diff --git a/.claude/skills/simulator-control/SKILL.md b/.claude/skills/simulator-control/SKILL.md
new file mode 100644
index 00000000000..2df58580bc2
--- /dev/null
+++ b/.claude/skills/simulator-control/SKILL.md
@@ -0,0 +1,293 @@
+---
+name: simulator-control
+description: Drive and inspect SwiftExampleApp on the booted iOS simulator end-to-end — tap, swipe, type, screenshot, read SwiftData, stream logs, dump the accessibility tree. Use when the user reports a UI bug, asks "why is X stuck?", wants a UAT run automated, or you need to verify the app's persisted state against what the UI shows. Covers both inspection (read-only via SwiftData + screenshots) AND control (UI automation via idb).
+argument-hint: "[describe | screenshot | tap-label <label> | tap-coord <x> <y> | type <text> | back | inspect <slot>]"
+---
+
+# Simulator Control — drive + inspect SwiftExampleApp
+
+When the user is testing SwiftExampleApp in the iOS simulator, you can do everything they could do: tap buttons by label, type text, swipe, dump the accessibility tree, screenshot the screen, read the SwiftData store directly for ground truth, cross-check chain state against testnet. Use this together with the human-in-the-loop, not against them — confirm with them before destructive actions.
+
+## Required tooling
+
+| Tool | Install | Why |
+|---|---|---|
+| `xcrun simctl` | Xcode CLT (already installed for iOS dev) | Screenshot, app container, openurl, logs |
+| `sqlite3` | macOS default | Read SwiftData `default.store` |
+| `idb` + `idb_companion` | `brew install facebook/fb/idb-companion` + `pipx install --python /opt/homebrew/bin/python3.12 fb-idb` (fb-idb 1.1.7 uses asyncio.get_event_loop() which Python 3.14 dropped — **must pin 3.12**) | Tap / swipe / type / accessibility tree |
+| `curl` + `WebFetch` | builtin | Cross-check chain state via insight.testnet API |
+
+Without `idb` the inspection workflows (screenshot + SwiftData + logs) still work; only control workflows are blocked.
+
+## Quick command reference
+
+```bash
+# === Setup (once per session) ===
+export PATH="$HOME/.local/bin:$PATH"
+UDID=$(xcrun simctl list devices booted | awk -F'[()]' '/Booted/ {print $2}')
+idb connect $UDID    # starts idb_companion alongside the running sim
+BUNDLE=org.dashfoundation.SwiftExampleApp
+
+# === INSPECT ===
+xcrun simctl io booted screenshot /tmp/sim.png             # screenshot
+idb ui describe-all --udid $UDID                            # accessibility tree (JSON)
+idb ui describe-point --udid $UDID X Y                      # element under coord
+
+# === CONTROL ===
+idb ui tap     --udid $UDID X Y                             # tap at coord
+idb ui swipe   --udid $UDID X1 Y1 X2 Y2 --duration 0.3      # swipe
+idb ui text    --udid $UDID "hello"                         # type text into focused field
+idb ui key     --udid $UDID 40                              # short press keycode (40 = return)
+idb ui button  --udid $UDID HOME                            # hardware buttons: HOME, LOCK, SIRI, SIDE_BUTTON
+
+# === APP ===
+xcrun simctl launch    booted $BUNDLE
+xcrun simctl terminate booted $BUNDLE
+xcrun simctl openurl   booted "dashplatform://identity/abc123"
+
+# === DATA ===
+DATA=$(xcrun simctl get_app_container booted $BUNDLE data)
+STORE="$DATA/Library/Application Support/default.store"
+sqlite3 "$STORE" "SELECT ..."
+
+# === LOGS ===
+xcrun simctl spawn booted log show --last 60s --info \
+    --predicate 'processImagePath CONTAINS "SwiftExampleApp"'
+```
+
+## The label-find-then-tap pattern (killer feature)
+
+Don't hardcode pixel coords. Dump the accessibility tree, filter by `AXLabel` (exact or substring), tap the frame center. Works across iPhone models / orientations / SwiftUI layout tweaks.
+
+```bash
+tap_label() {
+    local label="$1"
+    local udid=$(xcrun simctl list devices booted | awk -F'[()]' '/Booted/ {print $2}')
+    LABEL="$label" UDID="$udid" "$HOME/.local/bin/idb" ui describe-all --udid "$udid" 2>&1 \
+        | python3 -c "
+import json, os, subprocess, sys
+items = json.loads(sys.stdin.read())
+label = os.environ['LABEL']
+# Exact match first, fall back to substring
+match = next((it for it in items if it.get('AXLabel') == label and it.get('enabled')), None)
+if not match:
+    match = next((it for it in items if label in (it.get('AXLabel') or '') and it.get('enabled')), None)
+if not match:
+    print(f'no enabled element matching {label!r}', file=sys.stderr); sys.exit(1)
+f = match['frame']
+x, y = int(f['x'] + f['width']/2), int(f['y'] + f['height']/2)
+subprocess.run([os.path.expanduser('~/.local/bin/idb'), 'ui', 'tap', '--udid', os.environ['UDID'], str(x), str(y)], check=True)
+print(f'tapped {match.get(\"AXLabel\")!r} ({match.get(\"type\")}) at ({x},{y})')
+"
+}
+
+tap_label "Resume"
+```
+
+Use `AXUniqueId` instead of `AXLabel` when the UI sets one (more stable across localization). The back-navigation button in this app, for example, has `AXUniqueId: "BackButton"`.
+
+## SwiftData schema cheat sheet
+
+The app's `default.store` is a Core Data SQLite database. Tables are prefixed `ZPERSISTENT*` and columns `Z*`. Get the full list via `sqlite3 "$STORE" ".tables"`. Most relevant:
+
+| Table | Key columns | Purpose |
+|---|---|---|
+| `ZPERSISTENTASSETLOCK` | `ZSTATUSRAW`, `ZIDENTITYINDEXRAW`, `ZOUTPOINTHEX`, `ZPROOFBYTES`, `ZWALLETID`, `ZAMOUNTDUFFS` | Tracked asset locks |
+| `ZPERSISTENTIDENTITY` | `ZIDENTITYINDEX`, `ZIDENTITYID`, `ZNETWORKRAW`, `ZWALLET` | Registered platform identities |
+| `ZPERSISTENTWALLET` | `ZWALLETID`, `ZLABEL`, `ZNETWORKRAW` | Local wallets |
+| `ZPERSISTENTACCOUNT` | `ZACCOUNTTYPE`, `ZWALLET` | Per-wallet accounts |
+| `ZPERSISTENTTXO` | `ZWALLETID`, `ZTRANSACTION`, `ZSPENDINGTRANSACTION` | UTXOs, source of `TransactionListView` |
+| `ZPERSISTENTTRANSACTION` | `ZTXID`, `ZCONTEXT`, `ZFIRSTSEEN`, `ZBLOCKHEIGHT` | TXs |
+| `ZPERSISTENTDOCUMENT` | `ZDOCUMENTID`, `ZDATACONTRACT` | Documents |
+
+Discriminants (mirror Rust enums):
+- `ZSTATUSRAW` on asset lock: `0`=Built, `1`=Broadcast, `2`=InstantSendLocked, `3`=ChainLocked
+- `ZCONTEXT` on transaction: `0`=mempool, `1`=instantSend, `2`=inBlock, `3`=inChainLockedBlock
+
+`Z_PK` columns are integer foreign keys to the related table's primary key — stable for the install lifetime but NOT across re-installs. Quote `ZIDENTITYID` / `ZOUTPOINTHEX` / `ZWALLETID` blobs in any long-lived reference.
+
+## Common workflows
+
+### A — Verify a "stuck" asset lock (the SPV-catch-up-gap diagnostic)
+
+```bash
+sqlite3 "$STORE" -header -column "
+SELECT ZIDENTITYINDEXRAW AS slot, ZSTATUSRAW AS status,
+       ZAMOUNTDUFFS AS duffs, length(ZPROOFBYTES) AS proof_len,
+       length(ZTRANSACTIONBYTES) AS tx_len, ZOUTPOINTHEX
+  FROM ZPERSISTENTASSETLOCK
+ WHERE ZIDENTITYINDEXRAW = 10;"
+```
+
+Then cross-check chain state — strip the `:vout` suffix to get the txid:
+```bash
+TXID=$(sqlite3 "$STORE" "SELECT substr(ZOUTPOINTHEX, 1, 64) FROM ZPERSISTENTASSETLOCK WHERE ZIDENTITYINDEXRAW = 10;")
+curl -s "https://insight.testnet.networks.dash.org/insight-api/tx/$TXID" \
+  | python3 -c "import json,sys; d=json.load(sys.stdin); print(f'block={d.get(\"blockheight\")} conf={d.get(\"confirmations\")} txlock={d.get(\"txlock\")}')"
+```
+
+| SwiftData | On chain | Diagnosis |
+|---|---|---|
+| status 1, no proof | mined + txlock | **SPV catch-up gap** — signatures exist but the wallet hasn't backfilled them on app load |
+| status 1, no proof | mined, no txlock | Pure timing — waiting for masternodes |
+| status 1, no proof | not found / not mined | TX dropped or never confirmed |
+| status 2/3, proof present | anything | UI should already be showing Resume |
+| status 2/3, proof present, UI shows "Waiting…" | anything | **UI reactivity bug** — `@Query` not picking up update |
+
+### B — Drive a full UAT scenario end-to-end (example: crash-recovery)
+
+```bash
+# 1. Snapshot SwiftData state
+sqlite3 "$STORE" "SELECT ZIDENTITYINDEXRAW, ZSTATUSRAW FROM ZPERSISTENTASSETLOCK ORDER BY ZIDENTITYINDEXRAW;"
+
+# 2. Force-quit + relaunch (simulates a crash)
+xcrun simctl terminate booted $BUNDLE
+xcrun simctl launch    booted $BUNDLE
+sleep 3
+
+# 3. Take the Identities tab → Resumable Registrations → Resume row
+xcrun simctl io booted screenshot /tmp/after-launch.png
+tap_label "Identities"
+sleep 1
+tap_label "Resume"      # taps the first Resume button in the visible accessibility tree
+
+# 4. Verify the resume submit fires — read SwiftData a few times until ZSTATUSRAW goes 1->2->identity row appears
+```
+
+### C — Tap an arbitrary row by stable substring (e.g. an outpoint prefix)
+
+The accessibility tree exposes truncated UI strings AND full underlying labels for `Text(verbatim:)` content. Use a substring match to find a row whose visible txid prefix is known:
+
+```bash
+LABEL="780ea9931" tap_label "$LABEL"
+```
+
+### D — Find element under a screen point (debug a layout)
+
+```bash
+idb ui describe-point --udid $UDID 200 400
+```
+
+Returns the element at that coordinate — useful when an interactive area isn't where the visible layout suggests (e.g. SwiftUI Form hit-test boundaries on iOS 26).
+
+### E — Type into a focused TextField
+
+```bash
+# Tap the field first to focus it, then type.
+tap_label "Amount"
+idb ui text --udid $UDID "0.0025"
+idb ui key  --udid $UDID 40   # return
+```
+
+iOS keycodes: `40`=return, `42`=backspace, `43`=tab, `44`=space, see Apple's `HIDKeyboardKey` table.
+
+### F — Hardware buttons + system actions
+
+```bash
+idb ui button --udid $UDID HOME             # go to springboard
+idb ui button --udid $UDID LOCK             # lock screen
+idb ui button --udid $UDID SIDE_BUTTON      # side button
+idb ui button --udid $UDID SIRI             # invoke Siri
+```
+
+### G — Screenshot-diff to verify a state change
+
+```bash
+xcrun simctl io booted screenshot /tmp/before.png
+tap_label "Resume"
+sleep 1
+xcrun simctl io booted screenshot /tmp/after.png
+# Compare with magick or by reading both images into Claude.
+```
+
+### H — Log capture during an action
+
+```bash
+xcrun simctl spawn booted log stream --info \
+    --predicate 'processImagePath CONTAINS "SwiftExampleApp"' > /tmp/applog.txt 2>&1 &
+LOG_PID=$!
+# ... drive UI via idb / let the user act ...
+sleep 5
+kill $LOG_PID
+grep -iE "error|panic|fatal|💥|⚠️" /tmp/applog.txt
+```
+
+### I — Poll-and-wait for a state transition
+
+When you've kicked off an async operation and want to wait for the UI/SwiftData to confirm it:
+```bash
+for i in {1..30}; do
+    status=$(sqlite3 "$STORE" "SELECT ZSTATUSRAW FROM ZPERSISTENTASSETLOCK WHERE ZIDENTITYINDEXRAW = 10;")
+    echo "[$i] status=$status"
+    [ "$status" -ge 2 ] && break
+    sleep 2
+done
+```
+
+## Setup checklist
+
+Run before any session that needs UI control:
+
+```bash
+export PATH="$HOME/.local/bin:$PATH"
+which idb || { echo "install: brew install facebook/fb/idb-companion && pipx install --python /opt/homebrew/bin/python3.12 fb-idb"; exit 1; }
+UDID=$(xcrun simctl list devices booted | awk -F'[()]' '/Booted/ {print $2}')
+[ -z "$UDID" ] && { echo "no booted sim — boot one in Xcode or via 'xcrun simctl boot <udid>'"; exit 1; }
+idb connect $UDID 2>&1 | grep -q "udid:" || { echo "idb companion not reachable"; exit 1; }
+echo "ready: UDID=$UDID"
+```
+
+If `idb connect` hangs, clear stale companion processes: `pkill -f idb_companion` then re-run.
+
+## Pitfalls
+
+- **Data container path changes per install.** Always use `xcrun simctl get_app_container` to locate the SwiftData store — never hardcode the UUID.
+- **fb-idb 1.1.7 + Python 3.14 = broken.** Pin to Python 3.12 via `pipx install --python /opt/homebrew/bin/python3.12 fb-idb`. The error is `RuntimeError: There is no current event loop in thread 'MainThread'.`
+- **`getpwuid_r did not find a match`** stderr noise from `xcrun simctl spawn booted log ...` is harmless; logs still stream.
+- **Multiple booted simulators** — pass `--udid` explicitly. `xcrun simctl list devices booted` may pick a different one than the user expects.
+- **`describe-all` returns disabled / non-interactive elements too** — filter on `enabled == true` and `role in {AXButton, AXTextField, AXLink}` for actions, or `type == "Cell"` for list rows.
+- **`AXLabel` is not unique** — multiple "Confirmed" badges, multiple chevrons. When ambiguous, narrow by `frame.y` range or by walking the tree near a known parent. Prefer `AXUniqueId` when set.
+- **Tap coordinates are in points, not pixels** — `describe-all`'s frames match `xcrun simctl io screenshot` coords directly (no scaling).
+- **Sheet / modal presentations** can change the accessibility tree drastically — always `describe-all` again after a navigation, don't cache element coords across screens.
+- **Status-bar override for clean screenshots**: `xcrun simctl status_bar booted override --time "9:41"` and `xcrun simctl status_bar booted clear` to reset.
+- **Don't tap on a screen the user is mid-interaction with** unless you've confirmed it's safe — they may lose form state. Snapshot first, ask second on anything destructive.
+- **Cross-process SwiftData writes are unsafe** while the app holds the SQLite connection — readonly queries only.
+- **Tab-bar buttons aren't always exposed in `describe-all`.** SwiftUI bottom `TabView` items often render as a parent `Group { AXLabel: "Tab Bar" }` with no per-tab children in the flat tree. Use `describe-point` at the tab's expected coordinates instead — it returns the `AXRadioButton` with `subrole: AXTabButton` and the right label. Then tap by that frame.
+- **`head -c N` truncates JSON output mid-document** — `idb ui describe-all` produces a single JSON array; piping through `head` for inspection chops it and breaks `json.loads`. Save the full output to a file first (`idb ui describe-all > /tmp/tree.json`), then parse from the file.
+- **Env vars don't propagate into `python3 -c '...'`** the way they do into `bash`. Use a heredoc form instead:
+  ```bash
+  python3 << 'PY'
+  import os
+  label = os.environ.get('LABEL', 'default')
+  PY
+  ```
+  Or pass values via `--env` flags / command args. The `LABEL=... python3 -c "..."` form looks right but Python sees an empty environ when invoked through some shells.
+- **`status` is a readonly variable in zsh.** When writing polling loops that read a status code into a shell variable, name it anything else (`stat`, `current`, `value`). The harness's bash exec uses zsh-compatible semantics for some built-ins.
+- **For long-running polls, use `run_in_background: true`** on the Bash tool, OR wrap in a `Monitor`-friendly `until` loop. Chaining `sleep 30 && cat ...` calls is blocked by the harness — it's enforcing the "don't sleep-loop, use background tasks" rule.
+- **App launch can succeed at the OSLog level but the simulator display can still show home screen** if the app was already running in the background, the Simulator window is not focused, or the post-launch foregrounding race didn't fire. If `xcrun simctl launch` returns a PID but screenshot shows home, run `launch` a second time — the second call typically brings it to front.
+- **`xcrun simctl spawn booted log stream --predicate ...` does NOT capture Rust `tracing::*` output unless the app explicitly wires tracing into OSLog.** If your app uses `tracing-subscriber::fmt()` (the default) the logs go to stderr inside the app process, not to OSLog, so the log stream won't see them. To see Rust traces, the app needs a `tracing-oslog` (or equivalent) layer. Without one, you can still observe Rust-side state via SwiftData and behavior via screenshots.
+
+## What this skill does NOT do
+
+- **Mock the network / chain state.** For that you need testnet faucets, regtest, or fixture-based tests at the Rust layer.
+- **Simulate IS-lock / chain-lock signatures.** Those come from the masternode network. To test those code paths deterministically you need test fixtures injected at the Rust persister layer.
+- **Cross-process writes** to SwiftData while the app is running.
+
+## Worked example — iter 5 stuck-resume diagnosis (2026-05-13)
+
+User reported: identity slot #10 stuck on "Waiting for InstantSendLock…" forever. End-to-end workflow used:
+
+1. **Screenshot** → confirmed UI shows "Broadcast", proofBytes "—".
+2. **SwiftData query** → got the **full** outpoint `780ea9931eae9d4e6a0df2c0c2721c11bd645fc453fb2907b4a4894893a257d0:0` (the UI truncates to `780ea99…257d0:0`, useless for chain lookups).
+3. **WebFetch insight.testnet** with the full txid → block 1475917, 67 confirmations, **`txlock: true`** → diagnostic table row 1: **SPV catch-up gap**.
+4. **`idb ui describe-all`** → found `BackButton` at frame `{{16, 62}, {44, 44}}` and the slot-row by its full-txid `AXLabel`.
+5. **`idb ui tap 38 84`** → navigated back to the list, screenshot revealed all 9 asset locks: only slot #10 was stuck on Broadcast; slots #2-#9 are all InstantSendLocked. Confirms the bug is specific to outpoints that were already confirmed before this app session was first launched.
+6. **Label-find-then-tap** with substring `"780ea9931"` → restored user's screen to slot #10 detail.
+
+Total time: ~5 minutes of automated control + verification. No coordinate guessing, no screenshot squinting, ground truth from SwiftData + chain.
+
+## Future enhancements
+
+- Wrap `tap_label` in a checked-in script at `.claude/skills/simulator-control/scripts/tap-label.py`.
+- Add `wait-for-label "<label>" --timeout 30` that polls `describe-all` until the label appears (or disappears) — useful for SPV-delivered status transitions during UAT.
+- Macro `run-uat-scenario <name>` driving the full iter 5 UAT matrix once seed-data fixtures are in place.
diff --git a/Cargo.lock b/Cargo.lock
index b6294fe31f5..6483ccd2e77 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -513,7 +513,7 @@ dependencies = [
  "bitflags 2.11.0",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "regex",
@@ -1138,7 +1138,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1565,7 +1565,7 @@ dependencies = [
 [[package]]
 name = "dash-network"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -1576,7 +1576,7 @@ dependencies = [
 [[package]]
 name = "dash-network-seeds"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "dash-network",
 ]
@@ -1653,7 +1653,7 @@ dependencies = [
 [[package]]
 name = "dash-spv"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "async-trait",
  "chrono",
@@ -1681,7 +1681,7 @@ dependencies = [
 [[package]]
 name = "dash-spv-ffi"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "cbindgen 0.29.2",
  "clap",
@@ -1700,7 +1700,7 @@ dependencies = [
 [[package]]
 name = "dashcore"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "anyhow",
  "base64-compat",
@@ -1726,12 +1726,12 @@ dependencies = [
 [[package]]
 name = "dashcore-private"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 
 [[package]]
 name = "dashcore-rpc"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "dashcore-rpc-json",
  "hex",
@@ -1744,7 +1744,7 @@ dependencies = [
 [[package]]
 name = "dashcore-rpc-json"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "bincode",
  "dashcore",
@@ -1759,7 +1759,7 @@ dependencies = [
 [[package]]
 name = "dashcore_hashes"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "bincode",
  "dashcore-private",
@@ -2294,7 +2294,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3321,7 +3321,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3582,7 +3582,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3808,7 +3808,7 @@ dependencies = [
 [[package]]
 name = "key-wallet"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "aes",
  "async-trait",
@@ -3836,7 +3836,7 @@ dependencies = [
 [[package]]
 name = "key-wallet-ffi"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "cbindgen 0.29.2",
  "dash-network",
@@ -3852,7 +3852,7 @@ dependencies = [
 [[package]]
 name = "key-wallet-manager"
 version = "0.42.0"
-source = "git+https://github.com/dashpay/rust-dashcore?rev=53130869e5b9343ae59016323e5e5269e717a8fd#53130869e5b9343ae59016323e5e5269e717a8fd"
+source = "git+https://github.com/dashpay/rust-dashcore?rev=5297d61ac13b4bdfc85aef683e3c46e0597e6741#5297d61ac13b4bdfc85aef683e3c46e0597e6741"
 dependencies = [
  "async-trait",
  "bincode",
@@ -5130,8 +5130,8 @@ version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
- "heck 0.4.1",
- "itertools 0.10.5",
+ "heck 0.5.0",
+ "itertools 0.14.0",
  "log",
  "multimap",
  "petgraph",
@@ -5152,7 +5152,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5165,7 +5165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5295,7 +5295,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5333,9 +5333,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6049,7 +6049,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6062,7 +6062,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6121,7 +6121,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6944,7 +6944,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8348,7 +8348,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 078306a8b88..08eb019ccb1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -49,15 +49,15 @@ members = [
 ]
 
 [workspace.dependencies]
-dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-dash-spv-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
-dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "53130869e5b9343ae59016323e5e5269e717a8fd" }
+dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+dash-spv-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
+dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "5297d61ac13b4bdfc85aef683e3c46e0597e6741" }
 
 # Optimize heavy crypto crates even in dev/test builds so that
 # Halo 2 proof generation and verification run at near-release speed.
diff --git a/packages/rs-dpp/src/errors/protocol_error.rs b/packages/rs-dpp/src/errors/protocol_error.rs
index e0497c685b1..825bf832991 100644
--- a/packages/rs-dpp/src/errors/protocol_error.rs
+++ b/packages/rs-dpp/src/errors/protocol_error.rs
@@ -140,6 +140,24 @@ pub enum ProtocolError {
     #[error("Generic Error: {0}")]
     Generic(String),
 
+    /// External signer (e.g. Swift Keychain-backed
+    /// `MnemonicResolverCoreSigner`) reported a failure or returned a
+    /// non-conformant result. This is a distinct surface from
+    /// [`Self::Generic`] so callers (FFI layer, retry policies) can
+    /// distinguish a signer-side failure from a generic protocol
+    /// invariant.
+    ///
+    /// Examples of failures that surface here:
+    /// - The signer's `sign_ecdsa` future returned an error (resolver
+    ///   miss, derivation failure, invalid mnemonic, etc.).
+    /// - The signer returned a signature whose recovery id does not
+    ///   match the returned public key (invariant violation by a
+    ///   non-conformant signer — distinct from a soft failure, but
+    ///   surfaced uniformly here so the FFI layer doesn't need to
+    ///   pattern-match on signer-specific shapes).
+    #[error("External signer error: {0}")]
+    ExternalSignerError(String),
+
     #[error("Address witness verification error: {0}")]
     AddressWitnessError(String),
 
diff --git a/packages/rs-dpp/src/state_transition/mod.rs b/packages/rs-dpp/src/state_transition/mod.rs
index d00c1cf4226..f55dc8d2b91 100644
--- a/packages/rs-dpp/src/state_transition/mod.rs
+++ b/packages/rs-dpp/src/state_transition/mod.rs
@@ -1245,6 +1245,130 @@ impl StateTransition {
         Ok(())
     }
 
+    /// Signs `self.signable_bytes()` with an external [`key_wallet::signer::Signer`]
+    /// and stores the resulting Core-ECDSA signature on the state transition.
+    ///
+    /// This is the signer-driven counterpart to [`Self::sign_by_private_key`] for
+    /// the ECDSA (asset-lock-proof) signing path. It exists so callers — most
+    /// notably the iOS Swift SDK and any other host that holds its private keys
+    /// inside a hardware wallet, secure enclave, or remote signing service — can
+    /// produce the asset-lock-proof signature on `IdentityCreate` /
+    /// `IdentityTopUp` state transitions **without ever materialising a raw
+    /// `[u8]` private key on the Rust side**. The signer performs the
+    /// derive + sign + zeroise sequence atomically inside its own trust
+    /// boundary; this function only sees a 32-byte digest and the resulting
+    /// signature.
+    ///
+    /// # Wire-format parity with `sign_by_private_key`
+    ///
+    /// The byte layout of the signature stored on `self` is **byte-identical**
+    /// to the one produced by [`Self::sign_by_private_key`] when called with
+    /// `KeyType::ECDSA_SECP256K1` / `KeyType::ECDSA_HASH160` and the same
+    /// underlying private key. The pre-image transform mirrors
+    /// `dashcore::signer::sign`:
+    ///
+    /// 1. `digest = double_sha256(self.signable_bytes()?)`
+    /// 2. `signer.sign_ecdsa(path, digest).await` → non-recoverable
+    ///    `(secp256k1::ecdsa::Signature, secp256k1::PublicKey)`.
+    /// 3. Recover the recovery id by trying all four candidates against the
+    ///    returned public key (libsecp256k1 normalises both signing paths to
+    ///    low-s form so the 64-byte `r||s` payload is bit-identical).
+    /// 4. Serialise as a 65-byte compact recoverable signature with the
+    ///    `compressed` prefix convention used by `CompactSignature` — i.e.
+    ///    `[recovery_id + 27 + 4, r (32) || s (32)]`.
+    ///
+    /// # Errors
+    ///
+    /// - Returns [`ProtocolError::ExternalSignerError`] wrapping the signer's
+    ///   `Display` error when the underlying signer fails.
+    /// - Returns [`ProtocolError::ExternalSignerError`] if no recovery id
+    ///   matches the public key returned by the signer — this should be
+    ///   unreachable for a conformant signer (invariant violation by a
+    ///   non-conformant signer) but is surfaced rather than panicked on.
+    /// - Returns [`ProtocolError::Generic`] if the SHA-256 transform did not
+    ///   yield a 32-byte digest (defensive — should never happen).
+    /// - Returns [`ProtocolError::InvalidVerificationWrongNumberOfElements`] if
+    ///   `set_signature` rejects the result (matches `sign_by_private_key`).
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    pub async fn sign_with_signer<S: ::key_wallet::signer::Signer>(
+        &mut self,
+        path: &::key_wallet::bip32::DerivationPath,
+        signer: &S,
+    ) -> Result<(), ProtocolError> {
+        use dashcore::secp256k1::ecdsa::{RecoverableSignature, RecoveryId};
+        use dashcore::secp256k1::{Message, Secp256k1};
+        use dashcore::signer::{double_sha, CompactSignature};
+
+        let data = self.signable_bytes()?;
+        // Pre-image transform matches `dashcore::signer::sign`: double-SHA256
+        // of the signable bytes is the actual ECDSA message digest.
+        let data_hash = double_sha(&data);
+        let digest: [u8; 32] = data_hash
+            .as_slice()
+            .try_into()
+            .map_err(|_| ProtocolError::Generic("double_sha did not return 32 bytes".to_string()))?;
+
+        let (signature, public_key) = signer
+            .sign_ecdsa(path, digest)
+            .await
+            .map_err(|e| ProtocolError::ExternalSignerError(format!("signer failed: {}", e)))?;
+
+        // The signer returns a non-recoverable signature. The legacy path
+        // stores a 65-byte recoverable compact signature, so we brute-force
+        // the recovery id (0..3) by reconstructing a `RecoverableSignature`
+        // and comparing the recovered public key with the one the signer
+        // returned. secp256k1 normalises both `sign_ecdsa` and
+        // `sign_ecdsa_recoverable` outputs to low-s form, so the 64-byte
+        // `r||s` payload is bit-identical to what `dashcore::signer::sign`
+        // produces.
+        let compact_64 = signature.serialize_compact();
+        let secp = Secp256k1::new();
+        let msg = Message::from_digest(digest);
+
+        let mut found: Option<RecoverableSignature> = None;
+        for id in 0..4i32 {
+            let recid = match RecoveryId::try_from(id) {
+                Ok(r) => r,
+                Err(_) => continue,
+            };
+            let candidate = match RecoverableSignature::from_compact(&compact_64, recid) {
+                Ok(s) => s,
+                Err(_) => continue,
+            };
+            if let Ok(recovered) = secp.recover_ecdsa(&msg, &candidate) {
+                if recovered == public_key {
+                    found = Some(candidate);
+                    break;
+                }
+            }
+        }
+        let recoverable = found.ok_or_else(|| {
+            // Invariant violation by a non-conformant signer: the
+            // signature returned does not correspond to the public
+            // key the signer claims. Surface as ExternalSignerError
+            // (NOT Generic) so callers can distinguish signer-side
+            // failures from protocol-level invariants.
+            ProtocolError::ExternalSignerError(
+                "signer returned a signature whose recovery id does not match the returned public key".to_string(),
+            )
+        })?;
+
+        // Compressed-pubkey convention matches `dashcore::signer::sign`, which
+        // always passes `true` regardless of the underlying key encoding. The
+        // signer's `sign_ecdsa` returns the compressed `secp256k1::PublicKey`,
+        // so this is consistent.
+        let compact_65 = recoverable.to_compact_signature(true);
+
+        if !self.set_signature(compact_65.to_vec().into()) {
+            return Err(ProtocolError::InvalidVerificationWrongNumberOfElements {
+                needed: self.required_number_of_private_keys(),
+                using: 1,
+                msg: "failed to set ECDSA signature",
+            });
+        }
+        Ok(())
+    }
+
     #[cfg(feature = "state-transition-validation")]
     fn verify_by_raw_public_key<T: BlsModule>(
         &self,
@@ -3120,4 +3244,128 @@ mod tests {
             .unique_identifiers()
             .is_empty());
     }
+
+    // -----------------------------------------------------------------------
+    // sign_with_signer byte-parity test
+    //
+    // Proves that `StateTransition::sign_with_signer` produces a byte-identical
+    // signature to the legacy `sign_by_private_key` ECDSA path when both are
+    // driven by the same underlying secret. This is the on-wire contract the
+    // Swift / external-signer flow depends on: changing the digest pre-image
+    // or the recoverable-compact encoding would silently break asset-lock
+    // verification on testnet/mainnet, so we pin both shapes here.
+    // -----------------------------------------------------------------------
+    #[cfg(all(
+        feature = "state-transition-signing",
+        feature = "core_key_wallet",
+        feature = "bls-signatures"
+    ))]
+    #[tokio::test]
+    async fn sign_with_signer_matches_sign_by_private_key_byte_for_byte() {
+        use async_trait::async_trait;
+        use dashcore::secp256k1::{
+            ecdsa, rand::rngs::OsRng, Message, PublicKey, Secp256k1, SecretKey,
+        };
+        use key_wallet::bip32::DerivationPath;
+        use key_wallet::signer::{Signer as KwSigner, SignerMethod};
+
+        /// Fixed-key in-memory signer used only by this test. Mirrors how a
+        /// real KeychainSigner would behave: derive once, sign atomically,
+        /// return non-recoverable `(Signature, PublicKey)`. The path is
+        /// ignored — the wrapper holds exactly one key.
+        #[derive(Debug)]
+        struct FixedKeySigner {
+            secret: SecretKey,
+            public: PublicKey,
+        }
+
+        #[async_trait]
+        impl KwSigner for FixedKeySigner {
+            type Error = String;
+
+            fn supported_methods(&self) -> &[SignerMethod] {
+                &[SignerMethod::Digest]
+            }
+
+            async fn sign_ecdsa(
+                &self,
+                _path: &DerivationPath,
+                sighash: [u8; 32],
+            ) -> Result<(ecdsa::Signature, PublicKey), Self::Error> {
+                let secp = Secp256k1::new();
+                let msg = Message::from_digest(sighash);
+                let sig = secp.sign_ecdsa(&msg, &self.secret);
+                Ok((sig, self.public))
+            }
+
+            async fn public_key(
+                &self,
+                _path: &DerivationPath,
+            ) -> Result<PublicKey, Self::Error> {
+                Ok(self.public)
+            }
+        }
+
+        // Generate a single random key. Using the same key on both sides is
+        // load-bearing: the legacy path signs raw bytes, the signer path
+        // derives + signs inside the trust boundary. If the digest pre-image
+        // or compact-encoding differs, the bytes will diverge.
+        let secp = Secp256k1::new();
+        let (secret_key, public_key) = secp.generate_keypair(&mut OsRng);
+        let private_key_bytes = secret_key.secret_bytes();
+
+        let signer = FixedKeySigner {
+            secret: secret_key,
+            public: public_key,
+        };
+        let path = DerivationPath::default();
+
+        // Use a sample state transition that exercises signable_bytes() —
+        // any signable ST works since we're only comparing the signature
+        // bytes the two paths produce over the SAME `signable_bytes()`.
+        let mut st_legacy = sample_transfer_st();
+        let mut st_signer = sample_transfer_st();
+
+        // Sanity: both copies must have identical signable_bytes before signing.
+        assert_eq!(
+            st_legacy.signable_bytes().expect("legacy signable_bytes"),
+            st_signer.signable_bytes().expect("signer signable_bytes"),
+            "signable_bytes pre-image must match across copies"
+        );
+
+        // Legacy path: raw &[u8] private key → 65-byte recoverable compact.
+        // BLS is only used by `sign_by_private_key` when key_type is BLS12_381 —
+        // for the ECDSA path it's unused, but the function signature requires
+        // it, so we pass the NativeBlsModule that's already in the workspace.
+        let bls = crate::bls::native_bls::NativeBlsModule;
+        st_legacy
+            .sign_by_private_key(&private_key_bytes, KeyType::ECDSA_HASH160, &bls)
+            .expect("sign_by_private_key");
+
+        // New signer-driven path: digest → external signer → recovered →
+        // 65-byte recoverable compact. Byte-identical to the legacy result.
+        st_signer
+            .sign_with_signer(&path, &signer)
+            .await
+            .expect("sign_with_signer");
+
+        let sig_legacy = st_legacy.signature().expect("legacy signature set");
+        let sig_signer = st_signer.signature().expect("signer signature set");
+
+        assert_eq!(
+            sig_legacy.as_slice().len(),
+            65,
+            "legacy ECDSA signature must be 65 bytes (recoverable compact)"
+        );
+        assert_eq!(
+            sig_signer.as_slice().len(),
+            65,
+            "signer ECDSA signature must be 65 bytes (recoverable compact)"
+        );
+        assert_eq!(
+            sig_legacy.as_slice(),
+            sig_signer.as_slice(),
+            "sign_with_signer must produce byte-identical output to sign_by_private_key"
+        );
+    }
 }
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/mod.rs
index 8f622bbd0ba..d5bc5a345a0 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/mod.rs
@@ -24,7 +24,7 @@ use crate::version::PlatformVersion;
 use crate::{BlsModule, ProtocolError};
 impl IdentityCreateTransitionMethodsV0 for IdentityCreateTransition {
     #[cfg(feature = "state-transition-signing")]
-    async fn try_from_identity_with_signer<S: Signer<IdentityPublicKey>>(
+    async fn try_from_identity_with_signer_and_private_key<S: Signer<IdentityPublicKey>>(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -38,18 +38,58 @@ impl IdentityCreateTransitionMethodsV0 for IdentityCreateTransition {
             .state_transition_conversion_versions
             .identity_to_identity_create_transition_with_signer
         {
-            0 => Ok(IdentityCreateTransitionV0::try_from_identity_with_signer(
+            0 => Ok(
+                IdentityCreateTransitionV0::try_from_identity_with_signer_and_private_key(
+                    identity,
+                    asset_lock_proof,
+                    asset_lock_proof_private_key,
+                    signer,
+                    bls,
+                    user_fee_increase,
+                    platform_version,
+                )
+                .await?,
+            ),
+            v => Err(ProtocolError::UnknownVersionError(format!(
+                "Unknown IdentityCreateTransition version for try_from_identity_with_signer_and_private_key {v}"
+            ))),
+        }
+    }
+
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    #[allow(clippy::too_many_arguments)]
+    async fn try_from_identity_with_signers<IS, AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        identity_signer: &IS,
+        asset_lock_signer: &AS,
+        bls: &impl BlsModule,
+        user_fee_increase: UserFeeIncrease,
+        platform_version: &PlatformVersion,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        IS: Signer<IdentityPublicKey>,
+        AS: ::key_wallet::signer::Signer,
+    {
+        match platform_version
+            .dpp
+            .state_transition_conversion_versions
+            .identity_to_identity_create_transition_with_signer
+        {
+            0 => Ok(IdentityCreateTransitionV0::try_from_identity_with_signers(
                 identity,
                 asset_lock_proof,
-                asset_lock_proof_private_key,
-                signer,
+                asset_lock_proof_path,
+                identity_signer,
+                asset_lock_signer,
                 bls,
                 user_fee_increase,
                 platform_version,
             )
             .await?),
             v => Err(ProtocolError::UnknownVersionError(format!(
-                "Unknown IdentityCreateTransition version for try_from_identity_with_signer {v}"
+                "Unknown IdentityCreateTransition version for try_from_identity_with_signers {v}"
             ))),
         }
     }
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/v0/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/v0/mod.rs
index 561feb305a1..e34d05dc195 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/v0/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/methods/v0/mod.rs
@@ -17,8 +17,21 @@ use crate::{BlsModule, ProtocolError};
 use platform_version::version::PlatformVersion;
 
 pub trait IdentityCreateTransitionMethodsV0 {
+    /// Build an `IdentityCreate` state transition that holds the
+    /// asset-lock-proof private key in-process.
+    ///
+    /// The `signer` parameter signs each `IdentityPublicKey` witness (the
+    /// per-key signatures in `public_keys[]`), while the asset-lock-proof
+    /// signature on the outer state transition is produced from
+    /// `asset_lock_proof_private_key` via [`StateTransition::sign_by_private_key`].
+    ///
+    /// Prefer [`Self::try_from_identity_with_signers`] when the asset-lock
+    /// key lives outside Rust (Swift / hardware wallet / HSM): the
+    /// `_with_signers` variant routes asset-lock signing through an external
+    /// [`key_wallet::signer::Signer`] so the private key never crosses the FFI
+    /// boundary as raw bytes.
     #[cfg(feature = "state-transition-signing")]
-    async fn try_from_identity_with_signer<S: Signer<IdentityPublicKey>>(
+    async fn try_from_identity_with_signer_and_private_key<S: Signer<IdentityPublicKey>>(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -27,6 +40,33 @@ pub trait IdentityCreateTransitionMethodsV0 {
         user_fee_increase: UserFeeIncrease,
         platform_version: &PlatformVersion,
     ) -> Result<StateTransition, ProtocolError>;
+
+    /// Build an `IdentityCreate` state transition where the asset-lock-proof
+    /// signature is produced by an external [`key_wallet::signer::Signer`].
+    ///
+    /// `identity_signer` signs the per-key witnesses on `public_keys[]` (same
+    /// as the legacy `try_from_identity_with_signer_and_private_key` path),
+    /// while `asset_lock_signer` produces the outer state-transition ECDSA
+    /// signature for the key at `asset_lock_proof_path` — atomically deriving,
+    /// signing, and zeroising inside the signer's trust boundary. This is the
+    /// signing path used by hosts that hold their private keys outside Rust
+    /// (the iOS Swift SDK, hardware wallets, remote signers).
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    #[allow(clippy::too_many_arguments)]
+    async fn try_from_identity_with_signers<IS, AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        identity_signer: &IS,
+        asset_lock_signer: &AS,
+        bls: &impl BlsModule,
+        user_fee_increase: UserFeeIncrease,
+        platform_version: &PlatformVersion,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        IS: Signer<IdentityPublicKey>,
+        AS: ::key_wallet::signer::Signer;
+
     /// Get State Transition type
     fn get_type() -> StateTransitionType;
 }
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs
index 2a342b2b8d1..aff792b794f 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_create_transition/v0/v0_methods.rs
@@ -35,7 +35,7 @@ use crate::state_transition::StateTransition;
 use crate::version::PlatformVersion;
 impl IdentityCreateTransitionMethodsV0 for IdentityCreateTransitionV0 {
     #[cfg(feature = "state-transition-signing")]
-    async fn try_from_identity_with_signer<S: Signer<IdentityPublicKey>>(
+    async fn try_from_identity_with_signer_and_private_key<S: Signer<IdentityPublicKey>>(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -44,18 +44,79 @@ impl IdentityCreateTransitionMethodsV0 for IdentityCreateTransitionV0 {
         user_fee_increase: UserFeeIncrease,
         _platform_version: &PlatformVersion,
     ) -> Result<StateTransition, ProtocolError> {
+        let public_keys = identity
+            .public_keys()
+            .values()
+            .map(|public_key| public_key.clone().into())
+            .collect();
+        let identity_id = asset_lock_proof.create_identifier()?;
+
         let mut identity_create_transition = IdentityCreateTransitionV0 {
+            public_keys,
+            asset_lock_proof,
             user_fee_increase,
+            identity_id,
             ..Default::default()
         };
+
+        //todo: remove clone
+        let state_transition: StateTransition = identity_create_transition.clone().into();
+
+        let key_signable_bytes = state_transition.signable_bytes()?;
+
+        for (public_key_with_witness, (_, public_key)) in identity_create_transition
+            .public_keys
+            .iter_mut()
+            .zip(identity.public_keys().iter())
+        {
+            if public_key.key_type().is_unique_key_type() {
+                let signature = signer.sign(public_key, &key_signable_bytes).await?;
+                public_key_with_witness.set_signature(signature);
+            }
+        }
+
+        let mut state_transition: StateTransition = identity_create_transition.into();
+
+        state_transition.sign_by_private_key(asset_lock_proof_private_key, ECDSA_HASH160, bls)?;
+
+        Ok(state_transition)
+    }
+
+    /// Signer-driven counterpart to
+    /// [`Self::try_from_identity_with_signer_and_private_key`]: the
+    /// asset-lock-proof signature is produced by an external
+    /// [`key_wallet::signer::Signer`] rather than from a raw
+    /// `&[u8]` private key. See trait docs for the architectural rationale.
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    #[allow(clippy::too_many_arguments)]
+    async fn try_from_identity_with_signers<IS, AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        identity_signer: &IS,
+        asset_lock_signer: &AS,
+        _bls: &impl BlsModule,
+        user_fee_increase: UserFeeIncrease,
+        _platform_version: &PlatformVersion,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        IS: Signer<IdentityPublicKey>,
+        AS: ::key_wallet::signer::Signer,
+    {
         let public_keys = identity
             .public_keys()
             .values()
             .map(|public_key| public_key.clone().into())
             .collect();
-        identity_create_transition.set_public_keys(public_keys);
+        let identity_id = asset_lock_proof.create_identifier()?;
 
-        identity_create_transition.set_asset_lock_proof(asset_lock_proof)?;
+        let mut identity_create_transition = IdentityCreateTransitionV0 {
+            public_keys,
+            asset_lock_proof,
+            user_fee_increase,
+            identity_id,
+            ..Default::default()
+        };
 
         //todo: remove clone
         let state_transition: StateTransition = identity_create_transition.clone().into();
@@ -68,14 +129,19 @@ impl IdentityCreateTransitionMethodsV0 for IdentityCreateTransitionV0 {
             .zip(identity.public_keys().iter())
         {
             if public_key.key_type().is_unique_key_type() {
-                let signature = signer.sign(public_key, &key_signable_bytes).await?;
+                let signature = identity_signer.sign(public_key, &key_signable_bytes).await?;
                 public_key_with_witness.set_signature(signature);
             }
         }
 
         let mut state_transition: StateTransition = identity_create_transition.into();
 
-        state_transition.sign_by_private_key(asset_lock_proof_private_key, ECDSA_HASH160, bls)?;
+        // Atomic derive + sign + zeroise happens inside the signer. The host
+        // never sees a raw private key — only a 32-byte digest goes in and a
+        // serialised signature comes out.
+        state_transition
+            .sign_with_signer(asset_lock_proof_path, asset_lock_signer)
+            .await?;
 
         Ok(state_transition)
     }
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/mod.rs
index 243117c2945..5053cecac77 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/mod.rs
@@ -21,7 +21,7 @@ use platform_version::version::PlatformVersion;
 
 impl IdentityTopUpTransitionMethodsV0 for IdentityTopUpTransition {
     #[cfg(feature = "state-transition-signing")]
-    fn try_from_identity(
+    fn try_from_identity_with_private_key(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -35,16 +35,53 @@ impl IdentityTopUpTransitionMethodsV0 for IdentityTopUpTransition {
                 .state_transition_conversion_versions
                 .identity_to_identity_top_up_transition,
         ) {
-            0 => Ok(IdentityTopUpTransitionV0::try_from_identity(
+            0 => Ok(
+                IdentityTopUpTransitionV0::try_from_identity_with_private_key(
+                    identity,
+                    asset_lock_proof,
+                    asset_lock_proof_private_key,
+                    user_fee_increase,
+                    platform_version,
+                    version,
+                )?,
+            ),
+            v => Err(ProtocolError::UnknownVersionError(format!(
+                "Unknown IdentityTopUpTransition version for try_from_identity_with_private_key {v}"
+            ))),
+        }
+    }
+
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    async fn try_from_identity_with_signer<AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        user_fee_increase: UserFeeIncrease,
+        platform_version: &PlatformVersion,
+        version: Option<FeatureVersion>,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        AS: ::key_wallet::signer::Signer,
+    {
+        match version.unwrap_or(
+            platform_version
+                .dpp
+                .state_transition_conversion_versions
+                .identity_to_identity_top_up_transition,
+        ) {
+            0 => Ok(IdentityTopUpTransitionV0::try_from_identity_with_signer(
                 identity,
                 asset_lock_proof,
-                asset_lock_proof_private_key,
+                asset_lock_proof_path,
+                asset_lock_signer,
                 user_fee_increase,
                 platform_version,
                 version,
-            )?),
+            )
+            .await?),
             v => Err(ProtocolError::UnknownVersionError(format!(
-                "Unknown IdentityTopUpTransition version for try_from_identity {v}"
+                "Unknown IdentityTopUpTransition version for try_from_identity_with_signer {v}"
             ))),
         }
     }
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/v0/mod.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/v0/mod.rs
index d314b9325a7..d20032c799f 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/v0/mod.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/methods/v0/mod.rs
@@ -11,8 +11,17 @@ use crate::ProtocolError;
 use platform_version::version::{FeatureVersion, PlatformVersion};
 
 pub trait IdentityTopUpTransitionMethodsV0 {
+    /// Build an `IdentityTopUp` state transition whose asset-lock-proof
+    /// signature is produced from a raw `asset_lock_proof_private_key` held
+    /// in-process.
+    ///
+    /// Prefer [`Self::try_from_identity_with_signer`] when the asset-lock key
+    /// lives outside Rust (Swift / hardware wallet / HSM): the `_with_signer`
+    /// variant routes asset-lock signing through an external
+    /// [`key_wallet::signer::Signer`] so the private key never crosses the
+    /// FFI boundary as raw bytes.
     #[cfg(feature = "state-transition-signing")]
-    fn try_from_identity(
+    fn try_from_identity_with_private_key(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -21,6 +30,25 @@ pub trait IdentityTopUpTransitionMethodsV0 {
         version: Option<FeatureVersion>,
     ) -> Result<StateTransition, ProtocolError>;
 
