[takemiyamakoto]

Summary

Follow-up to #1317. It fixes three config-integrity gaps that #1317 left open. Stacked on #1317 (hotfix/dev-chains-avail-dedupe @ 1cbd903), so until #1317 merges, the diff to master also shows its commit.

1. Bundled fallback chain list repeated three chains. fearless/Modules/LiquidityPools/LiquidityPoolDetails/Resources/chains.json listed Manta Pacific Mainnet (169), Enjin Relaychain (d8761d3c…) and Liberland (6bd89e05…) twice, as a block of three. This PR removes the second block (76 → 73 chains).
   • The Manta Pacific and Enjin copies were identical.
   • The removed Liberland copy listed only LLD and had no XCM. The kept copy lists LLD, LLM and XOR with the SORA route, as the production and development lists do.
   • The order now matches the development list.
   • The app reads this file only when ChainSyncService.fetchLocalData is true, and it is false today. If it were true, sanitizingRemoteChains would refuse the whole list with duplicateRemoteChainIdentifier. None of the three chains is retired or app-owned, so none is filtered out before that check.
2. Production chain types repeated one chain. remote-config/production/chains/all_chains_types.json listed 6d8d9f145c2177fa83512492cdd80a71e29f22473f4a8943a6292149ac319fb9 twice. That chainId is the SORA Kusama parachain (2011), which NetworkRetirement retires.
   • Index 54: runtime_id 1, with numeric type ids ("Phase": "78", "17": "GenericEvent", …).
   • Index 98: runtime_id 14, with sora2_parachain_runtime::RuntimeEvent / RuntimeCall.
   • This PR removes index 54 and keeps index 98. The next section explains why.
3. Nothing verified the ownedSha256 pins in config/remote-config-imports.json. scripts/verify-remote-config.py now checks every pin.

Why the index-98 types entry stays

Every reader of chainTypesSourceUrl folds the array into a [String: Data] map with partialResult[chainId] = data, so the last entry for a chainId wins. The readers are:

• the app's ChainsTypesSyncService, created in ChainRegistryFactory;
• SnapshotHotBootBuilder, both its remote fallback and the map ChainsTypesSyncService saved;
• the SSF ChainsTypesSyncService that ChainRegistryAssembly and XcmAssembly use.

The types URL has no F_DEV branch, so every build, Debug included, reads this production file. Builds have therefore always used index 98. Removing index 54 leaves the map unchanged: I checked it is identical before and after, with 109 chainIds.

Provenance: shared-features-utils 8791e434 ("Update chains.json (#1056)", 2025-01-20, "Add SORA parachain types") appended the runtime 14 entries for both SORA parachains. It did not remove the older Kusama entry.

The development all_chains_types.json and the bundled types.json still hold the runtime_id 1 entry, and I left them as they are. No build reads the development types file. The bundled one is read only when ChainsTypesSyncService.fetchLocalData is true, and it is false today. The chain is retired and is in no chain list.

Audit changes (scripts/verify-remote-config.py)

The audit now also fails in these cases:

• A chainId is repeated in a chain list (*/chains/v*/chains*.json, as before), in a chain types file (*/chains/all_chains_types.json), or in the bundled chains.json / types.json. Other documents may still repeat chainIds, for example the XCM files.
• config/remote-config-imports.json is missing or unreadable.
• A pin is malformed or repeated.
• A pinned file is missing. Only exact-case paths inside remote-config/ count, so ../ and case slips also fail.
• A pinned file's SHA-256 differs from its ownedSha256. The message gives both digests.

The output gains a pinnedFiles count. There are 12 new tests in scripts/test-remote-config.py, and the docs describe the checks.

Data edits

• One commit carries the data edits, the re-pin and the log entry, as the manifest rule requires.
• production/chains/all_chains_types.json is re-pinned: ced6c59d… → cbef0d2d….
• One corrections entry is appended to the manifest.
• The registry table in docs/ChainRegistryVersions.md is refreshed.

Results

All checks ran locally; the project doesn't gate on hosted CI.

• Head: dab448005fb86406368e8e78917e04df9c6a2b37.
• Commits: 936220434 (data fix, re-pin, log, registry table) and dab448005 (audit, tests, docs).
• Both commits are green on their own. At 936220434, the old audit passes.

Stage	New audit (dab4480)	Old audit (1cbd903)
A: #1317's data	fails: 3 bundled repeats (169, d8761d3c, 6bd89e05) + chain types 6d8d9f14	passes
A1: only the bundled chains.json reverted	fails: its 3 repeats	passes
A2: only all_chains_types.json and its pin reverted	fails: 6d8d9f14 repeated	passes
B: data fixed, manifest not re-pinned	fails: all_chains_types.json has SHA-256 cbef0d2d…, pinned ced6c59d…	passes
C: a pinned file deleted	fails: pinned file remote-config/production/chains/v2/chains.json is missing	passes
D: head	passes: {"documents": 34, "ownedReferences": 1988, "pinnedFiles": 949}	passes

On a clean tree at head:

• python3 scripts/test-remote-config.py: 28/28 OK, under Python 3.9.6 and 3.14.10.
• python3 scripts/verify-remote-config.py . passes, and so does the run without an argument. All 949 pins match.

To reproduce the "before" run:

mkdir -p /tmp/before
git archive 1cbd9038d remote-config config/remote-config-imports.json fearless/Modules/LiquidityPools/LiquidityPoolDetails/Resources | tar -x -C /tmp/before
python3 scripts/verify-remote-config.py /tmp/before

Merge notes

• Merge Fix Debug/Dev chain sync: list Avail DA Mainnet once in chains_dev.json #1317 first. If this PR merges first, it carries Fix Debug/Dev chain sync: list Avail DA Mainnet once in chains_dev.json #1317's change, and Fix Debug/Dev chain sync: list Avail DA Mainnet once in chains_dev.json #1317 can be closed.
• Any later PR that edits a pinned file has to re-pin it, or this audit fails.
• Left as they are:
  • The bundled fallback is otherwise stale. It still has networks the remote lists have retired and older node lists. XOR on Liberland has precision 12 there, against 18 in the remote lists. I didn't check whether it decodes as [ChainModel].
  • A file under remote-config/ that has no pin isn't flagged. Today all 949 files are pinned.
• No Swift code changed; no Swift test reads either edited data file.

🤖 Generated with Claude Code

[takemiyamakoto]

Folded into #1326, which brings every open iOS PR into master in one change, so one code-owner approval covers it. This PR's branch is kept.