fix(android): consolidate migration-safe production release

[takemiyamakoto]

Outcome

Consolidates the migration, startup, release-integrity, Iroha/XCM, dependency-provenance, IAS-publication, and native-page-alignment hardening onto one exact reviewable Android head.

• prevents the historical Reown/CoreClient delegate-registration startup crash
• keeps delegate registration synchronized, retryable, and fail-closed until SDK initialization succeeds
• preserves legacy databases and secret payloads through bounded, journaled, quarantined migrations
• resets the process-wide secure-storage health latch around every durability-test case, removing hosted-CI order contamination while retaining the production monotonic restart-required behavior
• removes a package-level test-fake name collision and binds coordinator tests to the explicit test-only constructor
• rejects signing requests whose caller crypto type conflicts with durable wallet identity before any secret read
• updates TON Connect journal tests to the full previous-row snapshot contract and adds hostile mismatched/invalid/incomplete-row rejection coverage
• restores the valid migration-instrumentation class and five migration cases accidentally displaced during consolidation, then compiles the complete Android-test source set
• accepts legacy fearless-utils runtime JSON without runtime_id while preserving strict validation
• stages the owner-approved Iroha mobile SDK from exact immutable release assets and rejects alternate repository, archive, checksum, path, symlink, environment, and late Gradle-repository routes
• retains Iroha send and broad XCM fail-closed gates where production evidence is still missing
• records historical Google Play IAS publication evidence without exposing install URLs and emits private handoffs only through mode-0600 files bound to the exact public-evidence digest
• verifies the exact AAB bytes and every ELF PT_LOAD segment against the 16 KiB page-alignment contract with bounded archive/native-library inventories

Exact reviewed source

• commit: f5232473ece3bb82fbfa7d5dfd771ba3c5b06f21
• tree: 75b038c319ee9291e12a14a95ad31bd77d96971a
• parent: 9f5fd7e909f95d458eed30eef2625ba7ffc90d61
• base: develop
• supersedes every artifact built from earlier production-consolidation heads

Verification

The predecessor consolidation head passed the complete Gradle-backed release suite, including:

• full :common:testDebugUnitTest: 332 tests, 0 failures, 0 errors
• full :feature-account-impl:testDebugUnitTest: 137 tests, 0 failures, 0 errors
• full :feature-tonconnect-impl:testDebugUnitTest
• complete ./gradlew runTest: 730 Gradle tasks
• exact :core-db:compileDebugAndroidTestKotlin: 159 tasks, including the restored 1,518-line V2MigrationTest
• canonical staged-Iroha bridge online and repeated-offline build/test

The exact f5232473ece3bb82fbfa7d5dfd771ba3c5b06f21 delta passed locally:

• actionlint, YAML parsing, and git diff --check
• IAS publication audit: 6 positive and 184 adversarial cases
• private handoff writer: 2 positive and 17 adversarial cases
• exact recorded AAB verification: SHA-256, 16 native libraries, four ABIs, and 16 KiB alignment
• AAB alignment verifier: 1 positive and 20 adversarial cases
• IAS static contract: 1 positive and 645 adversarial cases; coverage cleanup: 4 positive and 12 adversarial cases
• Play release architecture: 4 positive and 123 adversarial cases
• release governance: 3 positive and 43 adversarial cases
• signed-tag contract: 1 positive and 13 adversarial cases
• source-tree verifier: 3 positive and 14 adversarial cases
• build-log verifier: 2 positive and 26 adversarial cases
• public provenance, dependency handoff, and branch-flow audits

Hosted verification is authoritative for this exact commit and tree:

• Android CI run 30693270515: terminal success. runTest completed 730 tasks; API 30, 31, and 36 each passed 39 critical migration/startup tests; wallet migration/startup instrumentation completed 951 tasks; debug APK/AAB assembly completed 803 tasks; the source-bound AAB gate passed signature, R8, and identity adversarial suites and verified 16 libraries across arm64-v8a, armeabi-v7a, x86, and x86_64 with every required segment aligned to 16,384 bytes (sha256:107abb5de5a4ef34fd637d392ac4ae75a6de658ed617fec8808af599b968be92).
• IAS candidate run 30693270516: terminal success for exact commit/tree binding, static and adversarial IAS controls, clean-source proof, and a non-cached unsigned IAS AAB build (BUILD SUCCESSFUL in 9m 45s; 1,333 actionable tasks, all 1,333 executed). Exact unsigned outputs, mapping files, unchanged source, and the fearless-utils effective tree were verified. Because this is an untrusted PR validation, qualification, upload, and private-handoff jobs correctly remained skipped.
• Branch Flow is terminal green.

Superseded Google Play IAS build

Previously accepted IAS builds were produced from obsolete heads. Their install URLs remain private and every such artifact is superseded; none is release evidence for this PR. A replacement handoff may be recorded only after the exact head above passes the complete qualification boundary from trusted protected develop with the real WalletConnect project ID.

Release boundary

IAS uses a deliberately ephemeral test signer. It is Google-hosted test distribution, not a production-track release, and cannot replace a production/Play-signed installation. Never uninstall a funded wallet merely to test it. Production Play publication still requires eligible approval, protected merge, real release integration values, the upload keystore, and Google Play release authority.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.