+    /// Build an `IdentityTopUp` state transition whose asset-lock-proof
+    /// signature is produced by an external [`key_wallet::signer::Signer`].
+    ///
+    /// The signer atomically derives, signs, and zeroises the key at
+    /// `asset_lock_proof_path` inside its own trust boundary — the host only
+    /// sees a 32-byte digest and the resulting Core-ECDSA signature.
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    async fn try_from_identity_with_signer<AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        user_fee_increase: UserFeeIncrease,
+        platform_version: &PlatformVersion,
+        version: Option<FeatureVersion>,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        AS: ::key_wallet::signer::Signer;
+
     /// Get State Transition type
     fn get_type() -> StateTransitionType {
         StateTransitionType::IdentityTopUp
diff --git a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/v0/v0_methods.rs b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/v0/v0_methods.rs
index da2b8f680b3..ccd4c06edec 100644
--- a/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/v0/v0_methods.rs
+++ b/packages/rs-dpp/src/state_transition/state_transitions/identity/identity_topup_transition/v0/v0_methods.rs
@@ -26,7 +26,7 @@ use crate::version::FeatureVersion;
 
 impl IdentityTopUpTransitionMethodsV0 for IdentityTopUpTransitionV0 {
     #[cfg(feature = "state-transition-signing")]
-    fn try_from_identity(
+    fn try_from_identity_with_private_key(
         identity: &Identity,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &[u8],
@@ -50,6 +50,41 @@ impl IdentityTopUpTransitionMethodsV0 for IdentityTopUpTransitionV0 {
 
         Ok(state_transition)
     }
+
+    /// Signer-driven counterpart to [`Self::try_from_identity_with_private_key`].
+    /// The asset-lock-proof signature is produced by `asset_lock_signer` via
+    /// [`StateTransition::sign_with_signer`], which performs the same
+    /// double-SHA256 + recoverable-compact serialisation as the legacy
+    /// `dashcore::signer::sign` path — so the resulting state transition is
+    /// bit-identical on the wire.
+    #[cfg(all(feature = "state-transition-signing", feature = "core_key_wallet"))]
+    async fn try_from_identity_with_signer<AS>(
+        identity: &Identity,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        user_fee_increase: UserFeeIncrease,
+        _platform_version: &PlatformVersion,
+        _version: Option<FeatureVersion>,
+    ) -> Result<StateTransition, ProtocolError>
+    where
+        AS: ::key_wallet::signer::Signer,
+    {
+        let identity_top_up_transition = IdentityTopUpTransitionV0 {
+            asset_lock_proof,
+            identity_id: identity.id(),
+            user_fee_increase,
+            signature: Default::default(),
+        };
+
+        let mut state_transition: StateTransition = identity_top_up_transition.into();
+
+        state_transition
+            .sign_with_signer(asset_lock_proof_path, asset_lock_signer)
+            .await?;
+
+        Ok(state_transition)
+    }
 }
 
 impl IdentityTopUpTransitionAccessorsV0 for IdentityTopUpTransitionV0 {
diff --git a/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs b/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
index 522bba25dd9..1df1e0dfa87 100644
--- a/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
+++ b/packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
@@ -2318,7 +2318,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -2516,7 +2516,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -2561,7 +2561,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity,
                 asset_lock_proof_top_up,
                 pk.as_slice(),
@@ -2666,7 +2666,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -2711,7 +2711,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity,
                 asset_lock_proof_top_up,
                 pk.as_slice(),
@@ -2856,7 +2856,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity,
                 asset_lock_proof_top_up,
                 pk.as_slice(),
@@ -2952,7 +2952,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -2997,7 +2997,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity,
                 asset_lock_proof_top_up.clone(),
                 pk.as_slice(),
@@ -3068,7 +3068,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof_top_up,
                 pk.as_slice(),
@@ -3182,7 +3182,7 @@ mod tests {
         .into();
 
         let mut identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof.clone(),
                 pk.as_slice(),
@@ -3260,7 +3260,7 @@ mod tests {
         ));
 
         let valid_identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -3302,7 +3302,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity,
                 asset_lock_proof_top_up.clone(),
                 pk.as_slice(),
@@ -3373,7 +3373,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof_top_up,
                 pk.as_slice(),
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/address_funding_from_asset_lock/tests.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/address_funding_from_asset_lock/tests.rs
index bb7f1a57f9c..d87640b2381 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/address_funding_from_asset_lock/tests.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/address_funding_from_asset_lock/tests.rs
@@ -8224,7 +8224,7 @@ mod tests {
             .into();
 
             let identity_create_transition: StateTransition =
-                IdentityCreateTransition::try_from_identity_with_signer(
+                IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                     &identity_to_fail,
                     asset_lock_proof.clone(),
                     pk.as_slice(),
@@ -8440,7 +8440,7 @@ mod tests {
             .into();
 
             let identity_create_transition: StateTransition =
-                IdentityCreateTransition::try_from_identity_with_signer(
+                IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                     &identity,
                     asset_lock_proof.clone(),
                     pk.as_slice(),
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs
index 3ad20f558cf..a15e1695c74 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs
@@ -281,7 +281,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -395,7 +395,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -551,7 +551,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof.clone(),
                 pk.as_slice(),
@@ -616,7 +616,7 @@ mod tests {
         ]));
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -775,7 +775,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof.clone(),
                 pk.as_slice(),
@@ -840,7 +840,7 @@ mod tests {
         ]));
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -1010,7 +1010,7 @@ mod tests {
             .into();
 
             let identity_create_transition: StateTransition =
-                IdentityCreateTransition::try_from_identity_with_signer(
+                IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                     &identity,
                     asset_lock_proof.clone(),
                     pk.as_slice(),
@@ -1078,7 +1078,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -1246,7 +1246,7 @@ mod tests {
             .into();
 
             let identity_create_transition: StateTransition =
-                IdentityCreateTransition::try_from_identity_with_signer(
+                IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                     &identity,
                     asset_lock_proof.clone(),
                     pk.as_slice(),
@@ -1314,7 +1314,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -1466,7 +1466,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof.clone(),
                 pk.as_slice(),
@@ -1556,7 +1556,7 @@ mod tests {
         ]));
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -1715,7 +1715,7 @@ mod tests {
         .into();
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof.clone(),
                 pk.as_slice(),
@@ -1805,7 +1805,7 @@ mod tests {
         ]));
 
         let identity_create_transition: StateTransition =
-            IdentityCreateTransition::try_from_identity_with_signer(
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 pk.as_slice(),
diff --git a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
index db335addf55..ce077429841 100644
--- a/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
+++ b/packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_top_up/mod.rs
@@ -202,7 +202,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity_already_in_system,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -332,7 +332,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity_already_in_system,
                 asset_lock_proof,
                 pk.as_slice(),
@@ -449,7 +449,7 @@ mod tests {
         );
 
         let identity_top_up_transition: StateTransition =
-            IdentityTopUpTransition::try_from_identity(
+            IdentityTopUpTransition::try_from_identity_with_private_key(
                 &identity_not_in_system,
                 asset_lock_proof,
                 pk.as_slice(),
diff --git a/packages/rs-drive-abci/tests/strategy_tests/strategy.rs b/packages/rs-drive-abci/tests/strategy_tests/strategy.rs
index 82a7374d9d1..0bfee8c03b4 100644
--- a/packages/rs-drive-abci/tests/strategy_tests/strategy.rs
+++ b/packages/rs-drive-abci/tests/strategy_tests/strategy.rs
@@ -2217,7 +2217,7 @@ impl NetworkStrategy {
                 .expect("failed to sign transaction for instant lock");
         }
 
-        IdentityTopUpTransition::try_from_identity(
+        IdentityTopUpTransition::try_from_identity_with_private_key(
             identity,
             asset_lock_proof,
             secret_key.as_ref(),
diff --git a/packages/rs-platform-wallet-ffi/Cargo.toml b/packages/rs-platform-wallet-ffi/Cargo.toml
index db2a2ebb31e..22ca8d2bc85 100644
--- a/packages/rs-platform-wallet-ffi/Cargo.toml
+++ b/packages/rs-platform-wallet-ffi/Cargo.toml
@@ -12,7 +12,7 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 [dependencies]
 platform-wallet = { path = "../rs-platform-wallet" }
 dpp = { path = "../rs-dpp" }
-dash-sdk = { path = "../rs-sdk" }
+dash-sdk = { path = "../rs-sdk", features = ["wallet"] }
 # Needed for `SignerHandle` + `VTableSigner` so the `*_with_signer`
 # entry points can accept iOS-side keychain-backed signers without
 # duplicating the vtable plumbing. See `signer.rs` in rs-sdk-ffi.
diff --git a/packages/rs-platform-wallet-ffi/src/asset_lock/build.rs b/packages/rs-platform-wallet-ffi/src/asset_lock/build.rs
index 1bb8c5fe286..f5ffc83dcc4 100644
--- a/packages/rs-platform-wallet-ffi/src/asset_lock/build.rs
+++ b/packages/rs-platform-wallet-ffi/src/asset_lock/build.rs
@@ -1,45 +1,85 @@
 //! FFI bindings for asset lock transaction building.
-
+//!
+//! These entry points are signer-driven: the asset-lock build path
+//! never sees a raw credit-output private key. Instead the caller
+//! supplies a [`MnemonicResolverHandle`] (the same vtable used by
+//! `dash_sdk_sign_with_mnemonic_resolver_and_path`); the FFI wraps
+//! it in a [`MnemonicResolverCoreSigner`] for the lifetime of the
+//! call and returns the credit-output derivation path as a C
+//! string. Callers later hand the path back to the same resolver
+//! when consuming the asset lock on Platform.
+
+use rs_sdk_ffi::MnemonicResolverHandle;
 use crate::error::*;
 use crate::handle::*;
+use rs_sdk_ffi::MnemonicResolverCoreSigner;
 use crate::runtime::runtime;
 use crate::{check_ptr, unwrap_option_or_return, unwrap_result_or_return};
+use std::ffi::CString;
+use std::os::raw::c_char;
 
-/// Build an asset lock transaction.
+/// Build an asset lock transaction via an external mnemonic resolver.
 ///
 /// On success:
 /// - `out_tx_bytes`/`out_tx_len`: serialized signed transaction
-/// - `out_private_key`: 32-byte one-time private key
+/// - `out_derivation_path`: NUL-terminated C string with the
+///   credit-output derivation path (e.g. `m/9'/1'/5'/0'/0'/3'/0'`).
+///   Free with `platform_wallet_string_free`.
 ///
 /// Free tx bytes with `asset_lock_manager_free_tx_bytes`.
+///
+/// # Safety
+/// - `core_signer_handle` must be a valid, non-destroyed
+///   `*mut MnemonicResolverHandle` produced by
+///   [`crate::dash_sdk_mnemonic_resolver_create`]. The caller retains
+///   ownership; this function does NOT destroy it.
 #[no_mangle]
+#[allow(clippy::too_many_arguments)]
 pub unsafe extern "C" fn asset_lock_manager_build_transaction(
     handle: Handle,
     amount_duffs: u64,
     account_index: u32,
     funding_type: u32,
     identity_index: u32,
+    core_signer_handle: *mut MnemonicResolverHandle,
     out_tx_bytes: *mut *mut u8,
     out_tx_len: *mut usize,
-    out_private_key: *mut [u8; 32],
+    out_derivation_path: *mut *mut c_char,
 ) -> PlatformWalletFFIResult {
+    check_ptr!(core_signer_handle);
     check_ptr!(out_tx_bytes);
     check_ptr!(out_tx_len);
-    check_ptr!(out_private_key);
+    check_ptr!(out_derivation_path);
 
     let option = parse_funding_type(funding_type);
     let funding = unwrap_option_or_return!(option);
 
+    let signer_addr = core_signer_handle as usize;
+
     let option = ASSET_LOCK_MANAGER_STORAGE.with_item(handle, |manager| {
+        let wallet_id = manager.wallet_id();
+        let network = manager.network();
+        // SAFETY: `signer_addr` came from `core_signer_handle` which
+        // the caller pinned alive for this call (see fn-level safety
+        // doc). The `MnemonicResolverCoreSigner` lives only on this
+        // stack frame and is dropped before the function returns.
+        let signer = unsafe {
+            MnemonicResolverCoreSigner::new(
+                signer_addr as *mut MnemonicResolverHandle,
+                wallet_id,
+                network,
+            )
+        };
         runtime().block_on(manager.build_asset_lock_transaction(
             amount_duffs,
             account_index,
             funding,
             identity_index,
+            &signer,
         ))
     });
     let result = unwrap_option_or_return!(option);
-    let (tx, key) = unwrap_result_or_return!(result);
+    let (tx, path) = unwrap_result_or_return!(result);
 
     let serialized = dashcore::consensus::serialize(&tx);
     let len = serialized.len();
@@ -47,19 +87,28 @@ pub unsafe extern "C" fn asset_lock_manager_build_transaction(
 
     *out_tx_bytes = Box::into_raw(boxed) as *mut u8;
     *out_tx_len = len;
-    *out_private_key = key.inner.secret_bytes();
+    let path_c = unwrap_result_or_return!(CString::new(path.to_string()));
+    *out_derivation_path = path_c.into_raw();
 
     PlatformWalletFFIResult::ok()
 }
 
-/// Build, broadcast, and wait for an asset lock proof.
+/// Build, broadcast, and wait for an asset lock proof via an
+/// external mnemonic resolver.
 ///
 /// On success:
 /// - `out_proof_bytes`/`out_proof_len`: bincode-encoded AssetLockProof
-/// - `out_private_key`: 32-byte one-time private key
+/// - `out_derivation_path`: NUL-terminated C string with the
+///   credit-output derivation path. Free with
+///   `platform_wallet_string_free`.
 /// - `out_txid`: 32-byte transaction ID
 ///
 /// Free proof bytes with `asset_lock_manager_free_proof_bytes`.
+///
+/// # Safety
+/// - `core_signer_handle` must be a valid, non-destroyed
+///   `*mut MnemonicResolverHandle`. Ownership is retained by the
+///   caller.
 #[no_mangle]
 #[allow(clippy::too_many_arguments)]
 pub unsafe extern "C" fn asset_lock_manager_create_funded_proof(
@@ -68,28 +117,42 @@ pub unsafe extern "C" fn asset_lock_manager_create_funded_proof(
     account_index: u32,
     funding_type: u32,
     identity_index: u32,
+    core_signer_handle: *mut MnemonicResolverHandle,
     out_proof_bytes: *mut *mut u8,
     out_proof_len: *mut usize,
-    out_private_key: *mut [u8; 32],
+    out_derivation_path: *mut *mut c_char,
     out_txid: *mut [u8; 32],
 ) -> PlatformWalletFFIResult {
+    check_ptr!(core_signer_handle);
     check_ptr!(out_proof_bytes);
     check_ptr!(out_proof_len);
-    check_ptr!(out_private_key);
+    check_ptr!(out_derivation_path);
     check_ptr!(out_txid);
 
     let funding = unwrap_option_or_return!(parse_funding_type(funding_type));
 
+    let signer_addr = core_signer_handle as usize;
+
     let option = ASSET_LOCK_MANAGER_STORAGE.with_item(handle, |manager| {
+        let wallet_id = manager.wallet_id();
+        let network = manager.network();
+        let signer = unsafe {
+            MnemonicResolverCoreSigner::new(
+                signer_addr as *mut MnemonicResolverHandle,
+                wallet_id,
+                network,
+            )
+        };
         runtime().block_on(manager.create_funded_asset_lock_proof(
             amount_duffs,
             account_index,
             funding,
             identity_index,
+            &signer,
         ))
     });
     let result = unwrap_option_or_return!(option);
-    let (proof, key, out_point) = unwrap_result_or_return!(result);
+    let (proof, path, out_point) = unwrap_result_or_return!(result);
 
     let bytes = unwrap_result_or_return!(dpp::bincode::encode_to_vec(
         &proof,
@@ -100,7 +163,8 @@ pub unsafe extern "C" fn asset_lock_manager_create_funded_proof(
     let boxed = bytes.into_boxed_slice();
     *out_proof_bytes = Box::into_raw(boxed) as *mut u8;
     *out_proof_len = len;
-    *out_private_key = key.inner.secret_bytes();
+    let path_c = unwrap_result_or_return!(CString::new(path.to_string()));
+    *out_derivation_path = path_c.into_raw();
     let mut txid_bytes = [0u8; 32];
     txid_bytes.copy_from_slice(&out_point.txid[..]);
     *out_txid = txid_bytes;
diff --git a/packages/rs-platform-wallet-ffi/src/asset_lock/manager.rs b/packages/rs-platform-wallet-ffi/src/asset_lock/manager.rs
index 1a031d9db46..4c79526cbf0 100644
--- a/packages/rs-platform-wallet-ffi/src/asset_lock/manager.rs
+++ b/packages/rs-platform-wallet-ffi/src/asset_lock/manager.rs
@@ -75,6 +75,7 @@ pub unsafe extern "C" fn asset_lock_manager_list_tracked_locks(
                         AssetLockStatus::Broadcast => 1,
                         AssetLockStatus::InstantSendLocked => 2,
                         AssetLockStatus::ChainLocked => 3,
+                        AssetLockStatus::Consumed => 4,
                     },
                     has_proof: lock.proof.is_some(),
                 }
diff --git a/packages/rs-platform-wallet-ffi/src/asset_lock/sync.rs b/packages/rs-platform-wallet-ffi/src/asset_lock/sync.rs
index 9ecc4069ed1..82f790a798a 100644
--- a/packages/rs-platform-wallet-ffi/src/asset_lock/sync.rs
+++ b/packages/rs-platform-wallet-ffi/src/asset_lock/sync.rs
@@ -4,8 +4,19 @@ use crate::error::*;
 use crate::handle::*;
 use crate::runtime::runtime;
 use crate::{check_ptr, unwrap_option_or_return, unwrap_result_or_return};
+use std::ffi::CString;
+use std::os::raw::c_char;
 use std::time::Duration;
 
+/// Build an `OutPoint` from a 32-byte raw txid pointer and a vout.
+///
+/// **FFI invariant:** the `txid` parameter is typed `*const [u8; 32]`,
+/// not `*const u8`. The `.expect("txid is 32 bytes")` below is sound
+/// *only* because the type system pins the length. If a future caller
+/// weakens the signature to `*const u8 + usize_len`, this panic
+/// becomes reachable across the FFI boundary and must be replaced
+/// with a fallible return. Don't relax the signature without
+/// hardening the body.
 fn parse_outpoint(txid: *const [u8; 32], vout: u32) -> dashcore::OutPoint {
     use dashcore::hashes::Hash;
     let txid_bytes = unsafe { *txid };
@@ -19,9 +30,18 @@ fn parse_outpoint(txid: *const [u8; 32], vout: u32) -> dashcore::OutPoint {
 ///
 /// On success:
 /// - `out_proof_bytes`/`out_proof_len`: bincode-encoded AssetLockProof
-/// - `out_private_key`: 32-byte one-time private key
+/// - `out_derivation_path`: NUL-terminated C string with the
+///   credit-output derivation path (free with
+///   `platform_wallet_string_free`).
 ///
 /// Free proof bytes with `asset_lock_manager_free_proof_bytes`.
+///
+/// Unlike `asset_lock_manager_create_funded_proof`, this entry point
+/// does **not** take a core signer handle — the resume path only
+/// re-derives the proof and the credit-output derivation path from
+/// the already-tracked lock state; signing the consume transition is
+/// the next stage's responsibility (e.g.
+/// [`crate::platform_wallet_register_identity_with_funding_signer`]).
 #[no_mangle]
 pub unsafe extern "C" fn asset_lock_manager_resume(
     handle: Handle,
@@ -30,12 +50,12 @@ pub unsafe extern "C" fn asset_lock_manager_resume(
     timeout_secs: u64,
     out_proof_bytes: *mut *mut u8,
     out_proof_len: *mut usize,
-    out_private_key: *mut [u8; 32],
+    out_derivation_path: *mut *mut c_char,
 ) -> PlatformWalletFFIResult {
     check_ptr!(txid);
     check_ptr!(out_proof_bytes);
     check_ptr!(out_proof_len);
-    check_ptr!(out_private_key);
+    check_ptr!(out_derivation_path);
 
     let out_point = parse_outpoint(txid, vout);
     let timeout = Duration::from_secs(timeout_secs);
@@ -44,7 +64,7 @@ pub unsafe extern "C" fn asset_lock_manager_resume(
         runtime().block_on(manager.resume_asset_lock(&out_point, timeout))
     });
     let result = unwrap_option_or_return!(option);
-    let (proof, key) = unwrap_result_or_return!(result);
+    let (proof, path) = unwrap_result_or_return!(result);
     let bytes = unwrap_result_or_return!(dpp::bincode::encode_to_vec(
         &proof,
         dpp::bincode::config::standard()
@@ -53,10 +73,82 @@ pub unsafe extern "C" fn asset_lock_manager_resume(
     let boxed = bytes.into_boxed_slice();
     *out_proof_bytes = Box::into_raw(boxed) as *mut u8;
     *out_proof_len = len;
-    *out_private_key = key.inner.secret_bytes();
+    let path_c = unwrap_result_or_return!(CString::new(path.to_string()));
+    *out_derivation_path = path_c.into_raw();
     PlatformWalletFFIResult::ok()
 }
 
+/// Fire-and-forget variant of [`asset_lock_manager_resume`] for the
+/// app-launch / app-foreground catch-up flow.
+///
+/// Calls `resume_asset_lock` internally and drops the returned
+/// `(proof, derivation_path)` tuple — the chain-lock cascade that
+/// `wait_for_proof` drives also queues an `AssetLockChangeSet` via
+/// `advance_asset_lock_status` that writes `statusRaw = 3 +
+/// proofBytes` back to SwiftData, which is the only payload the UI
+/// needs. There's no proof or path to plumb out, so the FFI surface
+/// stays free of out-params (and the matching free callbacks).
+///
+/// Returns `ok` on a successful proof resolution, an error on
+/// timeout / wait failure. The Swift caller is expected to schedule
+/// this on a background queue — `runtime().block_on(...)` parks the
+/// calling thread for up to `timeout_secs`.
+#[no_mangle]
+pub unsafe extern "C" fn asset_lock_manager_catch_up_blocking(
+    handle: Handle,
+    txid: *const [u8; 32],
+    vout: u32,
+    timeout_secs: u64,
+) -> PlatformWalletFFIResult {
+    check_ptr!(txid);
+
+    let out_point = parse_outpoint(txid, vout);
+    let timeout = Duration::from_secs(timeout_secs);
+
+    tracing::info!(
+        outpoint = %out_point,
+        timeout_secs,
+        "asset_lock_manager_catch_up_blocking: entered"
+    );
+
+    let option = ASSET_LOCK_MANAGER_STORAGE.with_item(handle, |manager| {
+        runtime().block_on(manager.resume_asset_lock(&out_point, timeout))
+    });
+    let result = match option {
+        Some(r) => r,
+        None => {
+            tracing::warn!(
+                outpoint = %out_point,
+                "asset_lock_manager_catch_up_blocking: invalid manager handle"
+            );
+            return PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorInvalidHandle,
+                "Manager handle invalid".to_string(),
+            );
+        }
+    };
+    match result {
+        Ok(_) => {
+            tracing::info!(
+                outpoint = %out_point,
+                "asset_lock_manager_catch_up_blocking: resume_asset_lock succeeded"
+            );
+            PlatformWalletFFIResult::ok()
+        }
+        Err(e) => {
+            tracing::warn!(
+                outpoint = %out_point,
+                error = %e,
+                "asset_lock_manager_catch_up_blocking: resume_asset_lock failed"
+            );
+            PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorWalletOperation,
+                format!("{}", e),
+            )
+        }
+    }
+}
+
 /// Recover a tracked asset lock from a serialized transaction.
 ///
 /// Re-tracks the asset lock in memory so it can be resumed later.
diff --git a/packages/rs-platform-wallet-ffi/src/asset_lock_persistence.rs b/packages/rs-platform-wallet-ffi/src/asset_lock_persistence.rs
new file mode 100644
index 00000000000..e9046788932
--- /dev/null
+++ b/packages/rs-platform-wallet-ffi/src/asset_lock_persistence.rs
@@ -0,0 +1,174 @@
+//! FFI types for forwarding
+//! [`AssetLockChangeSet`](platform_wallet::changeset::AssetLockChangeSet)
+//! out of [`FFIPersister`](crate::persistence::FFIPersister) to Swift.
+//!
+//! Mirrors the shape of the asset-lock changeset emitted by the
+//! [`AssetLockManager`](platform_wallet::wallet::asset_lock::AssetLockManager)
+//! at every status transition (Built → Broadcast → InstantSendLocked →
+//! ChainLocked) and on consumption. Swift maps each upsert onto a
+//! `PersistentAssetLock` row keyed by the outpoint and deletes rows
+//! for each removed outpoint.
+//!
+//! ## Ownership
+//!
+//! [`AssetLockEntryFFI`] points at Rust-owned byte buffers for the
+//! consensus-encoded transaction + the bincode-encoded proof. Both
+//! live in [`AssetLockEntryStorage`] for the callback window only —
+//! Swift must copy whatever bytes it needs before the callback
+//! returns. The storage Vec is dropped right after the FFI call, which
+//! releases the buffers.
+
+use bincode::config;
+use dashcore::consensus::Encodable;
+use dpp::prelude::AssetLockProof;
+use platform_wallet::changeset::AssetLockEntry;
+use platform_wallet::AssetLockStatus;
+
+/// Flat C mirror of one [`AssetLockEntry`].
+///
+/// The transaction is consensus-encoded; the optional proof is
+/// bincode-encoded with `dpp::bincode::config::standard()`. Both byte
+/// slices are Rust-owned for the lifetime of the callback and live in
+/// the matching [`AssetLockEntryStorage`].
+#[repr(C)]
+#[derive(Debug, Clone, Copy)]
+pub struct AssetLockEntryFFI {
+    /// Outpoint identifying this credit output: 32-byte txid (raw
+    /// internal byte order) followed by 4-byte little-endian vout.
+    /// Matches the serialization used by `PersistentTxo.outpoint`.
+    pub out_point: [u8; 36],
+    /// Consensus-encoded asset-lock transaction. Rust-owned, valid only
+    /// for the callback window.
+    pub transaction_bytes: *const u8,
+    pub transaction_bytes_len: usize,
+    /// BIP44 account index that funded this asset lock.
+    pub account_index: u32,
+    /// Discriminant of [`key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType`]:
+    /// 0 = IdentityRegistration, 1 = IdentityTopUp, 2 = IdentityTopUpNotBound,
+    /// 3 = IdentityInvitation, 4 = AssetLockAddressTopUp,
+    /// 5 = AssetLockShieldedAddressTopUp.
+    pub funding_type: u8,
+    /// Identity index used during creation.
+    pub identity_index: u32,
+    /// Locked amount in duffs (1 DASH = 1e8 duffs).
+    pub amount_duffs: u64,
+    /// Discriminant of [`AssetLockStatus`]:
+    /// 0 = Built, 1 = Broadcast, 2 = InstantSendLocked, 3 = ChainLocked.
+    pub status: u8,
+    /// Bincode-encoded [`AssetLockProof`] (standard config). Rust-owned,
+    /// `null` + `0` length when the entry has no proof yet (statuses
+    /// Built / Broadcast).
+    pub proof_bytes: *const u8,
+    pub proof_bytes_len: usize,
+}
+
+// SAFETY: All pointer fields are Rust-owned and lifetime-scoped to the
+// FFI callback. Sending the struct itself is fine; the receiver must
+// not retain pointers beyond the callback window.
+unsafe impl Send for AssetLockEntryFFI {}
+unsafe impl Sync for AssetLockEntryFFI {}
+
+/// Owned byte buffers backing one [`AssetLockEntryFFI`]'s pointer
+/// fields. Kept alive by the callback dispatcher for the callback
+/// window via a `Vec<AssetLockEntryStorage>` parallel to the
+/// `Vec<AssetLockEntryFFI>`.
+pub struct AssetLockEntryStorage {
+    pub transaction_bytes: Vec<u8>,
+    pub proof_bytes: Option<Vec<u8>>,
+}
+
+/// Build a `(Vec<AssetLockEntryFFI>, Vec<AssetLockEntryStorage>)` pair
+/// from the changeset entries. The storage Vec MUST live at least as
+/// long as the FFI Vec.
+pub fn build_asset_lock_entries(
+    entries: &[&AssetLockEntry],
+) -> (Vec<AssetLockEntryFFI>, Vec<AssetLockEntryStorage>) {
+    let mut storage: Vec<AssetLockEntryStorage> = Vec::with_capacity(entries.len());
+    let mut ffi: Vec<AssetLockEntryFFI> = Vec::with_capacity(entries.len());
+
+    for entry in entries {
+        let mut transaction_bytes: Vec<u8> = Vec::new();
+        // `Transaction::consensus_encode` returns `io::Result<usize>` and
+        // never fails when writing to a `Vec<u8>`; an Err here would
+        // mean a logic bug in `dashcore`, not bad input.
+        entry
+            .transaction
+            .consensus_encode(&mut transaction_bytes)
+            .expect("consensus_encode to Vec is infallible");
+
+        let proof_bytes: Option<Vec<u8>> = match &entry.proof {
+            Some(proof) => Some(
+                dpp::bincode::encode_to_vec::<&AssetLockProof, _>(proof, config::standard())
+                    .expect("bincode encoding AssetLockProof is infallible"),
+            ),
+            None => None,
+        };
+
+        let funding_type = funding_type_to_u8(entry.funding_type);
+        let status = status_to_u8(&entry.status);
+
+        storage.push(AssetLockEntryStorage {
+            transaction_bytes,
+            proof_bytes,
+        });
+
+        // Compute the pointers AFTER the storage push, then build the
+        // FFI entry referencing the just-pushed storage slot. Two
+        // Vecs grow independently so we cannot mix order — borrow the
+        // storage slot via index right after the push.
+        let slot = storage.last().expect("just pushed");
+        let (proof_ptr, proof_len) = match &slot.proof_bytes {
+            Some(bytes) => (bytes.as_ptr(), bytes.len()),
+            None => (std::ptr::null(), 0usize),
+        };
+
+        ffi.push(AssetLockEntryFFI {
+            out_point: outpoint_to_bytes(&entry.out_point),
+            transaction_bytes: slot.transaction_bytes.as_ptr(),
+            transaction_bytes_len: slot.transaction_bytes.len(),
+            account_index: entry.account_index,
+            funding_type,
+            identity_index: entry.identity_index,
+            amount_duffs: entry.amount_duffs,
+            status,
+            proof_bytes: proof_ptr,
+            proof_bytes_len: proof_len,
+        });
+    }
+
+    (ffi, storage)
+}
+
+/// Encode an [`OutPoint`](dashcore::OutPoint) as 36 bytes: 32-byte raw
+/// txid followed by 4-byte little-endian vout. Matches the encoding
+/// used by `PersistentTxo.outpoint`.
+pub fn outpoint_to_bytes(outpoint: &dashcore::OutPoint) -> [u8; 36] {
+    let mut bytes = [0u8; 36];
+    bytes[..32].copy_from_slice(outpoint.txid.as_ref());
+    bytes[32..].copy_from_slice(&outpoint.vout.to_le_bytes());
+    bytes
+}
+
+fn funding_type_to_u8(
+    funding_type: key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType,
+) -> u8 {
+    use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
+    match funding_type {
+        AssetLockFundingType::IdentityRegistration => 0,
+        AssetLockFundingType::IdentityTopUp => 1,
+        AssetLockFundingType::IdentityTopUpNotBound => 2,
+        AssetLockFundingType::IdentityInvitation => 3,
+        AssetLockFundingType::AssetLockAddressTopUp => 4,
+        AssetLockFundingType::AssetLockShieldedAddressTopUp => 5,
+    }
+}
+
+fn status_to_u8(status: &AssetLockStatus) -> u8 {
+    match status {
+        AssetLockStatus::Built => 0,
+        AssetLockStatus::Broadcast => 1,
+        AssetLockStatus::InstantSendLocked => 2,
+        AssetLockStatus::ChainLocked => 3,
+        AssetLockStatus::Consumed => 4,
+    }
+}
diff --git a/packages/rs-platform-wallet-ffi/src/core_wallet/broadcast.rs b/packages/rs-platform-wallet-ffi/src/core_wallet/broadcast.rs
index 8a2cafa5912..cf50b0e9235 100644
--- a/packages/rs-platform-wallet-ffi/src/core_wallet/broadcast.rs
+++ b/packages/rs-platform-wallet-ffi/src/core_wallet/broadcast.rs
@@ -1,7 +1,9 @@
 //! FFI bindings for CoreWallet transaction building and broadcasting.
 
+use rs_sdk_ffi::MnemonicResolverHandle;
 use crate::error::*;
 use crate::handle::*;
+use rs_sdk_ffi::MnemonicResolverCoreSigner;
 use crate::runtime::runtime;
 use crate::{check_ptr, unwrap_option_or_return, unwrap_result_or_return};
 use std::os::raw::c_char;
@@ -32,7 +34,21 @@ pub unsafe extern "C" fn core_wallet_broadcast_transaction(
     PlatformWalletFFIResult::ok()
 }
 
-/// Build, sign, and broadcast a payment to the given addresses.
+/// Build, sign, and broadcast a payment to the given addresses via
+/// an external mnemonic-resolver-backed signer.
+///
+/// The Swift caller supplies a [`MnemonicResolverHandle`] — the same
+/// vtable shape used by
+/// [`crate::dash_sdk_sign_with_mnemonic_resolver_and_path`] — which
+/// the FFI wraps in a [`MnemonicResolverCoreSigner`] for the
+/// lifetime of this call. Private keys never cross the FFI as raw
+/// bytes; every signature is produced inside the signer's atomic
+/// derive-and-sign step.
+///
+/// # Safety
+/// - `core_signer_handle` must be a valid, non-destroyed
+///   `*mut MnemonicResolverHandle`. Ownership is retained by the
+///   caller — this function does NOT destroy it.
 #[no_mangle]
 #[allow(clippy::too_many_arguments)]
 pub unsafe extern "C" fn core_wallet_send_to_addresses(
@@ -42,9 +58,11 @@ pub unsafe extern "C" fn core_wallet_send_to_addresses(
     addresses: *const *const c_char,
     amounts: *const u64,
     count: usize,
+    core_signer_handle: *mut MnemonicResolverHandle,
     out_tx_bytes: *mut *mut u8,
     out_tx_len: *mut usize,
 ) -> PlatformWalletFFIResult {
+    check_ptr!(core_signer_handle);
     if count > 0 {
         check_ptr!(addresses);
         check_ptr!(amounts);
@@ -76,8 +94,28 @@ pub unsafe extern "C" fn core_wallet_send_to_addresses(
         }
     };
 
+    let signer_addr = core_signer_handle as usize;
+
     let option = CORE_WALLET_STORAGE.with_item(handle, |wallet| {
-        runtime().block_on(wallet.send_to_addresses(std_account_type, account_index, outputs))
+        let wallet_id = wallet.wallet_id();
+        let network = wallet.network();
+        // SAFETY: the resolver handle is pinned alive for the duration
+        // of this FFI call (see fn-level safety doc). The
+        // `MnemonicResolverCoreSigner` lives on this stack frame and
+        // is dropped before the function returns.
+        let signer = unsafe {
+            MnemonicResolverCoreSigner::new(
+                signer_addr as *mut MnemonicResolverHandle,
+                wallet_id,
+                network,
+            )
+        };
+        runtime().block_on(wallet.send_to_addresses(
+            std_account_type,
+            account_index,
+            outputs,
+            &signer,
+        ))
     });
     let result = unwrap_option_or_return!(option);
     let tx = unwrap_result_or_return!(result);
diff --git a/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs b/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
index 76eedf09ad8..aa4dfc040ff 100644
--- a/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
+++ b/packages/rs-platform-wallet-ffi/src/core_wallet_types.rs
@@ -85,7 +85,23 @@ pub struct TransactionRecordFFI {
     pub block_timestamp: u32,
     /// 0=incoming, 1=outgoing, 2=internal, 3=coinJoin.
     pub direction: u32,
+    /// `transaction_type` rendered as a `Debug`-formatted string for
+    /// human display (`"Standard"`, `"AssetLock"`, etc.). NOT stable
+    /// across Rust version bumps — the typed discriminant is
+    /// `transaction_type_kind`; the string is for UI only and should
+    /// never be matched against.
     pub transaction_type: *mut c_char,
+    /// Typed discriminant of `key_wallet::transaction_checking::
+    /// transaction_router::TransactionType`:
+    /// 0=Standard, 1=CoinJoin, 2=ProviderRegistration,
+    /// 3=ProviderUpdateRegistrar, 4=ProviderUpdateService,
+    /// 5=ProviderUpdateRevocation, 6=AssetLock, 7=AssetUnlock,
+    /// 8=Coinbase, 9=Ignored. Stable wire shape — Swift
+    /// `PersistentTransaction.isAssetLock` matches on this byte
+    /// instead of regex-matching `transaction_type`'s Debug string.
+    /// `0xFF` is the sentinel for "pre-feature row whose discriminant
+    /// hasn't been populated yet"; treat as unknown.
+    pub transaction_type_kind: u8,
     pub net_amount: i64,
     pub fee: u64,
     pub has_fee: bool,
@@ -177,6 +193,17 @@ pub struct WalletChangeSetFFI {
     pub balance: BalanceChangeSetFFI,
     pub accounts: *mut AccountChangeSetFFI,
     pub accounts_count: usize,
+    /// Bincode-serialised `dashcore::ephemerealdata::chain_lock::ChainLock`
+    /// (`bincode::config::standard()`) representing the wallet's
+    /// `metadata.last_applied_chain_lock` after this round. `null` /
+    /// `0` length when this changeset didn't advance the chainlock
+    /// watermark. Persister writes the bytes to a dedicated SwiftData
+    /// column on `PersistentWallet` so the wallet's CL metadata
+    /// survives app restarts (otherwise it starts as `None` every
+    /// launch and the asset-lock-resume CL-from-metadata fallback in
+    /// `proof.rs` can't fire until SPV re-applies a fresh CL).
+    pub last_applied_chain_lock_bytes: *mut u8,
+    pub last_applied_chain_lock_bytes_len: usize,
 }
 
 // ---------------------------------------------------------------------------
@@ -343,6 +370,35 @@ impl WalletChangeSetFFI {
         }
 
         let accounts_count = ffi_accounts.len();
+
+        // Bincode-serialise `last_applied_chain_lock` if present.
+        // `ChainLock` derives `Encode` under upstream's `bincode`
+        // feature; `bincode::encode_to_vec` cannot fail for plain
+        // POD-shaped types, so a serialisation error here would
+        // indicate an upstream `ChainLock` derive regression — fall
+        // back to null and log so the persister round still
+        // succeeds for the rest of the changeset.
+        let (last_applied_chain_lock_bytes, last_applied_chain_lock_bytes_len) =
+            match cs.last_applied_chain_lock.as_ref() {
+                Some(cl) => match dpp::bincode::encode_to_vec(cl, dpp::bincode::config::standard())
+                {
+                    Ok(bytes) => {
+                        let len = bytes.len();
+                        let boxed = bytes.into_boxed_slice();
+                        (Box::into_raw(boxed) as *mut u8, len)
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            error = %e,
+                            "Failed to bincode-encode last_applied_chain_lock; \
+                             persister round will skip the watermark for this batch"
+                        );
+                        (std::ptr::null_mut(), 0)
+                    }
+                },
+                None => (std::ptr::null_mut(), 0),
+            };
+
         WalletChangeSetFFI {
             has_chain,
             chain,
@@ -350,6 +406,8 @@ impl WalletChangeSetFFI {
             balance,
             accounts: vec_to_ptr(ffi_accounts),
             accounts_count,
+            last_applied_chain_lock_bytes,
+            last_applied_chain_lock_bytes_len,
         }
     }
 }
@@ -750,6 +808,35 @@ fn record_spent_outpoints_ffi(
         .collect()
 }
 
+/// Map upstream `TransactionType` to a stable `u8` discriminant for
+/// the FFI wire shape. Order mirrors the enum declaration in
+/// `key_wallet::transaction_checking::transaction_router::mod.rs`,
+/// pinned here so a future variant addition surfaces as a compile
+/// error (the exhaustive match has no wildcard arm).
+///
+/// Stable contract: this byte is the Swift side's typed discriminant
+/// for `PersistentTransaction.isAssetLock` / `isAssetUnlock`. Keep
+/// it in sync with `TransactionTypeKind` in
+/// `swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentTransaction.swift`
+/// — every new variant added here must also gain a Swift enum case.
+fn transaction_type_to_u8(
+    ty: &key_wallet::transaction_checking::transaction_router::TransactionType,
+) -> u8 {
+    use key_wallet::transaction_checking::transaction_router::TransactionType;
+    match ty {
+        TransactionType::Standard => 0,
+        TransactionType::CoinJoin => 1,
+        TransactionType::ProviderRegistration => 2,
+        TransactionType::ProviderUpdateRegistrar => 3,
+        TransactionType::ProviderUpdateService => 4,
+        TransactionType::ProviderUpdateRevocation => 5,
+        TransactionType::AssetLock => 6,
+        TransactionType::AssetUnlock => 7,
+        TransactionType::Coinbase => 8,
+        TransactionType::Ignored => 9,
+    }
+}
+
 fn tx_record_to_ffi(
     tr: &key_wallet::managed_account::transaction_record::TransactionRecord,
 ) -> TransactionRecordFFI {
@@ -790,6 +877,7 @@ fn tx_record_to_ffi(
 
     let type_str = CString::new(format!("{:?}", tr.transaction_type))
         .unwrap_or_else(|_| CString::new("Unknown").unwrap());
+    let type_kind = transaction_type_to_u8(&tr.transaction_type);
     let label_str = CString::new(tr.label.clone()).unwrap_or_else(|_| CString::new("").unwrap());
 
     // Build the input-outpoint slice from `tx.input` directly. NOT from
@@ -834,6 +922,7 @@ fn tx_record_to_ffi(
         block_timestamp: blk_ts,
         direction: dir_val,
         transaction_type: type_str.into_raw(),
+        transaction_type_kind: type_kind,
         net_amount: tr.net_amount,
         fee: tr.fee.unwrap_or(0),
         has_fee: tr.fee.is_some(),
@@ -879,6 +968,21 @@ fn vec_to_ptr_u8(v: Vec<u8>, _len: usize) -> *mut u8 {
 pub unsafe fn free_wallet_changeset_ffi(cs: &WalletChangeSetFFI) {
     use std::ffi::CString;
 
+    // Top-level chain-lock bytes free path runs regardless of
+    // whether the changeset carried any account-level deltas — a
+    // round that ONLY advances the watermark (chain-lock arm with
+    // empty per_account on the WalletEvent side wouldn't fire, but
+    // a coalesced round may still resolve down to "just the CL"
+    // after `is_empty_no_records` filters out the other arms) must
+    // still release the heap allocation we made in `from_changeset`.
+    if !cs.last_applied_chain_lock_bytes.is_null() && cs.last_applied_chain_lock_bytes_len > 0 {
+        drop(Vec::from_raw_parts(
+            cs.last_applied_chain_lock_bytes,
+            cs.last_applied_chain_lock_bytes_len,
+            cs.last_applied_chain_lock_bytes_len,
+        ));
+    }
+
     if cs.accounts.is_null() || cs.accounts_count == 0 {
         return;
     }
diff --git a/packages/rs-platform-wallet-ffi/src/derive_and_persist_callbacks.rs b/packages/rs-platform-wallet-ffi/src/derive_and_persist_callbacks.rs
index 18ebab97eab..c33f785fff5 100644
--- a/packages/rs-platform-wallet-ffi/src/derive_and_persist_callbacks.rs
+++ b/packages/rs-platform-wallet-ffi/src/derive_and_persist_callbacks.rs
@@ -1,212 +1,60 @@
-//! C-ABI callback handles backing the
-//! [`crate::dash_sdk_derive_and_persist_identity_keys`] entry point.
+//! Identity-key persister C-ABI callback handle backing the
+//! [`crate::dash_sdk_derive_and_persist_identity_keys`] entry point
+//! and friends.
 //!
 //! The architectural intent is captured in `swift-sdk/CLAUDE.md`'s
 //! "no mnemonic round-tripping" rule: derivation pipelines must live
 //! on the Rust side, with Swift exposing only the two operations
 //! Rust cannot perform from its side — reading the mnemonic from
 //! the iOS Keychain and writing the derived key bytes back. This
-//! module exposes those two operations as paired vtable + handle
-//! types so a Rust-owned derivation loop can call into Swift for
-//! each one.
+//! module exposes the **write** half (identity-key persister); the
+//! **read** half (mnemonic resolver) lives in
+//! [`rs_sdk_ffi::mnemonic_resolver`](::rs_sdk_ffi::mnemonic_resolver)
+//! so non-wallet SDK callers can share it.
 //!
-//! # Why two separate handles
+//! # Why split from the resolver
 //!
 //! Conceptually they could ride on a single vtable, but the
 //! lifetimes are different:
 //!
 //! - The mnemonic resolver is single-use per call (one read of one
-//!   wallet's mnemonic per `dash_sdk_derive_and_persist_identity_keys`
-//!   invocation).
+//!   wallet's mnemonic per derivation invocation).
 //! - The persister is multi-use per call (`key_count` writes per
 //!   invocation).
 //!
 //! Splitting them also makes future extensions cleaner: a hardware-
 //! key-store impl might persist via a Secure Enclave wrapper that has
-//! nothing in common with how the mnemonic is fetched.
+//! nothing in common with how the mnemonic is fetched. Keeping the
+//! persister wallet-side (rather than promoting it to rs-sdk-ffi)
+//! reflects that the Keychain-write semantics are wallet-domain:
+//! `wallet_id` scoping, identity-index slot tagging, etc.
 //!
 //! # Synchronous on purpose
 //!
 //! Unlike the
 //! [`SignerVTable`](rs_sdk_ffi::SignerVTable) infrastructure (which
 //! uses a `oneshot` channel + `CompletionSlot` because biometric
-//! prompts can take seconds), Keychain reads and writes are
-//! sub-millisecond, so both callbacks here are fully synchronous —
-//! no completion-callback ceremony, no `tokio::time::timeout`.
+//! prompts can take seconds), Keychain writes are sub-millisecond,
+//! so the persister callback is fully synchronous — no
+//! completion-callback ceremony, no `tokio::time::timeout`.
 //! The Rust side blocks the calling thread for the duration of one
 //! Keychain hop. Callers that already invoke the derivation FFI on
 //! a background queue (the iOS pattern) get exactly what they want.
 //!
 //! # Lifetime / cleanup
 //!
-//! The Swift side calls `dash_sdk_mnemonic_resolver_create` /
-//! `dash_sdk_identity_key_persister_create`, which return opaque
-//! `*mut MnemonicResolverHandle` / `*mut IdentityKeyPersisterHandle`
-//! pointers. Pass them to
-//! `dash_sdk_derive_and_persist_identity_keys`. Then call the
-//! matching `_destroy` function — that fires the supplied destructor
-//! callback (typically the `Unmanaged.fromOpaque(...).release()`
-//! pattern Swift uses for its `KeychainSigner` ctx) so the Swift
-//! object can drop.
+//! The Swift side calls [`dash_sdk_identity_key_persister_create`],
+//! which returns an opaque `*mut IdentityKeyPersisterHandle` pointer.
+//! Pass it to
+//! [`crate::dash_sdk_derive_and_persist_identity_keys`]. Then call
+//! [`dash_sdk_identity_key_persister_destroy`] — that fires the
+//! supplied destructor callback (typically the
+//! `Unmanaged.fromOpaque(...).release()` pattern Swift uses for its
+//! `KeychainSigner` ctx) so the Swift object can drop.
 
