external TestFlight upload, processing, public-group assignment, and Apple-delivered physical-device upgrade evidence remain separate release gates and are not claimed by this PR.