 use std::ffi::c_void;
 use std::os::raw::c_char;
 
-// ---------------------------------------------------------------------------
-// Mnemonic resolver — Rust → Swift "fetch BIP-39 mnemonic for wallet_id"
-// ---------------------------------------------------------------------------
-
-/// Maximum mnemonic length, in bytes (excluding the trailing NUL),
-/// the resolver buffer can hold.
-///
-/// 1024 bytes covers every BIP-39 wordlist with margin to spare:
-/// the longest 24-word mnemonics in any supported language come in
-/// well under that — Korean (the longest of the supported lists)
-/// tops out near 700 bytes for a 24-word phrase. Picking a power-
-/// of-two cap keeps the inline Rust stack buffer (used in
-/// [`crate::dash_sdk_derive_and_persist_identity_keys`]) cheap to
-/// zero-on-drop.
-pub const MNEMONIC_RESOLVER_BUFFER_CAPACITY: usize = 1024;
-
-/// Resolver result codes returned by [`MnemonicResolveCallback`].
-///
-/// Mirrors the success/failure shape of `PlatformWalletFFIResult`
-/// at a finer-grained level so the Rust side can distinguish
-/// "Swift hit the buffer cap" from "Swift had no mnemonic stored
-/// for this wallet".
-pub mod mnemonic_resolver_result {
-    /// Mnemonic copied into the buffer; `out_len` was set.
-    pub const SUCCESS: i32 = 0;
-    /// The Swift side has no mnemonic stored for this `wallet_id`.
-    /// Surfaced to the Rust caller as
-    /// `PlatformWalletFFIResult::ErrorWalletOperation` with a
-    /// "mnemonic missing" detail.
-    pub const NOT_FOUND: i32 = 1;
-    /// Mnemonic exceeded [`MNEMONIC_RESOLVER_BUFFER_CAPACITY`].
-    /// Should not happen in practice — the buffer is sized for
-    /// every BIP-39 wordlist's 24-word phrase plus margin.
-    pub const BUFFER_TOO_SMALL: i32 = 2;
-    /// Anything else (Keychain access denied, decode error, etc.).
-    /// Surfaced as `ErrorWalletOperation` with a generic detail
-    /// the Swift side hopefully logged before returning.
-    pub const OTHER: i32 = 3;
-}
-
-/// Function pointer type for the mnemonic-resolve callback.
-///
-/// # Wire shape
-///
-/// - `ctx`: opaque Swift-side context (typically the result of
-///   `Unmanaged.passRetained(swiftSelf).toOpaque()`). Passed back
-///   verbatim by Rust on every invocation.
-/// - `wallet_id_bytes`: pointer to a 32-byte wallet id. Valid for
-///   the duration of the call only.
-/// - `out_mnemonic_utf8`: writable buffer for the NUL-terminated
-///   UTF-8 mnemonic. Capacity is
-///   [`MNEMONIC_RESOLVER_BUFFER_CAPACITY`] bytes (room for the
-///   trailing NUL).
-/// - `out_capacity`: equal to [`MNEMONIC_RESOLVER_BUFFER_CAPACITY`].
-///   Surfaced explicitly so the implementation can sanity-check
-///   without assuming the constant.
-/// - `out_len`: receives the byte count written to
-///   `out_mnemonic_utf8`, EXCLUDING the trailing NUL. Must be set
-///   on success.
-///
-/// # Safety
-///
-/// - `out_mnemonic_utf8` must be valid for `out_capacity` writable
-///   bytes for the duration of this call.
-/// - `wallet_id_bytes` must be valid for 32 readable bytes.
-/// - `out_len` must be valid for one `usize` write.
-/// - The implementation MUST return one of the
-///   [`mnemonic_resolver_result`] codes; any other value is treated
-///   as `OTHER`.
-pub type MnemonicResolveCallback = unsafe extern "C" fn(
-    ctx: *const c_void,
-    wallet_id_bytes: *const u8,
-    out_mnemonic_utf8: *mut c_char,
-    out_capacity: usize,
-    out_len: *mut usize,
-) -> i32;
-
-/// C-compatible vtable for a mnemonic resolver.
-#[repr(C)]
-pub struct MnemonicResolverVTable {
-    /// Synchronous "fetch mnemonic for `wallet_id`".
-    pub resolve: MnemonicResolveCallback,
-    /// Destructor for the `ctx` pointer. Invoked exactly once when
-    /// the matching `dash_sdk_mnemonic_resolver_destroy` is called.
-    pub destroy: unsafe extern "C" fn(ctx: *mut c_void),
-}
-
-/// Opaque Rust-side handle to a Swift-owned mnemonic resolver.
-///
-/// Constructed by [`dash_sdk_mnemonic_resolver_create`], destroyed
-/// by [`dash_sdk_mnemonic_resolver_destroy`]. Pass the pointer
-/// into [`crate::dash_sdk_derive_and_persist_identity_keys`].
-#[repr(C)]
-pub struct MnemonicResolverHandle {
-    pub(crate) ctx: *mut c_void,
-    pub(crate) vtable: *mut MnemonicResolverVTable,
-}
-
-// SAFETY: Swift side promises both pointers are thread-stable for
-// the lifetime of this handle. The handle is owned by Swift
-// across the FFI; Rust just dereferences it under the same lock
-// shape the existing signer FFI uses.
-unsafe impl Send for MnemonicResolverHandle {}
-unsafe impl Sync for MnemonicResolverHandle {}
-
-/// Build a new resolver handle that wraps a Swift-owned `ctx`
-/// pointer plus a pair of function pointers.
-///
-/// # Safety
-/// - `resolve_callback` must conform to [`MnemonicResolveCallback`]'s
-///   contract.
-/// - `destroy_callback` must safely free `ctx` exactly once.
-/// - `ctx` may be null (the destructor will be invoked with null
-///   on destroy regardless).
-#[no_mangle]
-pub unsafe extern "C" fn dash_sdk_mnemonic_resolver_create(
-    ctx: *mut c_void,
-    resolve_callback: MnemonicResolveCallback,
-    destroy_callback: unsafe extern "C" fn(ctx: *mut c_void),
-) -> *mut MnemonicResolverHandle {
-    // Allocate the vtable on the heap so it has a stable address
-    // for the lifetime of the handle — same pattern
-    // `dash_sdk_signer_create_with_ctx` follows.
-    let vtable = Box::into_raw(Box::new(MnemonicResolverVTable {
-        resolve: resolve_callback,
-        destroy: destroy_callback,
-    }));
-    Box::into_raw(Box::new(MnemonicResolverHandle { ctx, vtable }))
-}
-
-/// Destroy a previously-created resolver handle.
-///
-/// Calls the supplied destructor exactly once with the original
-/// `ctx`, then frees the heap-allocated vtable and the handle box.
-/// Safe to call with a null pointer (no-op).
-///
-/// # Safety
-/// `handle` must have been produced by
-/// [`dash_sdk_mnemonic_resolver_create`] and must not have been
-/// destroyed already.
-#[no_mangle]
-pub unsafe extern "C" fn dash_sdk_mnemonic_resolver_destroy(handle: *mut MnemonicResolverHandle) {
-    if handle.is_null() {
-        return;
-    }
-    let owned = unsafe { Box::from_raw(handle) };
-    unsafe {
-        if !owned.vtable.is_null() {
-            ((*owned.vtable).destroy)(owned.ctx);
-            // Reclaim the vtable box.
-            let _ = Box::from_raw(owned.vtable);
-        }
-    }
-}
-
 // ---------------------------------------------------------------------------
 // Identity-key persister — Rust → Swift "save this derived key to Keychain"
 // ---------------------------------------------------------------------------
@@ -342,6 +190,9 @@ pub unsafe extern "C" fn dash_sdk_identity_key_persister_create(
     persist_callback: PersistKeyCallback,
     destroy_callback: unsafe extern "C" fn(ctx: *mut c_void),
 ) -> *mut IdentityKeyPersisterHandle {
+    // Allocate the vtable on the heap so it has a stable address
+    // for the lifetime of the handle — same pattern
+    // `dash_sdk_signer_create_with_ctx` follows.
     let vtable = Box::into_raw(Box::new(IdentityKeyPersisterVTable {
         persist_key: persist_callback,
         destroy: destroy_callback,
@@ -349,7 +200,11 @@ pub unsafe extern "C" fn dash_sdk_identity_key_persister_create(
     Box::into_raw(Box::new(IdentityKeyPersisterHandle { ctx, vtable }))
 }
 
-/// Destroy a previously-created persister handle. Safe on null.
+/// Destroy a previously-created persister handle.
+///
+/// Calls the supplied destructor exactly once with the original
+/// `ctx`, then frees the heap-allocated vtable and the handle box.
+/// Safe to call with a null pointer (no-op).
 ///
 /// # Safety
 /// `handle` must have been produced by
@@ -366,6 +221,7 @@ pub unsafe extern "C" fn dash_sdk_identity_key_persister_destroy(
     unsafe {
         if !owned.vtable.is_null() {
             ((*owned.vtable).destroy)(owned.ctx);
+            // Reclaim the vtable box.
             let _ = Box::from_raw(owned.vtable);
         }
     }
@@ -380,36 +236,9 @@ mod tests {
     use super::*;
     use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 
-    static RESOLVER_CALLED: AtomicBool = AtomicBool::new(false);
-    static RESOLVER_DESTROYED: AtomicBool = AtomicBool::new(false);
     static PERSISTER_CALLS: AtomicUsize = AtomicUsize::new(0);
     static PERSISTER_DESTROYED: AtomicBool = AtomicBool::new(false);
 
-    unsafe extern "C" fn fake_resolve(
-        _ctx: *const c_void,
-        _wallet_id_bytes: *const u8,
-        out_buf: *mut c_char,
-        out_capacity: usize,
-        out_len: *mut usize,
-    ) -> i32 {
-        RESOLVER_CALLED.store(true, Ordering::SeqCst);
-        let phrase = b"abandon abandon abandon abandon abandon abandon abandon abandon \
-                       abandon abandon abandon about";
-        if phrase.len() + 1 > out_capacity {
-            return mnemonic_resolver_result::BUFFER_TOO_SMALL;
-        }
-        unsafe {
-            std::ptr::copy_nonoverlapping(phrase.as_ptr() as *const c_char, out_buf, phrase.len());
-            *out_buf.add(phrase.len()) = 0;
-            *out_len = phrase.len();
-        }
-        mnemonic_resolver_result::SUCCESS
-    }
-
-    unsafe extern "C" fn fake_resolver_destroy(_ctx: *mut c_void) {
-        RESOLVER_DESTROYED.store(true, Ordering::SeqCst);
-    }
-
     unsafe extern "C" fn fake_persist(_ctx: *const c_void, _args: *const PersistKeyArgs) -> u8 {
         PERSISTER_CALLS.fetch_add(1, Ordering::SeqCst);
         PERSIST_KEY_SUCCESS
@@ -419,36 +248,6 @@ mod tests {
         PERSISTER_DESTROYED.store(true, Ordering::SeqCst);
     }
 
-    #[test]
-    fn resolver_create_destroy_roundtrip() {
-        unsafe {
-            let h = dash_sdk_mnemonic_resolver_create(
-                std::ptr::null_mut(),
-                fake_resolve,
-                fake_resolver_destroy,
-            );
-            assert!(!h.is_null());
-            assert!(!(*h).vtable.is_null());
-
-            // Drive the resolver once to confirm the wired-up callback fires.
-            let mut buf = [0u8; MNEMONIC_RESOLVER_BUFFER_CAPACITY];
-            let mut len: usize = 0;
-            let rc = ((*(*h).vtable).resolve)(
-                (*h).ctx,
-                [0u8; 32].as_ptr(),
-                buf.as_mut_ptr() as *mut c_char,
-                buf.len(),
-                &mut len,
-            );
-            assert_eq!(rc, mnemonic_resolver_result::SUCCESS);
-            assert!(len > 0);
-
-            dash_sdk_mnemonic_resolver_destroy(h);
-        }
-        assert!(RESOLVER_CALLED.load(Ordering::SeqCst));
-        assert!(RESOLVER_DESTROYED.load(Ordering::SeqCst));
-    }
-
     #[test]
     fn persister_create_destroy_roundtrip() {
         unsafe {
@@ -487,10 +286,9 @@ mod tests {
     }
 
     #[test]
-    fn destroy_handles_null() {
+    fn destroy_persister_null_handle() {
         unsafe {
-            // Should be no-ops.
-            dash_sdk_mnemonic_resolver_destroy(std::ptr::null_mut());
+            // Should be a no-op.
             dash_sdk_identity_key_persister_destroy(std::ptr::null_mut());
         }
     }
diff --git a/packages/rs-platform-wallet-ffi/src/derive_identity_key_at_slot.rs b/packages/rs-platform-wallet-ffi/src/derive_identity_key_at_slot.rs
index a733dc019c9..73ccbefb27a 100644
--- a/packages/rs-platform-wallet-ffi/src/derive_identity_key_at_slot.rs
+++ b/packages/rs-platform-wallet-ffi/src/derive_identity_key_at_slot.rs
@@ -9,7 +9,7 @@ use key_wallet::bip32::ExtendedPrivKey;
 use platform_wallet::wallet::identity::network::derive_ecdsa_identity_auth_keypair_from_master;
 use zeroize::Zeroizing;
 
-use crate::derive_and_persist_callbacks::{
+use rs_sdk_ffi::{
     mnemonic_resolver_result, MnemonicResolverHandle, MNEMONIC_RESOLVER_BUFFER_CAPACITY,
 };
 use crate::error::*;
diff --git a/packages/rs-platform-wallet-ffi/src/identity_derive_and_persist.rs b/packages/rs-platform-wallet-ffi/src/identity_derive_and_persist.rs
index 882842b7015..961eec42b32 100644
--- a/packages/rs-platform-wallet-ffi/src/identity_derive_and_persist.rs
+++ b/packages/rs-platform-wallet-ffi/src/identity_derive_and_persist.rs
@@ -83,8 +83,10 @@ use key_wallet::bip32::{ExtendedPrivKey, ExtendedPubKey};
 use zeroize::{Zeroize, Zeroizing};
 
 use crate::derive_and_persist_callbacks::{
-    mnemonic_resolver_result, IdentityKeyPersisterHandle, MnemonicResolverHandle, PersistKeyArgs,
-    MNEMONIC_RESOLVER_BUFFER_CAPACITY, PERSIST_KEY_SUCCESS,
+    IdentityKeyPersisterHandle, PersistKeyArgs, PERSIST_KEY_SUCCESS,
+};
+use rs_sdk_ffi::{
+    mnemonic_resolver_result, MnemonicResolverHandle, MNEMONIC_RESOLVER_BUFFER_CAPACITY,
 };
 use crate::error::*;
 use crate::identity_key_preview::IdentityKeyPreviewFFI;
diff --git a/packages/rs-platform-wallet-ffi/src/identity_registration_funded_with_signer.rs b/packages/rs-platform-wallet-ffi/src/identity_registration_funded_with_signer.rs
index c7a12adbd0a..24022a655a7 100644
--- a/packages/rs-platform-wallet-ffi/src/identity_registration_funded_with_signer.rs
+++ b/packages/rs-platform-wallet-ffi/src/identity_registration_funded_with_signer.rs
@@ -1,60 +1,87 @@
 //! Asset-lock-funded identity registration driven by an external
-//! `SignerHandle`.
+//! `SignerHandle` (for the per-identity-key signatures) and a
+//! `MnemonicResolverHandle` (for the Core-side asset-lock signature).
+//!
+//! Two signer surfaces are deliberately distinct:
+//!
+//! - `signer_handle` (a `*mut rs_sdk_ffi::SignerHandle`) is the
+//!   Platform-side per-identity-key signer. It produces the `BLS` or
+//!   `ECDSA` signatures over the IdentityCreate transition's
+//!   per-public-key witnesses.
+//! - `core_signer_handle` (a `*mut MnemonicResolverHandle`) is the
+//!   Core-side ECDSA signer used for the asset-lock's outer
+//!   state-transition signature. It reuses the existing
+//!   Keychain-resolver vtable so the credit-output private key never
+//!   crosses the FFI boundary as raw bytes — see
+//!   [`rs_sdk_ffi::MnemonicResolverCoreSigner`].
 
 use std::collections::BTreeMap;
 use std::convert::TryFrom;
 use std::slice;
 
+use dashcore::hashes::Hash;
 use dpp::identity::accessors::IdentityGettersV0;
 use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
 use dpp::identity::{IdentityPublicKey, KeyType, Purpose, SecurityLevel};
 use dpp::platform_value::BinaryData;
-use platform_wallet::wallet::identity::types::funding::IdentityFundingMethod;
+use platform_wallet::wallet::identity::types::funding::IdentityFunding;
 use rs_sdk_ffi::{SignerHandle, VTableSigner};
 
 use crate::check_ptr;
+use crate::core_wallet_types::OutPointFFI;
+use rs_sdk_ffi::MnemonicResolverHandle;
 use crate::error::*;
 use crate::handle::*;
 use crate::identity_registration_with_signer::IdentityPubkeyFFI;
+use rs_sdk_ffi::MnemonicResolverCoreSigner;
 use crate::runtime::block_on_worker;
 use crate::{unwrap_option_or_return, unwrap_result_or_return};
 
-/// Register a new asset-lock-funded identity using an external signer.
-#[no_mangle]
-#[allow(clippy::too_many_arguments)]
-pub unsafe extern "C" fn platform_wallet_register_identity_with_funding_signer(
-    wallet_handle: Handle,
-    amount_duffs: u64,
-    identity_index: u32,
+/// Decode the C-side `IdentityPubkeyFFI` rows into the
+/// `BTreeMap<u32, IdentityPublicKey>` shape that
+/// `IdentityWallet::register_identity_with_funding` expects.
+///
+/// Shared by both the [`platform_wallet_register_identity_with_funding_signer`]
+/// (fresh asset-lock build) and
+/// [`platform_wallet_resume_identity_with_existing_asset_lock_signer`]
+/// (resume from tracked outpoint) entry points — the two differ only in
+/// how they construct the [`IdentityFunding`] variant; the keys-map
+/// shape is identical.
+///
+/// Returns `Err(PlatformWalletFFIResult)` carrying the FFI error the
+/// caller should bubble up directly. Mirrors the inline `Err(...)` /
+/// `unwrap_result_or_return!` flow elsewhere in this file.
+unsafe fn decode_identity_pubkeys(
     identity_pubkeys: *const IdentityPubkeyFFI,
     identity_pubkeys_count: usize,
-    signer_handle: *mut SignerHandle,
-    out_identity_id: *mut [u8; 32],
-    out_identity_handle: *mut Handle,
-) -> PlatformWalletFFIResult {
-    check_ptr!(signer_handle);
-    check_ptr!(identity_pubkeys);
-    check_ptr!(out_identity_id);
-    check_ptr!(out_identity_handle);
-    if identity_pubkeys_count == 0 {
-        return PlatformWalletFFIResult::err(
-            PlatformWalletFFIResultCode::ErrorInvalidParameter,
-            "identity_pubkeys_count must be >= 1",
-        );
-    }
-
+) -> Result<BTreeMap<u32, IdentityPublicKey>, PlatformWalletFFIResult> {
     let pubkey_rows: &[IdentityPubkeyFFI] =
         slice::from_raw_parts(identity_pubkeys, identity_pubkeys_count);
     let mut keys_map: BTreeMap<u32, IdentityPublicKey> = BTreeMap::new();
     for (i, row) in pubkey_rows.iter().enumerate() {
-        let key_type = unwrap_result_or_return!(KeyType::try_from(row.key_type));
-        let purpose = unwrap_result_or_return!(Purpose::try_from(row.purpose));
-        let security_level = unwrap_result_or_return!(SecurityLevel::try_from(row.security_level));
+        let key_type = KeyType::try_from(row.key_type).map_err(|e| {
+            PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorInvalidParameter,
+                format!("identity_pubkeys[{i}].key_type invalid: {e}"),
+            )
+        })?;
+        let purpose = Purpose::try_from(row.purpose).map_err(|e| {
+            PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorInvalidParameter,
+                format!("identity_pubkeys[{i}].purpose invalid: {e}"),
+            )
+        })?;
+        let security_level = SecurityLevel::try_from(row.security_level).map_err(|e| {
+            PlatformWalletFFIResult::err(
+                PlatformWalletFFIResultCode::ErrorInvalidParameter,
+                format!("identity_pubkeys[{i}].security_level invalid: {e}"),
+            )
+        })?;
         if row.pubkey_bytes.is_null() || row.pubkey_len == 0 {
-            return PlatformWalletFFIResult::err(
+            return Err(PlatformWalletFFIResult::err(
                 PlatformWalletFFIResultCode::ErrorNullPointer,
                 format!("identity_pubkeys[{i}].pubkey_bytes is null or empty"),
-            );
+            ));
         }
         let pubkey_bytes: Vec<u8> =
             slice::from_raw_parts(row.pubkey_bytes, row.pubkey_len).to_vec();
@@ -72,19 +99,197 @@ pub unsafe extern "C" fn platform_wallet_register_identity_with_funding_signer(
             }),
         );
     }
+    Ok(keys_map)
+}
+
+/// Register a new asset-lock-funded identity using an external signer.
+///
+/// # Safety
+/// - `signer_handle` must be a valid, non-destroyed `*mut SignerHandle`
+///   produced by `dash_sdk_signer_create_with_ctx`. The caller retains
+///   ownership.
+/// - `core_signer_handle` must be a valid, non-destroyed
+///   `*mut MnemonicResolverHandle` produced by
+///   [`crate::dash_sdk_mnemonic_resolver_create`]. The caller retains
+///   ownership.
+#[no_mangle]
+#[allow(clippy::too_many_arguments)]
+pub unsafe extern "C" fn platform_wallet_register_identity_with_funding_signer(
+    wallet_handle: Handle,
+    amount_duffs: u64,
+    identity_index: u32,
+    identity_pubkeys: *const IdentityPubkeyFFI,
+    identity_pubkeys_count: usize,
+    signer_handle: *mut SignerHandle,
+    core_signer_handle: *mut MnemonicResolverHandle,
+    out_identity_id: *mut [u8; 32],
+    out_identity_handle: *mut Handle,
+) -> PlatformWalletFFIResult {
+    check_ptr!(signer_handle);
+    check_ptr!(core_signer_handle);
+    check_ptr!(identity_pubkeys);
+    check_ptr!(out_identity_id);
+    check_ptr!(out_identity_handle);
+    if identity_pubkeys_count == 0 {
+        return PlatformWalletFFIResult::err(
+            PlatformWalletFFIResultCode::ErrorInvalidParameter,
+            "identity_pubkeys_count must be >= 1",
+        );
+    }
+
+    let keys_map = match decode_identity_pubkeys(identity_pubkeys, identity_pubkeys_count) {
+        Ok(m) => m,
+        Err(e) => return e,
+    };
+
+    // Round-trip both handles through `usize` so the spawned future's
+    // capture is `Send + 'static` — same pattern used by the existing
+    // address-signer FFI (raw pointers are `!Send`, `usize` isn't).
+    let signer_addr = signer_handle as usize;
+    let core_signer_addr = core_signer_handle as usize;
+
+    let option = PLATFORM_WALLET_STORAGE.with_item(wallet_handle, |wallet| {
+        let identity_wallet = wallet.identity().clone();
+        let wallet_id = wallet.wallet_id();
+        // Capture the network the asset-lock signer should derive
+        // under. Pulled from the wallet itself rather than threaded
+        // as an extra FFI parameter — it would be ambiguous if the
+        // two disagreed.
+        let network = wallet.sdk().network;
+        block_on_worker(async move {
+            // SAFETY: see the fn-level safety doc — both handles are
+            // pinned alive for the duration of this FFI call.
+            let identity_signer: &VTableSigner =
+                unsafe { &*(signer_addr as *const VTableSigner) };
+            let asset_lock_signer = unsafe {
+                MnemonicResolverCoreSigner::new(
+                    core_signer_addr as *mut MnemonicResolverHandle,
+                    wallet_id,
+                    network,
+                )
+            };
+            identity_wallet
+                .register_identity_with_funding(
+                    IdentityFunding::FromWalletBalance { amount_duffs },
+                    identity_index,
+                    keys_map,
+                    identity_signer,
+                    &asset_lock_signer,
+                    None,
+                )
+                .await
+        })
+    });
+    let result = unwrap_option_or_return!(option);
+    let identity = unwrap_result_or_return!(result);
+    let id_bytes: [u8; 32] = identity.id().to_buffer();
+    *out_identity_id = id_bytes;
+    let managed = platform_wallet::ManagedIdentity::new(identity, identity_index);
+    let handle = MANAGED_IDENTITY_STORAGE.insert(managed);
+    *out_identity_handle = handle;
+    PlatformWalletFFIResult::ok()
+}
+
+/// Resume identity registration from an already-tracked asset lock.
+///
+/// Sister to [`platform_wallet_register_identity_with_funding_signer`]:
+/// instead of building a fresh asset-lock transaction from wallet
+/// balance, this entry point picks up an existing tracked lock by
+/// outpoint and drives it through whatever stages remain (broadcast,
+/// IS/CL wait, Platform submission). Use case is crash recovery — a
+/// prior registration attempt left the lock in storage at
+/// `InstantSendLocked` / `ChainLocked` but the IdentityCreate transition
+/// never completed (app killed, network error, dismissed flow), and the
+/// user now wants to consume the lock from the
+/// "Fund from unused Asset Lock" picker in `CreateIdentityView`.
+///
+/// The Rust side dispatches via [`IdentityFunding::FromExistingAssetLock`]
+/// inside the same `register_identity_with_funding` helper used by the
+/// wallet-balance path — the resume logic and IS→CL fallback live
+/// there, not here. This FFI is a thin marshaler.
+///
+/// # Safety
+/// - `out_point` must be a valid, non-null pointer to an
+///   `OutPointFFI` (32-byte raw txid + u32 vout). The caller retains
+///   ownership; the FFI does not free it.
+/// - `signer_handle` must be a valid, non-destroyed `*mut SignerHandle`
+///   produced by `dash_sdk_signer_create_with_ctx`. The caller retains
+///   ownership.
+/// - `core_signer_handle` must be a valid, non-destroyed
+///   `*mut MnemonicResolverHandle` produced by
+///   [`crate::dash_sdk_mnemonic_resolver_create`]. The caller retains
+///   ownership.
+#[no_mangle]
+#[allow(clippy::too_many_arguments)]
+pub unsafe extern "C" fn platform_wallet_resume_identity_with_existing_asset_lock_signer(
+    wallet_handle: Handle,
+    out_point: *const OutPointFFI,
+    identity_index: u32,
+    identity_pubkeys: *const IdentityPubkeyFFI,
+    identity_pubkeys_count: usize,
+    signer_handle: *mut SignerHandle,
+    core_signer_handle: *mut MnemonicResolverHandle,
+    out_identity_id: *mut [u8; 32],
+    out_identity_handle: *mut Handle,
+) -> PlatformWalletFFIResult {
+    check_ptr!(out_point);
+    check_ptr!(signer_handle);
+    check_ptr!(core_signer_handle);
+    check_ptr!(identity_pubkeys);
+    check_ptr!(out_identity_id);
+    check_ptr!(out_identity_handle);
+    if identity_pubkeys_count == 0 {
+        return PlatformWalletFFIResult::err(
+            PlatformWalletFFIResultCode::ErrorInvalidParameter,
+            "identity_pubkeys_count must be >= 1",
+        );
+    }
+
+    // `OutPointFFI::txid` is `[u8; 32]` so the conversion is
+    // infallible — `from_byte_array` consumes the array directly,
+    // unlike `from_slice` which would defensively return a `Result`
+    // for length checking we don't need here. Matches the
+    // convention already used across `rs-drive-abci` /
+    // `rs-platform-wallet-ffi/src/persistence.rs`.
+    let out_point_ffi = *out_point;
+    let resume_outpoint = dashcore::OutPoint {
+        txid: dashcore::Txid::from_byte_array(out_point_ffi.txid),
+        vout: out_point_ffi.vout,
+    };
+
+    let keys_map = match decode_identity_pubkeys(identity_pubkeys, identity_pubkeys_count) {
+        Ok(m) => m,
+        Err(e) => return e,
+    };
 
     let signer_addr = signer_handle as usize;
+    let core_signer_addr = core_signer_handle as usize;
 
     let option = PLATFORM_WALLET_STORAGE.with_item(wallet_handle, |wallet| {
         let identity_wallet = wallet.identity().clone();
+        let wallet_id = wallet.wallet_id();
+        let network = wallet.sdk().network;
         block_on_worker(async move {
-            let signer: &VTableSigner = &*(signer_addr as *const VTableSigner);
+            // SAFETY: see the fn-level safety doc — both handles are
+            // pinned alive for the duration of this FFI call.
+            let identity_signer: &VTableSigner =
+                unsafe { &*(signer_addr as *const VTableSigner) };
+            let asset_lock_signer = unsafe {
+                MnemonicResolverCoreSigner::new(
+                    core_signer_addr as *mut MnemonicResolverHandle,
+                    wallet_id,
+                    network,
+                )
+            };
             identity_wallet
-                .register_identity_with_funding_external_signer(
-                    IdentityFundingMethod::FundWithWallet { amount_duffs },
+                .register_identity_with_funding(
+                    IdentityFunding::FromExistingAssetLock {
+                        out_point: resume_outpoint,
+                    },
                     identity_index,
                     keys_map,
-                    signer,
+                    identity_signer,
+                    &asset_lock_signer,
                     None,
                 )
                 .await
diff --git a/packages/rs-platform-wallet-ffi/src/lib.rs b/packages/rs-platform-wallet-ffi/src/lib.rs
index 0085d8c8547..4e2f4aa0da2 100644
--- a/packages/rs-platform-wallet-ffi/src/lib.rs
+++ b/packages/rs-platform-wallet-ffi/src/lib.rs
@@ -10,6 +10,7 @@
 #![allow(clippy::large_enum_variant)]
 
 pub mod asset_lock;
+pub mod asset_lock_persistence;
 pub mod contact;
 pub mod contact_persistence;
 pub mod contact_request;
diff --git a/packages/rs-platform-wallet-ffi/src/persistence.rs b/packages/rs-platform-wallet-ffi/src/persistence.rs
index 4fc7ddba2df..1d36ddd7e58 100644
--- a/packages/rs-platform-wallet-ffi/src/persistence.rs
+++ b/packages/rs-platform-wallet-ffi/src/persistence.rs
@@ -28,6 +28,7 @@ use std::ffi::CString;
 use std::os::raw::c_void;
 use std::slice;
 
+use crate::asset_lock_persistence::{build_asset_lock_entries, outpoint_to_bytes, AssetLockEntryFFI};
 use crate::contact_persistence::{
     free_contact_requests_ffi, ContactRequestFFI, ContactRequestRemovalFFI,
 };
@@ -42,7 +43,8 @@ use crate::token_persistence::{TokenBalanceRemovalFFI, TokenBalanceUpsertFFI};
 use crate::wallet_registration_persistence::AccountAddressPoolFFI;
 use crate::wallet_restore_types::{
     AccountSpecFFI, AccountTypeTagFFI, IdentityKeyRestoreFFI, IdentityRestoreEntryFFI,
-    LoadWalletListFreeFn, StandardAccountTypeTagFFI, UtxoRestoreEntryFFI, WalletRestoreEntryFFI,
+    LoadWalletListFreeFn, StandardAccountTypeTagFFI, UnresolvedAssetLockTxRecordFFI,
+    UtxoRestoreEntryFFI, WalletRestoreEntryFFI,
 };
 use dpp::address_funds::PlatformAddress;
 use dpp::identity::identity_public_key::v0::IdentityPublicKeyV0;
@@ -355,6 +357,27 @@ pub struct PersistenceCallbacks {
     pub on_get_core_tx_record_free_fn: Option<
         unsafe extern "C" fn(context: *mut c_void, tx_bytes: *const u8, tx_bytes_len: usize),
     >,
+    /// Called with an `AssetLockChangeSet` slice — upserts on the
+    /// tracked-asset-lock store and outpoint tombstones. Swift maps
+    /// upserts onto `PersistentAssetLock` rows keyed by the 36-byte
+    /// outpoint (`txid || vout_le`) and deletes rows for every
+    /// removal. The `transaction_bytes` / `proof_bytes` slices inside
+    /// each [`AssetLockEntryFFI`] are Rust-owned and valid only for
+    /// the callback window — Swift must copy them before returning.
+    ///
+    /// Returns 0 on success. A non-zero return flips the round's
+    /// `success` flag to `false` so [`Self::on_changeset_end_fn`]
+    /// receives the rollback signal.
+    pub on_persist_asset_locks_fn: Option<
+        unsafe extern "C" fn(
+            context: *mut c_void,
+            wallet_id: *const u8,
+            upserts_ptr: *const AssetLockEntryFFI,
+            upserts_count: usize,
+            removed_ptr: *const [u8; 36],
+            removed_count: usize,
+        ) -> i32,
+    >,
 }
 
 // SAFETY: The context pointer is managed by the FFI caller who must ensure
@@ -732,6 +755,52 @@ impl PlatformWalletPersistence for FFIPersister {
             }
         }
 
+        // Send asset-lock changeset — tracked-lock upserts (one row
+        // per credit output, addressed by outpoint) and outpoint
+        // tombstones (consumed-by-registration removals). Maps onto
+        // Swift's `PersistentAssetLock` rows.
+        if let Some(ref al_cs) = changeset.asset_locks {
+            if let Some(cb) = self.callbacks.on_persist_asset_locks_fn {
+                let upsert_refs: Vec<&platform_wallet::changeset::AssetLockEntry> =
+                    al_cs.asset_locks.values().collect();
+                let (upserts, _storage) = build_asset_lock_entries(&upsert_refs);
+                let removed: Vec<[u8; 36]> =
+                    al_cs.removed.iter().map(outpoint_to_bytes).collect();
+                if !upserts.is_empty() || !removed.is_empty() {
+                    let result = unsafe {
+                        cb(
+                            self.callbacks.context,
+                            wallet_id.as_ptr(),
+                            if upserts.is_empty() {
+                                std::ptr::null()
+                            } else {
+                                upserts.as_ptr()
+                            },
+                            upserts.len(),
+                            if removed.is_empty() {
+                                std::ptr::null()
+                            } else {
+                                removed.as_ptr()
+                            },
+                            removed.len(),
+                        )
+                    };
+                    // Pin both byte-buffer storage (`_storage`) and
+                    // the FFI Vec until after the callback so the
+                    // pointers stay valid through the C call.
+                    drop(upserts);
+                    drop(_storage);
+                    if result != 0 {
+                        eprintln!(
+                            "Asset lock persistence callback returned error code {}",
+                            result
+                        );
+                        round_success = false;
+                    }
+                }
+            }
+        }
+
         // Send DashPay contact-request changeset.
         //
         // The flat upsert array is built by walking every source
@@ -1704,6 +1773,52 @@ fn build_wallet_start_state(
         wallet_info.metadata.last_synced = Some(entry.last_synced);
     }
 
+    // Persisted `last_applied_chain_lock` — bincode-decoded from the
+    // bytes Swift handed back. Restoring this before the wallet
+    // enters the manager means the asset-lock-resume CL-from-metadata
+    // fallback (`proof.rs`) can fire immediately at app launch on
+    // any tracked lock whose funding block height is `<= cl.block_height`,
+    // without waiting for SPV to re-apply a fresh CL. SPV persists
+    // its own `best_chainlock` independently; this is the symmetric
+    // wallet-side restore.
+    //
+    // Decode failure is treated as miss: malformed bytes here are
+    // either a serialisation-shape regression in upstream `ChainLock`
+    // or a corrupted SwiftData row — neither is recoverable in-flight,
+    // so log at `warn` (so the operator sees it) and continue with
+    // `metadata.last_applied_chain_lock = None`. The next fresh
+    // chainlock arrival will overwrite the field with a valid value
+    // and the failure window for the metadata fallback is the SPV
+    // catch-up latency, same as if the column had been empty.
+    if !entry.last_applied_chain_lock_bytes.is_null()
+        && entry.last_applied_chain_lock_bytes_len > 0
+    {
+        let cl_slice = unsafe {
+            slice::from_raw_parts(
+                entry.last_applied_chain_lock_bytes,
+                entry.last_applied_chain_lock_bytes_len,
+            )
+        };
+        match dpp::bincode::decode_from_slice::<
+            dashcore::ephemerealdata::chain_lock::ChainLock,
+            _,
+        >(cl_slice, dpp::bincode::config::standard())
+        {
+            Ok((cl, _)) => {
+                wallet_info.metadata.last_applied_chain_lock = Some(cl);
+            }
+            Err(e) => {
+                tracing::warn!(
+                    wallet_id = %hex::encode(entry.wallet_id),
+                    error = %e,
+                    "load: failed to decode persisted last_applied_chain_lock; \
+                     metadata.last_applied_chain_lock left as None — the \
+                     next fresh CLSig will repopulate"
+                );
+            }
+        }
+    }
+
     // Persisted unspent UTXOs → funds-bearing accounts. Keys-only and
     // PlatformPayment variants are skipped: the former never carry
     // UTXOs, the latter route through `PlatformAddressSyncStartState`.
@@ -1892,6 +2007,62 @@ fn build_wallet_start_state(
         wallet_info.update_balance();
     }
 
+    // Selectively repopulate the in-memory `transactions()` map with
+    // the funding-tx records of any tracked asset locks still at
+    // `statusRaw < 2` (Built / Broadcast). The wallet's load path
+    // otherwise leaves `transactions()` empty for these accounts —
+    // most tx history is consumed reactively from SwiftData rather
+    // than the in-memory map, so the bulk-restore cost isn't
+    // justified. But asset locks waiting on a proof are the one
+    // exception: `WalletManager::apply_chain_lock` walks the in-
+    // memory `transactions()` map looking for records to promote
+    // from `InBlock` to `InChainLockedBlock`. If the funding tx
+    // isn't present at the moment the next CLSig fires, the
+    // promotion silently drops on the floor and the asset lock
+    // stays stuck at `Broadcast` indefinitely.
+    //
+    // Re-injecting these specific records is the minimum surface
+    // that lets the existing event-driven cascade do its job: at
+    // the next chain-lock event the bridge's Fix-1
+    // `chain_lock_promotions` projection picks them up, Swift
+    // flips their `PersistentTransaction.context` to `3`, and the
+    // `AssetLockManager::resolve_status_with_in_memory` path
+    // builds a `ChainAssetLockProof` from the row's block info.
+    //
+    // Each restored record is synthetic: `input_details` /
+    // `output_details` are empty (we don't have the per-account
+    // role classification at load time), `net_amount` is zero, and
+    // `account_type` reflects the funding BIP44 slot. None of
+    // those fields are read by the chain-lock cascade — only
+    // `context` and `height()` matter for the
+    // `apply_chain_lock` → bridge → persister loop.
+    let unresolved_recs: &[UnresolvedAssetLockTxRecordFFI] =
+        if entry.unresolved_asset_lock_tx_records.is_null()
+            || entry.unresolved_asset_lock_tx_records_count == 0
+        {
+            &[]
+        } else {
+            unsafe {
+                slice::from_raw_parts(
+                    entry.unresolved_asset_lock_tx_records,
+                    entry.unresolved_asset_lock_tx_records_count,
+                )
+            }
+        };
+    if !unresolved_recs.is_empty() {
+        let stats =
+            restore_unresolved_asset_lock_tx_records(&mut wallet_info, unresolved_recs)?;
+        if stats.restored > 0 || stats.dropped() > 0 {
+            tracing::info!(
+                wallet_id = %hex::encode(entry.wallet_id),
+                restored = stats.restored,
+                dropped_decode = stats.dropped_decode,
+                dropped_no_account = stats.dropped_no_account,
+                "load: unresolved-asset-lock tx-record restore complete"
+            );
+        }
+    }
+
     let mut per_account = PerWalletPlatformAddressState::new();
     for (&account_key, account) in &wallet.accounts.platform_payment_accounts {
         per_account.entry(account_key.account).or_insert_with(|| {
@@ -1987,11 +2158,20 @@ fn build_wallet_start_state(
         wallet_identities,
     };
 
+    // Rehydrate tracked asset-locks (built / broadcast / IS-locked
+    // / chain-locked credit outputs awaiting registration). These
+    // rows are persisted by `on_persist_asset_locks_fn` whenever the
+    // asset-lock manager flushes a status change, and the Swift load
+    // path hands them back here so an in-flight registration that
+    // was interrupted by an app kill can resume from the latest
+    // status without rebroadcasting.
+    let unused_asset_locks = build_unused_asset_locks(entry)?;
+
     let wallet_state = ClientWalletStartState {
         wallet,
         wallet_info,
         identity_manager,
-        unused_asset_locks: BTreeMap::new(),
+        unused_asset_locks,
     };
 
     let platform_address_state = if per_account.is_empty()
@@ -2034,6 +2214,168 @@ fn build_wallet_start_state(
 /// an empty map and gets refreshed on the next sync round — same
 /// degraded-but-usable behaviour as before this change for that
 /// narrow case.
+/// Rebuild the `unused_asset_locks` map carried on
+/// [`ClientWalletStartState`] from the `tracked_asset_locks` slice the
+/// Swift load callback hands back. Mirrors the encoding used by
+/// [`crate::asset_lock_persistence::build_asset_lock_entries`]:
+///
+/// - `out_point` is 32-byte raw txid + 4-byte little-endian vout.
+/// - `transaction_bytes` is consensus-encoded.
+/// - `proof_bytes` is bincode-encoded (`dpp::bincode::config::standard()`).
+///   `null` / 0 length means "no proof yet" (statuses Built / Broadcast).
+///
+/// A malformed entry returns `Err(PersistenceError)` so the caller
+/// surfaces the load failure rather than dropping a partially-rebuilt
+/// state silently. Empty / null `tracked_asset_locks` yields an empty
+/// map (same as the legacy hardcoded path).
+fn build_unused_asset_locks(
+    entry: &WalletRestoreEntryFFI,
+) -> Result<
+    BTreeMap<u32, BTreeMap<dashcore::OutPoint, platform_wallet::TrackedAssetLock>>,
+    PersistenceError,
+> {
+    use dashcore::hashes::Hash;
+
+    let specs: &[AssetLockEntryFFI] = if entry.tracked_asset_locks.is_null()
+        || entry.tracked_asset_locks_count == 0
+    {
+        &[]
+    } else {
+        // SAFETY: Swift guarantees the pointer + count form a valid
+        // slice for the callback window; this function runs inside
+        // that window (called from `build_wallet_start_state` invoked
+        // by `FFIPersister::load`).
+        unsafe { slice::from_raw_parts(entry.tracked_asset_locks, entry.tracked_asset_locks_count) }
+    };
+
+    let mut map: BTreeMap<u32, BTreeMap<dashcore::OutPoint, platform_wallet::TrackedAssetLock>> =
+        BTreeMap::new();
+    for spec in specs {
+        // Decode the outpoint: 32-byte raw txid + 4-byte LE vout.
+        let txid = dashcore::Txid::from_slice(&spec.out_point[..32]).map_err(|e| {
+            PersistenceError::from(format!(
+                "tracked asset lock: invalid txid in outpoint: {}",
+                e
+            ))
+        })?;
+        let vout_bytes: [u8; 4] = spec.out_point[32..]
+            .try_into()
+            .expect("4-byte slice from 36-byte array");
+        let vout = u32::from_le_bytes(vout_bytes);
+        let out_point = dashcore::OutPoint { txid, vout };
+
+        // Decode the consensus-encoded transaction.
+        if spec.transaction_bytes.is_null() || spec.transaction_bytes_len == 0 {
+            return Err(PersistenceError::from(
+                "tracked asset lock: empty transaction bytes".to_string(),
+            ));
+        }
+        // SAFETY: Swift guarantees the buffer is valid for the
+        // callback window. We immediately decode + clone out of it,
+        // so the lifetime concern is satisfied.
+        let tx_bytes =
+            unsafe { slice::from_raw_parts(spec.transaction_bytes, spec.transaction_bytes_len) };
+        let transaction: dashcore::Transaction = dashcore::consensus::deserialize(tx_bytes)
+            .map_err(|e| {
+                PersistenceError::from(format!(
+                    "tracked asset lock: failed to decode transaction: {}",
+                    e
+                ))
+            })?;
+
+        // Decode the optional bincode-encoded proof.
+        let proof: Option<dpp::prelude::AssetLockProof> = if spec.proof_bytes.is_null()
+            || spec.proof_bytes_len == 0
+        {
+            None
+        } else {
+            // SAFETY: Same lifetime contract as `transaction_bytes`.
+            let proof_bytes =
+                unsafe { slice::from_raw_parts(spec.proof_bytes, spec.proof_bytes_len) };
+            let (proof, _) = dpp::bincode::decode_from_slice::<
+                dpp::prelude::AssetLockProof,
+                _,
+            >(proof_bytes, config::standard())
+            .map_err(|e| {
+                PersistenceError::from(format!(
+                    "tracked asset lock: failed to decode proof: {}",
+                    e
+                ))
+            })?;
+            Some(proof)
+        };
+
+        let funding_type = funding_type_from_u8(spec.funding_type)?;
+        let status = status_from_u8(spec.status)?;
+
+        // Skip `Consumed` rows. The Swift persister keeps them for
+        // historical UI lookups (transactions list → locked amount),
+        // but the in-memory `tracked_asset_locks` map is for
+        // still-actionable locks only — a consumed lock has no proof
+        // worth waiting on and adding it back to memory at every
+        // load would defeat the point of marking it terminal.
+        if matches!(status, platform_wallet::AssetLockStatus::Consumed) {
+            continue;
+        }
+
+        let tracked = platform_wallet::TrackedAssetLock {
+            out_point,
+            transaction,
+            account_index: spec.account_index,
+            funding_type,
+            identity_index: spec.identity_index,
+            amount: spec.amount_duffs,
+            status,
+            proof,
+        };
+        map.entry(spec.account_index)
+            .or_default()
+            .insert(out_point, tracked);
+    }
+
+    Ok(map)
+}
+
+fn funding_type_from_u8(
+    b: u8,
+) -> Result<
+    key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType,
+    PersistenceError,
+> {
+    use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
+    Ok(match b {
+        0 => AssetLockFundingType::IdentityRegistration,
+        1 => AssetLockFundingType::IdentityTopUp,
+        2 => AssetLockFundingType::IdentityTopUpNotBound,
+        3 => AssetLockFundingType::IdentityInvitation,
+        4 => AssetLockFundingType::AssetLockAddressTopUp,
+        5 => AssetLockFundingType::AssetLockShieldedAddressTopUp,
+        other => {
+            return Err(PersistenceError::from(format!(
+                "tracked asset lock: unknown funding_type discriminant {}",
+                other
+            )))
+        }
+    })
+}
+
+fn status_from_u8(b: u8) -> Result<platform_wallet::AssetLockStatus, PersistenceError> {
+    use platform_wallet::AssetLockStatus;
+    Ok(match b {
+        0 => AssetLockStatus::Built,
+        1 => AssetLockStatus::Broadcast,
+        2 => AssetLockStatus::InstantSendLocked,
+        3 => AssetLockStatus::ChainLocked,
+        4 => AssetLockStatus::Consumed,
+        other => {
+            return Err(PersistenceError::from(format!(
+                "tracked asset lock: unknown status discriminant {}",
+                other
+            )))
+        }
+    })
+}
+
 fn build_wallet_identity_bucket(
     entry: &WalletRestoreEntryFFI,
 ) -> Result<BTreeMap<u32, ManagedIdentity>, PersistenceError> {
@@ -2287,3 +2629,318 @@ unsafe fn slice_from_raw<'a>(ptr: *const u8, len: usize) -> &'a [u8] {
         slice::from_raw_parts(ptr, len)
     }
 }
+
+/// Per-call statistics for [`restore_unresolved_asset_lock_tx_records`].
+/// Pulled out as a struct so the caller logs a single rollup line and
+/// the unit tests can assert on the breakdown without ad-hoc tuples.
+#[derive(Debug, Default, PartialEq, Eq)]
+struct UnresolvedRestoreStats {
+    restored: usize,
+    dropped_decode: usize,
+    dropped_no_account: usize,
+}
+
+impl UnresolvedRestoreStats {
+    fn dropped(&self) -> usize {
+        self.dropped_decode + self.dropped_no_account
+    }
+}
+
+/// Project a slice of [`UnresolvedAssetLockTxRecordFFI`] rows onto the
+/// in-memory `transactions()` maps of the matching
+/// `standard_bip44_accounts[account_index]` slots on the rebuilt
+/// `ManagedWalletInfo`.
+///
+/// See the call site in [`build_wallet_start_state`] for the design
+/// rationale on WHY this exists at all (selective bulk-restore for
+/// the chain-lock cascade path). This helper is the pure
+/// computational core, separated so a Rust unit test can exercise it
+/// without standing up an entire `WalletRestoreEntryFFI`.
+///
+/// Returns an `Err` only for non-recoverable corruption (malformed
+/// `block_hash`). Per-row decode failures and no-matching-account
+/// rows are counted into `UnresolvedRestoreStats` so the caller can
+/// emit a single rollup log line.
+fn restore_unresolved_asset_lock_tx_records(
+    wallet_info: &mut ManagedWalletInfo,
+    records: &[UnresolvedAssetLockTxRecordFFI],
+) -> Result<UnresolvedRestoreStats, PersistenceError> {
+    use dashcore::hashes::Hash;
+    use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
+    use key_wallet::managed_account::transaction_record::{
+        TransactionDirection, TransactionRecord,
+    };
+    use key_wallet::transaction_checking::{BlockInfo, TransactionContext, TransactionType};
+
+    let mut stats = UnresolvedRestoreStats::default();
+    for rec in records {
+        let tx_bytes = unsafe { slice_from_raw(rec.tx_bytes, rec.tx_bytes_len) };
+        let tx: dashcore::Transaction = match dashcore::consensus::encode::deserialize(tx_bytes) {
+            Ok(t) => t,
+            Err(e) => {
+                stats.dropped_decode += 1;
+                tracing::warn!(
+                    account_index = rec.account_index,
+                    error = %e,
+                    "load: skipping unresolved-asset-lock tx record with undecodable bytes"
+                );
+                continue;
+            }
+        };
+
+        // Only the two confirmed contexts are reconstructible from
+        // the persisted scalars; `0` / `1` either have no block
+        // info to project or need an IS-lock signature blob we
+        // don't carry. Treat them as `Mempool` — defensive code
+        // for an edge that shouldn't occur in practice (an asset
+        // lock at `Built` / `Broadcast` has by definition not yet
+        // observed IS-lock or block confirmation).
+        let context = match rec.context_raw {
+            2 => {
+                let block_hash = dashcore::BlockHash::from_slice(&rec.block_hash)
+                    .map_err(|e| format!(
+                        "load: malformed block_hash on unresolved asset-lock tx record: {}",
+                        e
+                    ))?;
+                TransactionContext::InBlock(BlockInfo::new(
+                    rec.block_height,
+                    block_hash,
+                    rec.block_timestamp as u32,
+                ))
+            }
+            3 => {
+                let block_hash = dashcore::BlockHash::from_slice(&rec.block_hash)
+                    .map_err(|e| format!(
+                        "load: malformed block_hash on unresolved asset-lock tx record: {}",
+                        e
+                    ))?;
+                TransactionContext::InChainLockedBlock(BlockInfo::new(
+                    rec.block_height,
+                    block_hash,
+                    rec.block_timestamp as u32,
+                ))
+            }
+            _ => TransactionContext::Mempool,
+        };
+
+        // Asset-lock txs are funded from a BIP44 account; that's
+        // the only account map the asset-lock recovery flow
+        // consults (`recover_asset_lock_blocking` reads
+        // `info.core_wallet.accounts.standard_bip44_accounts.get(
+        // &account_index)...transactions().get(&out_point.txid)`),
+        // so restoration goes through the same map. Records for
+        // other variants would never be reached by that lookup.
+        let Some(account) = wallet_info
+            .accounts
+            .standard_bip44_accounts
+            .get_mut(&rec.account_index)
+        else {
+            stats.dropped_no_account += 1;
+            tracing::warn!(
+                account_index = rec.account_index,
+                "load: dropping unresolved-asset-lock tx record — no matching BIP44 account"
+            );
+            continue;
+        };
+
+        let account_type = account.managed_account_type().to_account_type();
+        let record = TransactionRecord::new(
+            tx,
+            account_type,
+            context,
+            // Funding transactions ARE asset locks by definition —
+            // the upstream router classifies them via the
+            // `AssetLockPayloadType` special-tx payload. Use the
+            // same tag here so any downstream code keying off
+            // `transaction_type` sees the canonical value.
+            TransactionType::AssetLock,
+            // The funding flow always starts from our own UTXOs
+            // and writes one credit output to ourselves; per
+            // `TransactionDirection::Internal`'s docstring, a
+            // self-transfer with no outputs to external addresses
+            // is "Internal". `wait_for_proof` doesn't read
+            // direction; this is just the most-correct tag.
+            TransactionDirection::Internal,
+            Vec::new(),
+            Vec::new(),
+            0,
+        );
+        account.transactions_mut().insert(record.txid, record);
+        stats.restored += 1;
+    }
+    Ok(stats)
+}
+
+#[cfg(test)]
+mod tests {
+    //! Unit tests for the load-side helpers. Focused on the
+    //! restoration loops that don't need the full FFI plumbing —
+    //! exercising the in-memory mutation against synthetic input.
+
+    use super::*;
+    use dashcore::blockdata::transaction::txin::TxIn;
+    use dashcore::blockdata::transaction::txout::TxOut;
+    use dashcore::blockdata::transaction::Transaction;
+    use dashcore::consensus::encode::serialize;
+    use dashcore::{Network, ScriptBuf};
+    use key_wallet::account::{Account, AccountType, StandardAccountType};
+    use key_wallet::bip32::{ExtendedPrivKey, ExtendedPubKey};
+    use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
+    use key_wallet::mnemonic::{Language, Mnemonic};
+    use key_wallet::wallet::Wallet;
+    use dashcore::secp256k1::Secp256k1;
+
+    /// Pins the contract that an `InBlock` unresolved-asset-lock row
+    /// projects onto the matching BIP44 account's in-memory
+    /// `transactions()` map with the correct context — the precise
+    /// invariant the chain-lock cascade depends on at the next CLSig
+    /// after a wallet restart.
+    #[test]
+    fn restore_unresolved_records_inserts_inblock_record() {
+        let mut wallet_info = test_managed_wallet_info_with_bip44(0);
+        let tx = synthetic_minimal_tx();
+        let txid = tx.txid();
+        let tx_bytes = serialize(&tx);
+
+        // Build a single `InBlock` row pointing at account 0.
+        let mut tx_buf: Vec<u8> = tx_bytes.clone();
+        let block_hash = [0x42u8; 32];
+        let rec = UnresolvedAssetLockTxRecordFFI {
+            account_index: 0,
+            tx_bytes: tx_buf.as_mut_ptr(),
+            tx_bytes_len: tx_buf.len(),
+            context_raw: 2,
+            block_height: 1475917,
+            block_hash,
+            block_timestamp: 1700000000,
+            first_seen: 1699999000,
+        };
+
+        let stats = restore_unresolved_asset_lock_tx_records(&mut wallet_info, &[rec])
+            .expect("restoration should not return an error for a well-formed row");
+        assert_eq!(
+            stats,
+            UnresolvedRestoreStats {
+                restored: 1,
+                dropped_decode: 0,
+                dropped_no_account: 0
+            }
+        );
+
+        let account = wallet_info
+            .accounts
+            .standard_bip44_accounts
+            .get(&0)
+            .expect("BIP44 account 0 must exist on the synthetic wallet");
+        let restored = account
+            .transactions()
+            .get(&txid)
+            .expect("restored record must be in the in-memory map");
+        match &restored.context {
+            key_wallet::transaction_checking::TransactionContext::InBlock(info) => {
+                assert_eq!(info.height(), 1475917);
+                let actual_hash = info.block_hash();
+                let actual_hash_bytes: &[u8; 32] = actual_hash.as_ref();
+                assert_eq!(actual_hash_bytes, &block_hash);
+            }
+            other => panic!("expected InBlock context, got {:?}", other),
+        }
+
+        // Keep the buffer alive until after the read so the
+        // `tx_bytes` pointer remains valid for the duration of
+        // `restore_unresolved_asset_lock_tx_records`. The function
+        // copies the decoded `Transaction` into the record, so the
+        // original buffer can drop after the call returns — but we
+        // keep it alive explicitly here to make the lifetime
+        // contract obvious for reviewers.
+        drop(tx_buf);
+    }
+
+    /// Pins that a no-matching-account row is counted but doesn't
+    /// abort the load — important so a stray persisted row from a
+    /// pruned account doesn't poison wallet load.
+    #[test]
+    fn restore_unresolved_records_skips_missing_account() {
+        let mut wallet_info = test_managed_wallet_info_with_bip44(0);
+        let tx = synthetic_minimal_tx();
+        let mut tx_buf: Vec<u8> = serialize(&tx);
+
+        let rec = UnresolvedAssetLockTxRecordFFI {
+            account_index: 99, // not present
+            tx_bytes: tx_buf.as_mut_ptr(),
+            tx_bytes_len: tx_buf.len(),
+            context_raw: 2,
+            block_height: 1,
+            block_hash: [0u8; 32],
+            block_timestamp: 0,
+            first_seen: 0,
+        };
+
+        let stats = restore_unresolved_asset_lock_tx_records(&mut wallet_info, &[rec])
+            .expect("missing-account is a recoverable drop, not an error");
+        assert_eq!(stats.restored, 0);
+        assert_eq!(stats.dropped_no_account, 1);
+        drop(tx_buf);
+    }
+
+    /// Helper: build a `ManagedWalletInfo` with a single BIP44
+    /// account at `index`. Uses a hard-coded valid xpub so the
+    /// construction is deterministic; the test cares about the
+    /// `transactions()` map structure, not key material.
+    fn test_managed_wallet_info_with_bip44(index: u32) -> ManagedWalletInfo {
+        // Derive a valid testnet xpub from the canonical
+        // `abandon × 11 about` BIP-39 vector so the construction is
+        // reproducible and doesn't depend on a hand-typed
+        // base58-checked string. Same pattern the upstream
+        // `account_collection_test.rs` uses.
+        let mnemonic = Mnemonic::from_phrase(
+            "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about",
+            Language::English,
+        )
+        .expect("static BIP-39 vector must parse");
+        let seed = mnemonic.to_seed("");
+        let master = ExtendedPrivKey::new_master(Network::Testnet, &seed)
+            .expect("master derivation must succeed");
+        let secp = Secp256k1::new();
+        let xpub = ExtendedPubKey::from_priv(&secp, &master);
+        let account = Account::from_xpub(
+            None,
+            AccountType::Standard {
+                index,
+                standard_account_type: StandardAccountType::BIP44Account,
+            },
+            xpub,
+            Network::Testnet,
+        )
+        .expect("Account::from_xpub on a valid xpub must succeed");
+        let mut accounts = key_wallet::AccountCollection::new();
+        accounts
+            .insert(account)
+            .expect("inserting the single account must succeed");
+        let wallet = Wallet::new_external_signable(Network::Testnet, [0u8; 32], accounts);
+        ManagedWalletInfo::from_wallet(&wallet, 0)
+    }
+
+    /// Helper: a minimum valid consensus-encodable transaction —
+    /// version 1, one synthetic input, one zero-value output. The
+    /// restoration helper only cares that the bytes round-trip
+    /// through `consensus::encode::deserialize`; the tx's semantic
+    /// validity is irrelevant.
+    fn synthetic_minimal_tx() -> Transaction {
+        Transaction {
+            version: 1,
+            lock_time: 0,
+            input: vec![TxIn {
+                previous_output: dashcore::OutPoint::null(),
+                script_sig: ScriptBuf::new(),
+                sequence: 0xffffffff,
+                witness: dashcore::Witness::default(),
+            }],
+            output: vec![TxOut {
+                value: 0,
+                script_pubkey: ScriptBuf::new(),
+            }],
+            special_transaction_payload: None,
+        }
+    }
+}
diff --git a/packages/rs-platform-wallet-ffi/src/shielded_sync.rs b/packages/rs-platform-wallet-ffi/src/shielded_sync.rs
index 31e9bd43140..810a5c23f03 100644
--- a/packages/rs-platform-wallet-ffi/src/shielded_sync.rs
+++ b/packages/rs-platform-wallet-ffi/src/shielded_sync.rs
@@ -17,7 +17,7 @@ use platform_wallet::wallet::shielded::ShieldedSyncSummary;
 
 use zeroize::Zeroizing;
 
-use crate::derive_and_persist_callbacks::{
+use rs_sdk_ffi::{
     mnemonic_resolver_result, MnemonicResolverHandle, MNEMONIC_RESOLVER_BUFFER_CAPACITY,
 };
 use crate::error::*;
diff --git a/packages/rs-platform-wallet-ffi/src/sign_with_mnemonic_resolver.rs b/packages/rs-platform-wallet-ffi/src/sign_with_mnemonic_resolver.rs
index 70103901917..6dc50f16bf0 100644
--- a/packages/rs-platform-wallet-ffi/src/sign_with_mnemonic_resolver.rs
+++ b/packages/rs-platform-wallet-ffi/src/sign_with_mnemonic_resolver.rs
@@ -45,7 +45,7 @@ use dashcore::secp256k1::Secp256k1;
 use key_wallet::bip32::{DerivationPath, ExtendedPrivKey};
 use zeroize::Zeroizing;
 
-use crate::derive_and_persist_callbacks::{
+use rs_sdk_ffi::{
     mnemonic_resolver_result, MnemonicResolverHandle, MNEMONIC_RESOLVER_BUFFER_CAPACITY,
 };
 use crate::identity_keys_from_mnemonic::parse_mnemonic_any_language;
@@ -276,7 +276,7 @@ mod tests {
     unsafe extern "C" fn noop_destroy(_ctx: *mut c_void) {}
 
     fn make_resolver(
-        cb: crate::derive_and_persist_callbacks::MnemonicResolveCallback,
+        cb: rs_sdk_ffi::MnemonicResolveCallback,
     ) -> *mut MnemonicResolverHandle {
         unsafe { dash_sdk_mnemonic_resolver_create(std::ptr::null_mut(), cb, noop_destroy) }
     }
diff --git a/packages/rs-platform-wallet-ffi/src/spv.rs b/packages/rs-platform-wallet-ffi/src/spv.rs
index b68421854a4..04cc61b2b87 100644
--- a/packages/rs-platform-wallet-ffi/src/spv.rs
+++ b/packages/rs-platform-wallet-ffi/src/spv.rs
@@ -188,6 +188,15 @@ pub unsafe extern "C" fn platform_wallet_manager_spv_tip_unix_seconds(
 }
 
 /// Start SPV sync in the background.
+///
+/// `enable_masternodes` is NOT a caller knob: platform-wallet always
+/// needs `ChainLockManager` + `InstantSendManager` running so
+/// asset-lock proofs can resolve via the `CLSig` / `ISLock` P2P
+/// messages. Disabling masternode sync silently breaks
+/// `AssetLockManager::wait_for_proof`, which is a published feature.
+/// Hardcoded to `true` here; if a future caller has a real reason to
+/// run SPV without masternode sync, it can construct the wallet
+/// manager without the asset-lock path instead.
 #[no_mangle]
 #[allow(clippy::field_reassign_with_default)]
 pub unsafe extern "C" fn platform_wallet_manager_spv_start(
@@ -199,7 +208,6 @@ pub unsafe extern "C" fn platform_wallet_manager_spv_start(
     peer_count: usize,
     restrict_to_configured_peers: bool,
     start_from_height: u32,
-    masternode_sync_enabled: bool,
 ) -> PlatformWalletFFIResult {
     check_ptr!(data_dir);
     let data_dir_str = unwrap_result_or_return!(CStr::from_ptr(data_dir).to_str()).to_string();
@@ -234,7 +242,14 @@ pub unsafe extern "C" fn platform_wallet_manager_spv_start(
         if start_from_height > 0 {
             config.start_from_height = Some(start_from_height);
         }
-        config.enable_masternodes = masternode_sync_enabled;
+        // Asset-lock proof acquisition (`AssetLockManager::wait_for_proof`)
+        // depends on `CLSig` / `ISLock` P2P messages reaching the wallet,
+        // which only happens when `ChainLockManager` + `InstantSendManager`
+        // are spawned (see dash-spv/src/client/lifecycle.rs). Hardcode
+        // here so trusted-SDK callers (who'd otherwise disable masternode
+        // sync) don't silently break asset-lock-funded identity
+        // registration.
+        config.enable_masternodes = true;
         config.restrict_to_configured_peers = restrict_to_configured_peers;
         for p in &peer_list {
             if let Ok(addr) = p.parse() {
diff --git a/packages/rs-platform-wallet-ffi/src/wallet_restore_types.rs b/packages/rs-platform-wallet-ffi/src/wallet_restore_types.rs
index 3e1d82567fa..4e92aaa6f2f 100644
--- a/packages/rs-platform-wallet-ffi/src/wallet_restore_types.rs
+++ b/packages/rs-platform-wallet-ffi/src/wallet_restore_types.rs
@@ -26,6 +26,7 @@
 
 use std::os::raw::{c_char, c_void};
 
+use crate::asset_lock_persistence::AssetLockEntryFFI;
 use crate::platform_address_types::AddressBalanceEntryFFI;
 use crate::types::FFINetwork;
 
@@ -308,6 +309,65 @@ pub struct UtxoRestoreEntryFFI {
     pub is_locked: bool,
 }
 
+/// One persisted transaction record carried back at load time so the
+/// in-memory `transactions()` map can be selectively repopulated for
+/// the small subset of records that matter for chain-lock cascade —
+/// today, the funding transactions of tracked asset locks still at
+/// `Built` / `Broadcast` (`statusRaw < 2`).
+///
+/// Why selectively rather than wholesale: the wallet's own load path
+/// only bulk-restores UTXOs, not tx records, by design — most tx
+/// history is consumed reactively through SwiftData `@Query`s, not
+/// from the in-memory map. The exception is asset locks waiting for
+/// IS-lock / chain-lock proofs: their funding tx must live in the
+/// in-memory map at the moment the next chain-lock event fires, or
+/// `WalletManager::apply_chain_lock` finds nothing to promote and
+/// the bridge has no `chain_lock_promotions` to emit. Restoring
+/// these specific records closes that gap without breaking the rest
+/// of the lazy-load model.
+///
+/// `context_raw` matches `TransactionContext` discriminants:
+/// 0 = Mempool, 1 = InstantSend, 2 = InBlock, 3 = InChainLockedBlock.
+/// Only `2` and `3` are reconstructible from these scalar fields;
+/// `0` / `1` need either no block info (Mempool) or an IS-lock blob
+/// we don't carry (InstantSend), so the Rust load path treats them
+/// as `Mempool` — defensive code for an edge that shouldn't occur in
+/// practice (an asset lock at `Built` / `Broadcast` has by definition
+/// not yet observed IS-lock or block confirmation).
+#[repr(C)]
+pub struct UnresolvedAssetLockTxRecordFFI {
+    /// BIP44 account index the funding tx spent UTXOs from — the
+    /// same `account_index` the Rust `TrackedAssetLock` carries.
+    /// Routes the record into the matching
+    /// `standard_bip44_accounts[account_index].transactions_mut()`
+    /// bucket at load time.
+    pub account_index: u32,
+    /// Consensus-encoded asset-lock transaction body. Same wire
+    /// format `dashcore::consensus::encode::serialize` produces, so
+    /// `Transaction::consensus_decode` round-trips. Swift-owned for
+    /// the callback window; freed by `LoadWalletListFreeFn`.
+    pub tx_bytes: *mut u8,
+    pub tx_bytes_len: usize,
+    /// `TransactionContext` discriminant; see struct docstring for
+    /// values. Anything other than `2` / `3` is treated as `Mempool`
+    /// by the load path.
+    pub context_raw: u32,
+    /// Block height (meaningful only when `context_raw` is `2` or
+    /// `3`; zero placeholder otherwise).
+    pub block_height: u32,
+    /// Block hash (wire-orientation 32 bytes; meaningful only when
+    /// `context_raw` is `2` or `3`; zeros otherwise).
+    pub block_hash: [u8; 32],
+    /// Block timestamp (Unix seconds; same meaningfulness rule as
+    /// `block_height`).
+    pub block_timestamp: u64,
+    /// Persisted "first seen" Unix-second timestamp. Carried so the
+    /// rebuilt `TransactionRecord` mirrors what Swift had on disk;
+    /// `wait_for_proof` itself reads only `context` + `height()`, so
+    /// a zero here is benign for the chain-lock cascade path.
+    pub first_seen: u64,
+}
+
 /// Per-wallet entry returned by `on_load_wallet_list_fn`.
 ///
 /// `accounts` points to a contiguous array of length `accounts_count`.
@@ -349,6 +409,47 @@ pub struct WalletRestoreEntryFFI {
     /// row's `script_pubkey` buffer.
     pub utxos: *const UtxoRestoreEntryFFI,
     pub utxos_count: usize,
+    /// Tracked asset-lock entries persisted by the
+    /// `on_persist_asset_locks_fn` callback that need to be
+    /// rehydrated into `ClientWalletStartState.unused_asset_locks`
+    /// so wallet load resumes mid-flight registrations.
+    ///
+    /// Each entry's `transaction_bytes` / `proof_bytes` buffers are
+    /// Swift-owned and freed by `LoadWalletListFreeFn`. `null` / `0`
+    /// when the wallet has no persisted tracked locks.
+    pub tracked_asset_locks: *const AssetLockEntryFFI,
+    pub tracked_asset_locks_count: usize,
+    /// Funding tx records for tracked asset locks at `statusRaw < 2`
+    /// (Built / Broadcast). The Rust load path re-inserts each entry
+    /// into the matching `standard_bip44_accounts[account_index]
+    /// .transactions_mut()` bucket so the next incoming chain-lock
+    /// event can find these txids in the in-memory map and promote
+    /// them via `apply_chain_lock` — closing the SPV-restart gap
+    /// where an asset lock would otherwise stay stuck at `Broadcast`
+    /// indefinitely because the wallet's `transactions()` started
+    /// empty and no follow-up CLSig at a higher height was ever
+    /// going to re-fire promotion for the lower-height block.
+    ///
+    /// Each entry's `tx_bytes` buffer is Swift-owned and freed by
+    /// `LoadWalletListFreeFn`. `null` / `0` when the wallet has no
+    /// unresolved asset locks.
+    pub unresolved_asset_lock_tx_records: *const UnresolvedAssetLockTxRecordFFI,
+    pub unresolved_asset_lock_tx_records_count: usize,
+    /// Bincode-serialised
+    /// `dashcore::ephemerealdata::chain_lock::ChainLock`
+    /// (`bincode::config::standard()`) carrying the persisted
+    /// `WalletMetadata::last_applied_chain_lock` from the last
+    /// session. `null` / `0` when no chainlock was ever persisted
+    /// (fresh wallet, or wallet that hasn't observed a chainlock
+    /// since the metadata-persist feature shipped). When present,
+    /// `build_wallet_start_state` decodes and stamps it into
+    /// `wallet_info.metadata.last_applied_chain_lock` before the
+    /// wallet enters the manager — so the asset-lock-resume
+    /// CL-from-metadata fallback in `proof.rs` can fire on
+    /// catch-up tasks at app launch without waiting for SPV to
+    /// re-apply a fresh chainlock.
+    pub last_applied_chain_lock_bytes: *const u8,
+    pub last_applied_chain_lock_bytes_len: usize,
 }
 
 // SAFETY: Pointers are Swift-owned and lifetime-scoped to the callback.
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index 9d9bdae0377..ddf1f0a2187 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -9,7 +9,7 @@ description = "Platform wallet with identity management support"
 [dependencies]
 # Dash Platform packages
 dpp = { path = "../rs-dpp" }
-dash-sdk = { path = "../rs-sdk", default-features = false, features = ["dashpay-contract", "dpns-contract"] }
+dash-sdk = { path = "../rs-sdk", default-features = false, features = ["dashpay-contract", "dpns-contract", "wallet"] }
 platform-encryption = { path = "../rs-platform-encryption" }
 
 # Key wallet dependencies (from rust-dashcore)
@@ -57,7 +57,7 @@ static_assertions = "1.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 # Re-enable the SDK with mocks feature for test-only mock builders;
 # the non-test build keeps the leaner default-feature SDK above.
-dash-sdk = { path = "../rs-sdk", default-features = false, features = ["dashpay-contract", "dpns-contract", "mocks"] }
+dash-sdk = { path = "../rs-sdk", default-features = false, features = ["dashpay-contract", "dpns-contract", "wallet", "mocks"] }
 
 
 [features]
diff --git a/packages/rs-platform-wallet/src/changeset/changeset.rs b/packages/rs-platform-wallet/src/changeset/changeset.rs
index 40af538a08f..f3e0fe76c2e 100644
--- a/packages/rs-platform-wallet/src/changeset/changeset.rs
+++ b/packages/rs-platform-wallet/src/changeset/changeset.rs
@@ -23,6 +23,7 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use dashcore::blockdata::transaction::{OutPoint, Transaction};
+use dashcore::ephemerealdata::chain_lock::ChainLock;
 use dashcore::ephemerealdata::instant_lock::InstantLock;
 use dashcore::Txid;
 
@@ -135,6 +136,19 @@ pub struct CoreChangeSet {
     /// the same flush both pushing the same gap-limit boundary
     /// collapse to one entry.
     pub addresses_derived: Vec<key_wallet_manager::DerivedAddress>,
+
+    /// Highest chainlock the wallet has applied (mirrors
+    /// `WalletMetadata::last_applied_chain_lock`). Populated by the
+    /// `TransactionsChainlocked` bridge arm so the persister can
+    /// roundtrip this field across app restarts — without persisting
+    /// it, `metadata.last_applied_chain_lock` starts as `None` on
+    /// every load and the asset-lock-resume metadata fallback
+    /// (`proof.rs`) can't fire until SPV re-applies a fresh CL.
+    ///
+    /// Monotonic-max on merge by `block_height` (a chainlock at a
+    /// lower height never overwrites a higher one — chain locks are
+    /// strictly forward-advancing per upstream's contract).
+    pub last_applied_chain_lock: Option<ChainLock>,
 }
 
 impl Merge for CoreChangeSet {
@@ -177,6 +191,20 @@ impl Merge for CoreChangeSet {
         // append only entries we haven't seen yet — preserves arrival
         // order so the persister's writes line up with the same
         // derivation order the wallet's pool sees.
+        // Chain-lock watermark: monotonic-max by `block_height`. A
+        // later changeset's chain lock at a higher (or equal) height
+        // wins; anything lower is ignored. `None` means "no update
+        // in this batch", same convention as `synced_height`.
+        if let Some(other_cl) = other.last_applied_chain_lock {
+            let take = self
+                .last_applied_chain_lock
+                .as_ref()
+                .is_none_or(|existing| other_cl.block_height >= existing.block_height);
+            if take {
+                self.last_applied_chain_lock = Some(other_cl);
+            }
+        }
+
         if !other.addresses_derived.is_empty() {
             let mut seen: std::collections::HashSet<(
                 key_wallet::account::AccountType,
@@ -204,6 +232,7 @@ impl Merge for CoreChangeSet {
             && self.last_processed_height.is_none()
             && self.synced_height.is_none()
             && self.addresses_derived.is_empty()
+            && self.last_applied_chain_lock.is_none()
     }
 }
 
diff --git a/packages/rs-platform-wallet/src/changeset/core_bridge.rs b/packages/rs-platform-wallet/src/changeset/core_bridge.rs
index b2d9761ac2b..e4593b09777 100644
--- a/packages/rs-platform-wallet/src/changeset/core_bridge.rs
+++ b/packages/rs-platform-wallet/src/changeset/core_bridge.rs
@@ -195,6 +195,36 @@ async fn build_core_changeset(
             synced_height: Some(*height),
             ..CoreChangeSet::default()
         },
+        WalletEvent::TransactionsChainlocked { chain_lock, .. } => {
+            // The wallet has already promoted the matching records from
+            // `InBlock` to `InChainLockedBlock` by the time this event
+            // fires (upstream `WalletManager::process_chain_lock` mutates
+            // the in-memory map before emitting); our poll loop reads
+            // `record.context.is_chain_locked()` directly so we don't
+            // mirror per-record promotions here.
+            //
+            // What we DO persist is the wallet's global
+            // `metadata.last_applied_chain_lock` advance. Without this
+            // roundtrip, the metadata starts as `None` on every restart
+            // and the asset-lock-resume CL-from-metadata fallback in
+            // `proof.rs` can't fire until SPV re-applies a fresh
+            // ChainLock — wasted latency that the persister-roundtrip
+            // collapses to ~zero. SPV persists its own `best_chainlock`
+            // independently; this is the symmetric wallet-side
+            // persistence, not a re-application.
+            //
+            // Caveat: the upstream `apply_chain_lock` only emits this
+            // event when `per_account` is non-empty (records were
+            // promoted). A CL that advanced the wallet's metadata but
+            // had nothing to promote is invisible here — accepted
+            // limitation, addressed in practice because the very
+            // first CL that does promote records (typical on an
+            // actively-syncing wallet) persists the current height.
+            CoreChangeSet {
+                last_applied_chain_lock: Some(chain_lock.clone()),
+                ..CoreChangeSet::default()
+            }
+        }
     }
 }
 
@@ -323,5 +353,6 @@ impl CoreChangeSet {
             && self.instant_locks_for_non_final_records.is_empty()
             && self.last_processed_height.is_none()
             && self.synced_height.is_none()
+            && self.last_applied_chain_lock.is_none()
     }
 }
diff --git a/packages/rs-platform-wallet/src/error.rs b/packages/rs-platform-wallet/src/error.rs
index 006e9b01331..717462e0659 100644
--- a/packages/rs-platform-wallet/src/error.rs
+++ b/packages/rs-platform-wallet/src/error.rs
@@ -96,8 +96,14 @@ pub enum PlatformWalletError {
     #[error("Token operation failed: {0}")]
     TokenError(String),
 
-    #[error("Timed out waiting for finality proof for transaction {0}")]
-    FinalityTimeout(dashcore::Txid),
+    #[error("Timed out waiting for finality proof for outpoint {0}")]
+    /// IS-lock did not propagate within `wait_for_proof`'s deadline.
+    /// Carries the outpoint (not just the txid) so the caller can
+    /// drive the IS→CL upgrade flow without re-walking the
+    /// tracked-asset-lock map by `(funding_type, identity_index)` —
+    /// which is BTreeMap-order, non-deterministic when multiple
+    /// unproven locks share that key.
+    FinalityTimeout(dashcore::OutPoint),
 
     #[error("Asset lock proof expired (IS proof too old, CL not yet available): {0}")]
     AssetLockExpired(String),
@@ -161,3 +167,76 @@ pub fn is_instant_lock_proof_invalid(error: &dash_sdk::Error) -> bool {
         ))
     )
 }
+
+/// Check whether a platform-wallet error represents a *Core-side*
+/// InstantSend lock timeout (the asset-lock manager waited the full
+/// timeout for an IS-lock proof and never observed one).
+///
+/// Companion to [`is_instant_lock_proof_invalid`] (which detects
+/// **Platform-side** rejection of an IS proof after one was obtained).
+/// Both surfaces trigger the same fallback path in the registration /
+/// top-up flow: upgrade the asset-lock to a ChainLock proof and retry.
+///
+/// The IS-timeout shape comes from
+/// [`AssetLockManager::wait_for_proof`](crate::wallet::asset_lock::manager::AssetLockManager),
+/// which emits `PlatformWalletError::FinalityTimeout(Txid)` when the
+/// 300-second IS deadline elapses.
+pub fn is_instant_lock_timeout(error: &PlatformWalletError) -> bool {
+    matches!(error, PlatformWalletError::FinalityTimeout(_))
+}
+
+/// Extract the `InvalidAssetLockProofCoreChainHeightError` (DPP
+/// consensus code 10506) from an SDK error if Platform rejected a
+/// ChainLock asset-lock proof because Platform's
+/// `last_committed_core_height` is still behind the proof's
+/// `core_chain_locked_height`.
+///
+/// Returns `Some(&error)` whenever the rejection matches, exposing
+/// `proof_core_chain_locked_height()` (what the wallet claimed) and
+/// `current_core_chain_locked_height()` (Platform's currently observed
+/// tip). The latter is what the wallet can log to attribute the lag
+/// to: small means routine race against Platform's
+/// `create-empty-blocks-interval` (3m on mainnet); large or stuck
+/// means the DAPI node we hit is genuinely behind / misbehaving.
+///
+/// Returns `None` for everything else. The check is stateless and
+/// re-evaluated on every CheckTx, so a resubmit after Platform
+/// catches up will pass — but Tenderdash's mempool caches rejected-tx
+/// hashes for ~24h on mainnet/testnet (`keep-invalid-txs-in-cache =
+/// true` in dashmate's tenderdash template), so the resubmit must
+/// carry a *different* signable-bytes hash to bypass the cache. The
+/// submission layer handles that by bumping
+/// `PutSettings::user_fee_increase` before re-issuing.
+///
+/// Companion to [`is_instant_lock_proof_invalid`]; both feed the
+/// CL-proof retry path in the identity registration / top-up flow.
+///
+/// **Coverage caveat:** only inspects the two `dash_sdk::Error`
+/// variants that today wrap consensus errors —
+/// `StateTransitionBroadcastError` (from `broadcast_and_wait`) and
+/// `Protocol(ProtocolError::ConsensusError)` (from validation). If a
+/// future SDK version surfaces the same `InvalidAssetLockProofCoreChainHeightError`
+/// through a different variant (e.g. wrapped in a transport-layer
+/// error type), the retry helper silently falls through to the "Sdk"
+/// passthrough. Re-audit this matcher whenever `dash_sdk::Error`
+/// gains new variants that can carry consensus errors.
+pub fn as_asset_lock_proof_cl_height_too_low(
+    error: &dash_sdk::Error,
+) -> Option<&dpp::consensus::basic::identity::InvalidAssetLockProofCoreChainHeightError> {
+    use dpp::consensus::basic::BasicError;
+    use dpp::consensus::ConsensusError;
+
+    let consensus_error = match error {
+        dash_sdk::Error::StateTransitionBroadcastError(broadcast_err) => {
+            broadcast_err.cause.as_ref()
+        }
+        dash_sdk::Error::Protocol(dpp::ProtocolError::ConsensusError(ce)) => Some(ce.as_ref()),
+        _ => None,
+    };
+    match consensus_error {
+        Some(ConsensusError::BasicError(
+            BasicError::InvalidAssetLockProofCoreChainHeightError(e),
+        )) => Some(e),
+        _ => None,
+    }
+}
diff --git a/packages/rs-platform-wallet/src/lib.rs b/packages/rs-platform-wallet/src/lib.rs
index 98b9a609a43..a2a6cdd3848 100644
--- a/packages/rs-platform-wallet/src/lib.rs
+++ b/packages/rs-platform-wallet/src/lib.rs
@@ -60,9 +60,8 @@ pub use wallet::identity::{
     calculate_account_reference, derive_auto_accept_private_key, derive_contact_payment_address,
     derive_contact_payment_addresses, derive_contact_xpub, BlockTime, ContactRequest,
     ContactXpubData, DashPayProfile, DpnsNameInfo, EstablishedContact, IdentityFunding,
-    IdentityFundingMethod, IdentityLocation, IdentityManager, IdentityStatus, KeyStorage,
-    ManagedIdentity, PrivateKeyData, ProfileUpdate, RegistrationIndex, TopUpFundingMethod,
-    DEFAULT_CONTACT_GAP_LIMIT,
+    IdentityLocation, IdentityManager, IdentityStatus, KeyStorage, ManagedIdentity,
+    PrivateKeyData, ProfileUpdate, RegistrationIndex, DEFAULT_CONTACT_GAP_LIMIT,
 };
 pub use wallet::platform_wallet::PlatformWalletInfo;
 pub use wallet::PlatformAddressTag;
diff --git a/packages/rs-platform-wallet/src/manager/accessors.rs b/packages/rs-platform-wallet/src/manager/accessors.rs
index 172667098af..578079f9986 100644
--- a/packages/rs-platform-wallet/src/manager/accessors.rs
+++ b/packages/rs-platform-wallet/src/manager/accessors.rs
@@ -490,6 +490,7 @@ impl<P: PlatformWalletPersistence + 'static> PlatformWalletManager<P> {
                     AssetLockStatus::Broadcast => 1,
                     AssetLockStatus::InstantSendLocked => 2,
                     AssetLockStatus::ChainLocked => 3,
+                    AssetLockStatus::Consumed => 4,
                 };
                 let (instant_lock_present, chain_lock_height) = match &lock.proof {
                     Some(dpp::prelude::AssetLockProof::Instant(_)) => (true, 0u32),
diff --git a/packages/rs-platform-wallet/src/wallet/apply.rs b/packages/rs-platform-wallet/src/wallet/apply.rs
index 1c0ea40654b..f6834094336 100644
--- a/packages/rs-platform-wallet/src/wallet/apply.rs
+++ b/packages/rs-platform-wallet/src/wallet/apply.rs
@@ -47,7 +47,7 @@
 use key_wallet::wallet::Wallet;
 
 use crate::changeset::PlatformWalletChangeSet;
-use crate::wallet::asset_lock::tracked::TrackedAssetLock;
+use crate::wallet::asset_lock::tracked::{AssetLockStatus, TrackedAssetLock};
 use crate::wallet::platform_wallet::PlatformWalletInfo;
 
 /// Errors returned by [`PlatformWalletInfo::apply_changeset`] and the
@@ -277,21 +277,36 @@ impl PlatformWalletInfo {
         //    field difference is `amount_duffs` vs `amount`. The
         //    `Transaction` inside the entry transfers ownership
         //    directly into the wallet map with no clone.
+        //
+        //    `Consumed` is the terminal post-consumption state: it
+        //    means an identity registration / top-up has burned this
+        //    asset lock. We drop the entry from the in-memory map
+        //    (the wallet has no further use for it; nothing should be
+        //    waiting on its proof) but the changeset's `asset_locks`
+        //    entry still flows through to the Swift persister so the
+        //    `PersistentAssetLock` row is upserted with `statusRaw=4`
+        //    for historical lookups (e.g. the Transactions list
+        //    rendering the original locked amount on a consumed
+        //    funding tx).
         if let Some(al_cs) = asset_locks {
             for (out_point, entry) in al_cs.asset_locks {
-                self.tracked_asset_locks.insert(
-                    out_point,
-                    TrackedAssetLock {
-                        out_point: entry.out_point,
-                        transaction: entry.transaction,
-                        account_index: entry.account_index,
-                        funding_type: entry.funding_type,
-                        identity_index: entry.identity_index,
-                        amount: entry.amount_duffs,
-                        status: entry.status,
-                        proof: entry.proof,
-                    },
-                );
+                if entry.status == AssetLockStatus::Consumed {
+                    self.tracked_asset_locks.remove(&out_point);
+                } else {
+                    self.tracked_asset_locks.insert(
+                        out_point,
+                        TrackedAssetLock {
+                            out_point: entry.out_point,
+                            transaction: entry.transaction,
+                            account_index: entry.account_index,
+                            funding_type: entry.funding_type,
+                            identity_index: entry.identity_index,
+                            amount: entry.amount_duffs,
+                            status: entry.status,
+                            proof: entry.proof,
+                        },
+                    );
+                }
             }
             for out_point in al_cs.removed {
                 self.tracked_asset_locks.remove(&out_point);
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
index d4ca680af55..dd8b8a8e886 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/build.rs
@@ -7,8 +7,10 @@ use crate::broadcaster::TransactionBroadcaster;
 use std::time::Duration;
 
 use dashcore::Address as DashAddress;
-use dashcore::{OutPoint, PrivateKey, Transaction, TxOut};
+use dashcore::{OutPoint, Transaction, TxOut};
+use key_wallet::bip32::DerivationPath;
 use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
+use key_wallet::signer::Signer;
 use key_wallet::wallet::managed_wallet_info::asset_lock_builder::{
     AssetLockFundingType, CreditOutputFunding,
 };
@@ -27,8 +29,11 @@ use super::tracked::{AssetLockStatus, TrackedAssetLock};
 impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     /// Build an asset lock transaction using the key-wallet builder.
     ///
-    /// Delegates UTXO selection, fee calculation, change handling, and signing
-    /// to `ManagedWalletInfo::build_asset_lock`.
+    /// Delegates UTXO selection, fee calculation, and signing to
+    /// `ManagedWalletInfo::build_asset_lock_with_signer`. The host
+    /// never sees a raw credit-output private key — the returned
+    /// `DerivationPath` is what the caller hands back to the same
+    /// `signer` when the credit output is later consumed on Platform.
     ///
     /// # Arguments
     ///
@@ -37,13 +42,21 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     /// * `funding_type` — Which account to derive the one-time key from
     ///   (e.g., `IdentityRegistration`, `IdentityTopUp`).
     /// * `identity_index` — Identity index (used by `IdentityTopUp`, ignored by others).
-    pub async fn build_asset_lock_transaction(
+    /// * `signer` — External signer that produces both the funding-input
+    ///   P2PKH signatures and the credit-output public key. For Swift,
+    ///   this is typically a
+    ///   [`MnemonicResolverCoreSigner`](crate::wallet::asset_lock::build)
+    ///   from `platform-wallet-ffi` — built on top of the
+    ///   Keychain-resolver vtable so private keys never cross the FFI
+    ///   boundary.
+    pub async fn build_asset_lock_transaction<S: Signer>(
         &self,
         amount_duffs: u64,
         account_index: u32,
         funding_type: AssetLockFundingType,
         identity_index: u32,
-    ) -> Result<(Transaction, PrivateKey), PlatformWalletError> {
+        signer: &S,
+    ) -> Result<(Transaction, DerivationPath), PlatformWalletError> {
         if amount_duffs == 0 {
             return Err(PlatformWalletError::AssetLockTransaction(
                 "Amount must be greater than zero".to_string(),
@@ -76,10 +89,16 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
             identity_index,
         };
 
-        // 3. Delegate to the key-wallet builder.
+        // 3. Delegate to the key-wallet signer-driven builder.
         let result = info
             .core_wallet
-            .build_asset_lock(wallet, account_index, vec![funding], DEFAULT_FEE_PER_KB)
+            .build_asset_lock_with_signer(
+                wallet,
+                account_index,
+                vec![funding],
+                DEFAULT_FEE_PER_KB,
+                signer,
+            )
             .await
             .map_err(|e| {
                 PlatformWalletError::AssetLockTransaction(format!(
@@ -88,36 +107,31 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                 ))
             })?;
 
-        // 4. Convert the raw key bytes to a PrivateKey.
+        // 4. Pull the (pubkey, path) for our single credit output.
         //
-        // `build_asset_lock` is the soft-wallet variant, so the
-        // keys are always the `Private` variant of
-        // `AssetLockCreditKeys`. The `Public` variant would only
-        // come from `build_asset_lock_with_signer` (external
-        // signer path) which we don't use here.
+        // `build_asset_lock_with_signer` always returns the `Public`
+        // variant. The `Private` arm would only come from the soft-
+        // wallet `build_asset_lock` path which we no longer call from
+        // platform-wallet — defensively bail if it appears.
         use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockCreditKeys;
-        let key_bytes = match result.keys {
-            AssetLockCreditKeys::Private(mut keys) => keys.drain(..).next().ok_or_else(|| {
-                PlatformWalletError::AssetLockTransaction(
-                    "Builder returned no credit-output keys".to_string(),
-                )
-            })?,
-            AssetLockCreditKeys::Public(_) => {
+        let path = match result.keys {
+            AssetLockCreditKeys::Public(mut keys) => {
+                let (_pubkey, path) = keys.drain(..).next().ok_or_else(|| {
+                    PlatformWalletError::AssetLockTransaction(
+                        "Builder returned no credit-output keys".to_string(),
+                    )
+                })?;
+                path
+            }
+            AssetLockCreditKeys::Private(_) => {
                 return Err(PlatformWalletError::AssetLockTransaction(
-                    "Builder returned Public keys (signer path); expected Private from soft wallet"
+                    "Builder returned Private keys; signer-driven path expected Public"
                         .to_string(),
                 ));
             }
         };
-        let one_time_private_key = PrivateKey::from_byte_array(&key_bytes, self.sdk.network)
-            .map_err(|e| {
-                PlatformWalletError::AssetLockTransaction(format!(
-                    "Invalid private key from builder: {}",
-                    e
-                ))
-            })?;
 
-        Ok((result.transaction, one_time_private_key))
+        Ok((result.transaction, path))
     }
 
     /// Peek at the next unused address from a funding account without
@@ -260,12 +274,15 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     ///
     /// ## Flow
     ///
-    /// 1. Build the asset lock transaction via the key-wallet builder.
+    /// 1. Build the asset lock transaction via the key-wallet
+    ///    signer-driven builder.
     /// 2. Track the lifecycle as `Built` (in-memory).
     /// 3. Broadcast the transaction.
     /// 4. Wait for an InstantLock or ChainLock proof via the event channel.
     /// 5. Track the lifecycle as `InstantSendLocked` or `ChainLocked`.
-    /// 6. Return `(proof, private_key, txid)`.
+    /// 6. Return `(proof, credit_output_derivation_path, txid)` — the
+    ///    caller hands the path back to the same `signer` when
+    ///    consuming the credit on Platform.
     ///
     /// ## Persistence
     ///
@@ -284,16 +301,26 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     /// * `funding_type` — Which account to derive the one-time key from.
     /// * `identity_index` — HD identity index (for `IdentityTopUp`, this is
     ///   the registration index identifying which identity is being topped up).
-    pub async fn create_funded_asset_lock_proof(
+    /// * `signer` — External ECDSA signer (Swift Keychain-backed in
+    ///   production via `MnemonicResolverCoreSigner`).
+    pub async fn create_funded_asset_lock_proof<S: Signer>(
         &self,
         amount_duffs: u64,
         account_index: u32,
         funding_type: AssetLockFundingType,
         identity_index: u32,
-    ) -> Result<(dpp::prelude::AssetLockProof, PrivateKey, OutPoint), PlatformWalletError> {
+        signer: &S,
+    ) -> Result<(dpp::prelude::AssetLockProof, DerivationPath, OutPoint), PlatformWalletError>
+    {
         // 1. Build the asset lock transaction.
-        let (tx, key) = self
-            .build_asset_lock_transaction(amount_duffs, account_index, funding_type, identity_index)
+        let (tx, path) = self
+            .build_asset_lock_transaction(
+                amount_duffs,
+                account_index,
+                funding_type,
+                identity_index,
+                signer,
+            )
             .await?;
 
         let txid = tx.txid();
@@ -352,6 +379,6 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
             .await?;
         self.queue_asset_lock_changeset(cs_final);
 
-        Ok((proof, key, out_point))
+        Ok((proof, path, out_point))
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/lock_notify_handler.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/lock_notify_handler.rs
index ab4336acd3e..8c159cdda20 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/lock_notify_handler.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/lock_notify_handler.rs
@@ -22,12 +22,28 @@ impl LockNotifyHandler {
 
 impl EventHandler for LockNotifyHandler {
     fn on_sync_event(&self, event: &dash_spv::sync::SyncEvent) {
-        if matches!(
-            event,
-            dash_spv::sync::SyncEvent::InstantLockReceived { .. }
-                | dash_spv::sync::SyncEvent::ChainLockReceived { .. }
-        ) {
-            self.notify.notify_waiters();
+        // Demoted to `debug!` — these events arrive at network
+        // frequency on a synced node (every 2.5min for CL on
+        // mainnet, plus per-tx IS events). Operator visibility into
+        // *what we did* with each event lives on the consumer side
+        // (`wait_for_proof`); this handler just wakes them.
+        match event {
+            dash_spv::sync::SyncEvent::InstantLockReceived { .. } => {
+                tracing::debug!("LockNotifyHandler: InstantLockReceived — waking waiters");
+                self.notify.notify_waiters();
+            }
+            dash_spv::sync::SyncEvent::ChainLockReceived {
+                chain_lock,
+                validated,
+            } => {
+                tracing::debug!(
+                    chain_lock_height = chain_lock.block_height,
+                    validated,
+                    "LockNotifyHandler: ChainLockReceived — waking waiters"
+                );
+                self.notify.notify_waiters();
+            }
+            _ => {}
         }
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/manager.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/manager.rs
index 3afc0053612..a39e1e52fcd 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/manager.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/manager.rs
@@ -106,6 +106,21 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
 // ---------------------------------------------------------------------------
 
 impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
+    /// Wallet id this manager operates on. Exposed so FFI callers that
+    /// build a `MnemonicResolverCoreSigner` (or similar) on demand can
+    /// thread the wallet id through to the resolver callback without
+    /// reaching into private fields.
+    pub fn wallet_id(&self) -> WalletId {
+        self.wallet_id
+    }
+
+    /// Network the SDK was constructed with. Same rationale as
+    /// [`Self::wallet_id`] — needed by FFI callers that build a
+    /// `key_wallet::signer::Signer` per call.
+    pub fn network(&self) -> dashcore::Network {
+        self.sdk.network
+    }
+
     /// List all tracked asset locks (blocking version for UI / synchronous contexts).
     ///
     /// Uses `tokio::sync::RwLock::blocking_read` — must NOT be called from
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/proof.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/proof.rs
index 8850f595b35..d6215d33de5 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/proof.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/proof.rs
@@ -120,21 +120,18 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                 ))
             })?;
 
-        let is_chain_locked = matches!(record.context, TransactionContext::InChainLockedBlock(_));
-        let height = record.height().unwrap_or(0);
-
-        if is_chain_locked && height > 0 {
-            let platform_height = self.get_platform_core_chain_locked_height().await?;
-
-            if height <= platform_height {
+        // Local SPV-verified ChainLock is the only signal we trust.
+        // Skipping a Platform-tip pre-flight: it's an unproven self-
+        // report and a malicious DAPI could stall us forever; the
+        // submission layer handles the CL-height race by retrying with
+        // a bumped `user_fee_increase` if Platform's tip lags ours.
+        if matches!(record.context, TransactionContext::InChainLockedBlock(_)) {
+            if let Some(height) = record.height() {
                 tracing::debug!(
-                    "Upgrading IS-lock proof to ChainLock proof for tx {} \
-                     (height={}, platform_cl_height={})",
+                    "Upgrading IS-lock proof to ChainLock proof for tx {} (height={})",
                     out_point.txid,
                     height,
-                    platform_height,
                 );
-
                 return Ok(dpp::prelude::AssetLockProof::Chain(ChainAssetLockProof {
                     core_chain_locked_height: height,
                     out_point: *out_point,
@@ -145,19 +142,6 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
         Ok(proof)
     }
 
-    /// Fetch Platform's current `core_chain_locked_height` by querying the
-    /// latest epoch info with metadata.
-    async fn get_platform_core_chain_locked_height(&self) -> Result<u32, PlatformWalletError> {
-        use dash_sdk::platform::fetch_current_no_parameters::FetchCurrent;
-        use dpp::block::extended_epoch_info::ExtendedEpochInfo;
-
-        let (_epoch, metadata) = ExtendedEpochInfo::fetch_current_with_metadata(&self.sdk)
-            .await
-            .map_err(PlatformWalletError::Sdk)?;
-
-        Ok(metadata.core_chain_locked_height)
-    }
-
     /// Upgrade an IS-lock proof to a ChainLock proof after a Platform
     /// rejection.
     ///
@@ -243,30 +227,21 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
             }
         };
 
-        // Wait for Platform to verify the block height.
-        let platform_height = self.get_platform_core_chain_locked_height().await?;
-
-        if height > platform_height {
-            // Platform hasn't verified this block yet. Poll until it does
-            // (ChainLock propagation to Platform is typically fast).
-            tracing::info!(
-                "TX {} at height {} but Platform at height {}, waiting...",
-                txid,
-                height,
-                platform_height
-            );
-            // TODO: Poll Platform height until it catches up, for now return error.
-            return Err(PlatformWalletError::AssetLockExpired(format!(
-                "Transaction {} is at height {} but Platform has only verified up to height {}",
-                txid, height, platform_height
-            )));
-        }
-
+        // Build the proof at the wallet's SPV-verified ChainLock height.
+        // We DON'T consult Platform's self-reported `core_chain_locked_height`
+        // here — that metadata is unproven and a malicious DAPI node could
+        // stall us indefinitely. If Platform's CL tip is briefly behind
+        // ours at submission time (race window up to
+        // `create-empty-blocks-interval`, ~3m on mainnet), the caller's
+        // submission layer (`registration.rs`) detects the resulting
+        // `InvalidAssetLockProofCoreChainHeightError` (code 10506) and
+        // retries with a fresh ST (bumped `user_fee_increase`) to bypass
+        // Tenderdash's invalid-tx cache (`keep-invalid-txs-in-cache = true`
+        // on mainnet/testnet).
         tracing::info!(
-            "Building ChainLock proof for tx {} (height={}, platform_cl_height={})",
+            "Building ChainLock proof for tx {} (height={}, SPV-verified locally)",
             txid,
             height,
-            platform_height,
         );
 
         Ok(dpp::prelude::AssetLockProof::Chain(ChainAssetLockProof {
@@ -290,6 +265,21 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
         let deadline = tokio::time::Instant::now() + timeout;
 
         loop {
+            // Arm the `Notify` future BEFORE the state check, closing
+            // the missed-wakeup race in dashpay/platform#3641
+            // (Found-008): `notify_waiters()` only wakes already-
+            // registered waiters and does NOT store a permit, so a
+            // CL/IS event arriving in the gap between "no proof yet"
+            // and the `.await` below would be discarded and we'd
+            // sleep until `FinalityTimeout`. Calling `enable()` on
+            // the pinned `Notified` future registers this waiter
+            // first; any subsequent `notify_waiters()` is captured
+            // and the `await` either completes immediately or, if
+            // the event fires after, wakes us up normally.
+            let notified = self.lock_notify.notified();
+            tokio::pin!(notified);
+            notified.as_mut().enable();
+
             // Check — might have been updated by SPV sync. Falls back
             // to the persister so a chainlock that arrived between
             // polls (and was evicted from the in-memory map) is still
@@ -316,14 +306,16 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
 
             let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
             if remaining.is_zero() {
-                return Err(PlatformWalletError::FinalityTimeout(out_point.txid));
+                return Err(PlatformWalletError::FinalityTimeout(*out_point));
             }
 
-            // Wait for a lock event notification or timeout.
+            // Wait for a lock event notification or timeout. The
+            // `notified` future is the one we armed above, so any
+            // CL/IS event since then is already buffered into it.
             tokio::select! {
-                _ = self.lock_notify.notified() => continue,
+                _ = &mut notified => continue,
                 _ = tokio::time::sleep(remaining) => {
-                    return Err(PlatformWalletError::FinalityTimeout(out_point.txid));
+                    return Err(PlatformWalletError::FinalityTimeout(*out_point));
                 }
             }
         }
@@ -347,7 +339,9 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
         use dpp::identity::state_transition::asset_lock_proof::InstantAssetLockProof;
         use key_wallet::transaction_checking::TransactionContext;
 
+        tracing::info!(outpoint = %out_point, ?timeout, "wait_for_proof: entered");
         let deadline = tokio::time::Instant::now() + timeout;
+        let mut iter: u32 = 0;
 
         // Read account_index and transaction from the tracked lock.
         let (account_index, tracked_tx) = {
@@ -365,6 +359,49 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
         };
 
         loop {
+            iter += 1;
+            // Arm the `Notify` future BEFORE the state check, closing
+            // the missed-wakeup race in dashpay/platform#3641
+            // (Found-008): `notify_waiters()` only wakes already-
+            // registered waiters and does NOT store a permit, so an
+            // IS/CL event arriving in the gap between "no proof yet"
+            // and the `.await` below would be discarded and we'd
+            // sleep until `FinalityTimeout`. Calling `enable()` on
+            // the pinned `Notified` future registers this waiter
+            // first; any subsequent `notify_waiters()` is captured
+            // and the `await` either completes immediately or, if
+            // the event fires after, wakes us up normally.
+            let notified = self.lock_notify.notified();
+            tokio::pin!(notified);
+            notified.as_mut().enable();
+
+            // Snapshot the wallet's global CL state for diagnostics.
+            let (wallet_cl_height, in_memory_tx_ctx, in_memory_tx_height) = {
+                let wm = self.wallet_manager.read().await;
+                let info = wm.get_wallet_info(&self.wallet_id);
+                let cl_h = info
+                    .as_ref()
+                    .and_then(|i| i.core_wallet.metadata.last_applied_chain_lock.as_ref())
+                    .map(|cl| cl.block_height);
+                let rec = info.as_ref().and_then(|i| {
+                    i.core_wallet
+                        .accounts
+                        .standard_bip44_accounts
+                        .get(&account_index)
+                        .and_then(|a| a.transactions().get(&out_point.txid))
+                });
+                let ctx = rec.map(|r| format!("{:?}", r.context));
+                let h = rec.and_then(|r| r.height());
+                (cl_h, ctx, h)
+            };
+            tracing::debug!(
+                outpoint = %out_point,
+                iter,
+                wallet_cl_height = ?wallet_cl_height,
+                in_memory_tx_ctx = ?in_memory_tx_ctx,
+                in_memory_tx_height = ?in_memory_tx_height,
+                "wait_for_proof: iteration"
+            );
             // Check the transaction record context for finality. Falls
             // back to the persister so a chainlocked record evicted
             // from the in-memory map is still observed.
@@ -393,26 +430,109 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                     }
                     TransactionContext::InChainLockedBlock(_) => {
                         if let Some(height) = record.height() {
+                            // SPV-verified ChainLock BLS signature already
+                            // promoted this record's context — local
+                            // finality is cryptographically established.
+                            // We don't pre-flight Platform here; the
+                            // submission layer handles the CL-height race
+                            // by retrying with a bumped `user_fee_increase`
+                            // when Platform's tip is briefly behind ours.
                             return Ok(dpp::prelude::AssetLockProof::Chain(ChainAssetLockProof {
                                 core_chain_locked_height: height,
                                 out_point: *out_point,
                             }));
                         }
                     }
-                    _ => {}
+                    _ => {
+                        // Per-record context isn't `InChainLockedBlock`
+                        // yet, but the wallet's global
+                        // `last_applied_chain_lock` may already cover
+                        // this record's block height — e.g. on
+                        // app-launch catch-up, when a record is
+                        // re-injected into the in-memory map at its
+                        // persisted `InBlock` context, after the CL
+                        // event that would have promoted it has already
+                        // fired and passed. The wallet's metadata holds
+                        // the BLS-verified ChainLock from that earlier
+                        // event, so we can build a Chain proof directly
+                        // — same cryptographic guarantee as the
+                        // `InChainLockedBlock` arm above.
+                        //
+                        // Chain-id check: refuse the fallback if the
+                        // wallet's declared network doesn't match the
+                        // SDK's. A persisted `last_applied_chain_lock`
+                        // from a different network (config drift /
+                        // restore-from-backup gone wrong) would have
+                        // us building a proof against the wrong chain;
+                        // Platform would reject with 10506 and the
+                        // submission layer would burn its full retry
+                        // budget on impossible-to-satisfy bumps.
+                        if let Some(height) = record.height() {
+                            let (wallet_cl_height, wallet_network) = {
+                                let wm = self.wallet_manager.read().await;
+                                let info = wm.get_wallet_info(&self.wallet_id);
+                                let cl_h = info
+                                    .as_ref()
+                                    .and_then(|i| {
+                                        i.core_wallet.metadata.last_applied_chain_lock.as_ref()
+                                    })
+                                    .map(|cl| cl.block_height);
+                                let net = info.map(|i| {
+                                    use key_wallet::wallet::managed_wallet_info::wallet_info_interface::WalletInfoInterface;
+                                    i.network()
+                                });
+                                (cl_h, net)
+                            };
+                            let networks_match =
+                                matches!(wallet_network, Some(n) if n == self.sdk.network);
+                            if matches!(wallet_cl_height, Some(h) if h >= height)
+                                && networks_match
+                            {
+                                tracing::info!(
+                                    "Building ChainLock proof for tx {} from wallet's \
+                                     last_applied_chain_lock (record at height={}, \
+                                     wallet_cl={}) — per-record promotion missed by \
+                                     SPV catch-up cascade",
+                                    out_point.txid,
+                                    height,
+                                    wallet_cl_height.unwrap_or(0),
+                                );
+                                return Ok(dpp::prelude::AssetLockProof::Chain(
+                                    ChainAssetLockProof {
+                                        core_chain_locked_height: height,
+                                        out_point: *out_point,
+                                    },
+                                ));
+                            } else if matches!(wallet_cl_height, Some(h) if h >= height)
+                                && !networks_match
+                            {
+                                tracing::error!(
+                                    sdk_network = ?self.sdk.network,
+                                    wallet_network = ?wallet_network,
+                                    outpoint = %out_point,
+                                    "wait_for_proof: REFUSING to build CL proof from \
+                                     wallet_cl_height fallback — wallet's declared \
+                                     network does not match the SDK's. Persisted \
+                                     state likely loaded into the wrong network."
+                                );
+                            }
+                        }
+                    }
                 }
             }
 
             let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
             if remaining.is_zero() {
-                return Err(PlatformWalletError::FinalityTimeout(out_point.txid));
+                return Err(PlatformWalletError::FinalityTimeout(*out_point));
             }
 
-            // Wait for a lock event notification or timeout.
+            // Wait for a lock event notification or timeout. The
+            // `notified` future is the one we armed above, so any
+            // IS/CL event since then is already buffered into it.
             tokio::select! {
-                _ = self.lock_notify.notified() => continue,
+                _ = &mut notified => continue,
                 _ = tokio::time::sleep(remaining) => {
-                    return Err(PlatformWalletError::FinalityTimeout(out_point.txid));
+                    return Err(PlatformWalletError::FinalityTimeout(*out_point));
                 }
             }
         }
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/recovery.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/recovery.rs
index b26a140f3fd..e08ae860c2d 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/recovery.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/recovery.rs
@@ -8,7 +8,8 @@ use crate::broadcaster::TransactionBroadcaster;
 use std::time::Duration;
 
 use dashcore::Address as DashAddress;
-use dashcore::{OutPoint, PrivateKey};
+use dashcore::OutPoint;
+use key_wallet::bip32::DerivationPath;
 use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
 use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
 
@@ -198,27 +199,45 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
     ///   (upgrading a stale IS-lock to a ChainLock proof if necessary).
     ///
     /// After obtaining the proof, advances the tracked lock status and
-    /// re-derives the one-time private key from the wallet.
+    /// re-derives the one-time credit-output derivation path from the
+    /// wallet's funding-account address pool.
     ///
-    /// Returns `(proof, private_key)` ready for use in identity registration
-    /// or top-up.
+    /// Returns `(proof, derivation_path)` ready for use in identity
+    /// registration or top-up via the `_with_signer` SDK methods. The
+    /// caller passes `derivation_path` to the same signer used for the
+    /// build phase when the credit output is later consumed on Platform.
     pub async fn resume_asset_lock(
         &self,
         out_point: &OutPoint,
         timeout: Duration,
-    ) -> Result<(dpp::prelude::AssetLockProof, PrivateKey), PlatformWalletError> {
+    ) -> Result<(dpp::prelude::AssetLockProof, DerivationPath), PlatformWalletError> {
+        tracing::info!(outpoint = %out_point, ?timeout, "resume_asset_lock: entered");
+
         // 1. Look up the tracked lock — snapshot the fields we need.
         let (tx, status, existing_proof, account_index) = {
             let wm = self.wallet_manager.read().await;
             let info = wm
                 .get_wallet_info(&self.wallet_id)
                 .ok_or_else(|| PlatformWalletError::WalletNotFound(hex::encode(self.wallet_id)))?;
+            let tracked_count = info.tracked_asset_locks.len();
             let lock = info.tracked_asset_locks.get(out_point).ok_or_else(|| {
+                tracing::warn!(
+                    outpoint = %out_point,
+                    tracked_count,
+                    "resume_asset_lock: asset lock not in tracked_asset_locks map"
+                );
                 PlatformWalletError::AssetLockProofWait(format!(
                     "Asset lock {} is not tracked",
                     out_point
                 ))
             })?;
+            tracing::info!(
+                outpoint = %out_point,
+                status = ?lock.status,
+                has_proof = lock.proof.is_some(),
+                account_index = lock.account_index,
+                "resume_asset_lock: lock looked up"
+            );
             (
                 lock.transaction.clone(),
                 lock.status.clone(),
@@ -257,6 +276,19 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                 self.validate_or_upgrade_proof(proof, account_index, out_point)
                     .await?
             }
+            AssetLockStatus::Consumed => {
+                // Terminal — the asset lock was already burned by a
+                // successful identity registration / top-up. We
+                // should never reach this arm in practice (the
+                // `tracked_asset_locks` map drops Consumed entries
+                // and the load path filters them out), but the
+                // exhaustive match needs an arm. Treat as a wallet-
+                // state mismatch rather than panicking.
+                return Err(PlatformWalletError::AssetLockProofWait(format!(
+                    "Asset lock {} is already Consumed — nothing to resume",
+                    out_point
+                )));
+            }
         };
 
         // 3. Advance status and attach proof.
@@ -269,8 +301,8 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
             .await?;
         self.queue_asset_lock_changeset(cs);
 
-        // 4. Re-derive the one-time private key.
-        let private_key = {
+        // 4. Re-derive the one-time credit-output derivation path.
+        let path = {
             let wm = self.wallet_manager.read().await;
             let info = wm
                 .get_wallet_info(&self.wallet_id)
@@ -281,22 +313,31 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                     out_point
                 ))
             })?;
-            self.rederive_private_key(lock).await?
+            self.rederive_credit_output_path(lock).await?
         };
 
-        Ok((proof, private_key))
+        Ok((proof, path))
     }
 
-    /// Re-derive the one-time private key for a tracked asset lock.
+    /// Re-derive the one-time credit-output **derivation path** for a
+    /// tracked asset lock.
     ///
     /// The credit output address was generated from a funding account
-    /// (identity registration, top-up, etc.). This method finds that address
-    /// in the funding account's address pool, retrieves its derivation path,
-    /// and derives the private key from the wallet's root key.
-    async fn rederive_private_key(
+    /// (identity registration, top-up, etc.). This method finds that
+    /// address in the funding account's address pool and retrieves
+    /// its derivation path — the path is what the caller hands to a
+    /// `key_wallet::signer::Signer` when later consuming the credit
+    /// output on Platform.
+    ///
+    /// Previously this method derived the actual private key from the
+    /// wallet's root xpriv; that path is no longer reachable for
+    /// `ExternalSignable` wallets (the root key isn't in-process) and
+    /// the signer-based architecture doesn't need it — the signer
+    /// owns derivation end-to-end.
+    async fn rederive_credit_output_path(
         &self,
         lock: &TrackedAssetLock,
-    ) -> Result<PrivateKey, PlatformWalletError> {
+    ) -> Result<DerivationPath, PlatformWalletError> {
         use dashcore::blockdata::transaction::special_transaction::TransactionPayload;
         use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
 
@@ -374,17 +415,6 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
                 ))
             })?;
 
-        // 4. Derive the private key from the wallet's root key.
-        let wallet = wm
-            .get_wallet(&self.wallet_id)
-            .ok_or_else(|| PlatformWalletError::WalletNotFound(hex::encode(self.wallet_id)))?;
-        let secret_key = wallet.derive_private_key(&derivation_path).map_err(|e| {
-            PlatformWalletError::AssetLockTransaction(format!(
-                "Failed to derive private key for asset lock: {}",
-                e
-            ))
-        })?;
-
-        Ok(PrivateKey::new(secret_key, self.sdk.network))
+        Ok(derivation_path)
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/tracking.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/tracking.rs
index e25df55ea05..8c5fdde9018 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/sync/tracking.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/sync/tracking.rs
@@ -25,19 +25,58 @@ impl<B: TransactionBroadcaster + ?Sized> AssetLockManager<B> {
         cs
     }
 
-    /// Remove an asset lock after successful consumption (registration or top-up).
+    /// Mark a tracked asset lock as
+    /// [`Consumed`](AssetLockStatus::Consumed) after a successful
+    /// identity registration or top-up.
     ///
-    /// Returns an [`AssetLockChangeSet`] tombstoning the removed entry
-    /// (empty if the lock was not tracked).
-    pub(crate) async fn remove_asset_lock(&self, out_point: &OutPoint) -> AssetLockChangeSet {
+    /// Two-sided semantics:
+    ///
+    /// 1. **In-memory** (`tracked_asset_locks`) — the entry is
+    ///    removed. The wallet has no further use for a consumed lock
+    ///    (proof is one-shot, status will never advance again), so
+    ///    keeping it in memory just costs heap.
+    /// 2. **Persisted** (`PersistentAssetLock` on the Swift side) —
+    ///    the row is retained with `status = Consumed`. Historical
+    ///    UI lookups (e.g. the Transactions list mapping a funding
+    ///    tx row back to its locked amount) need this row to
+    ///    survive consumption.
+    ///
+    /// The changeset carries only `asset_locks` (with the consumed
+    /// entry). It deliberately does NOT populate `removed`: that set
+    /// drives the Swift persister to delete the row, which would
+    /// undo (2). Apply-side replay in `apply.rs` detects the
+    /// `Consumed` status and drops the in-memory entry on the
+    /// Rust side, mirroring this method's runtime behavior.
+    ///
+    /// Distinguishes three outcomes via the result:
+    ///
+    /// - `Ok(changeset)` with a populated `asset_locks` entry — the
+    ///   lock was tracked and is now `Consumed`. The changeset upserts
+    ///   the persisted row with `statusRaw=4` for historical lookup.
+    /// - `Ok(empty changeset)` — the lock was not tracked (already
+    ///   consumed by a prior call, or never present). Idempotent.
+    /// - `Err(WalletNotFound)` — the wallet id is unknown to the
+    ///   manager. Always a programmer error / stale handle.
+    pub(crate) async fn consume_asset_lock(
+        &self,
+        out_point: &OutPoint,
+    ) -> Result<AssetLockChangeSet, PlatformWalletError> {
         let mut wm = self.wallet_manager.write().await;
+        let info = wm
+            .get_wallet_info_mut(&self.wallet_id)
+            .ok_or_else(|| PlatformWalletError::WalletNotFound(hex::encode(self.wallet_id)))?;
         let mut cs = AssetLockChangeSet::default();
-        if let Some(info) = wm.get_wallet_info_mut(&self.wallet_id) {
-            if info.tracked_asset_locks.remove(out_point).is_some() {
-                cs.removed.insert(*out_point);
-            }
+        if let Some(mut entry) = info.tracked_asset_locks.remove(out_point) {
+            entry.status = AssetLockStatus::Consumed;
+            entry.proof = None; // one-shot — never relevant after consumption
+            cs.asset_locks.insert(*out_point, (&entry).into());
+        } else {
+            tracing::warn!(
+                outpoint = %out_point,
+                "consume_asset_lock: outpoint not tracked — already consumed or never present"
+            );
         }
-        cs
+        Ok(cs)
     }
 
     /// Advance the status of a tracked asset lock and optionally attach the proof.
diff --git a/packages/rs-platform-wallet/src/wallet/asset_lock/tracked.rs b/packages/rs-platform-wallet/src/wallet/asset_lock/tracked.rs
index 7939e67d03c..83657e4b9fd 100644
--- a/packages/rs-platform-wallet/src/wallet/asset_lock/tracked.rs
+++ b/packages/rs-platform-wallet/src/wallet/asset_lock/tracked.rs
@@ -5,20 +5,41 @@
 //!
 //! Private keys are NOT stored here — they are re-derived from
 //! `funding_type` + `identity_index` via the key-wallet's `Wallet`.
-/// TODO: Shall we move to state module
+
 use dashcore::{OutPoint, Transaction};
 use dpp::prelude::AssetLockProof;
 use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
 
 use crate::changeset::AssetLockEntry;
 
-/// Asset lock status on Core chain. Tracked until consumed, then removed.
+/// Asset lock status on Core chain.
+///
+/// The wallet tracks asset locks from build through consumption. The
+/// terminal [`Consumed`](Self::Consumed) state is kept (rather than
+/// removed from storage) so historical UI lookups — e.g. the
+/// "Transactions" list mapping a funding tx to its locked amount —
+/// still resolve after the identity registration / top-up succeeded.
+/// The catch-up scanner and any "ready to fund" UI filter on
+/// `< InstantSendLocked` so post-Consumed entries don't generate
+/// noise.
+///
+/// NOT `#[non_exhaustive]` by design: every cross-crate match site
+/// (FFI, accessors) uses exhaustive arms intentionally so the
+/// compiler catches a new variant addition the way `Consumed` was
+/// caught — at every status_to_u8 / status_from_u8 / serializer call.
+/// Marking the enum `#[non_exhaustive]` would force wildcard arms
+/// and silently lose that signal.
 #[derive(Debug, Clone, PartialEq)]
 pub enum AssetLockStatus {
     Built,
     Broadcast,
     InstantSendLocked,
     ChainLocked,
+    /// Successfully consumed by an identity registration / top-up.
+    /// Terminal state. The entry persists for historical lookup
+    /// (amount, identity index, funding tx) but is excluded from any
+    /// "still actionable" predicate.
+    Consumed,
 }
 
 /// A tracked asset lock. Private keys are NOT stored here — they're
diff --git a/packages/rs-platform-wallet/src/wallet/core/balance_handler.rs b/packages/rs-platform-wallet/src/wallet/core/balance_handler.rs
index fdf9120add2..d6974721275 100644
--- a/packages/rs-platform-wallet/src/wallet/core/balance_handler.rs
+++ b/packages/rs-platform-wallet/src/wallet/core/balance_handler.rs
@@ -53,6 +53,10 @@ impl EventHandler for BalanceUpdateHandler {
             } => (wallet_id, balance),
             // No balance on SyncHeightAdvanced — checkpoint advance only.
             WalletEvent::SyncHeightAdvanced { .. } => return,
+            // No balance on TransactionsChainlocked — chainlocks only
+            // promote finality (`InBlock` → `InChainLockedBlock`),
+            // they don't change UTXO state or balances.
+            WalletEvent::TransactionsChainlocked { .. } => return,
         };
 
         // try_read on the wallets map (NOT the wallet_manager
diff --git a/packages/rs-platform-wallet/src/wallet/core/broadcast.rs b/packages/rs-platform-wallet/src/wallet/core/broadcast.rs
index c4ab34f3ab5..4609d1fb6d2 100644
--- a/packages/rs-platform-wallet/src/wallet/core/broadcast.rs
+++ b/packages/rs-platform-wallet/src/wallet/core/broadcast.rs
@@ -1,6 +1,7 @@
 use dashcore::{Address as DashAddress, Transaction};
 use key_wallet::account::account_type::StandardAccountType;
 use key_wallet::managed_account::managed_account_trait::ManagedAccountTrait;
+use key_wallet::signer::Signer;
 
 use crate::broadcaster::TransactionBroadcaster;
 use crate::{CoreWallet, PlatformWalletError};
@@ -25,9 +26,19 @@ impl<B: TransactionBroadcaster + ?Sized> CoreWallet<B> {
 
     /// Build, sign, and broadcast a payment to the given addresses.
     ///
-    /// Uses key-wallet's [`TransactionBuilder`] for UTXO selection, fee
-    /// estimation, and signing. Change is sent to the next internal address
-    /// of the specified account.
+    /// Uses key-wallet's
+    /// [`TransactionBuilder`](key_wallet::wallet::managed_wallet_info::transaction_builder::TransactionBuilder)
+    /// for UTXO selection, fee estimation, and signing. Change is sent to
+    /// the next internal address of the specified account.
+    ///
+    /// Signing is delegated to the caller-supplied
+    /// [`Signer`](key_wallet::signer::Signer) via the
+    /// `impl<S: Signer> TransactionSigner for S` blanket in
+    /// `key-wallet`'s `transaction_builder.rs`. For Swift wallets this
+    /// is typically a
+    /// [`MnemonicResolverCoreSigner`](crate::wallet::asset_lock::build)
+    /// from `platform-wallet-ffi`, backed by the Keychain-resolver
+    /// vtable so private keys never cross the FFI boundary.
     ///
     /// **Note (smell):** the body of this method is a near-duplicate of
     /// `ManagedWalletInfo::build_and_sign_transaction` in `key-wallet`
@@ -35,11 +46,12 @@ impl<B: TransactionBroadcaster + ?Sized> CoreWallet<B> {
     /// It's reimplemented here because the upstream helper is BIP-44-only,
     /// parametrizing upstream on `AccountTypePreference` so it picks
     /// `standard_bip{32,44}_accounts` would be a trivial change
-    pub async fn send_to_addresses(
+    pub async fn send_to_addresses<S: Signer>(
         &self,
         account_type: StandardAccountType,
         account_index: u32,
         outputs: Vec<(DashAddress, u64)>,
+        signer: &S,
     ) -> Result<Transaction, PlatformWalletError> {
         use key_wallet::wallet::managed_wallet_info::coin_selection::SelectionStrategy;
         use key_wallet::wallet::managed_wallet_info::transaction_builder::TransactionBuilder;
@@ -108,6 +120,11 @@ impl<B: TransactionBroadcaster + ?Sized> CoreWallet<B> {
                 ),
             };
 
+            // The blanket `impl<S: Signer> TransactionSigner for S` in
+            // `key-wallet/src/wallet/managed_wallet_info/transaction_builder.rs:482`
+            // makes the signer drop-in for the previously `Wallet`-backed
+            // path; the funds-derived `address_derivation_path` lookup is
+            // unchanged.
             let mut builder = TransactionBuilder::new()
                 .set_current_height(current_height)
                 .set_selection_strategy(SelectionStrategy::LargestFirst)
@@ -117,7 +134,7 @@ impl<B: TransactionBroadcaster + ?Sized> CoreWallet<B> {
             }
 
             let (tx, _fee) = builder
-                .build_signed(wallet, |addr| {
+                .build_signed(signer, |addr| {
                     managed_account.address_derivation_path(&addr)
                 })
                 .await
diff --git a/packages/rs-platform-wallet/src/wallet/core/wallet.rs b/packages/rs-platform-wallet/src/wallet/core/wallet.rs
index 5a29db29002..8e83fd6b947 100644
--- a/packages/rs-platform-wallet/src/wallet/core/wallet.rs
+++ b/packages/rs-platform-wallet/src/wallet/core/wallet.rs
@@ -55,6 +55,14 @@ impl<B: TransactionBroadcaster + ?Sized> CoreWallet<B> {
         &self.balance
     }
 
+    /// Wallet id this `CoreWallet` operates on. Exposed so FFI
+    /// callers that need to construct a per-call `Signer` (e.g.
+    /// `MnemonicResolverCoreSigner`) can thread the same wallet id
+    /// the resolver callback will receive.
+    pub fn wallet_id(&self) -> WalletId {
+        self.wallet_id
+    }
+
     /// Get the next unused BIP-44 external (receive) address for a specific account.
     pub async fn next_receive_address_for_account(
         &self,
diff --git a/packages/rs-platform-wallet/src/wallet/identity/mod.rs b/packages/rs-platform-wallet/src/wallet/identity/mod.rs
index 25fcf426a8b..c2c567185da 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/mod.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/mod.rs
@@ -34,6 +34,6 @@ pub use state::{BlockTime, IdentityLocation, IdentityManager, ManagedIdentity, R
 pub use types::dashpay::profile::{calculate_avatar_hash, calculate_dhash_fingerprint};
 pub use types::{
     ContactRequest, DashPayProfile, DashpayAddressMatch, DpnsNameInfo, EstablishedContact,
-    IdentityFunding, IdentityFundingMethod, IdentityStatus, KeyStorage, PaymentDirection,
-    PaymentEntry, PaymentStatus, PrivateKeyData, ProfileUpdate, TopUpFundingMethod,
+    IdentityFunding, IdentityStatus, KeyStorage, PaymentDirection, PaymentEntry, PaymentStatus,
+    PrivateKeyData, ProfileUpdate,
 };
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/identity_handle.rs b/packages/rs-platform-wallet/src/wallet/identity/network/identity_handle.rs
index 80619ef8663..07e1ff75a29 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/identity_handle.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/identity_handle.rs
@@ -467,18 +467,17 @@ impl<B: TransactionBroadcaster + ?Sized> IdentityWallet<B> {
         })
     }
 
-    /// Extract the outpoint from an asset lock proof.
-    ///
-    /// For instant proofs, this is the txid of the embedded transaction
-    /// combined with the output index from the proof.
-    /// For chain proofs, this is the out_point directly.
-    pub(super) fn out_point_from_proof(proof: &AssetLockProof) -> Option<dashcore::OutPoint> {
+    /// Extract the outpoint from an asset lock proof. Total over the
+    /// `AssetLockProof` enum — neither variant can fail to produce an
+    /// outpoint (Instant: derived from embedded tx + output index;
+    /// Chain: carried directly as `out_point`).
+    pub(super) fn out_point_from_proof(proof: &AssetLockProof) -> dashcore::OutPoint {
         match proof {
-            AssetLockProof::Instant(instant) => Some(dashcore::OutPoint::new(
+            AssetLockProof::Instant(instant) => dashcore::OutPoint::new(
                 instant.transaction().txid(),
                 instant.output_index(),
-            )),
-            AssetLockProof::Chain(chain) => Some(chain.out_point),
+            ),
+            AssetLockProof::Chain(chain) => chain.out_point,
         }
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/registration.rs b/packages/rs-platform-wallet/src/wallet/identity/network/registration.rs
index 8d5943235c2..eeccaef2184 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/registration.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/registration.rs
@@ -1,8 +1,58 @@
-//! Identity registration flows.
+//! Identity registration and top-up flows.
+//!
+//! Two public entry points — one to register, one to top up:
+//!
+//! - [`register_identity_with_funding`](IdentityWallet::register_identity_with_funding)
+//! - [`top_up_identity_with_funding`](IdentityWallet::top_up_identity_with_funding)
+//!
+//! Each handles pre-flight, funding resolution, submission with
+//! Platform-side retries, IS→CL fallback, and IdentityManager
+//! bookkeeping. The SDK's `_with_signer` calls are issued inline
+//! at the submission site — no thin "primitive" wrappers, since
+//! a primitive that bypasses the recovery layers has no caller in
+//! this codebase. If a single-shot use case ever materialises
+//! (e.g. an external tool managing its own submission policy),
+//! factor it out then; cheaper to add a method than to maintain a
+//! dead one.
+//!
+//! ## Platform-side recovery layers
+//!
+//! Both methods wrap the SDK submission in two retry layers, in
+//! this order:
+//!
+//! 1. **CL-height-too-low** (`InvalidAssetLockProofCoreChainHeightError`,
+//!    consensus code 10506) — Platform's observed Core tip is briefly
+//!    behind the wallet's SPV-verified CL. Bump
+//!    `PutSettings::user_fee_increase` (changes ST signable bytes →
+//!    different ST hash → bypasses Tenderdash's 24h invalid-tx cache)
+//!    and resubmit the same proof. See
+//!    [`submit_with_cl_height_retry`].
+//!
+//! 2. **IS-lock rejection** (`InvalidInstantAssetLockProofSignatureError`)
+//!    — Drive rejected because the IS-lock signing quorum has rotated
+//!    out. Detected via [`crate::error::is_instant_lock_proof_invalid`].
+//!    Upgrade IS→CL via `upgrade_to_chain_lock_proof` and retry. The
+//!    CL retry is itself wrapped in the CL-height-too-low loop.
+//!
+//! On the funding-build side, a third recovery handles the
+//! Core-side IS timeout:
+//!
+//! 3. **IS-lock build-time timeout** —
+//!    [`create_funded_asset_lock_proof`](crate::wallet::asset_lock::manager::AssetLockManager::create_funded_asset_lock_proof)
+//!    returns `PlatformWalletError::FinalityTimeout` because the
+//!    IS-lock didn't propagate within 300s. Resolved by re-entering
+//!    `resume_asset_lock` (which will fall through to the
+//!    `metadata.last_applied_chain_lock` fallback in `proof.rs`).
+//!
+//! All recovery paths share the same outpoint-keyed cleanup —
+//! [`consume_asset_lock`](crate::wallet::asset_lock::manager::AssetLockManager::consume_asset_lock)
+//! — once Platform finally accepts the submission.
 
 use std::collections::BTreeMap;
 use std::time::Duration;
 
+use dashcore::OutPoint;
+use dpp::identity::accessors::IdentitySettersV0;
 use dpp::identity::signer::Signer;
 use dpp::identity::v0::IdentityV0;
 use dpp::identity::Identity;
@@ -12,70 +62,334 @@ use dpp::identity::Purpose;
 use dpp::identity::SecurityLevel;
 use dpp::prelude::AssetLockProof;
 use dpp::prelude::Identifier;
+use key_wallet::bip32::DerivationPath;
+use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
 
 use dash_sdk::platform::transition::put_identity::PutIdentity;
 use dash_sdk::platform::transition::put_settings::PutSettings;
 use dash_sdk::platform::transition::top_up_identity::TopUpIdentity;
 
-use crate::error::PlatformWalletError;
-// PrivateKeyData no longer needed at the registration call sites —
-// `add_key` takes a flat `Option<(wallet_id, identity_index, key_index)>`
-// breadcrumb directly.
-
+use crate::error::{
+    as_asset_lock_proof_cl_height_too_low, is_instant_lock_proof_invalid, PlatformWalletError,
+};
 use crate::wallet::identity::types::funding::IdentityFunding;
 
 use super::*;
-use crate::wallet::identity::types::funding::IdentityFundingMethod;
 
 // ---------------------------------------------------------------------------
-// Identity registration
+// Timeout policy
+// ---------------------------------------------------------------------------
+
+/// Time we will wait for a ChainLock to materialise after an IS-lock
+/// fallback is triggered. 180s mirrors the existing fallback shape and
+/// is roughly the worst-case ChainLock latency we've observed in
+/// testnet operation. Promoted to a constant so the registration and
+/// top-up flows can't drift apart on this number.
+const CL_FALLBACK_TIMEOUT: Duration = Duration::from_secs(180);
+
+/// Delay between retries when Platform rejected with CL-height-too-low.
+/// Each retry bumps `PutSettings::user_fee_increase` so the ST hash
+/// changes (Tenderdash caches rejected ST hashes for ~24h on
+/// mainnet/testnet — `keep-invalid-txs-in-cache = true` in dashmate's
+/// tenderdash template, hardcoded at
+/// `packages/dashmate/templates/platform/drive/tenderdash/config.toml.dot:355`).
+const CL_HEIGHT_RETRY_DELAY: Duration = Duration::from_secs(15);
+
+/// Total time we'll keep retrying before surfacing the error. Sized to
+/// cover Platform's `create-empty-blocks-interval` (3m on mainnet)
+/// plus a 30s safety margin: if Platform hasn't observed the wallet's
+/// ChainLock by then, the lag is no longer routine and we need
+/// operator visibility instead of further silent retries. The
+/// rejection error carries Platform's `current_core_chain_locked_height`
+/// each round so logs name the laggard node's reported tip explicitly.
+const CL_HEIGHT_RETRY_BUDGET: Duration = Duration::from_secs(210);
+
+/// Submit a state transition with automatic retry on
+/// `InvalidAssetLockProofCoreChainHeightError` (consensus code 10506).
+///
+/// Each retry bumps `settings.user_fee_increase` so the resubmitted ST
+/// hashes differently — Tenderdash caches rejected ST hashes for ~24h
+/// on mainnet/testnet (`keep-invalid-txs-in-cache = true`), so an
+/// identical-bytes resubmit would be silently dropped before reaching
+/// Platform's CheckTx.
+///
+/// We don't pre-flight Platform's chain-lock tip — that's an unproven
+/// self-report and a malicious DAPI node could stall us indefinitely.
+/// Submit optimistically and react to Platform's deterministic CheckTx
+/// rejection. The cryptographic finality guarantee on the wallet side
+/// comes from the SPV-verified ChainLock BLS signature
+/// (`info.core_wallet.metadata.last_applied_chain_lock`) that promoted
+/// the asset-lock tx's record context to `InChainLockedBlock` before
+/// we constructed the proof.
+///
+/// Non-CL-height errors are passed through unchanged. Every rejection
+/// is logged with both the proof's claimed height and Platform's
+/// currently observed Core tip so persistent lag (>3.5min) attributes
+/// to the specific DAPI node we hit and not to a generic timeout.
+///
+/// **Cancellation:** not cancellation-safe. If the caller drops the
+/// returned future mid-sleep, the bumped `user_fee_increase` is lost
+/// and any in-flight submission whose response we never consume
+/// remains queued in Tenderdash's mempool until it commits or expires.
+/// Callers wrapping this in `tokio::select!` with a short timeout
+/// should be prepared to either retry (settings reset to original)
+/// or accept that Platform may still execute the dropped attempt.
+async fn submit_with_cl_height_retry<F, Fut, R>(
+    mut settings: Option<PutSettings>,
+    submit: F,
+) -> Result<R, dash_sdk::Error>
+where
+    F: Fn(Option<PutSettings>) -> Fut,
+    Fut: std::future::Future<Output = Result<R, dash_sdk::Error>>,
+{
+    let started = tokio::time::Instant::now();
+    let deadline = started + CL_HEIGHT_RETRY_BUDGET;
+    let mut attempt: u32 = 0;
+    loop {
+        attempt += 1;
+        match submit(settings).await {
+            Ok(r) => return Ok(r),
+            Err(e) => {
+                let Some(detail) = as_asset_lock_proof_cl_height_too_low(&e) else {
+                    return Err(e);
+                };
+                let elapsed = started.elapsed();
+                let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+                if remaining.is_zero() {
+                    tracing::error!(
+                        "Platform rejected ChainLock proof: CL height too low \
+                         (proof claimed height={}, Platform tip={}, attempt {}, \
+                         elapsed {}s) — retry budget of {}s exhausted; surfacing \
+                         error. Platform's reported tip is stuck — likely a lagging \
+                         or misbehaving DAPI node.",
+                        detail.proof_core_chain_locked_height(),
+                        detail.current_core_chain_locked_height(),
+                        attempt,
+                        elapsed.as_secs(),
+                        CL_HEIGHT_RETRY_BUDGET.as_secs(),
+                    );
+                    return Err(e);
+                }
+                let sleep_for = remaining.min(CL_HEIGHT_RETRY_DELAY);
+                tracing::warn!(
+                    "Platform rejected ChainLock proof: CL height too low \
+                     (proof claimed height={}, Platform tip={}, attempt {}, \
+                     elapsed {}s); bumping user_fee_increase and waiting {}s \
+                     before retry",
+                    detail.proof_core_chain_locked_height(),
+                    detail.current_core_chain_locked_height(),
+                    attempt,
+                    elapsed.as_secs(),
+                    sleep_for.as_secs(),
+                );
+                settings = Some(bump_user_fee_increase(settings.unwrap_or_default()));
+                tokio::time::sleep(sleep_for).await;
+            }
+        }
+    }
+}
+
+/// Bump `user_fee_increase` by 1 (saturating at `u16::MAX`).
+fn bump_user_fee_increase(mut settings: PutSettings) -> PutSettings {
+    settings.user_fee_increase = Some(settings.user_fee_increase.unwrap_or(0).saturating_add(1));
+    settings
+}
+
+// ---------------------------------------------------------------------------
+// Funding resolution (shared between register and top-up)
 // ---------------------------------------------------------------------------
 
+/// Outcome of resolving an [`IdentityFunding`] to a concrete asset-lock
+/// proof + derivation path.
+///
+/// `tracked_out_point` is `Some` whenever this wallet's
+/// `AssetLockManager` owns the lifecycle of the underlying asset lock
+/// — i.e. for `FromWalletBalance` (we just built and tracked it) and
+/// `FromExistingAssetLock` (caller is resuming a tracked entry). It's
+/// `None` for `UseAssetLock` where the caller has externally-managed
+/// proofs and we shouldn't touch the tracked-asset-lock map. The
+/// outpoint also drives both IS→CL fallback (look up the lock by
+/// outpoint) and cleanup (remove the lock on Platform success).
+struct ResolvedFunding {
+    proof: AssetLockProof,
+    path: DerivationPath,
+    tracked_out_point: Option<OutPoint>,
+}
+
+/// Outcome of [`IdentityWallet::resolve_funding_with_is_timeout_fallback`]:
+/// either a fully-resolved funding triple, or an IS-timeout that the
+/// caller can convert to a ChainLock retry using the recovered
+/// outpoint.
+enum FundingResolution {
+    Resolved(ResolvedFunding),
+    /// IS-lock didn't propagate within the asset-lock manager's wait
+    /// window. The outpoint of the tracked-but-unproven lock is
+    /// surfaced so the caller can drive an `upgrade_to_chain_lock_proof`
+    /// retry without re-walking the tracked-asset-lock map.
+    IsTimeout {
+        out_point: OutPoint,
+    },
+}
+
 impl IdentityWallet {
-    /// Register a new asset-lock-funded identity on Platform using an
-    /// externally-supplied signer + caller-derived authentication keys.
+    /// Resolve an [`IdentityFunding`] to a concrete proof + path +
+    /// (optional) tracked outpoint, capturing the IS-lock timeout case
+    /// as a structured outcome so the caller can drive a CL retry.
     ///
-    /// The caller must provide:
+    /// `funding_type` selects the BIP44 account the
+    /// `FromWalletBalance` variant pulls UTXOs from
+    /// (`IdentityRegistration` for register, `IdentityTopUp` for top
+    /// up). The other variants ignore it — they don't build new
+    /// asset locks.
     ///
-    /// - `funding`: an `IdentityFundingMethod`.
-    /// - `identity_index`: BIP-9 identity index.
-    /// - `keys_map`: the auth pubkeys the new identity will be created
-    ///   with. Caller must derive these from the wallet seed (or from
-    ///   iOS Keychain via `dash_sdk_derive_identity_keys_from_mnemonic`)
-    ///   and persist the matching private keys to whatever store the
-    ///   `signer` reads from. The first key (id=0) MUST be a MASTER /
-    ///   AUTHENTICATION key — DPP's IdentityCreate state transition
-    ///   itself must be signed by a MASTER-level identity key, and we
-    ///   pin that role on id=0 by convention so callers don't need
-    ///   protocol knowledge to assemble the map. The asset-lock-spend
-    ///   signature on the same transition is a separate signature
-    ///   keyed off `asset_lock_private_key`, supplied via `funding`.
-    /// - `signer`: external signer for the IdentityCreate transition's
-    ///   per-key signatures.
+    /// # IS-lock timeout handling
     ///
-    /// On success the new identity is added to the local manager and
-    /// each key is recorded with its derivation breadcrumb for the
-    /// persister callback. IS->CL fallback is retained.
-    pub async fn register_identity_with_funding_external_signer<S>(
+    /// For the two variants that internally invoke `wait_for_proof`
+    /// (`FromWalletBalance` and `FromExistingAssetLock`), an IS-lock
+    /// that never propagates within the 300s window surfaces as
+    /// `PlatformWalletError::FinalityTimeout(out_point)`. The variant
+    /// carries the *exact* outpoint that timed out (no
+    /// `find_tracked_unproven_lock` BTreeMap walk needed), so the
+    /// `IsTimeout` outcome is built directly from the error payload.
+    async fn resolve_funding_with_is_timeout_fallback<AS>(
         &self,
-        funding: IdentityFundingMethod,
+        funding: IdentityFunding,
+        funding_type: AssetLockFundingType,
+        identity_index: u32,
+        asset_lock_signer: &AS,
+    ) -> Result<FundingResolution, PlatformWalletError>
+    where
+        AS: ::key_wallet::signer::Signer + Send + Sync,
+    {
+        match funding {
+            IdentityFunding::FromWalletBalance { amount_duffs } => {
+                match self
+                    .asset_locks
+                    .create_funded_asset_lock_proof(
+                        amount_duffs,
+                        0,
+                        funding_type,
+                        identity_index,
+                        asset_lock_signer,
+                    )
+                    .await
+                {
+                    Ok((proof, path, out_point)) => {
+                        Ok(FundingResolution::Resolved(ResolvedFunding {
+                            proof,
+                            path,
+                            tracked_out_point: Some(out_point),
+                        }))
+                    }
+                    Err(PlatformWalletError::FinalityTimeout(out_point)) => {
+                        // The exact outpoint that timed out comes from
+                        // the error payload — no `find_tracked_unproven_lock`
+                        // walk needed (which would pick BTreeMap-first
+                        // on multiple unproven locks for the same key).
+                        Ok(FundingResolution::IsTimeout { out_point })
+                    }
+                    Err(e) => Err(e),
+                }
+            }
+            IdentityFunding::FromExistingAssetLock { out_point } => {
+                match self
+                    .asset_locks
+                    .resume_asset_lock(&out_point, Duration::from_secs(300))
+                    .await
+                {
+                    Ok((proof, path)) => Ok(FundingResolution::Resolved(ResolvedFunding {
+                        proof,
+                        path,
+                        tracked_out_point: Some(out_point),
+                    })),
+                    Err(PlatformWalletError::FinalityTimeout(timed_out)) => {
+                        // Outpoint from the error (which equals
+                        // `out_point` from the variant in practice —
+                        // but we use the error payload for parity
+                        // with the FromWalletBalance arm).
+                        Ok(FundingResolution::IsTimeout {
+                            out_point: timed_out,
+                        })
+                    }
+                    Err(e) => Err(e),
+                }
+            }
+            IdentityFunding::UseAssetLock {
+                proof,
+                derivation_path,
+            } => Ok(FundingResolution::Resolved(ResolvedFunding {
+                proof,
+                path: derivation_path,
+                // Caller owns the lock lifecycle — don't touch the
+                // tracked-asset-lock map.
+                tracked_out_point: None,
+            })),
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// register
+// ---------------------------------------------------------------------------
+
+impl IdentityWallet {
+    /// Register a new asset-lock-funded identity on Platform.
+    ///
+    /// Single entry point for every register-with-asset-lock case:
+    ///
+    /// 1. Pre-flight — validate `keys_map[0]` is a MASTER +
+    ///    AUTHENTICATION key (the IdentityCreate transition itself
+    ///    must be signed by a MASTER-level identity key, and we pin
+    ///    that role on id=0 by convention).
+    /// 2. Resolve the [`IdentityFunding`] to an asset-lock proof +
+    ///    derivation path.
+    /// 3. Submit via
+    ///    `Identity::put_to_platform_and_wait_for_response_with_signer`
+    ///    inside `submit_with_cl_height_retry`, with IS→CL fallback
+    ///    on **both** Core-side timeout (`FinalityTimeout`) and
+    ///    Platform-side rejection
+    ///    (`InvalidInstantAssetLockProofSignatureError`).
+    /// 4. On success, add the confirmed identity to the local
+    ///    `IdentityManager` and record each key's derivation breadcrumb.
+    /// 5. Remove the tracked asset lock (if any) — the credit output
+    ///    has been consumed, so the entry is no longer needed.
+    ///
+    /// # The IS→CL fallback path
+    ///
+    /// The Core-side timeout fallback is the architectural fix this
+    /// iter introduces. Before, `create_funded_asset_lock_proof`'s
+    /// 300s IS-lock timeout was terminal: a chain-locked but
+    /// IS-unlocked asset-lock would leave the funded DASH stranded.
+    /// The fix uses the **same** asset-lock signer for the CL retry —
+    /// no priv-key materialisation Rust-side — so the "no private keys
+    /// outside Swift, even briefly between operations" architectural
+    /// invariant is preserved.
+    ///
+    /// # Idempotency note
+    ///
+    /// The IS→CL retry is bounded (180s waiting for ChainLock). If the
+    /// CL retry itself fails, the asset-lock stays tracked (cleanup
+    /// only runs on Platform success) so subsequent registration
+    /// attempts can resume via `FromExistingAssetLock`.
+    pub async fn register_identity_with_funding<S, AS>(
+        &self,
+        funding: IdentityFunding,
         identity_index: u32,
         keys_map: BTreeMap<u32, IdentityPublicKey>,
-        signer: &S,
+        identity_signer: &S,
+        asset_lock_signer: &AS,
         settings: Option<PutSettings>,
     ) -> Result<Identity, PlatformWalletError>
     where
         S: Signer<IdentityPublicKey> + Send + Sync,
+        AS: ::key_wallet::signer::Signer + Send + Sync,
     {
+        // Step 1: pre-flight on the caller-supplied keys map.
         if keys_map.is_empty() {
             return Err(PlatformWalletError::InvalidIdentityData(
                 "keys_map must contain at least one identity public key".to_string(),
             ));
         }
-        // Defensive: pin id=0 to MASTER+AUTHENTICATION at the FFI
-        // boundary so a malformed map fails fast here instead of
-        // surfacing as an opaque protocol-side rejection from
-        // `put_to_platform_and_wait_for_response`.
         {
             use dpp::identity::identity_public_key::accessors::v0::IdentityPublicKeyGettersV0;
             match keys_map.get(&0) {
@@ -91,103 +405,129 @@ impl IdentityWallet {
                 }
                 None => {
                     return Err(PlatformWalletError::InvalidIdentityData(
-                        "keys_map must include key id=0 with MASTER security level".to_string(),
+                        "keys_map must include key id=0 with MASTER security level"
+                            .to_string(),
                     ));
                 }
             }
         }
 
-        // Step 1: obtain asset lock proof + private key.
-        let (asset_lock_proof, asset_lock_private_key) = match funding {
-            IdentityFundingMethod::UseAssetLock { proof, private_key } => (proof, private_key),
-            IdentityFundingMethod::FundWithWallet { amount_duffs } => {
-                use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
-                let (proof, key, _out_point) = self
+        // Step 2: resolve funding to a proof + derivation path. The
+        // resolver catches IS-lock timeouts and surfaces them as a
+        // structured outcome carrying the tracked outpoint, so the
+        // CL retry uses the SAME credit output (no new asset lock).
+        let ResolvedFunding {
+            proof,
+            path,
+            tracked_out_point,
+        } = match self
+            .resolve_funding_with_is_timeout_fallback(
+                funding,
+                AssetLockFundingType::IdentityRegistration,
+                identity_index,
+                asset_lock_signer,
+            )
+            .await?
+        {
+            FundingResolution::Resolved(rf) => rf,
+            FundingResolution::IsTimeout { out_point } => {
+                tracing::warn!(
+                    "IS-lock did not propagate within 300s for funded identity registration \
+                     (tx {}), falling back to ChainLock proof",
+                    out_point.txid
+                );
+                let chain_proof = self
                     .asset_locks
-                    .create_funded_asset_lock_proof(
-                        amount_duffs,
-                        0,
-                        AssetLockFundingType::IdentityRegistration,
-                        identity_index,
-                    )
+                    .upgrade_to_chain_lock_proof(&out_point, CL_FALLBACK_TIMEOUT)
                     .await?;
-                (proof, key)
+                // Recover the credit-output derivation path. The
+                // asset lock is now CL-attached (status advanced by
+                // `upgrade_to_chain_lock_proof`'s caller path), so
+                // `resume_asset_lock` short-circuits to the existing-
+                // proof branch and just re-derives the path. This is
+                // cheap (no SPV wait) and avoids duplicating the
+                // path-derivation logic here.
+                let (_, path) = self
+                    .asset_locks
+                    .resume_asset_lock(&out_point, CL_FALLBACK_TIMEOUT)
+                    .await?;
+                ResolvedFunding {
+                    proof: chain_proof,
+                    path,
+                    tracked_out_point: Some(out_point),
+                }
             }
         };
 
-        // Step 2: build the placeholder identity from caller-supplied keys.
-        let identity = Identity::V0(IdentityV0 {
+        // Build the placeholder identity ONCE so both the primary
+        // attempt and the IS→CL retry submit the same key set
+        // without a `keys_map` deep clone on the retry path.
+        let placeholder = Identity::V0(IdentityV0 {
             id: Identifier::default(),
             public_keys: keys_map,
             balance: 0,
             revision: 0,
         });
 
-        // Step 3: submit, with IS->CL fallback on InstantSend rejection.
-        let proof_out_point = Self::out_point_from_proof(&asset_lock_proof);
-
-        let identity = match identity
-            .put_to_platform_and_wait_for_response(
+        // Step 3: submit, with two layers of Platform-side fallback:
+        //   - **CL-height-too-low** (transient): bump `user_fee_increase`
+        //     and retry the same proof. See [`submit_with_cl_height_retry`].
+        //   - **IS-lock rejection** (quorum rotated): upgrade IS→CL on
+        //     the same credit-output outpoint — no new asset lock built,
+        //     no new funding-tx broadcast.
+        //
+        // Both retries share the original `placeholder` Identity; the
+        // CL-height retry also iterates inside the IS→CL fallback branch
+        // so a freshly-upgraded CL proof gets the same patience.
+        let proof_out_point = Self::out_point_from_proof(&proof);
+        let identity = match submit_with_cl_height_retry(settings, |s| {
+            placeholder.put_to_platform_and_wait_for_response_with_signer(
                 &self.sdk,
-                asset_lock_proof,
-                &asset_lock_private_key,
-                signer,
-                settings,
+                proof.clone(),
+                &path,
+                asset_lock_signer,
+                identity_signer,
+                s,
             )
-            .await
+        })
+        .await
         {
             Ok(identity) => identity,
-            Err(e) if crate::error::is_instant_lock_proof_invalid(&e) => {
-                if let Some(out_point) = proof_out_point {
-                    tracing::warn!(
-                        "IS-lock proof rejected for identity registration (tx {}, external signer), \
-                         retrying with ChainLock proof",
-                        out_point.txid
-                    );
-                    let chain_proof = self
-                        .asset_locks
-                        .upgrade_to_chain_lock_proof(&out_point, Duration::from_secs(180))
-                        .await?;
-                    identity
-                        .put_to_platform_and_wait_for_response(
-                            &self.sdk,
-                            chain_proof,
-                            &asset_lock_private_key,
-                            signer,
-                            settings,
-                        )
-                        .await
-                        .map_err(|e| {
-                            PlatformWalletError::InvalidIdentityData(format!(
-                                "Failed to register identity on Platform (ChainLock retry): {}",
-                                e
-                            ))
-                        })?
-                } else {
-                    return Err(PlatformWalletError::InvalidIdentityData(format!(
-                        "Failed to register identity on Platform: {}",
-                        e
-                    )));
-                }
-            }
-            Err(e) => {
-                return Err(PlatformWalletError::InvalidIdentityData(format!(
-                    "Failed to register identity on Platform: {}",
-                    e
-                )));
+            Err(e) if is_instant_lock_proof_invalid(&e) => {
+                let out_point = proof_out_point;
+                tracing::warn!(
+                    "IS-lock proof rejected by Platform for identity registration (tx {}), \
+                     retrying with ChainLock proof",
+                    out_point.txid
+                );
+                let chain_proof = self
+                    .asset_locks
+                    .upgrade_to_chain_lock_proof(&out_point, CL_FALLBACK_TIMEOUT)
+                    .await?;
+                submit_with_cl_height_retry(settings, |s| {
+                    placeholder.put_to_platform_and_wait_for_response_with_signer(
+                        &self.sdk,
+                        chain_proof.clone(),
+                        &path,
+                        asset_lock_signer,
+                        identity_signer,
+                        s,
+                    )
+                })
+                .await
+                .map_err(PlatformWalletError::Sdk)?
             }
+            Err(e) => return Err(PlatformWalletError::Sdk(e)),
         };
 
-        // Step 4: add to local manager + record key derivation
-        // breadcrumbs (mirrors the legacy variant exactly so the
-        // persister callback fires the same way regardless of which
-        // path produced the identity).
+        // Step 4: bookkeeping — add to local IdentityManager + record
+        // key derivation breadcrumbs.
         {
             use dpp::identity::accessors::IdentityGettersV0;
 
             let mut wm = self.wallet_manager.write().await;
             let info = wm.get_wallet_info_mut(&self.wallet_id).ok_or_else(|| {
-                crate::error::PlatformWalletError::WalletNotFound(
+                PlatformWalletError::WalletNotFound(
                     "Wallet info not found in wallet manager".to_string(),
                 )
             })?;
@@ -219,273 +559,256 @@ impl IdentityWallet {
             }
         }
 
-        Ok(identity)
-    }
+        // Step 5: clean up the tracked asset lock — Platform has
+        // accepted the registration and the credit output is now
+        // consumed. Only fires for the variants where we own the
+        // lifecycle (`FromWalletBalance` / `FromExistingAssetLock`);
+        // `UseAssetLock` is `None` and skipped.
+        if let Some(out_point) = tracked_out_point {
+            // Cleanup failure here can only mean WalletNotFound
+            // (the wallet handle that just registered an identity
+            // vanished). Surface as a warn — the identity DID
+            // register successfully on Platform, so propagating the
+            // error to the caller would be misleading.
+            if let Err(e) = self.asset_locks.consume_asset_lock(&out_point).await {
+                tracing::warn!(
+                    outpoint = %out_point,
+                    error = %e,
+                    "consume_asset_lock failed after successful Platform submit"
+                );
+            }
+        }
 
-    /// Register a new identity using an externally-provided identity, asset
-    /// lock proof, and signer.
-    ///
-    /// Unlike
-    /// [`register_identity_with_funding_external_signer`](Self::register_identity_with_funding_external_signer),
-    /// this method does **not** derive keys or manage the internal
-    /// `IdentityManager`. The caller supplies a fully-constructed `Identity`
-    /// object, the asset lock proof + private key, and a `Signer`
-    /// implementation directly.
-    ///
-    /// This is useful when the caller manages identities outside of the
-    /// platform-wallet `IdentityManager` (e.g. evo-tool's
-    /// `QualifiedIdentity`).
-    ///
-    /// Returns the confirmed `Identity` from Platform.
-    pub async fn register_identity_with_signer<S: Signer<IdentityPublicKey>>(
-        &self,
-        identity: &Identity,
-        asset_lock_proof: AssetLockProof,
-        asset_lock_private_key: &dashcore::PrivateKey,
-        signer: &S,
-        settings: Option<PutSettings>,
-    ) -> Result<Identity, dash_sdk::Error> {
-        identity
-            .put_to_platform_and_wait_for_response(
-                &self.sdk,
-                asset_lock_proof,
-                asset_lock_private_key,
-                signer,
-                settings,
-            )
-            .await
+        Ok(identity)
     }
+}
 
-    /// Top up an identity's credit balance using an externally-provided
-    /// identity and asset lock proof.
-    ///
-    /// Unlike [`top_up_identity_with_funding`](Self::top_up_identity_with_funding),
-    /// this method does **not** look up the identity in the internal
-    /// `IdentityManager`. The caller supplies the `Identity` object and the
-    /// asset lock proof + private key directly.
-    ///
-    /// This is useful when the caller manages identities outside of the
-    /// platform-wallet `IdentityManager` (e.g. evo-tool's
-    /// `QualifiedIdentity`).
-    ///
-    /// Returns the new credit balance.
-    pub async fn top_up_identity_with_signer(
-        &self,
-        identity: &Identity,
-        asset_lock_proof: AssetLockProof,
-        asset_lock_private_key: &dashcore::PrivateKey,
-        settings: Option<PutSettings>,
-    ) -> Result<u64, dash_sdk::Error> {
-        identity
-            .top_up_identity(
-                &self.sdk,
-                asset_lock_proof,
-                asset_lock_private_key,
-                settings.and_then(|s| s.user_fee_increase),
-                settings,
-            )
-            .await
-    }
+// ---------------------------------------------------------------------------
+// top-up
+// ---------------------------------------------------------------------------
 
-    /// Register a new identity using an [`IdentityFunding`] variant and an
-    /// externally-provided identity + signer.
-    ///
-    /// This method unifies funding resolution and Platform submission in a
-    /// single call:
-    ///
-    /// * **`FromWalletBalance`** — builds an asset lock from wallet UTXOs via
-    ///   [`AssetLockManager::create_funded_asset_lock_proof`], then submits the
-    ///   identity registration to Platform.
-    /// * **`FromExistingAssetLock`** — resumes a tracked asset lock by outpoint,
-    ///   re-deriving the proof and private key from whatever stage the lock
-    ///   is at.
+impl IdentityWallet {
+    /// Top up an existing identity's credit balance.
     ///
-    /// Unlike
-    /// [`register_identity_with_funding_external_signer`](Self::register_identity_with_funding_external_signer),
-    /// this method does **not** derive keys or manage the internal
-    /// `IdentityManager`. The caller supplies a fully-constructed `Identity`
-    /// and a `Signer` implementation, making it suitable for callers that
-    /// manage identities externally (e.g. evo-tool's `QualifiedIdentity`).
+    /// Mirror of [`register_identity_with_funding`](Self::register_identity_with_funding)
+    /// for top-ups:
     ///
-    /// Returns the confirmed `Identity` from Platform.
-    pub async fn funded_register_identity<S: Signer<IdentityPublicKey>>(
+    /// 1. Look up the identity by `identity_id` in the local
+    ///    `IdentityManager`. Return `IdentityNotFound` if missing.
+    /// 2. Resolve the [`IdentityFunding`] to an asset-lock proof.
+    /// 3. Submit via `Identity::top_up_identity_with_signer` inside
+    ///    `submit_with_cl_height_retry`, with IS→CL fallback on
+    ///    Core-side timeout and Platform-side rejection (same as
+    ///    register).
+    /// 4. Persist the new credit balance + remove the tracked asset
+    ///    lock.
+    pub async fn top_up_identity_with_funding<AS>(
         &self,
-        identity: &Identity,
+        identity_id: &Identifier,
         funding: IdentityFunding,
-        identity_index: u32,
-        signer: &S,
+        asset_lock_signer: &AS,
         settings: Option<PutSettings>,
-    ) -> Result<Identity, PlatformWalletError> {
-        use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
+    ) -> Result<u64, PlatformWalletError>
+    where
+        AS: ::key_wallet::signer::Signer + Send + Sync,
+    {
+        // Step 1: retrieve the identity + its HD index.
+        let (identity, identity_index) = {
+            let wm = self.wallet_manager.read().await;
+            let info = wm.get_wallet_info(&self.wallet_id).ok_or_else(|| {
+                PlatformWalletError::WalletNotFound(
+                    "Wallet info not found in wallet manager".to_string(),
+                )
+            })?;
+            let manager = &info.identity_manager;
+            let identity = manager
+                .identity(identity_id)
+                .map(|m| m.identity.clone())
+                .ok_or(PlatformWalletError::IdentityNotFound(*identity_id))?;
+            let index = manager
+                .identity_index(identity_id)
+                .ok_or(PlatformWalletError::IdentityIndexNotSet(*identity_id))?;
+            (identity, index)
+        };
 
-        let (asset_lock_proof, asset_lock_private_key, tracked_out_point) = match funding {
-            IdentityFunding::FromWalletBalance { amount_duffs } => {
-                let (proof, key, out_point) = self
+        // Step 2: resolve funding. Same IS→CL fallback shape as
+        // `register_identity_with_funding` — see that method for the
+        // architectural rationale.
+        let ResolvedFunding {
+            proof,
+            path,
+            tracked_out_point,
+        } = match self
+            .resolve_funding_with_is_timeout_fallback(
+                funding,
+                AssetLockFundingType::IdentityTopUp,
+                identity_index,
+                asset_lock_signer,
+            )
+            .await?
+        {
+            FundingResolution::Resolved(rf) => rf,
+            FundingResolution::IsTimeout { out_point } => {
+                tracing::warn!(
+                    "IS-lock did not propagate within 300s for funded identity top-up \
+                     (tx {}), falling back to ChainLock proof",
+                    out_point.txid
+                );
+                let chain_proof = self
                     .asset_locks
-                    .create_funded_asset_lock_proof(
-                        amount_duffs,
-                        0,
-                        AssetLockFundingType::IdentityRegistration,
-                        identity_index,
-                    )
+                    .upgrade_to_chain_lock_proof(&out_point, CL_FALLBACK_TIMEOUT)
                     .await?;
-                (proof, key, Some(out_point))
-            }
-            IdentityFunding::FromExistingAssetLock { out_point } => {
-                let (proof, key) = self
+                let (_, path) = self
                     .asset_locks
-                    .resume_asset_lock(&out_point, Duration::from_secs(300))
+                    .resume_asset_lock(&out_point, CL_FALLBACK_TIMEOUT)
                     .await?;
-                (proof, key, Some(out_point))
+                ResolvedFunding {
+                    proof: chain_proof,
+                    path,
+                    tracked_out_point: Some(out_point),
+                }
             }
         };
 
-        // Extract the outpoint before consuming the proof, in case we need to
-        // build a ChainLock proof for recovery.
-        let proof_out_point = Self::out_point_from_proof(&asset_lock_proof);
-
-        let result = match self
-            .register_identity_with_signer(
-                identity,
-                asset_lock_proof,
-                &asset_lock_private_key,
-                signer,
-                settings,
+        // Step 3: submit. Two Platform-side fallback layers (matches
+        // `register_identity_with_funding`): CL-height-too-low retries
+        // bump `user_fee_increase` to bypass Tenderdash's invalid-tx
+        // cache, and IS-lock rejection triggers an IS→CL upgrade on the
+        // same outpoint.
+        let proof_out_point = Self::out_point_from_proof(&proof);
+        let new_balance = match submit_with_cl_height_retry(settings, |s| {
+            identity.top_up_identity_with_signer(
+                &self.sdk,
+                proof.clone(),
+                &path,
+                asset_lock_signer,
+                s,
             )
-            .await
+        })
+        .await
         {
-            Ok(identity) => identity,
-            Err(e) if crate::error::is_instant_lock_proof_invalid(&e) => {
-                if let Some(out_point) = proof_out_point {
-                    tracing::warn!(
-                        "IS-lock proof rejected for funded identity registration (tx {}), \
-                         retrying with ChainLock proof",
-                        out_point.txid
-                    );
-                    let chain_proof = self
-                        .asset_locks
-                        .upgrade_to_chain_lock_proof(&out_point, Duration::from_secs(180))
-                        .await?;
-                    self.register_identity_with_signer(
-                        identity,
-                        chain_proof,
-                        &asset_lock_private_key,
-                        signer,
-                        settings,
+            Ok(balance) => balance,
+            Err(e) if is_instant_lock_proof_invalid(&e) => {
+                let out_point = proof_out_point;
+                tracing::warn!(
+                    "IS-lock proof rejected by Platform for identity top-up (tx {}), \
+                     retrying with ChainLock proof",
+                    out_point.txid
+                );
+                let chain_proof = self
+                    .asset_locks
+                    .upgrade_to_chain_lock_proof(&out_point, CL_FALLBACK_TIMEOUT)
+                    .await?;
+                submit_with_cl_height_retry(settings, |s| {
+                    identity.top_up_identity_with_signer(
+                        &self.sdk,
+                        chain_proof.clone(),
+                        &path,
+                        asset_lock_signer,
+                        s,
                     )
-                    .await
-                    .map_err(PlatformWalletError::Sdk)?
-                } else {
-                    return Err(PlatformWalletError::Sdk(e));
-                }
+                })
+                .await
+                .map_err(PlatformWalletError::Sdk)?
             }
             Err(e) => return Err(PlatformWalletError::Sdk(e)),
         };
 
-        // Clean up the tracked asset lock after successful consumption.
+        // Step 4: persist the new balance + clean up the tracked lock.
+        {
+            let mut wm = self.wallet_manager.write().await;
+            let info = wm.get_wallet_info_mut(&self.wallet_id).ok_or_else(|| {
+                PlatformWalletError::WalletNotFound(
+                    "Wallet info not found in wallet manager".to_string(),
+                )
+            })?;
+            if let Some(managed) = info.identity_manager.managed_identity_mut(identity_id) {
+                managed.identity.set_balance(new_balance);
+                if let Err(e) = self.persister.store(managed.snapshot_changeset().into()) {
+                    tracing::error!(
+                        identity = %identity_id,
+                        error = %e,
+                        "Failed to persist identity balance update after top_up"
+                    );
+                }
+            }
+        }
         if let Some(out_point) = tracked_out_point {
-            self.asset_locks.remove_asset_lock(&out_point).await;
+            // Cleanup failure here can only mean WalletNotFound
+            // (the wallet handle that just registered an identity
+            // vanished). Surface as a warn — the identity DID
+            // register successfully on Platform, so propagating the
+            // error to the caller would be misleading.
+            if let Err(e) = self.asset_locks.consume_asset_lock(&out_point).await {
+                tracing::warn!(
+                    outpoint = %out_point,
+                    error = %e,
+                    "consume_asset_lock failed after successful Platform submit"
+                );
+            }
         }
 
-        Ok(result)
+        Ok(new_balance)
     }
+}
 
-    /// Top up an identity using an [`IdentityFunding`] variant and an
-    /// externally-provided identity.
-    ///
-    /// This method unifies funding resolution and Platform submission in a
-    /// single call:
-    ///
-    /// * **`FromWalletBalance`** — builds an asset lock from wallet UTXOs via
-    ///   [`AssetLockManager::create_funded_asset_lock_proof`], then submits the
-    ///   top-up to Platform.
-    /// * **`FromExistingAssetLock`** — resumes a tracked asset lock by outpoint,
-    ///   re-deriving the proof and private key from whatever stage the lock
-    ///   is at.
-    ///
-    /// Unlike [`top_up_identity_with_funding`](Self::top_up_identity_with_funding),
-    /// this method does **not** look up the identity in the internal
-    /// `IdentityManager`. The caller supplies the `Identity` object directly,
-    /// making it suitable for callers that manage identities externally
-    /// (e.g. evo-tool's `QualifiedIdentity`).
-    ///
-    /// Returns the new credit balance.
-    pub async fn funded_top_up_identity(
-        &self,
-        identity: &Identity,
-        funding: IdentityFunding,
-        identity_index: u32,
-        settings: Option<PutSettings>,
-    ) -> Result<u64, PlatformWalletError> {
-        use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
 
-        let (asset_lock_proof, asset_lock_private_key, tracked_out_point) = match funding {
-            IdentityFunding::FromWalletBalance { amount_duffs } => {
-                let (proof, key, out_point) = self
-                    .asset_locks
-                    .create_funded_asset_lock_proof(
-                        amount_duffs,
-                        0,
-                        AssetLockFundingType::IdentityTopUp,
-                        identity_index,
-                    )
-                    .await?;
-                (proof, key, Some(out_point))
-            }
-            IdentityFunding::FromExistingAssetLock { out_point } => {
-                let (proof, key) = self
-                    .asset_locks
-                    .resume_asset_lock(&out_point, Duration::from_secs(300))
-                    .await?;
-                (proof, key, Some(out_point))
-            }
-        };
+// `find_tracked_unproven_lock` was removed when
+// `PlatformWalletError::FinalityTimeout` was widened to carry the full
+// `OutPoint` (previously only the `Txid`). The IS→CL fallback now reads
+// the outpoint directly off the error payload — no BTreeMap walk by
+// `(funding_type, identity_index)` is needed, which also closes the
+// non-determinism gap when multiple unproven locks shared that key.
 
-        // Extract the outpoint before consuming the proof, in case we need to
-        // build a ChainLock proof for recovery.
-        let proof_out_point = Self::out_point_from_proof(&asset_lock_proof);
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
 
-        let new_balance = match self
-            .top_up_identity_with_signer(
-                identity,
-                asset_lock_proof,
-                &asset_lock_private_key,
-                settings,
-            )
-            .await
-        {
-            Ok(balance) => balance,
-            Err(e) if crate::error::is_instant_lock_proof_invalid(&e) => {
-                if let Some(out_point) = proof_out_point {
-                    tracing::warn!(
-                        "IS-lock proof rejected for funded identity top-up (tx {}), \
-                         retrying with ChainLock proof",
-                        out_point.txid
-                    );
-                    let chain_proof = self
-                        .asset_locks
-                        .upgrade_to_chain_lock_proof(&out_point, Duration::from_secs(180))
-                        .await?;
-                    self.top_up_identity_with_signer(
-                        identity,
-                        chain_proof,
-                        &asset_lock_private_key,
-                        settings,
-                    )
-                    .await
-                    .map_err(PlatformWalletError::Sdk)?
-                } else {
-                    return Err(PlatformWalletError::Sdk(e));
-                }
-            }
-            Err(e) => return Err(PlatformWalletError::Sdk(e)),
-        };
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::error::is_instant_lock_timeout;
+    use dashcore::{OutPoint, Txid};
 
-        // Clean up the tracked asset lock after successful consumption.
-        if let Some(out_point) = tracked_out_point {
-            self.asset_locks.remove_asset_lock(&out_point).await;
-        }
+    /// Pins the IS-timeout discriminator: only `FinalityTimeout`
+    /// matches, so the IS→CL fallback arms route exactly the cases
+    /// we expect. Companion to `is_instant_lock_proof_invalid`
+    /// (which discriminates SDK errors at the Platform-rejection
+    /// boundary).
+    #[test]
+    fn is_instant_lock_timeout_only_matches_finality_timeout() {
+        let timeout = PlatformWalletError::FinalityTimeout(OutPoint {
+            txid: Txid::from([0u8; 32]),
+            vout: 0,
+        });
+        assert!(
+            is_instant_lock_timeout(&timeout),
+            "FinalityTimeout must route to IS→CL fallback"
+        );
 
-        Ok(new_balance)
+        // Adjacent error shapes that share the asset-lock domain but
+        // are NOT timeouts — must NOT trigger the fallback.
+        let expired = PlatformWalletError::AssetLockExpired("CL not yet available".to_string());
+        assert!(
+            !is_instant_lock_timeout(&expired),
+            "AssetLockExpired must NOT trigger IS→CL fallback \
+             (the lock is already past the CL grace window)"
+        );
+
+        let not_cl = PlatformWalletError::AssetLockNotChainLocked("missing".to_string());
+        assert!(
+            !is_instant_lock_timeout(&not_cl),
+            "AssetLockNotChainLocked must NOT trigger IS→CL fallback"
+        );
+
+        let wait_err = PlatformWalletError::AssetLockProofWait("not tracked".to_string());
+        assert!(
+            !is_instant_lock_timeout(&wait_err),
+            "AssetLockProofWait must NOT trigger IS→CL fallback \
+             (wallet-state mismatch is a hard failure)"
+        );
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/identity/network/top_up.rs b/packages/rs-platform-wallet/src/wallet/identity/network/top_up.rs
index ba05137ec4d..feea66ab0ae 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/network/top_up.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/network/top_up.rs
@@ -1,195 +1,57 @@
-//! Top up an identity's credit balance.
+//! Identity top-up convenience wrapper.
+//!
+//! The substantive top-up logic lives next to identity registration in
+//! [`super::registration`] — both flows share the same funding
+//! resolution, IS→CL fallback, and asset-lock cleanup machinery, so
+//! keeping them in one module avoids duplication.
+//!
+//! This file just hosts the convenience wrapper `top_up_identity`
+//! (defaults to wallet-balance funding) that delegates to the L2
+//! orchestrator `top_up_identity_with_funding`.
 
-use std::time::Duration;
-
-use dpp::identity::accessors::IdentitySettersV0;
 use dpp::prelude::Identifier;
 
 use dash_sdk::platform::transition::put_settings::PutSettings;
-use dash_sdk::platform::transition::top_up_identity::TopUpIdentity;
 
 use crate::error::PlatformWalletError;
-
-use crate::wallet::identity::types::funding::TopUpFundingMethod;
+use crate::wallet::identity::types::funding::IdentityFunding;
 
 use super::*;
 
-// ---------------------------------------------------------------------------
-// Top-up
-// ---------------------------------------------------------------------------
-
 impl IdentityWallet {
-    /// Top up an existing identity's credit balance.
+    /// Top up an existing identity's credit balance from this wallet's
+    /// UTXOs.
     ///
-    /// Convenience wrapper that uses `FundWithWallet` funding. For other
-    /// funding methods, use [`top_up_identity_with_funding`](Self::top_up_identity_with_funding).
+    /// Convenience wrapper around
+    /// [`top_up_identity_with_funding`](Self::top_up_identity_with_funding)
+    /// for the common case (`IdentityFunding::FromWalletBalance`).
     ///
     /// # Arguments
     ///
     /// * `identity_id` - The identifier of the identity to top up.
-    /// * `topup_index` - An incrementing index distinguishing successive
-    ///   top-ups for the same identity.
     /// * `amount_duffs` - Amount of Dash (in duffs) to add.
-    pub async fn top_up_identity(
+    /// * `asset_lock_signer` - External ECDSA signer that produces both
+    ///   the funding-input P2PKH signatures during asset-lock build and
+    ///   the consume-phase outer signature on the IdentityTopUp
+    ///   transition. In Swift this is a `MnemonicResolverCoreSigner`
+    ///   wrapping the Keychain resolver vtable.
+    pub async fn top_up_identity<AS>(
         &self,
         identity_id: &Identifier,
-        topup_index: u32,
         amount_duffs: u64,
+        asset_lock_signer: &AS,
         settings: Option<PutSettings>,
-    ) -> Result<(), PlatformWalletError> {
+    ) -> Result<(), PlatformWalletError>
+    where
+        AS: ::key_wallet::signer::Signer + Send + Sync,
+    {
         self.top_up_identity_with_funding(
             identity_id,
-            TopUpFundingMethod::FundWithWallet { amount_duffs },
-            topup_index,
+            IdentityFunding::FromWalletBalance { amount_duffs },
+            asset_lock_signer,
             settings,
         )
-        .await
-    }
-
-    /// Top up an existing identity's credit balance with a specified funding method.
-    ///
-    /// # Funding methods
-    ///
-    /// * `UseAssetLock` - Use a pre-existing proof and private key directly.
-    /// * `FundWithWallet` - Build an asset lock from wallet UTXOs (default).
-    ///
-    /// # IS -> CL fallback
-    ///
-    /// See [`register_identity_with_funding`](Self::register_identity_with_funding)
-    /// for details on the IS -> CL fallback strategy.
-    pub async fn top_up_identity_with_funding(
-        &self,
-        identity_id: &Identifier,
-        funding: TopUpFundingMethod,
-        // TODO(platform-wallet): route `topup_index` through the
-        // derivation path for the top-up asset lock. Currently
-        // unused; the function derives from `identity_index`
-        // alone.
-        _topup_index: u32,
-        settings: Option<PutSettings>,
-    ) -> Result<(), PlatformWalletError> {
-        // Retrieve the identity and its HD index from the manager.
-        let (identity, identity_index) = {
-            let wm = self.wallet_manager.read().await;
-            let info = wm.get_wallet_info(&self.wallet_id).ok_or_else(|| {
-                crate::error::PlatformWalletError::WalletNotFound(
-                    "Wallet info not found in wallet manager".to_string(),
-                )
-            })?;
-            let manager = &info.identity_manager;
-            let identity = manager
-                .identity(identity_id)
-                .map(|m| m.identity.clone())
-                .ok_or(PlatformWalletError::IdentityNotFound(*identity_id))?;
-            let index = manager
-                .identity_index(identity_id)
-                .ok_or(PlatformWalletError::IdentityIndexNotSet(*identity_id))?;
-            (identity, index)
-        };
-
-        // Step 1: Obtain the asset lock proof and private key.
-        let (asset_lock_proof, asset_lock_private_key) = match funding {
-            TopUpFundingMethod::UseAssetLock { proof, private_key } => (proof, private_key),
-            TopUpFundingMethod::FundWithWallet { amount_duffs } => {
-                use key_wallet::wallet::managed_wallet_info::asset_lock_builder::AssetLockFundingType;
-                let (proof, key, _out_point) = self
-                    .asset_locks
-                    .create_funded_asset_lock_proof(
-                        amount_duffs,
-                        0,
-                        AssetLockFundingType::IdentityTopUp,
-                        identity_index,
-                    )
-                    .await?;
-                (proof, key)
-            }
-        };
-
-        // Extract the outpoint before consuming the proof, in case we need to
-        // build a ChainLock proof for recovery.
-        let proof_out_point = Self::out_point_from_proof(&asset_lock_proof);
-
-        // Step 2: Submit the top-up state transition.
-        let user_fee_increase = settings.and_then(|s| s.user_fee_increase);
-        let new_balance = match identity
-            .top_up_identity(
-                &self.sdk,
-                asset_lock_proof,
-                &asset_lock_private_key,
-                user_fee_increase,
-                settings,
-            )
-            .await
-        {
-            Ok(balance) => balance,
-            Err(e) if crate::error::is_instant_lock_proof_invalid(&e) => {
-                // IS-lock proof was rejected — try to upgrade to ChainLock.
-                if let Some(out_point) = proof_out_point {
-                    tracing::warn!(
-                        "IS-lock proof rejected for identity top-up (tx {}), \
-                         retrying with ChainLock proof",
-                        out_point.txid
-                    );
-                    let chain_proof = self
-                        .asset_locks
-                        .upgrade_to_chain_lock_proof(&out_point, Duration::from_secs(180))
-                        .await?;
-                    identity
-                        .top_up_identity(
-                            &self.sdk,
-                            chain_proof,
-                            &asset_lock_private_key,
-                            user_fee_increase,
-                            settings,
-                        )
-                        .await
-                        .map_err(|e| {
-                            PlatformWalletError::InvalidIdentityData(format!(
-                                "Failed to top up identity (ChainLock retry): {}",
-                                e
-                            ))
-                        })?
-                } else {
-                    return Err(PlatformWalletError::InvalidIdentityData(format!(
-                        "Failed to top up identity: {}",
-                        e
-                    )));
-                }
-            }
-            Err(e) => {
-                return Err(PlatformWalletError::InvalidIdentityData(format!(
-                    "Failed to top up identity: {}",
-                    e
-                )));
-            }
-        };
-
-        // Update the identity's balance in the local manager and
-        // queue the snapshot so the new balance survives relaunch.
-        //
-        // `set_balance` on the inner DPP `Identity` doesn't know about
-        // the persister, so we drive it ourselves via
-        // `ManagedIdentity::snapshot_changeset` + `WalletPersister::store`
-        // (both `pub(crate)`, usable inside this crate).
-        {
-            let mut wm = self.wallet_manager.write().await;
-            let info = wm.get_wallet_info_mut(&self.wallet_id).ok_or_else(|| {
-                crate::error::PlatformWalletError::WalletNotFound(
-                    "Wallet info not found in wallet manager".to_string(),
-                )
-            })?;
-            if let Some(managed) = info.identity_manager.managed_identity_mut(identity_id) {
-                managed.identity.set_balance(new_balance);
-                if let Err(e) = self.persister.store(managed.snapshot_changeset().into()) {
-                    tracing::error!(
-                        identity = %identity_id,
-                        error = %e,
-                        "Failed to persist identity balance update after top_up"
-                    );
-                }
-            }
-        }
-
+        .await?;
         Ok(())
     }
 }
diff --git a/packages/rs-platform-wallet/src/wallet/identity/types/funding.rs b/packages/rs-platform-wallet/src/wallet/identity/types/funding.rs
index b417ea4840e..dd6a3093709 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/types/funding.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/types/funding.rs
@@ -1,86 +1,81 @@
-//! Funding method enums for identity registration and top-up.
+//! Funding source enum for identity registration and top-up.
 //!
-//! These enums describe *how* an identity operation is funded, decoupling the
-//! funding source from the identity lifecycle logic.
+//! The single source of funding for any identity lifecycle operation
+//! (register, top up) is [`IdentityFunding`]. The funded-but-not-yet-
+//! consumed asset lock is the central concept — every variant ends up
+//! resolved to `(AssetLockProof, DerivationPath)` before submission to
+//! Platform.
 //!
-//! ## Type overview
+//! ## Historical note
 //!
-//! * [`IdentityFunding`] — unified funding enum used by the new
-//!   `create_funded_asset_lock_proof` flow. Covers wallet-balance and
-//!   pre-existing asset locks.
-//! * [`IdentityFundingMethod`] / [`TopUpFundingMethod`] — original per-operation
-//!   enums consumed by `register_identity_with_funding` and
-//!   `top_up_identity_with_funding`. Retained for backwards compatibility.
+//! Earlier iterations carried two parallel funding enums
+//! (`IdentityFundingMethod` / `TopUpFundingMethod`) consumed by
+//! per-operation helpers. They were merged into [`IdentityFunding`]
+//! once the registration and top-up high-level helpers grew identical
+//! funding-resolution + IS→CL fallback shapes — at which point the
+//! per-operation enums were dead weight. The merge happened in iter
+//! 4 of the swift-funding-with-asset-lock series.
 
-use dashcore::{OutPoint, PrivateKey};
-use dpp::prelude::AssetLockProof;
+use dashcore::OutPoint;
+use key_wallet::bip32::DerivationPath;
 
-// ─── Unified funding enum ────────────────────────────────────────────────────
-
-/// How to fund an identity operation (registration, top-up, etc.).
+/// How to fund an identity operation (registration, top-up).
 ///
-/// This is the *unified* enum consumed by
-/// [`CoreWallet::create_funded_asset_lock_proof`](crate::wallet::core::CoreWallet::create_funded_asset_lock_proof).
-/// It replaces the earlier pattern of having separate funding enums per
-/// operation type.
+/// Resolved by the high-level `register_identity_with_funding` /
+/// `top_up_identity_with_funding` helpers into an
+/// `(AssetLockProof, DerivationPath, OutPoint)` triple that the
+/// `_with_signer` SDK methods can consume. The `OutPoint` is retained
+/// for cleanup (so the tracked-asset-lock row can be removed on
+/// success) and for IS→CL fallback (so the consumed lock can be
+/// looked up by outpoint when the IS proof times out or is rejected).
 #[derive(Debug, Clone)]
 pub enum IdentityFunding {
     /// Build an asset lock from wallet UTXOs for the given amount.
+    ///
+    /// The helper picks the appropriate funding account
+    /// (`identity_registration` for register, `identity_topup` for top
+    /// up), builds the asset-lock tx, broadcasts it, waits for an
+    /// IS-lock proof, and falls back to ChainLock if the IS-lock times
+    /// out (300s) or is rejected at Platform.
     FromWalletBalance {
         /// Amount to lock (in duffs).
         amount_duffs: u64,
     },
-    /// Resume from a tracked asset lock identified by its outpoint (txid + output index).
+
+    /// Resume from a tracked asset lock identified by its outpoint
+    /// (txid + output index).
     ///
-    /// The asset lock must already be tracked by the [`AssetLockManager`].
-    /// The manager will resume from whatever stage the lock is at (built,
-    /// broadcast, IS-locked, or chain-locked) and re-derive the private key.
+    /// The asset lock must already be tracked by the
+    /// [`AssetLockManager`](crate::wallet::asset_lock::manager::AssetLockManager).
+    /// The manager resumes from whatever stage the lock is at (built,
+    /// broadcast, IS-locked, or chain-locked) and re-derives the
+    /// credit-output derivation path; the signer-driven submission path
+    /// then passes that path back to the same signer when constructing
+    /// the IdentityCreate / IdentityTopUp transition.
     FromExistingAssetLock {
         /// The outpoint identifying the tracked asset lock (txid + output index).
         out_point: OutPoint,
     },
-}
-
-// ─── Per-operation funding enums (original API) ──────────────────────────────
 
-/// Funding method for identity registration.
-pub enum IdentityFundingMethod {
-    /// Use a pre-existing asset lock proof (e.g. one tracked by
-    /// [`CoreWallet::tracked_asset_locks`]).
-    UseAssetLock {
-        /// The asset lock proof (IS or CL).
-        proof: AssetLockProof,
-        /// The one-time private key from the asset lock payload.
-        private_key: PrivateKey,
-    },
-    /// Build an asset lock from wallet UTXOs for the given amount (in duffs).
+    /// Use a pre-supplied asset lock proof + derivation path directly.
     ///
-    /// This is the default path used by the convenience wrapper.
-    FundWithWallet {
-        /// Amount to lock (in duffs).
-        amount_duffs: u64,
-    },
-    // NOTE: FundFromAddresses (platform address funding, no asset lock) is
-    // intentionally omitted for now. It requires a different state transition
-    // type (`IdentityCreateFromAddressesTransition`) and a different signer
-    // (`Signer<PlatformAddress>`), making it a substantially different code
-    // path. It can be added in a follow-up PR.
-}
-
-/// Funding method for identity top-up.
-pub enum TopUpFundingMethod {
-    /// Use a pre-existing asset lock proof.
+    /// The caller has already obtained the proof through some external
+    /// flow (e.g. an SDK-side broadcast that ran outside this wallet's
+    /// `AssetLockManager`) and just needs the registration / top-up
+    /// flow to submit it. No tracking, no fallback, no cleanup — the
+    /// caller owns the lifecycle.
+    ///
+    /// In practice this variant is used by callers that manage asset
+    /// locks via a sibling component (evo-tool's tasks, integration
+    /// tests, etc.). The Swift app's normal flow goes through
+    /// `FromWalletBalance` or `FromExistingAssetLock`.
     UseAssetLock {
         /// The asset lock proof (IS or CL).
-        proof: AssetLockProof,
-        /// The one-time private key from the asset lock payload.
-        private_key: PrivateKey,
-    },
-    /// Build an asset lock from wallet UTXOs for the given amount (in duffs).
-    ///
-    /// This is the default path used by the convenience wrapper.
-    FundWithWallet {
-        /// Amount to lock (in duffs).
-        amount_duffs: u64,
+        proof: dpp::prelude::AssetLockProof,
+        /// Derivation path the credit-output P2PKH was built from. The
+        /// signer-driven submission path passes this to the asset-lock
+        /// signer when constructing the IdentityCreate / IdentityTopUp
+        /// transition.
+        derivation_path: DerivationPath,
     },
 }
diff --git a/packages/rs-platform-wallet/src/wallet/identity/types/mod.rs b/packages/rs-platform-wallet/src/wallet/identity/types/mod.rs
index 8a602a49ff6..05f652b6e51 100644
--- a/packages/rs-platform-wallet/src/wallet/identity/types/mod.rs
+++ b/packages/rs-platform-wallet/src/wallet/identity/types/mod.rs
@@ -15,5 +15,5 @@ pub use dashpay::{
     ContactRequest, DashPayProfile, DashpayAddressMatch, EstablishedContact, PaymentDirection,
     PaymentEntry, PaymentStatus, ProfileUpdate,
 };
-pub use funding::{IdentityFunding, IdentityFundingMethod, TopUpFundingMethod};
+pub use funding::IdentityFunding;
 pub use key_storage::{DpnsNameInfo, IdentityStatus, KeyStorage, PrivateKeyData};
diff --git a/packages/rs-platform-wallet/src/wallet/platform_wallet_traits.rs b/packages/rs-platform-wallet/src/wallet/platform_wallet_traits.rs
index caad29c10b8..f6e01218fbc 100644
--- a/packages/rs-platform-wallet/src/wallet/platform_wallet_traits.rs
+++ b/packages/rs-platform-wallet/src/wallet/platform_wallet_traits.rs
@@ -3,9 +3,10 @@
 //! Implements [`WalletInfoInterface`], [`WalletTransactionChecker`], and
 //! [`ManagedAccountOperations`] by delegating to the inner `ManagedWalletInfo`.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
 
 use async_trait::async_trait;
+use dashcore::ephemerealdata::chain_lock::ChainLock;
 use dashcore::ephemerealdata::instant_lock::InstantLock;
 use dashcore::prelude::CoreBlockHeight;
 use dashcore::{Address as DashAddress, Transaction, Txid};
@@ -159,6 +160,34 @@ impl WalletInfoInterface for PlatformWalletInfo {
     fn monitor_revision(&self) -> u64 {
         self.core_wallet.monitor_revision()
     }
+
+    // Delegate the chain-lock methods to the inner `ManagedWalletInfo`.
+    //
+    // Without these delegations, `WalletInfoInterface`'s default impls
+    // kick in (no-op `apply_chain_lock` returning an empty BTreeMap;
+    // `last_applied_chain_lock` returning `None`). That's the bug behind
+    // "stuck asset lock #10": upstream's
+    // `spawn_chainlock_wallet_dispatch` task receives every validated
+    // `ChainLockReceived` event and calls
+    // `wallet.write().await.apply_chain_lock(...)`, but our
+    // `PlatformWalletInfo` was hitting the trait default — promotion
+    // never fired and `metadata.last_applied_chain_lock` stayed `None`.
+    fn last_applied_chain_lock(&self) -> Option<&ChainLock> {
+        self.core_wallet.last_applied_chain_lock()
+    }
+
+    fn apply_chain_lock(&mut self, chain_lock: ChainLock) -> BTreeMap<AccountType, Vec<Txid>> {
+        let cl_height = chain_lock.block_height;
+        let per_account = self.core_wallet.apply_chain_lock(chain_lock);
+        let total_promoted: usize = per_account.values().map(|v| v.len()).sum();
+        tracing::debug!(
+            cl_height,
+            total_promoted,
+            accounts_with_promotions = per_account.len(),
+            "apply_chain_lock delegated"
+        );
+        per_account
+    }
 }
 
 // ---------------------------------------------------------------------------
diff --git a/packages/rs-sdk-ffi/src/identity/put.rs b/packages/rs-sdk-ffi/src/identity/put.rs
index 63b3cfaf558..17b16c32229 100644
--- a/packages/rs-sdk-ffi/src/identity/put.rs
+++ b/packages/rs-sdk-ffi/src/identity/put.rs
@@ -74,7 +74,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_instant_lock(
 
         // Use PutIdentity trait to put identity to platform
         let state_transition = identity
-            .put_to_platform(
+            .put_to_platform_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
@@ -164,7 +164,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_instant_lock_and
 
         // Use PutIdentity trait to put identity to platform and wait for response
         let confirmed_identity = identity
-            .put_to_platform_and_wait_for_response(
+            .put_to_platform_and_wait_for_response_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
@@ -246,7 +246,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_chain_lock(
 
         // Use PutIdentity trait to put identity to platform
         let state_transition = identity
-            .put_to_platform(
+            .put_to_platform_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
@@ -325,7 +325,7 @@ pub unsafe extern "C" fn dash_sdk_identity_put_to_platform_with_chain_lock_and_w
 
         // Use PutIdentity trait to put identity to platform and wait for response
         let confirmed_identity = identity
-            .put_to_platform_and_wait_for_response(
+            .put_to_platform_and_wait_for_response_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
diff --git a/packages/rs-sdk-ffi/src/identity/topup.rs b/packages/rs-sdk-ffi/src/identity/topup.rs
index 8a98c0053d6..68486234ddd 100644
--- a/packages/rs-sdk-ffi/src/identity/topup.rs
+++ b/packages/rs-sdk-ffi/src/identity/topup.rs
@@ -65,11 +65,10 @@ pub unsafe extern "C" fn dash_sdk_identity_topup_with_instant_lock(
         use dash_sdk::platform::transition::top_up_identity::TopUpIdentity;
 
         let new_balance = identity
-            .top_up_identity(
+            .top_up_identity_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
-                settings.and_then(|s| s.user_fee_increase),
                 settings,
             )
             .await
@@ -139,11 +138,10 @@ pub unsafe extern "C" fn dash_sdk_identity_topup_with_instant_lock_and_wait(
         use dash_sdk::platform::transition::top_up_identity::TopUpIdentity;
 
         let _new_balance = identity
-            .top_up_identity(
+            .top_up_identity_with_private_key(
                 &wrapper.sdk,
                 asset_lock_proof,
                 &private_key,
-                settings.and_then(|s| s.user_fee_increase),
                 settings,
             )
             .await
diff --git a/packages/rs-sdk-ffi/src/lib.rs b/packages/rs-sdk-ffi/src/lib.rs
index d367bb42527..e3ebf91673d 100644
--- a/packages/rs-sdk-ffi/src/lib.rs
+++ b/packages/rs-sdk-ffi/src/lib.rs
@@ -20,9 +20,14 @@ mod evonode;
 mod group;
 mod identity;
 mod protocol_version;
+mod mnemonic_resolver;
+mod mnemonic_resolver_core_signer;
 mod sdk;
 mod signer;
 mod signer_simple;
+
+pub use mnemonic_resolver::*;
+pub use mnemonic_resolver_core_signer::*;
 mod system;
 mod token;
 mod types;
@@ -100,8 +105,13 @@ pub extern "C" fn dash_sdk_enable_logging(level: u8) {
     // Build the filter string with per-crate directives -- identical to what
     // was previously stored in RUST_LOG, but constructed in-process so there
     // is no data-race with concurrent `env::var` reads on other threads.
+    // Includes `platform_wallet` + `platform_wallet_ffi` so wallet-side
+    // traces (asset-lock catch-up, wait_for_proof, etc.) reach the
+    // configured level instead of falling through to the EnvFilter
+    // default (warn).
     let filter_string = format!(
         "dash_sdk={log_level},rs_sdk={log_level},rs_sdk_ffi={log_level},\
+         platform_wallet={log_level},platform_wallet_ffi={log_level},\
          dapi_grpc={log_level},h2={log_level},tower={log_level},\
          hyper={log_level},tonic={log_level}"
     );
diff --git a/packages/rs-sdk-ffi/src/mnemonic_resolver.rs b/packages/rs-sdk-ffi/src/mnemonic_resolver.rs
new file mode 100644
index 00000000000..817ec322eed
--- /dev/null
+++ b/packages/rs-sdk-ffi/src/mnemonic_resolver.rs
@@ -0,0 +1,187 @@
+//! Rust → Swift "fetch BIP-39 mnemonic for wallet_id" FFI vtable.
+//!
+//! The architectural intent is the `swift-sdk/CLAUDE.md` "no
+//! mnemonic round-tripping" rule: derivation pipelines must live on
+//! the Rust side, with Swift exposing only the two operations Rust
+//! cannot perform from its side — reading the mnemonic from the iOS
+//! Keychain and writing the derived key bytes back. This module
+//! exposes the read half (mnemonic resolver). The write half
+//! (identity-key persister) lives in `platform-wallet-ffi` because
+//! the Keychain-write semantics are wallet-domain.
+//!
+//! # Synchronous on purpose
+//!
+//! Unlike the [`SignerVTable`](crate::signer::VTableSigner)
+//! infrastructure (which uses a `oneshot` channel + `CompletionSlot`
+//! because biometric prompts can take seconds), Keychain reads are
+//! sub-millisecond, so this callback is fully synchronous — no
+//! completion-callback ceremony, no `tokio::time::timeout`. The
+//! Rust side blocks the calling thread for the duration of one
+//! Keychain hop. Callers that already invoke the consuming FFI on
+//! a background queue (the iOS pattern) get exactly what they want.
+//!
+//! # Lifetime / cleanup
+//!
+//! The Swift side calls [`dash_sdk_mnemonic_resolver_create`], which
+//! returns an opaque `*mut MnemonicResolverHandle`. Pass it to any
+//! FFI entry point that needs to derive from a wallet-stored
+//! mnemonic (e.g. `dash_sdk_derive_and_persist_identity_keys`,
+//! `asset_lock_manager_create_funded_proof`). Then call
+//! [`dash_sdk_mnemonic_resolver_destroy`] — that fires the supplied
+//! destructor callback (typically the
+//! `Unmanaged.fromOpaque(...).release()` pattern Swift uses for its
+//! `MnemonicResolverAndPersister` ctx) so the Swift object can drop.
+
+use std::ffi::c_void;
+use std::os::raw::c_char;
+
+/// Maximum mnemonic length, in bytes (excluding the trailing NUL),
+/// the resolver buffer can hold.
+///
+/// 1024 bytes covers every BIP-39 wordlist with margin to spare:
+/// the longest 24-word mnemonics in any supported language come in
+/// well under that — Korean (the longest of the supported lists)
+/// tops out near 700 bytes for a 24-word phrase. Picking a power-
+/// of-two cap keeps the inline Rust stack buffer cheap to
+/// zero-on-drop.
+pub const MNEMONIC_RESOLVER_BUFFER_CAPACITY: usize = 1024;
+
+/// Resolver result codes returned by [`MnemonicResolveCallback`].
+///
+/// Mirrors the success/failure shape of `PlatformWalletFFIResult`
+/// at a finer-grained level so the Rust side can distinguish
+/// "Swift hit the buffer cap" from "Swift had no mnemonic stored
+/// for this wallet".
+pub mod mnemonic_resolver_result {
+    /// Mnemonic copied into the buffer; `out_len` was set.
+    pub const SUCCESS: i32 = 0;
+    /// The Swift side has no mnemonic stored for this `wallet_id`.
+    /// Surfaced to the Rust caller as
+    /// `PlatformWalletFFIResult::ErrorWalletOperation` with a
+    /// "mnemonic missing" detail.
+    pub const NOT_FOUND: i32 = 1;
+    /// Mnemonic exceeded [`super::MNEMONIC_RESOLVER_BUFFER_CAPACITY`].
+    /// Should not happen in practice — the buffer is sized for
+    /// every BIP-39 wordlist's 24-word phrase plus margin.
+    pub const BUFFER_TOO_SMALL: i32 = 2;
+    /// Anything else (Keychain access denied, decode error, etc.).
+    /// Surfaced as `ErrorWalletOperation` with a generic detail
+    /// the Swift side hopefully logged before returning.
+    pub const OTHER: i32 = 3;
+}
+
+/// Function pointer type for the mnemonic-resolve callback.
+///
+/// # Wire shape
+///
+/// - `ctx`: opaque Swift-side context (typically the result of
+///   `Unmanaged.passRetained(swiftSelf).toOpaque()`). Passed back
+///   verbatim by Rust on every invocation.
+/// - `wallet_id_bytes`: pointer to a 32-byte wallet id. Valid for
+///   the duration of the call only.
+/// - `out_mnemonic_utf8`: writable buffer for the NUL-terminated
+///   UTF-8 mnemonic. Capacity is
+///   [`MNEMONIC_RESOLVER_BUFFER_CAPACITY`] bytes (room for the
+///   trailing NUL).
+/// - `out_capacity`: equal to [`MNEMONIC_RESOLVER_BUFFER_CAPACITY`].
+///   Surfaced explicitly so the implementation can sanity-check
+///   without assuming the constant.
+/// - `out_len`: receives the byte count written to
+///   `out_mnemonic_utf8`, EXCLUDING the trailing NUL. Must be set
+///   on success.
+///
+/// # Safety
+///
+/// - `out_mnemonic_utf8` must be valid for `out_capacity` writable
+///   bytes for the duration of this call.
+/// - `wallet_id_bytes` must be valid for 32 readable bytes.
+/// - `out_len` must be valid for one `usize` write.
+/// - The implementation MUST return one of the
+///   [`mnemonic_resolver_result`] codes; any other value is treated
+///   as `OTHER`.
+pub type MnemonicResolveCallback = unsafe extern "C" fn(
+    ctx: *const c_void,
+    wallet_id_bytes: *const u8,
+    out_mnemonic_utf8: *mut c_char,
+    out_capacity: usize,
+    out_len: *mut usize,
+) -> i32;
+
+/// C-compatible vtable for a mnemonic resolver.
+#[repr(C)]
+pub struct MnemonicResolverVTable {
+    /// Synchronous "fetch mnemonic for `wallet_id`".
+    pub resolve: MnemonicResolveCallback,
+    /// Destructor for the `ctx` pointer. Invoked exactly once when
+    /// the matching `dash_sdk_mnemonic_resolver_destroy` is called.
+    pub destroy: unsafe extern "C" fn(ctx: *mut c_void),
+}
+
+/// Opaque Rust-side handle to a Swift-owned mnemonic resolver.
+///
+/// Constructed by [`dash_sdk_mnemonic_resolver_create`], destroyed
+/// by [`dash_sdk_mnemonic_resolver_destroy`]. Pass the pointer
+/// into any FFI entry point that derives from a wallet-stored
+/// mnemonic.
+#[repr(C)]
+pub struct MnemonicResolverHandle {
+    pub ctx: *mut c_void,
+    pub vtable: *mut MnemonicResolverVTable,
+}
+
+// SAFETY: Swift side promises both pointers are thread-stable for
+// the lifetime of this handle. The handle is owned by Swift
+// across the FFI; Rust just dereferences it under the same lock
+// shape the existing signer FFI uses.
+unsafe impl Send for MnemonicResolverHandle {}
+unsafe impl Sync for MnemonicResolverHandle {}
+
+/// Build a new resolver handle that wraps a Swift-owned `ctx`
+/// pointer plus a pair of function pointers.
+///
+/// # Safety
+/// - `resolve_callback` must conform to [`MnemonicResolveCallback`]'s
+///   contract.
+/// - `destroy_callback` must safely free `ctx` exactly once.
+/// - `ctx` may be null (the destructor will be invoked with null
+///   on destroy regardless).
+#[no_mangle]
+pub unsafe extern "C" fn dash_sdk_mnemonic_resolver_create(
+    ctx: *mut c_void,
+    resolve_callback: MnemonicResolveCallback,
+    destroy_callback: unsafe extern "C" fn(ctx: *mut c_void),
+) -> *mut MnemonicResolverHandle {
+    // Allocate the vtable on the heap so it has a stable address
+    // for the lifetime of the handle — same pattern
+    // `dash_sdk_signer_create_with_ctx` follows.
+    let vtable = Box::into_raw(Box::new(MnemonicResolverVTable {
+        resolve: resolve_callback,
+        destroy: destroy_callback,
+    }));
+    Box::into_raw(Box::new(MnemonicResolverHandle { ctx, vtable }))
+}
+
+/// Destroy a previously-created resolver handle.
+///
+/// Calls the supplied destructor exactly once with the original
+/// `ctx`, then frees the heap-allocated vtable and the handle box.
+/// Safe to call with a null pointer (no-op).
+///
+/// # Safety
+/// `handle` must have been produced by
+/// [`dash_sdk_mnemonic_resolver_create`] and must not have been
+/// destroyed already.
+#[no_mangle]
+pub unsafe extern "C" fn dash_sdk_mnemonic_resolver_destroy(handle: *mut MnemonicResolverHandle) {
+    if handle.is_null() {
+        return;
+    }
+    let owned = unsafe { Box::from_raw(handle) };
+    unsafe {
+        if !owned.vtable.is_null() {
+            ((*owned.vtable).destroy)(owned.ctx);
+            // Reclaim the vtable box.
+            let _ = Box::from_raw(owned.vtable);
+        }
+    }
+}
diff --git a/packages/rs-sdk-ffi/src/mnemonic_resolver_core_signer.rs b/packages/rs-sdk-ffi/src/mnemonic_resolver_core_signer.rs
new file mode 100644
index 00000000000..0acfd78cbe1
--- /dev/null
+++ b/packages/rs-sdk-ffi/src/mnemonic_resolver_core_signer.rs
@@ -0,0 +1,474 @@
+//! Core-side ECDSA [`key_wallet::signer::Signer`] implementation that
+//! sources its private keys via the
+//! [`MnemonicResolverHandle`](crate::mnemonic_resolver::MnemonicResolverHandle)
+//! callback.
+//!
+//! Same architectural intent as `dash_sdk_sign_with_mnemonic_resolver_and_path`
+//! (in `platform-wallet-ffi`) — keep the Swift caller out of the
+//! mnemonic-orchestration loop so the `swift-sdk/CLAUDE.md`
+//! "no mnemonic round-tripping" rule is satisfied — but exposed as
+//! a Rust-side `Signer` trait object so it can plug into key-wallet's
+//! signer-driven builders
+//! (`build_asset_lock_with_signer`, `TransactionBuilder::build_signed`)
+//! and rs-sdk's `_with_signer` state-transition methods.
+//!
+//! # Lifecycle and unsafety contract
+//!
+//! - The wrapper stores the resolver pointer as a `usize` and only
+//!   reconstitutes the typed pointer inside `sign_ecdsa` / `public_key`.
+//!   That keeps the struct `Send + Sync` without an `unsafe impl` on
+//!   the field type itself.
+//! - The caller is responsible for keeping the resolver handle alive
+//!   for the lifetime of every `MnemonicResolverCoreSigner` value that
+//!   wraps it. The signer never destroys the resolver — the FFI entry
+//!   point that built the signer is also the one that owns the
+//!   resolver's lifetime; ownership boundaries are documented at the
+//!   call site.
+//! - The MnemonicResolverHandle's vtable is `Send + Sync` by contract
+//!   (`MnemonicResolverHandle` itself carries `unsafe impl Send + Sync`).
+//!
+//! # No double-hashing
+//!
+//! The `Signer::sign_ecdsa` trait contract is explicit (see
+//! `key-wallet/src/signer.rs:109-120`): the caller passes a
+//! pre-computed 32-byte digest, and the signer signs it directly.
+//! rs-dpp's `StateTransition::sign_with_signer` (which is what the
+//! `_with_signer` SDK calls eventually invoke) takes care of the
+//! `double_sha` pre-image; we just receive the 32 bytes and sign.
+//!
+//! # Zeroization
+//!
+//! Every intermediate that carries key material — the resolver
+//! buffer, the BIP-39 seed, the derived 32-byte scalar — is wrapped
+//! in `Zeroizing` and dropped before the method returns. No private
+//! key bytes survive past the trait-method boundary.
+
+use std::ffi::c_void;
+use std::os::raw::c_char;
+
+use async_trait::async_trait;
+use key_wallet::dashcore::secp256k1::{self, Secp256k1};
+use key_wallet::bip32::{DerivationPath, ExtendedPrivKey};
+use key_wallet::signer::{Signer, SignerMethod};
+use key_wallet::Network;
+use thiserror::Error;
+use zeroize::Zeroizing;
+
+use crate::mnemonic_resolver::{
+    mnemonic_resolver_result, MnemonicResolverHandle, MNEMONIC_RESOLVER_BUFFER_CAPACITY,
+};
+use crate::signer_simple::parse_mnemonic_any_language;
+
+/// Failure modes for the
+/// [`MnemonicResolverCoreSigner`](crate::mnemonic_resolver_core_signer::MnemonicResolverCoreSigner)
+/// signer.
+///
+/// Replaces the earlier `type Error = String;` shape with discriminants
+/// callers can pattern-match (FFI layer, retry policies). The
+/// `ResolverFailed(i32)` variant carries the resolver's raw return code
+/// for the unknown-error path so operators can inspect the value
+/// without modifying this enum every time a new code is introduced.
+///
+/// All variants are `Display`-only — no key material ever appears in
+/// the error payload (mnemonic / seed / derived scalar are all
+/// zeroized before any error can leak out of the resolver flow).
+#[derive(Debug, Error)]
+pub enum MnemonicResolverSignerError {
+    /// Resolver handle was null at signer-construction time and the
+    /// caller subsequently invoked a signing method. Production callers
+    /// always pass a non-null handle; this variant exists primarily so
+    /// tests can exercise the null-safety contract documented on
+    /// [`MnemonicResolverCoreSigner::new`].
+    #[error("null mnemonic resolver handle")]
+    NullHandle,
+
+    /// The Swift-side resolver reported that no mnemonic is stored for
+    /// the wallet_id this signer was constructed with. Translates the
+    /// FFI `NOT_FOUND` return code.
+    #[error("mnemonic not found in keychain for the given wallet_id")]
+    NotFound,
+
+    /// The resolver requested a longer output buffer than this signer
+    /// allocates. Should be unreachable in practice — the buffer is
+    /// sized for the maximum BIP-39 phrase across all supported word
+    /// lists. Translates the FFI `BUFFER_TOO_SMALL` return code.
+    #[error("mnemonic resolver buffer too small")]
+    BufferTooSmall,
+
+    /// Catch-all for unknown resolver return codes. The raw code is
+    /// preserved so operators can grep the Swift bridge for the
+    /// matching error path.
+    #[error("mnemonic resolver failed with code {0}")]
+    ResolverFailed(i32),
+
+    /// The resolver returned data that wasn't valid UTF-8 over the
+    /// declared length. Indicates a Swift-side encoding bug.
+    #[error("invalid UTF-8 in resolved mnemonic")]
+    InvalidUtf8,
+
+    /// The resolver returned a buffer whose declared length is zero or
+    /// exceeds the capacity. Indicates a Swift-side framing bug.
+    #[error("resolver returned invalid mnemonic length {0}")]
+    InvalidMnemonicLength(usize),
+
+    /// The resolved string is not a valid BIP-39 mnemonic phrase
+    /// (failed checksum or word-list lookup).
+    #[error("invalid mnemonic phrase: {0}")]
+    InvalidMnemonic(String),
+
+    /// BIP-32 derivation failed — either the master key was
+    /// non-conformant or the path produced an invalid child key. The
+    /// inner message is the upstream `bip32` library's `Display`.
+    #[error("BIP-32 derivation failed: {0}")]
+    DerivationFailed(String),
+
+    /// The derived 32-byte scalar is not a valid secp256k1 field
+    /// element. Vanishingly improbable in production (the BIP-32
+    /// derivation flow already filters non-conformant child keys), but
+    /// surfaced explicitly so this case can't masquerade as a generic
+    /// error.
+    #[error("invalid private key scalar: {0}")]
+    InvalidScalar(String),
+}
+
+/// `key_wallet::signer::Signer` implementation that derives ECDSA
+/// secp256k1 keys from a wallet mnemonic, fetched via a Swift-owned
+/// [`MnemonicResolverHandle`].
+///
+/// Every signing operation is atomic: resolve mnemonic → parse →
+/// seed → derive at the requested path → sign (or compute pubkey) →
+/// zero all intermediate buffers, in one `await`-free synchronous
+/// step (the trait method itself is `async` for compatibility with
+/// the wider [`Signer`] surface, but the body never yields).
+pub struct MnemonicResolverCoreSigner {
+    /// Resolver handle stored as `usize` so the wrapping struct can
+    /// derive `Send + Sync` without an extra `unsafe impl` on the
+    /// field. The pointer is reconstituted inside the methods that
+    /// need it — see the unsafety contract on the module-level docs
+    /// for the lifetime guarantee.
+    resolver_addr: usize,
+    /// Wallet id passed through to every resolver invocation so the
+    /// Swift side can look up the right mnemonic. Same shape as
+    /// `dash_sdk_sign_with_mnemonic_resolver_and_path`'s
+    /// `wallet_id_bytes` parameter.
+    wallet_id: [u8; 32],
+    /// Network the derived `ExtendedPrivKey` is bound to. Captured
+    /// at construction so the trait methods don't need an extra
+    /// argument plumbed through key-wallet's `Signer` contract
+    /// (which is intentionally network-agnostic).
+    network: Network,
+}
+
+// SAFETY: `usize` and `[u8; 32]` are both `Send + Sync`; `Network`
+// is a plain `Copy` enum. The raw resolver pointer hidden inside
+// `resolver_addr` is documented to be thread-safe by contract — the
+// Swift-side vtable is either `@MainActor`-isolated or backed by a
+// serial dispatch queue, mirroring how `MnemonicResolverHandle`
+// itself carries `unsafe impl Send + Sync` in
+// `crate::mnemonic_resolver`.
+//
+// We deliberately do *not* stash the pointer as `*mut
+// MnemonicResolverHandle` directly: that field would be `!Send +
+// !Sync`, forcing an `unsafe impl Send + Sync` on this struct that
+// covers more than the resolver's actual thread-safety contract
+// (raw pointer fields are unsoundly broad). The `usize` indirection
+// is sound because it sheds the "pointer to T" type, leaving only
+// a numeric handle whose dereference responsibility lives in each
+// method body (next to its safety justification).
+//
+// No explicit `unsafe impl Send` / `unsafe impl Sync` needed — both
+// auto-traits derive from the `usize + [u8; 32] + Network` field
+// shape.
+
+impl MnemonicResolverCoreSigner {
+    /// Construct a new `MnemonicResolverCoreSigner`.
+    ///
+    /// # Safety
+    /// - `handle` must come from
+    ///   [`crate::mnemonic_resolver::dash_sdk_mnemonic_resolver_create`]
+    ///   and must stay alive for the entire lifetime of every
+    ///   `MnemonicResolverCoreSigner`
+    ///   value that wraps it. The signer never destroys the handle —
+    ///   ownership belongs to the FFI caller that built it.
+    /// - `handle` may be null; methods will fail with a resolver
+    ///   error if the resolver is dereferenced. Production callers
+    ///   should pass non-null.
+    pub unsafe fn new(
+        handle: *mut MnemonicResolverHandle,
+        wallet_id: [u8; 32],
+        network: Network,
+    ) -> Self {
+        Self {
+            resolver_addr: handle as usize,
+            wallet_id,
+            network,
+        }
+    }
+
+    /// Resolve the mnemonic from the Swift-side callback, then
+    /// derive the secp256k1 private key at `path`. Returns the raw
+    /// 32-byte scalar in a `Zeroizing` wrapper so the caller's last
+    /// drop point zeros it.
+    ///
+    /// All other intermediate buffers (mnemonic, seed) are dropped
+    /// (and zeroed) before this method returns — only the final
+    /// derived scalar leaks out, and even that is `Zeroizing`-wrapped.
+    fn derive_priv(
+        &self,
+        path: &DerivationPath,
+    ) -> Result<Zeroizing<[u8; 32]>, MnemonicResolverSignerError> {
+        if self.resolver_addr == 0 {
+            return Err(MnemonicResolverSignerError::NullHandle);
+        }
+
+        // ---- Resolve mnemonic into a Zeroizing buffer -----------------------
+        let mut mnemonic_buf: Zeroizing<[u8; MNEMONIC_RESOLVER_BUFFER_CAPACITY]> =
+            Zeroizing::new([0u8; MNEMONIC_RESOLVER_BUFFER_CAPACITY]);
+        let mut mnemonic_len: usize = 0;
+
+        // SAFETY: We re-cast from `usize` to `*mut MnemonicResolverHandle`
+        // here. The caller of `new()` guaranteed the original pointer
+        // outlives this signer (see the unsafety contract on
+        // `Self::new`). `MnemonicResolverHandle`'s vtable + ctx are
+        // thread-stable per the same module's `unsafe impl Send +
+        // Sync` justification.
+        let resolver = unsafe { &*(self.resolver_addr as *const MnemonicResolverHandle) };
+        let vtable = unsafe { &*resolver.vtable };
+        let rc = unsafe {
+            (vtable.resolve)(
+                resolver.ctx as *const c_void,
+                self.wallet_id.as_ptr(),
+                mnemonic_buf.as_mut_ptr() as *mut c_char,
+                MNEMONIC_RESOLVER_BUFFER_CAPACITY,
+                &mut mnemonic_len,
+            )
+        };
+        match rc {
+            x if x == mnemonic_resolver_result::SUCCESS => {}
+            x if x == mnemonic_resolver_result::NOT_FOUND => {
+                return Err(MnemonicResolverSignerError::NotFound);
+            }
+            x if x == mnemonic_resolver_result::BUFFER_TOO_SMALL => {
+                return Err(MnemonicResolverSignerError::BufferTooSmall);
+            }
+            other => {
+                return Err(MnemonicResolverSignerError::ResolverFailed(other));
+            }
+        }
+        if mnemonic_len == 0 || mnemonic_len > MNEMONIC_RESOLVER_BUFFER_CAPACITY {
+            return Err(MnemonicResolverSignerError::InvalidMnemonicLength(
+                mnemonic_len,
+            ));
+        }
+
+        // Parse mnemonic. UTF-8 validation runs on the prefix only —
+        // we never construct an owned `String` (the resulting buffer
+        // is dropped via Zeroizing).
+        let mnemonic_str = std::str::from_utf8(&mnemonic_buf[..mnemonic_len])
+            .map_err(|_| MnemonicResolverSignerError::InvalidUtf8)?;
+        let mnemonic = parse_mnemonic_any_language(mnemonic_str)
+            .map_err(|e| MnemonicResolverSignerError::InvalidMnemonic(e.to_string()))?;
+
+        // ---- Derive seed and BIP-32 key at `path` ---------------------------
+        let seed: Zeroizing<[u8; 64]> = Zeroizing::new(mnemonic.to_seed(""));
+        drop(mnemonic);
+
+        let secp = Secp256k1::new();
+        let master = ExtendedPrivKey::new_master(self.network, seed.as_ref()).map_err(|e| {
+            MnemonicResolverSignerError::DerivationFailed(format!("master: {e}"))
+        })?;
+        let derived = master.derive_priv(&secp, path).map_err(|e| {
+            MnemonicResolverSignerError::DerivationFailed(format!("path: {e}"))
+        })?;
+
+        // `secret_bytes()` returns a plain `[u8; 32]`; wrap in
+        // `Zeroizing` so the caller (and any panic-unwind path)
+        // wipes it on drop.
+        let bytes = Zeroizing::new(derived.private_key.secret_bytes());
+        Ok(bytes)
+    }
+}
+
+#[async_trait]
+impl Signer for MnemonicResolverCoreSigner {
+    type Error = MnemonicResolverSignerError;
+
+    fn supported_methods(&self) -> &[SignerMethod] {
+        // Only digest signing is supported — the resolver flow has
+        // no facility for parsing or rendering full transactions.
+        static METHODS: &[SignerMethod] = &[SignerMethod::Digest];
+        METHODS
+    }
+
+    async fn sign_ecdsa(
+        &self,
+        path: &DerivationPath,
+        sighash: [u8; 32],
+    ) -> Result<(secp256k1::ecdsa::Signature, secp256k1::PublicKey), Self::Error> {
+        let secret_bytes = self.derive_priv(path)?;
+        let secp = Secp256k1::new();
+        // `SecretKey::from_slice` validates the 32-byte scalar is a
+        // legitimate field element. The slice borrow is dropped at
+        // the end of this block; `secret_bytes` is then zeroed when
+        // it falls out of scope.
+        let secret = secp256k1::SecretKey::from_slice(secret_bytes.as_ref())
+            .map_err(|e| MnemonicResolverSignerError::InvalidScalar(e.to_string()))?;
+        let msg = secp256k1::Message::from_digest(sighash);
+        let signature = secp.sign_ecdsa(&msg, &secret);
+        let pubkey = secp256k1::PublicKey::from_secret_key(&secp, &secret);
+        // `secp256k1::SecretKey` is `Copy` (a thin wrapper over a
+        // 32-byte buffer) and doesn't itself zero on drop — but the
+        // backing buffer here came from `secret_bytes`
+        // (a `Zeroizing<[u8; 32]>`), which IS wiped when it falls
+        // out of scope below. The `secret` binding is forgotten by
+        // letting it go out of scope; no explicit `drop` needed.
+        let _ = secret;
+        Ok((signature, pubkey))
+    }
+
+    async fn public_key(&self, path: &DerivationPath) -> Result<secp256k1::PublicKey, Self::Error> {
+        let secret_bytes = self.derive_priv(path)?;
+        let secp = Secp256k1::new();
+        let secret = secp256k1::SecretKey::from_slice(secret_bytes.as_ref())
+            .map_err(|e| MnemonicResolverSignerError::InvalidScalar(e.to_string()))?;
+        let pubkey = secp256k1::PublicKey::from_secret_key(&secp, &secret);
+        let _ = secret;
+        Ok(pubkey)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::mnemonic_resolver::{
+        dash_sdk_mnemonic_resolver_create, dash_sdk_mnemonic_resolver_destroy,
+    };
+    use std::str::FromStr;
+
+    /// English BIP-39 test vector (all-zero entropy).
+    const ENGLISH_PHRASE: &str =
+        "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+    unsafe extern "C" fn english_resolve(
+        _ctx: *const c_void,
+        _wallet_id_bytes: *const u8,
+        out_buf: *mut c_char,
+        out_capacity: usize,
+        out_len: *mut usize,
+    ) -> i32 {
+        let phrase = ENGLISH_PHRASE.as_bytes();
+        if phrase.len() + 1 > out_capacity {
+            return mnemonic_resolver_result::BUFFER_TOO_SMALL;
+        }
+        std::ptr::copy_nonoverlapping(phrase.as_ptr() as *const c_char, out_buf, phrase.len());
+        *out_buf.add(phrase.len()) = 0;
+        *out_len = phrase.len();
+        mnemonic_resolver_result::SUCCESS
+    }
+
+    unsafe extern "C" fn missing_resolve(
+        _ctx: *const c_void,
+        _wallet_id_bytes: *const u8,
+        _out_buf: *mut c_char,
+        _out_capacity: usize,
+        _out_len: *mut usize,
+    ) -> i32 {
+        mnemonic_resolver_result::NOT_FOUND
+    }
+
+    unsafe extern "C" fn noop_destroy(_ctx: *mut c_void) {}
+
+    fn make_resolver(
+        cb: crate::mnemonic_resolver::MnemonicResolveCallback,
+    ) -> *mut MnemonicResolverHandle {
+        unsafe { dash_sdk_mnemonic_resolver_create(std::ptr::null_mut(), cb, noop_destroy) }
+    }
+
+    fn test_path() -> DerivationPath {
+        DerivationPath::from_str("m/9'/1'/5'/0'/0'/0'/0'").expect("valid path")
+    }
+
+    #[tokio::test]
+    async fn sign_ecdsa_round_trips_and_verifies() {
+        let resolver = make_resolver(english_resolve);
+        let signer = unsafe { MnemonicResolverCoreSigner::new(resolver, [0u8; 32], Network::Testnet) };
+
+        let sighash = [0x42u8; 32];
+        let (sig, pk) = signer
+            .sign_ecdsa(&test_path(), sighash)
+            .await
+            .expect("signing succeeds");
+
+        let secp = Secp256k1::new();
+        let msg = secp256k1::Message::from_digest(sighash);
+        secp.verify_ecdsa(&msg, &sig, &pk)
+            .expect("signature must verify against returned pubkey");
+
+        unsafe { dash_sdk_mnemonic_resolver_destroy(resolver) };
+    }
+
+    #[tokio::test]
+    async fn public_key_matches_sign_ecdsa_pubkey() {
+        let resolver = make_resolver(english_resolve);
+        let signer = unsafe { MnemonicResolverCoreSigner::new(resolver, [0u8; 32], Network::Testnet) };
+
+        let path = test_path();
+        let pk_only = signer.public_key(&path).await.expect("public_key succeeds");
+        let (_, pk_via_sign) = signer
+            .sign_ecdsa(&path, [0u8; 32])
+            .await
+            .expect("signing succeeds");
+
+        assert_eq!(
+            pk_only, pk_via_sign,
+            "public_key() and sign_ecdsa() must return the same pubkey for the same path"
+        );
+
+        unsafe { dash_sdk_mnemonic_resolver_destroy(resolver) };
+    }
+
+    #[tokio::test]
+    async fn missing_resolver_surfaces_not_found_error() {
+        let resolver = make_resolver(missing_resolve);
+        let signer = unsafe { MnemonicResolverCoreSigner::new(resolver, [0u8; 32], Network::Testnet) };
+
+        let err = signer
+            .sign_ecdsa(&test_path(), [0u8; 32])
+            .await
+            .expect_err("must fail when resolver returns NOT_FOUND");
+        // Pin the typed variant — String-contains is no longer the
+        // contract. Surfaces FFI/test breakage at the structured-error
+        // boundary rather than at a free-form Display payload.
+        assert!(
+            matches!(err, MnemonicResolverSignerError::NotFound),
+            "error should be NotFound, got: {err:?}"
+        );
+
+        unsafe { dash_sdk_mnemonic_resolver_destroy(resolver) };
+    }
+
+    #[tokio::test]
+    async fn null_handle_surfaces_clean_error() {
+        let signer = unsafe {
+            MnemonicResolverCoreSigner::new(std::ptr::null_mut(), [0u8; 32], Network::Testnet)
+        };
+        let err = signer
+            .sign_ecdsa(&test_path(), [0u8; 32])
+            .await
+            .expect_err("must fail with null handle");
+        assert!(
+            matches!(err, MnemonicResolverSignerError::NullHandle),
+            "error should be NullHandle, got: {err:?}"
+        );
+    }
+
+    #[test]
+    fn advertises_digest_only() {
+        let signer = unsafe {
+            MnemonicResolverCoreSigner::new(std::ptr::null_mut(), [0u8; 32], Network::Testnet)
+        };
+        let methods = signer.supported_methods();
+        assert_eq!(methods.len(), 1);
+        assert!(matches!(methods[0], SignerMethod::Digest));
+    }
+}
diff --git a/packages/rs-sdk/src/platform/transition/broadcast_identity.rs b/packages/rs-sdk/src/platform/transition/broadcast_identity.rs
index 7763bb12412..53b1965675a 100644
--- a/packages/rs-sdk/src/platform/transition/broadcast_identity.rs
+++ b/packages/rs-sdk/src/platform/transition/broadcast_identity.rs
@@ -13,6 +13,8 @@ use dpp::identity::signer::Signer;
 use dpp::identity::IdentityPublicKey;
 use dpp::native_bls::NativeBlsModule;
 use dpp::prelude::{AssetLockProof, Identity};
+
+use super::put_settings::PutSettings;
 use dpp::state_transition::identity_create_transition::methods::IdentityCreateTransitionMethodsV0;
 use dpp::state_transition::identity_create_transition::IdentityCreateTransition;
 use dpp::state_transition::StateTransition;
@@ -87,33 +89,103 @@ pub(crate) trait BroadcastRequestForNewIdentity<T: TransportRequest, S: Signer<I
     /// # Error Handling
     /// This method propagates any errors encountered during the signing or conversion process.
     /// These are returned as [`Error`] instances.
+    ///
+    /// Prefer [`Self::broadcast_request_for_new_identity_with_signer`] when
+    /// the asset-lock private key lives outside Rust (Swift / hardware wallet
+    /// / HSM): the `_with_signer` variant routes asset-lock signing through
+    /// an external [`key_wallet::signer::Signer`] so the private key never
+    /// crosses the FFI boundary as raw bytes.
     #[allow(async_fn_in_trait)]
-    async fn broadcast_request_for_new_identity(
+    async fn broadcast_request_for_new_identity_with_private_key(
         &self,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &PrivateKey,
         signer: &S,
         platform_version: &PlatformVersion,
+        settings: Option<PutSettings>,
     ) -> Result<(StateTransition, BroadcastStateTransitionRequest), Error>;
+
+    /// Signer-driven counterpart to
+    /// [`Self::broadcast_request_for_new_identity_with_private_key`].
+    ///
+    /// `identity_signer` signs the per-key witnesses on `public_keys[]`,
+    /// while `asset_lock_signer` produces the outer state-transition ECDSA
+    /// signature for the key at `asset_lock_proof_path` — atomically
+    /// deriving, signing, and zeroising inside the signer's trust boundary.
+    ///
+    /// `settings.user_fee_increase` is the percentage multiplier the
+    /// caller wants applied to the ST's processing fee. Threading it
+    /// through the builder is load-bearing: it both affects fee
+    /// accounting AND changes the ST's signable bytes, which the
+    /// upstream CL-height retry path in `platform-wallet` relies on
+    /// to bypass Tenderdash's invalid-tx hash cache
+    /// (`keep-invalid-txs-in-cache = true` in dashmate's
+    /// mainnet/testnet templates). `None` / unset = unaltered fees.
+    #[cfg(feature = "core_key_wallet")]
+    #[allow(async_fn_in_trait)]
+    async fn broadcast_request_for_new_identity_with_signer<AS>(
+        &self,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &S,
+        platform_version: &PlatformVersion,
+        settings: Option<PutSettings>,
+    ) -> Result<(StateTransition, BroadcastStateTransitionRequest), Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync;
 }
 
 impl<S: Signer<IdentityPublicKey>>
     BroadcastRequestForNewIdentity<proto::BroadcastStateTransitionRequest, S> for Identity
 {
-    async fn broadcast_request_for_new_identity(
+    async fn broadcast_request_for_new_identity_with_private_key(
         &self,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &PrivateKey,
         signer: &S,
         platform_version: &PlatformVersion,
+        settings: Option<PutSettings>,
     ) -> Result<(StateTransition, BroadcastStateTransitionRequest), Error> {
-        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signer(
+        let user_fee_increase = settings.and_then(|s| s.user_fee_increase).unwrap_or_default();
+        let identity_create_transition =
+            IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
+                self,
+                asset_lock_proof,
+                asset_lock_proof_private_key.inner.as_ref(),
+                signer,
+                &NativeBlsModule,
+                user_fee_increase,
+                platform_version,
+            )
+            .await?;
+        ensure_valid_state_transition_structure(&identity_create_transition, platform_version)?;
+        let request = identity_create_transition.broadcast_request_for_state_transition()?;
+        Ok((identity_create_transition, request))
+    }
+
+    #[cfg(feature = "core_key_wallet")]
+    async fn broadcast_request_for_new_identity_with_signer<AS>(
+        &self,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &S,
+        platform_version: &PlatformVersion,
+        settings: Option<PutSettings>,
+    ) -> Result<(StateTransition, BroadcastStateTransitionRequest), Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync,
+    {
+        let user_fee_increase = settings.and_then(|s| s.user_fee_increase).unwrap_or_default();
+        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signers(
             self,
             asset_lock_proof,
-            asset_lock_proof_private_key.inner.as_ref(),
-            signer,
+            asset_lock_proof_path,
+            identity_signer,
+            asset_lock_signer,
             &NativeBlsModule,
-            0,
+            user_fee_increase,
             platform_version,
         )
         .await?;
diff --git a/packages/rs-sdk/src/platform/transition/put_identity.rs b/packages/rs-sdk/src/platform/transition/put_identity.rs
index fd5803c2c90..24592500b2b 100644
--- a/packages/rs-sdk/src/platform/transition/put_identity.rs
+++ b/packages/rs-sdk/src/platform/transition/put_identity.rs
@@ -26,8 +26,15 @@ use std::collections::{BTreeMap, BTreeSet};
 /// Trait for creating identities on the platform.
 #[async_trait::async_trait]
 pub trait PutIdentity<IS: Signer<IdentityPublicKey>>: Waitable {
-    /// Creates an identity using an asset lock proof.
-    async fn put_to_platform(
+    /// Creates an identity using an asset lock proof whose private key
+    /// is held in-process.
+    ///
+    /// Prefer [`Self::put_to_platform_with_signer`] when the asset-lock
+    /// private key lives outside Rust (Swift / hardware wallet / HSM):
+    /// the `_with_signer` variant routes asset-lock signing through an
+    /// external [`key_wallet::signer::Signer`] so the private key never
+    /// crosses the FFI boundary as raw bytes.
+    async fn put_to_platform_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
@@ -37,7 +44,10 @@ pub trait PutIdentity<IS: Signer<IdentityPublicKey>>: Waitable {
     ) -> Result<StateTransition, Error>;
 
     /// Creates an identity using an asset lock and waits for confirmation.
-    async fn put_to_platform_and_wait_for_response(
+    ///
+    /// In-process private-key counterpart to
+    /// [`Self::put_to_platform_and_wait_for_response_with_signer`].
+    async fn put_to_platform_and_wait_for_response_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
@@ -48,6 +58,48 @@ pub trait PutIdentity<IS: Signer<IdentityPublicKey>>: Waitable {
     where
         Self: Sized;
 
+    /// Creates an identity using an asset lock proof whose private key
+    /// is held by an external [`key_wallet::signer::Signer`] (Swift,
+    /// hardware wallet, HSM).
+    ///
+    /// `identity_signer` signs the per-key witnesses on `public_keys[]`
+    /// (same as [`Self::put_to_platform_with_private_key`]), while
+    /// `asset_lock_signer` produces the outer state-transition ECDSA
+    /// signature for the key at `asset_lock_proof_path` — atomically
+    /// deriving, signing, and zeroising inside the signer's trust
+    /// boundary.
+    #[cfg(feature = "core_key_wallet")]
+    async fn put_to_platform_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &IS,
+        settings: Option<PutSettings>,
+    ) -> Result<StateTransition, Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync;
+
+    /// Creates an identity using an asset-lock signer and waits for
+    /// confirmation.
+    ///
+    /// Signer-driven counterpart to
+    /// [`Self::put_to_platform_and_wait_for_response_with_private_key`].
+    #[cfg(feature = "core_key_wallet")]
+    async fn put_to_platform_and_wait_for_response_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &IS,
+        settings: Option<PutSettings>,
+    ) -> Result<Self, Error>
+    where
+        Self: Sized,
+        AS: dpp::key_wallet::signer::Signer + Send + Sync;
+
     /// Creates an identity funded by Platform addresses using explicit nonces.
     ///
     /// Use [Identity::new_with_input_addresses_and_keys](dpp::identity::Identity::new_with_input_addresses_and_keys)
@@ -91,7 +143,7 @@ pub trait PutIdentity<IS: Signer<IdentityPublicKey>>: Waitable {
 
 #[async_trait::async_trait]
 impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
-    async fn put_to_platform(
+    async fn put_to_platform_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
@@ -99,7 +151,7 @@ impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
         signer: &IS,
         settings: Option<PutSettings>,
     ) -> Result<StateTransition, Error> {
-        put_identity_with_asset_lock(
+        put_identity_with_asset_lock_and_private_key(
             self,
             sdk,
             asset_lock_proof,
@@ -110,7 +162,7 @@ impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
         .await
     }
 
-    async fn put_to_platform_and_wait_for_response(
+    async fn put_to_platform_and_wait_for_response_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
@@ -119,7 +171,7 @@ impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
         settings: Option<PutSettings>,
     ) -> Result<Identity, Error> {
         let state_transition = self
-            .put_to_platform(
+            .put_to_platform_with_private_key(
                 sdk,
                 asset_lock_proof,
                 asset_lock_proof_private_key,
@@ -131,6 +183,58 @@ impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
         Self::wait_for_response(sdk, state_transition, settings).await
     }
 
+    #[cfg(feature = "core_key_wallet")]
+    async fn put_to_platform_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &IS,
+        settings: Option<PutSettings>,
+    ) -> Result<StateTransition, Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync,
+    {
+        put_identity_with_asset_lock_and_signer(
+            self,
+            sdk,
+            asset_lock_proof,
+            asset_lock_proof_path,
+            asset_lock_signer,
+            identity_signer,
+            settings,
+        )
+        .await
+    }
+
+    #[cfg(feature = "core_key_wallet")]
+    async fn put_to_platform_and_wait_for_response_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        identity_signer: &IS,
+        settings: Option<PutSettings>,
+    ) -> Result<Identity, Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync,
+    {
+        let state_transition = self
+            .put_to_platform_with_signer(
+                sdk,
+                asset_lock_proof,
+                asset_lock_proof_path,
+                asset_lock_signer,
+                identity_signer,
+                settings,
+            )
+            .await?;
+
+        Self::wait_for_response(sdk, state_transition, settings).await
+    }
+
     async fn put_with_address_funding<AS: Signer<PlatformAddress> + Send + Sync>(
         &self,
         sdk: &Sdk,
@@ -178,7 +282,7 @@ impl<IS: Signer<IdentityPublicKey>> PutIdentity<IS> for Identity {
     }
 }
 
-async fn put_identity_with_asset_lock<S: Signer<IdentityPublicKey>>(
+async fn put_identity_with_asset_lock_and_private_key<S: Signer<IdentityPublicKey>>(
     identity: &Identity,
     sdk: &Sdk,
     asset_lock_proof: AssetLockProof,
@@ -186,12 +290,54 @@ async fn put_identity_with_asset_lock<S: Signer<IdentityPublicKey>>(
     signer: &S,
     settings: Option<PutSettings>,
 ) -> Result<StateTransition, Error> {
+    // `broadcast_request_for_new_identity_with_private_key` reads
+    // `PutSettings::user_fee_increase` internally; threading
+    // `settings` straight through honours that knob without the
+    // pre-extraction dance. The CL-height retry path in
+    // `platform-wallet` relies on `user_fee_increase` to change the
+    // ST's signable bytes (Tenderdash's 24h invalid-tx hash cache
+    // would silently drop identical-bytes resubmits).
     let (state_transition, _) = identity
-        .broadcast_request_for_new_identity(
+        .broadcast_request_for_new_identity_with_private_key(
             asset_lock_proof,
             asset_lock_proof_private_key,
             signer,
             sdk.version(),
+            settings,
+        )
+        .await?;
+    ensure_valid_state_transition_structure(&state_transition, sdk.version())?;
+    state_transition.broadcast(sdk, settings).await?;
+    Ok(state_transition)
+}
+
+#[cfg(feature = "core_key_wallet")]
+#[allow(clippy::too_many_arguments)]
+async fn put_identity_with_asset_lock_and_signer<IS, AS>(
+    identity: &Identity,
+    sdk: &Sdk,
+    asset_lock_proof: AssetLockProof,
+    asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+    asset_lock_signer: &AS,
+    identity_signer: &IS,
+    settings: Option<PutSettings>,
+) -> Result<StateTransition, Error>
+where
+    IS: Signer<IdentityPublicKey>,
+    AS: dpp::key_wallet::signer::Signer + Send + Sync,
+{
+    // `broadcast_request_for_new_identity_with_signer` reads
+    // `PutSettings::user_fee_increase` internally; thread `settings`
+    // through to honour the CL-height retry's hash-bumping mechanism
+    // (see the matching block in `put_identity_with_asset_lock_and_private_key`).
+    let (state_transition, _) = identity
+        .broadcast_request_for_new_identity_with_signer(
+            asset_lock_proof,
+            asset_lock_proof_path,
+            asset_lock_signer,
+            identity_signer,
+            sdk.version(),
+            settings,
         )
         .await?;
     ensure_valid_state_transition_structure(&state_transition, sdk.version())?;
diff --git a/packages/rs-sdk/src/platform/transition/top_up_identity.rs b/packages/rs-sdk/src/platform/transition/top_up_identity.rs
index 422c20c4553..15626d86f33 100644
--- a/packages/rs-sdk/src/platform/transition/top_up_identity.rs
+++ b/packages/rs-sdk/src/platform/transition/top_up_identity.rs
@@ -5,37 +5,63 @@ use super::waitable::Waitable;
 use crate::{Error, Sdk};
 use dpp::dashcore::PrivateKey;
 use dpp::identity::{Identity, PartialIdentity};
-use dpp::prelude::{AssetLockProof, UserFeeIncrease};
+use dpp::prelude::AssetLockProof;
 use dpp::state_transition::identity_topup_transition::methods::IdentityTopUpTransitionMethodsV0;
 use dpp::state_transition::identity_topup_transition::IdentityTopUpTransition;
 
 #[async_trait::async_trait]
 pub trait TopUpIdentity: Waitable {
-    async fn top_up_identity(
+    /// Tops up an existing identity using an asset lock proof whose
+    /// private key is held in-process.
+    ///
+    /// Prefer [`Self::top_up_identity_with_signer`] when the asset-lock
+    /// private key lives outside Rust (Swift / hardware wallet / HSM):
+    /// the `_with_signer` variant routes asset-lock signing through an
+    /// external [`key_wallet::signer::Signer`] so the private key never
+    /// crosses the FFI boundary as raw bytes.
+    async fn top_up_identity_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &PrivateKey,
-        user_fee_increase: Option<UserFeeIncrease>,
         settings: Option<PutSettings>,
     ) -> Result<u64, Error>;
+
+    /// Tops up an existing identity using an asset-lock signer.
+    ///
+    /// Signer-driven counterpart to
+    /// [`Self::top_up_identity_with_private_key`]. `asset_lock_signer`
+    /// produces the outer state-transition ECDSA signature for the key
+    /// at `asset_lock_proof_path` — atomically deriving, signing, and
+    /// zeroising inside the signer's trust boundary.
+    #[cfg(feature = "core_key_wallet")]
+    async fn top_up_identity_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        settings: Option<PutSettings>,
+    ) -> Result<u64, Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync;
 }
 
 #[async_trait::async_trait]
 impl TopUpIdentity for Identity {
-    async fn top_up_identity(
+    async fn top_up_identity_with_private_key(
         &self,
         sdk: &Sdk,
         asset_lock_proof: AssetLockProof,
         asset_lock_proof_private_key: &PrivateKey,
-        user_fee_increase: Option<UserFeeIncrease>,
         settings: Option<PutSettings>,
     ) -> Result<u64, Error> {
-        let state_transition = IdentityTopUpTransition::try_from_identity(
+        let user_fee_increase = settings.and_then(|s| s.user_fee_increase).unwrap_or_default();
+        let state_transition = IdentityTopUpTransition::try_from_identity_with_private_key(
             self,
             asset_lock_proof,
             asset_lock_proof_private_key.inner.as_ref(),
-            user_fee_increase.unwrap_or_default(),
+            user_fee_increase,
             sdk.version(),
             None,
         )?;
@@ -46,4 +72,35 @@ impl TopUpIdentity for Identity {
             .balance
             .ok_or(Error::Generic("expected an identity balance".to_string()))
     }
+
+    #[cfg(feature = "core_key_wallet")]
+    async fn top_up_identity_with_signer<AS>(
+        &self,
+        sdk: &Sdk,
+        asset_lock_proof: AssetLockProof,
+        asset_lock_proof_path: &dpp::key_wallet::bip32::DerivationPath,
+        asset_lock_signer: &AS,
+        settings: Option<PutSettings>,
+    ) -> Result<u64, Error>
+    where
+        AS: dpp::key_wallet::signer::Signer + Send + Sync,
+    {
+        let user_fee_increase = settings.and_then(|s| s.user_fee_increase).unwrap_or_default();
+        let state_transition = IdentityTopUpTransition::try_from_identity_with_signer(
+            self,
+            asset_lock_proof,
+            asset_lock_proof_path,
+            asset_lock_signer,
+            user_fee_increase,
+            sdk.version(),
+            None,
+        )
+        .await?;
+        ensure_valid_state_transition_structure(&state_transition, sdk.version())?;
+        let identity: PartialIdentity = state_transition.broadcast_and_wait(sdk, settings).await?;
+
+        identity
+            .balance
+            .ok_or(Error::Generic("expected an identity balance".to_string()))
+    }
 }
diff --git a/packages/strategy-tests/src/transitions.rs b/packages/strategy-tests/src/transitions.rs
index fecb5a66aff..34c0111dfe2 100644
--- a/packages/strategy-tests/src/transitions.rs
+++ b/packages/strategy-tests/src/transitions.rs
@@ -383,7 +383,7 @@ pub fn create_identity_top_up_transition(
         let (asset_lock_proof, private_key) = proof_and_pk;
         let pk_bytes = private_key.to_bytes();
 
-        IdentityTopUpTransition::try_from_identity(
+        IdentityTopUpTransition::try_from_identity_with_private_key(
             identity,
             asset_lock_proof,
             pk_bytes.as_ref(),
@@ -1139,7 +1139,7 @@ pub async fn create_identities_state_transitions(
         if let Some(proof_and_pk) = asset_lock_proofs.pop() {
             let (asset_lock_proof, private_key) = proof_and_pk;
             let pk = private_key.to_bytes();
-            match IdentityCreateTransition::try_from_identity_with_signer(
+            match IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
                 &identity,
                 asset_lock_proof,
                 &pk,
@@ -1227,7 +1227,7 @@ where
             amount_range,
             rng,
         );
-        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signer(
+        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
             &identity.clone(),
             asset_lock_proof,
             &pk,
@@ -1276,7 +1276,7 @@ pub async fn create_state_transitions_for_identities_and_proofs(
 ) -> Vec<(Identity, StateTransition)> {
     let mut results = Vec::with_capacity(identities_with_proofs.len());
     for (mut identity, private_key, asset_lock_proof) in identities_with_proofs.into_iter() {
-        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signer(
+        let identity_create_transition = IdentityCreateTransition::try_from_identity_with_signer_and_private_key(
             &identity.clone(),
             asset_lock_proof,
             &private_key,
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
index 2623a53f3e1..71a0fcc3c5d 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift
@@ -28,7 +28,8 @@ public enum DashModelContainer {
             PersistentTransaction.self,
             PersistentTxo.self,
             PersistentPendingInput.self,
-            PersistentWalletManagerMetadata.self
+            PersistentWalletManagerMetadata.self,
+            PersistentAssetLock.self
         ]
     }
 
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentAssetLock.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentAssetLock.swift
new file mode 100644
index 00000000000..7eaa7be72b5
--- /dev/null
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentAssetLock.swift
@@ -0,0 +1,150 @@
+import Foundation
+import SwiftData
+
+/// SwiftData model for persisting a single tracked asset-lock credit
+/// output (DIP-0027). Mirrors
+/// [`AssetLockEntry`](platform_wallet::changeset::AssetLockEntry) on
+/// the Rust side, one row per `(walletId, outpoint)`. Upserted by the
+/// `on_persist_asset_locks_fn` callback whenever the asset-lock
+/// manager flushes a status transition (Built → Broadcast →
+/// InstantSendLocked → ChainLocked) and deleted when the lock is
+/// consumed by a successful identity-registration / top-up flow.
+///
+/// Two consumers:
+/// 1. `RegistrationProgressView` reads `statusRaw` to drive the
+///    stage progress bar (`@Query` filtered by `walletId +
+///    identityIndexRaw`).
+/// 2. The wallet load path rebuilds `unused_asset_locks` on the
+///    Rust side from these rows so an in-flight registration that
+///    was interrupted by an app kill can resume from the latest
+///    status without rebroadcasting the asset-lock transaction.
+@Model
+public final class PersistentAssetLock {
+    /// Index `walletId` so per-wallet asset-lock scans (the progress
+    /// bar's `@Query`, the storage explorer's wallet-scoped drill-
+    /// down, the load-time rehydration path) hit an index instead of
+    /// scanning the whole table.
+    #Index<PersistentAssetLock>([\.walletId])
+
+    /// 36-byte outpoint encoded as `<txid hex (display order)>:<vout>`.
+    /// Matches the formatting used by `PersistentTxo.outpointHex` /
+    /// `PersistentPendingInput`'s outpoint surface so the same lock
+    /// is identifiable across all three. Unique across the SwiftData
+    /// store — a collision would imply two wallets producing the
+    /// same outpoint, which is unreachable in practice.
+    @Attribute(.unique) public var outPointHex: String
+
+    /// 32-byte wallet id owning this asset lock.
+    public var walletId: Data
+
+    /// Consensus-encoded asset-lock transaction (Core special
+    /// transaction type 8, `AssetLockPayload`). Carried so the load
+    /// path can re-instantiate the `TrackedAssetLock` without
+    /// rebroadcasting.
+    public var transactionBytes: Data
+
+    /// Discriminant of [`AssetLockFundingType`]:
+    /// 0 = IdentityRegistration, 1 = IdentityTopUp, 2 = IdentityTopUpNotBound,
+    /// 3 = IdentityInvitation, 4 = AssetLockAddressTopUp,
+    /// 5 = AssetLockShieldedAddressTopUp. Stored as `Int` so SwiftData
+    /// predicates can compare directly without a cast.
+    public var fundingTypeRaw: Int
+
+    /// Identity index slot consumed by this asset lock — the source of
+    /// truth for matching against an in-flight registration's
+    /// `RegistrationProgressView`. Stored as `Int32` so `#Predicate`
+    /// can compare against a Swift-side `UInt32` lossily-cast value
+    /// without overflow surprises (identity indices stay well under
+    /// `Int32.max`).
+    public var identityIndexRaw: Int32
+
+    /// Locked amount in duffs (1 DASH = 1e8 duffs). Stored as `Int64`
+    /// for the same predicate-friendliness reason as
+    /// `identityIndexRaw`.
+    public var amountDuffs: Int64
+
+    /// Discriminant of [`AssetLockStatus`]:
+    /// 0 = Built, 1 = Broadcast, 2 = InstantSendLocked, 3 = ChainLocked.
+    /// Stored as `Int` so `#Predicate` can match raw values directly
+    /// (the progress bar compares against 0/1/2/3).
+    public var statusRaw: Int
+
+    /// Bincode-encoded `AssetLockProof` (`dpp::bincode::config::standard()`).
+    /// Absent (`nil`) until the lock reaches `InstantSendLocked` /
+    /// `ChainLocked`. The load path passes these bytes back over FFI
+    /// where Rust decodes them into the live proof.
+    public var proofBytes: Data?
+
+    /// Record timestamps.
+    public var createdAt: Date
+    public var updatedAt: Date
+
+    public init(
+        outPointHex: String,
+        walletId: Data,
+        transactionBytes: Data,
+        fundingTypeRaw: Int,
+        identityIndexRaw: Int32,
+        amountDuffs: Int64,
+        statusRaw: Int,
+        proofBytes: Data? = nil
+    ) {
+        self.outPointHex = outPointHex
+        self.walletId = walletId
+        self.transactionBytes = transactionBytes
+        self.fundingTypeRaw = fundingTypeRaw
+        self.identityIndexRaw = identityIndexRaw
+        self.amountDuffs = amountDuffs
+        self.statusRaw = statusRaw
+        self.proofBytes = proofBytes
+        self.createdAt = Date()
+        self.updatedAt = Date()
+    }
+}
+
+// MARK: - Queries
+
+extension PersistentAssetLock {
+    /// Per-wallet predicate. Indexed scan via the `walletId` index.
+    public static func predicate(walletId: Data) -> Predicate<PersistentAssetLock> {
+        #Predicate<PersistentAssetLock> { entry in
+            entry.walletId == walletId
+        }
+    }
+
+    /// Per-slot predicate keyed by `(walletId, identityIndex)` — used
+    /// by `RegistrationProgressView` to find the in-flight lock for
+    /// a particular registration slot.
+    public static func predicate(
+        walletId: Data,
+        identityIndex: UInt32
+    ) -> Predicate<PersistentAssetLock> {
+        let identityIndexRaw = Int32(bitPattern: identityIndex)
+        return #Predicate<PersistentAssetLock> { entry in
+            entry.walletId == walletId && entry.identityIndexRaw == identityIndexRaw
+        }
+    }
+}
+
+// MARK: - Outpoint encoding helpers
+
+extension PersistentAssetLock {
+    /// Encode a 36-byte raw outpoint (`txid_le || vout_le`) — matching
+    /// the layout used by the Rust-side `AssetLockEntryFFI.out_point`
+    /// — as the canonical display-order hex string
+    /// `<txid display hex>:<vout>`.
+    ///
+    /// The Rust side serializes the txid in raw byte order (little-
+    /// endian on the wire); display order is the reverse, same as
+    /// `PersistentTxo.outpointHex`.
+    public static func encodeOutPoint(rawBytes: Data) -> String {
+        precondition(rawBytes.count == 36, "outpoint must be 36 bytes")
+        let txid = rawBytes.prefix(32)
+        let voutBytes = rawBytes.suffix(4)
+        let vout = voutBytes.withUnsafeBytes { raw in
+            raw.load(as: UInt32.self).littleEndian
+        }
+        let txidHex = txid.reversed().map { String(format: "%02x", $0) }.joined()
+        return "\(txidHex):\(vout)"
+    }
+}
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentTransaction.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentTransaction.swift
index 3e072af6555..5e4b3c687a4 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentTransaction.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentTransaction.swift
@@ -47,8 +47,26 @@ public final class PersistentTransaction {
     public var blockTimestamp: UInt32
     /// Direction: 0=incoming, 1=outgoing, 2=internal, 3=coinJoin.
     public var direction: UInt32
-    /// Transaction type name (Standard, CoinJoin, etc.).
+    /// Transaction type name (Standard, CoinJoin, etc.). Sourced
+    /// from Rust's `Debug` repr of `TransactionType` for human
+    /// display only — DO NOT use this string as a discriminant;
+    /// match on [`transactionTypeKind`] instead. The string is
+    /// not a stable wire contract (a `#[derive(Debug)]` rename on
+    /// the Rust side would silently change it).
     public var transactionType: String
+    /// Typed discriminant of Rust's
+    /// `key_wallet::transaction_checking::transaction_router::TransactionType`,
+    /// kept in lockstep with [`TransactionTypeKind`]. Use this byte
+    /// (via [`typedKind`] / [`isAssetLock`] / [`isAssetUnlock`]) to
+    /// branch on transaction kind in UI code; the parallel
+    /// [`transactionType`] string is human-readable only and not
+    /// stable.
+    ///
+    /// Sentinel `0xFF` means "pre-feature row whose discriminant
+    /// hasn't been populated yet" — SPV's next upsert round
+    /// replaces it with the real discriminant on touch. Accessors
+    /// treat the sentinel as unknown (no branch fires).
+    public var transactionTypeKind: UInt8 = 0xFF
     /// Net amount in duffs (signed: positive=received, negative=sent).
     public var netAmount: Int64
     /// Fee in duffs (nil if unknown).
@@ -152,9 +170,74 @@ public final class PersistentTransaction {
         }
     }
 
+    /// Typed view onto [`transactionTypeKind`]. `nil` only for the
+    /// `0xFF` sentinel (pre-feature row not yet re-persisted by SPV)
+    /// or for a future Rust-side variant addition Swift hasn't
+    /// learned about yet — both treated as "unknown" by the
+    /// `isAssetLock` / `isAssetUnlock` accessors so an unexpected
+    /// byte never silently fires the wrong branch.
+    public var typedKind: TransactionTypeKind? {
+        TransactionTypeKind(rawValue: transactionTypeKind)
+    }
+
+    /// `true` when this transaction is a Dash Platform asset-lock
+    /// funding tx — a Layer-1 burn that mints Layer-2 credits. The
+    /// wallet's `direction` classifier reports `Internal` because the
+    /// credit output is derived from this wallet's identity-funding
+    /// account, but the *intent* is conversion to L2 credits, not
+    /// "transaction to myself."
+    public var isAssetLock: Bool {
+        typedKind == .assetLock
+    }
+
+    /// Companion to [`isAssetLock`] — withdrawal back to L1.
+    public var isAssetUnlock: Bool {
+        typedKind == .assetUnlock
+    }
+
+    /// Direction text for UI surfaces, overridden for asset-lock /
+    /// asset-unlock txs where the raw `Internal` direction is
+    /// misleading (the L1 DASH isn't going "to myself" — it's being
+    /// converted to / from L2 platform credits).
+    ///
+    /// Use this anywhere a human-readable "what happened" label is
+    /// needed; fall back to [`directionName`] only when the consumer
+    /// genuinely needs the raw direction (e.g. the filter dropdown).
+    public var displayDirection: String {
+        if isAssetLock { return "Asset Lock" }
+        if isAssetUnlock { return "Asset Unlock" }
+        return directionName
+    }
+
     public var formattedAmount: String {
         let dash = Double(abs(netAmount)) / 100_000_000.0
         let sign = netAmount >= 0 ? "+" : "-"
         return String(format: "%@%.8f DASH", sign, dash)
     }
 }
+
+/// Typed mirror of Rust's
+/// `key_wallet::transaction_checking::transaction_router::TransactionType`,
+/// pinned to the `u8` discriminants emitted by
+/// `transaction_type_to_u8` in `rs-platform-wallet-ffi`'s
+/// `core_wallet_types.rs`. The Rust side has a comment requiring
+/// any new variant to gain a Swift case here in the same commit;
+/// the reverse holds too (Swift is the consumer's source of truth
+/// for the discriminant byte).
+///
+/// Note: `transactionTypeKind == 0xFF` is the
+/// "pre-feature / not-populated" sentinel and is NOT a case in this
+/// enum — `TransactionTypeKind(rawValue: 0xFF)` returns `nil`, which
+/// the accessors treat as "unknown" so no branch fires falsely.
+public enum TransactionTypeKind: UInt8 {
+    case standard = 0
+    case coinJoin = 1
+    case providerRegistration = 2
+    case providerUpdateRegistrar = 3
+    case providerUpdateService = 4
+    case providerUpdateRevocation = 5
+    case assetLock = 6
+    case assetUnlock = 7
+    case coinbase = 8
+    case ignored = 9
+}
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentWallet.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentWallet.swift
index 3f910993114..4b237821a2e 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentWallet.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Persistence/Models/PersistentWallet.swift
@@ -55,6 +55,16 @@ public final class PersistentWallet {
     public var syncedHeight: UInt32
     /// Timestamp of last sync (Unix seconds).
     public var lastSynced: UInt64
+    /// Bincode-serialised
+    /// `dashcore::ephemerealdata::chain_lock::ChainLock` carrying the
+    /// wallet's `WalletMetadata::last_applied_chain_lock` from the
+    /// previous session. Roundtripped across app launches so the
+    /// asset-lock-resume CL-from-metadata fallback in Rust's
+    /// `proof.rs` can fire on catch-up at launch without waiting
+    /// for SPV to re-apply a fresh ChainLock. `nil` when no
+    /// ChainLock has ever been observed for this wallet (fresh
+    /// wallet, or pre-feature row).
+    public var lastAppliedChainLockBytes: Data?
     /// User imported this wallet from an existing mnemonic (as
     /// opposed to generating a fresh one). Cosmetic flag that
     /// drives the "📥 Imported" badge; defaulted to `false` for
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/AssetLock/ManagedAssetLockManager.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/AssetLock/ManagedAssetLockManager.swift
index 6083eadef16..b9dea56316b 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/AssetLock/ManagedAssetLockManager.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/AssetLock/ManagedAssetLockManager.swift
@@ -51,16 +51,17 @@ public class ManagedAssetLockManager {
     public struct BuildResult {
         /// Serialized signed transaction.
         public let transaction: Data
-        /// 32-byte one-time private key.
-        public let privateKey: Data
+        /// Credit-output derivation path (string form). The signer
+        /// uses this path to produce the consume-phase signature.
+        public let derivationPath: String
     }
 
     /// Result of creating a funded asset lock proof.
     public struct FundedProofResult {
         /// Bincode-encoded AssetLockProof.
         public let proofBytes: Data
-        /// 32-byte one-time private key.
-        public let privateKey: Data
+        /// Credit-output derivation path (string form).
+        public let derivationPath: String
         /// 32-byte transaction ID.
         public let txid: Data
     }
@@ -69,8 +70,8 @@ public class ManagedAssetLockManager {
     public struct ResumeResult {
         /// Bincode-encoded AssetLockProof.
         public let proofBytes: Data
-        /// 32-byte one-time private key.
-        public let privateKey: Data
+        /// Credit-output derivation path (string form).
+        public let derivationPath: String
     }
 
     // MARK: - Queries
@@ -102,60 +103,72 @@ public class ManagedAssetLockManager {
 
     // MARK: - Build
 
-    /// Build an asset lock transaction.
+    /// Build an asset lock transaction. The caller supplies a
+    /// `MnemonicResolver` whose vtable backs every per-input Core
+    /// ECDSA signature; the credit-output private key is never
+    /// exposed across the FFI. The resolver must outlive this call.
     public func buildTransaction(
         amountDuffs: UInt64,
         accountIndex: UInt32 = 0,
         fundingType: FundingType,
-        identityIndex: UInt32 = 0
+        identityIndex: UInt32 = 0,
+        resolver: MnemonicResolver
     ) throws -> BuildResult {
         var txBytesPtr: UnsafeMutablePointer<UInt8>? = nil
         var txLen: UInt = 0
-        var privateKey: FFIByteTuple32 = // gitleaks:allow
-            (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+        var pathPtr: UnsafeMutablePointer<CChar>? = nil
 
-        try asset_lock_manager_build_transaction(
-            handle, amountDuffs, accountIndex, fundingType.rawValue, identityIndex,
-            &txBytesPtr, &txLen, &privateKey
-        ).check()
+        try withExtendedLifetime(resolver) {
+            try asset_lock_manager_build_transaction(
+                handle, amountDuffs, accountIndex, fundingType.rawValue, identityIndex,
+                resolver.handle, &txBytesPtr, &txLen, &pathPtr
+            ).check()
+        }
 
         guard let txPtr = txBytesPtr, txLen > 0 else {
             throw PlatformWalletError.unknown("FFI returned success but transaction buffer was empty")
         }
         defer { asset_lock_manager_free_tx_bytes(txPtr, txLen) }
+        defer { if let p = pathPtr { platform_wallet_string_free(p) } }
 
         let txData = Data(bytes: txPtr, count: Int(txLen))
-        let keyData = withUnsafeBytes(of: &privateKey) { Data($0) }
-        return BuildResult(transaction: txData, privateKey: keyData)
+        let path = pathPtr.map { String(cString: $0) } ?? ""
+        return BuildResult(transaction: txData, derivationPath: path)
     }
 
-    /// Build, broadcast, and wait for an asset lock proof.
+    /// Build, broadcast, and wait for an asset lock proof. Signing
+    /// happens through the supplied `MnemonicResolver` — the
+    /// credit-output private key never crosses the FFI boundary.
     public func createFundedProof(
         amountDuffs: UInt64,
         accountIndex: UInt32 = 0,
         fundingType: FundingType,
-        identityIndex: UInt32 = 0
+        identityIndex: UInt32 = 0,
+        resolver: MnemonicResolver
     ) throws -> FundedProofResult {
         var proofBytesPtr: UnsafeMutablePointer<UInt8>? = nil
         var proofLen: UInt = 0
-        var privateKey: FFIByteTuple32 = // gitleaks:allow
-            (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+        var pathPtr: UnsafeMutablePointer<CChar>? = nil
         var txid: FFIByteTuple32 =
             (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
 
-        try asset_lock_manager_create_funded_proof(
-            handle, amountDuffs, accountIndex, fundingType.rawValue, identityIndex,
-            &proofBytesPtr, &proofLen, &privateKey, &txid
-        ).check()
+        try withExtendedLifetime(resolver) {
+            try asset_lock_manager_create_funded_proof(
+                handle, amountDuffs, accountIndex, fundingType.rawValue, identityIndex,
+                resolver.handle, &proofBytesPtr, &proofLen, &pathPtr, &txid
+            ).check()
+        }
 
         guard let proofPtr = proofBytesPtr, proofLen > 0 else {
             throw PlatformWalletError.unknown("FFI returned success but proof buffer was empty")
         }
         defer { asset_lock_manager_free_proof_bytes(proofPtr, proofLen) }
+        defer { if let p = pathPtr { platform_wallet_string_free(p) } }
 
+        let path = pathPtr.map { String(cString: $0) } ?? ""
         return FundedProofResult(
             proofBytes: Data(bytes: proofPtr, count: Int(proofLen)),
-            privateKey: withUnsafeBytes(of: &privateKey) { Data($0) },
+            derivationPath: path,
             txid: withUnsafeBytes(of: &txid) { Data($0) }
         )
     }
@@ -163,6 +176,9 @@ public class ManagedAssetLockManager {
     // MARK: - Resume
 
     /// Resume a tracked asset lock from whatever stage it's at.
+    /// Resume only re-derives the proof + credit-output path; signing
+    /// the consume transaction happens in the next FFI call, which
+    /// is where the resolver plugs in. No signer parameter needed.
     public func resume(
         txid: Data,
         vout: UInt32 = 0,
@@ -176,8 +192,7 @@ public class ManagedAssetLockManager {
 
         var proofBytesPtr: UnsafeMutablePointer<UInt8>? = nil
         var proofLen: UInt = 0
-        var privateKey: FFIByteTuple32 = // gitleaks:allow
-            (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+        var pathPtr: UnsafeMutablePointer<CChar>? = nil
 
         var txidTuple: FFIByteTuple32 =
             (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
@@ -189,17 +204,56 @@ public class ManagedAssetLockManager {
 
         try asset_lock_manager_resume(
             handle, &txidTuple, vout, timeoutSeconds,
-            &proofBytesPtr, &proofLen, &privateKey
+            &proofBytesPtr, &proofLen, &pathPtr
         ).check()
 
         guard let proofPtr = proofBytesPtr, proofLen > 0 else {
             throw PlatformWalletError.unknown("FFI returned success but proof buffer was empty")
         }
         defer { asset_lock_manager_free_proof_bytes(proofPtr, proofLen) }
+        defer { if let p = pathPtr { platform_wallet_string_free(p) } }
 
+        let path = pathPtr.map { String(cString: $0) } ?? ""
         return ResumeResult(
             proofBytes: Data(bytes: proofPtr, count: Int(proofLen)),
-            privateKey: withUnsafeBytes(of: &privateKey) { Data($0) }
+            derivationPath: path
         )
     }
+
+    /// Fire-and-forget catch-up for a tracked asset lock — the
+    /// app-launch / app-foreground variant of [`resume`].
+    ///
+    /// Drives the same `resume_asset_lock` path as [`resume`] but
+    /// discards the returned proof + derivation-path tuple. The proof
+    /// reaches the UI via the `AssetLockChangeSet` that
+    /// `advance_asset_lock_status` queues — `statusRaw = 3 +
+    /// proofBytes` lands on the `PersistentAssetLock` row, the UI
+    /// observes it through `@Query`, no Swift-side state to plumb.
+    ///
+    /// Blocking: the Rust `runtime().block_on(...)` parks the calling
+    /// thread for up to `timeoutSeconds`. Callers MUST schedule this
+    /// on a background queue / `Task.detached`.
+    public func catchUpBlocking(
+        txid: Data,
+        vout: UInt32 = 0,
+        timeoutSeconds: UInt64 = 300
+    ) throws {
+        guard txid.count == 32 else {
+            throw PlatformWalletError.invalidParameter(
+                "txid must be 32 bytes, got \(txid.count)"
+            )
+        }
+
+        var txidTuple: FFIByteTuple32 =
+            (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+        txid.withUnsafeBytes { buf in
+            withUnsafeMutableBytes(of: &txidTuple) { dst in
+                dst.copyBytes(from: buf.prefix(32))
+            }
+        }
+
+        try asset_lock_manager_catch_up_blocking(
+            handle, &txidTuple, vout, timeoutSeconds
+        ).check()
+    }
 }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/CoreWallet/ManagedCoreWallet.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/CoreWallet/ManagedCoreWallet.swift
index ba02dbc3c39..bfb23a34869 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/CoreWallet/ManagedCoreWallet.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/CoreWallet/ManagedCoreWallet.swift
@@ -109,18 +109,27 @@ public class ManagedCoreWallet {
         let cStrings = recipients.map { ($0.address as NSString).utf8String }
         let amounts = recipients.map { $0.amountDuffs }
 
+        // Resolver-backed signer owns mnemonic access for the lifetime
+        // of this call. Each Core ECDSA signature happens atomically
+        // inside the resolver vtable (mnemonic fetched, key derived,
+        // digest signed, buffers zeroed) — no priv key leaves Swift.
+        let resolver = MnemonicResolver()
+
         try cStrings.withUnsafeBufferPointer { addrBuf in
             try amounts.withUnsafeBufferPointer { amountBuf in
-                try core_wallet_send_to_addresses(
-                    handle,
-                    accountType.rawValue,
-                    accountIndex,
-                    addrBuf.baseAddress,
-                    amountBuf.baseAddress,
-                    UInt(recipients.count),
-                    &txBytesPtr,
-                    &txLen
-                ).check()
+                try withExtendedLifetime(resolver) {
+                    try core_wallet_send_to_addresses(
+                        handle,
+                        accountType.rawValue,
+                        accountIndex,
+                        addrBuf.baseAddress,
+                        amountBuf.baseAddress,
+                        UInt(recipients.count),
+                        resolver.handle,
+                        &txBytesPtr,
+                        &txLen
+                    ).check()
+                }
             }
         }
 
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
index 23d806eed66..924eea07438 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/ManagedPlatformWallet.swift
@@ -2365,9 +2365,17 @@ extension ManagedPlatformWallet {
         let handle = self.handle
         let signerHandle = signer.handle
         let pubkeys = identityPubkeys
+        // Create a `MnemonicResolver` owned for the lifetime of the
+        // FFI call — Rust constructs a `MnemonicResolverCoreSigner`
+        // from this handle to sign the asset-lock proof's
+        // credit-spending signature on the IdentityCreate transition.
+        // The resolver's vtable callback fetches the mnemonic from
+        // Keychain, derives the priv key at the credit-output path,
+        // signs the digest, and zeroes — atomic per call. No priv
+        // key ever lives in Rust memory across operations.
+        let coreSigner = MnemonicResolver()
         return try await Task.detached(priority: .userInitiated) {
             () -> (Identifier, ManagedIdentity) in
-            _ = signer
             var idTuple: (
                 UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
                 UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
@@ -2380,21 +2388,31 @@ extension ManagedPlatformWallet {
             var outManagedHandle: Handle = NULL_HANDLE
             // Pin each pubkey buffer simultaneously via the existing
             // helper, then hand the assembled row array to the FFI.
+            //
+            // `withExtendedLifetime` is the canonical Swift idiom for
+            // "keep this ARC-managed object alive across an FFI call
+            // that captures a raw handle to it". `_ = signer` /
+            // `_ = coreSigner` is folklore; the optimizer may elide
+            // the discard in -O builds, releasing the resolver mid-
+            // FFI-call → use-after-free in the vtable callback.
             let pubkeyBuffers: [Data] = pubkeys.map { $0.pubkeyBytes }
-            let result = ManagedPlatformWallet.withPubkeyFFIArray(
-                pubkeys,
-                buffers: pubkeyBuffers
-            ) { ffiRowsPtr, ffiRowsCount in
-                platform_wallet_register_identity_with_funding_signer(
-                    handle,
-                    amountDuffs,
-                    identityIndex,
-                    ffiRowsPtr,
-                    UInt(ffiRowsCount),
-                    signerHandle,
-                    &idTuple,
-                    &outManagedHandle
-                )
+            let result = withExtendedLifetime((signer, coreSigner)) {
+                ManagedPlatformWallet.withPubkeyFFIArray(
+                    pubkeys,
+                    buffers: pubkeyBuffers
+                ) { ffiRowsPtr, ffiRowsCount in
+                    platform_wallet_register_identity_with_funding_signer(
+                        handle,
+                        amountDuffs,
+                        identityIndex,
+                        ffiRowsPtr,
+                        UInt(ffiRowsCount),
+                        signerHandle,
+                        coreSigner.handle,
+                        &idTuple,
+                        &outManagedHandle
+                    )
+                }
             }
             try result.check()
             // Copy the 32-byte tuple into a Data via withUnsafeBytes.
@@ -2402,4 +2420,113 @@ extension ManagedPlatformWallet {
             return (identityId, ManagedIdentity(handle: outManagedHandle))
         }.value
     }
+
+    /// Resume identity registration from an existing tracked asset lock.
+    ///
+    /// Sibling to
+    /// [`registerIdentityWithFunding(amountDuffs:identityIndex:identityPubkeys:signer:)`]:
+    /// the wallet-balance variant builds a fresh asset-lock transaction;
+    /// this variant picks up a lock that's already tracked (status
+    /// `InstantSendLocked` / `ChainLocked`) and drives whatever stages
+    /// remain. Use case is crash recovery — a prior attempt left the
+    /// lock in storage but the IdentityCreate transition never landed,
+    /// and the user picks the lock from the
+    /// "Fund from unused Asset Lock" surface in `CreateIdentityView`.
+    ///
+    /// `outPointTxid` is the 32-byte raw txid (little-endian wire order,
+    /// same shape as `OutPointFFI.txid` on the Rust side and what
+    /// `PersistentAssetLock.outPointHex` reverses for display); the
+    /// caller is responsible for decoding back from the display-order
+    /// hex before passing in.
+    ///
+    /// Caller MUST pre-derive `identityPubkeys` (typically via
+    /// `dash_sdk_derive_identity_keys_from_mnemonic`) AND pre-persist
+    /// each key's private material to the Keychain using
+    /// `prePersistIdentityKeysForRegistration` BEFORE calling this —
+    /// same precondition as `registerIdentityWithFunding`.
+    ///
+    /// Returns `(identityId, ManagedIdentity)` for the freshly
+    /// registered identity.
+    public func resumeIdentityWithAssetLock(
+        outPointTxid: Data,
+        outPointVout: UInt32,
+        identityIndex: UInt32,
+        identityPubkeys: [ManagedPlatformWallet.IdentityPubkey],
+        signer: KeychainSigner
+    ) async throws -> (Identifier, ManagedIdentity) {
+        guard outPointTxid.count == 32 else {
+            throw PlatformWalletError.invalidParameter(
+                "outPointTxid must be exactly 32 bytes (was \(outPointTxid.count))"
+            )
+        }
+        guard !identityPubkeys.isEmpty else {
+            throw PlatformWalletError.invalidParameter("identityPubkeys is empty")
+        }
+        let handle = self.handle
+        let signerHandle = signer.handle
+        let pubkeys = identityPubkeys
+        // Same `MnemonicResolver` lifetime + vtable rationale as
+        // `registerIdentityWithFunding` — the credit-output private key
+        // is fetched per-call from Keychain, signed, zeroed; no priv
+        // key ever lives in Rust memory across operations.
+        let coreSigner = MnemonicResolver()
+        return try await Task.detached(priority: .userInitiated) {
+            () -> (Identifier, ManagedIdentity) in
+            var idTuple: (
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8
+            ) = (
+                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+            )
+            var outManagedHandle: Handle = NULL_HANDLE
+            var txidTuple: (
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+                UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8
+            ) = (
+                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+            )
+            outPointTxid.withUnsafeBytes { src in
+                Swift.withUnsafeMutableBytes(of: &txidTuple) { dst in
+                    dst.copyMemory(from: src)
+                }
+            }
+            var outPoint = OutPointFFI(txid: txidTuple, vout: outPointVout)
+            let pubkeyBuffers: [Data] = pubkeys.map { $0.pubkeyBytes }
+            // `withExtendedLifetime` pins `signer` and `coreSigner`
+            // through the closure body. The FFI call inside is
+            // synchronous (Rust uses `block_on_worker` under the
+            // hood), so the closure returns before the lifetime
+            // wrapper exits — invariant holds. If anyone refactors
+            // this to spawn an unawaited Task inside, the resolver
+            // could be dropped mid-flight and Rust would see a
+            // dangling pointer; keep the FFI call inline.
+            let result = withExtendedLifetime((signer, coreSigner)) {
+                ManagedPlatformWallet.withPubkeyFFIArray(
+                    pubkeys,
+                    buffers: pubkeyBuffers
+                ) { ffiRowsPtr, ffiRowsCount in
+                    platform_wallet_resume_identity_with_existing_asset_lock_signer(
+                        handle,
+                        &outPoint,
+                        identityIndex,
+                        ffiRowsPtr,
+                        UInt(ffiRowsCount),
+                        signerHandle,
+                        coreSigner.handle,
+                        &idTuple,
+                        &outManagedHandle
+                    )
+                }
+            }
+            try result.check()
+            let identityId = Swift.withUnsafeBytes(of: idTuple) { Data($0) }
+            return (identityId, ManagedIdentity(handle: outManagedHandle))
+        }.value
+    }
 }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletFFI.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletFFI.swift
index ac6b3fb678f..28061814138 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletFFI.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletFFI.swift
@@ -24,6 +24,18 @@ typealias FFIByteTuple20 = (
     UInt8, UInt8, UInt8, UInt8
 )
 
+/// 36-byte fixed tuple — used by the asset-lock persister to carry
+/// outpoints (32-byte raw txid + 4-byte little-endian vout). Matches
+/// the Rust-side `AssetLockEntryFFI.out_point` and the parallel
+/// removed-outpoint array on `on_persist_asset_locks_fn`.
+typealias FFIByteTuple36 = (
+    UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+    UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+    UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+    UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8,
+    UInt8, UInt8, UInt8, UInt8
+)
+
 // MARK: - Mnemonic-resolver callback result codes
 
 /// Mirrors the Rust `mnemonic_resolver_result` constants in
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
index 8f6cdc3dc0c..f1c4402e428 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift
@@ -74,6 +74,17 @@ public class PlatformWalletManager: ObservableObject {
     /// Background task that polls SPV progress.
     private var progressPollTask: Task<Void, Never>?
 
+    /// `ManagedAssetLockManager` instances retained while their
+    /// detached catch-up tasks run. Each wrapper's `deinit`
+    /// invalidates the underlying FFI handle, which would crash the
+    /// in-flight `asset_lock_manager_catch_up_blocking` call — so we
+    /// hold the wrappers here for the duration of a batch. Replaced
+    /// (and the previous batch released) on each
+    /// `catchUpStuckAssetLocks` invocation, by which time the prior
+    /// batch's tasks have either resolved or hit their five-minute
+    /// timeout.
+    private var retainedAssetLockManagers: [ManagedAssetLockManager] = []
+
     // MARK: - Init
 
     /// Empty init for `@StateObject` usage. Call [`configure`] before
@@ -319,9 +330,186 @@ public class PlatformWalletManager: ObservableObject {
             }
         }
 
+        // Kick off a background catch-up pass for every persisted
+        // asset lock at `statusRaw < 2`. Closes the SPV-restart gap:
+        // the wallet's in-memory transactions map was just
+        // selectively repopulated by the load path (Rust-side
+        // `restore_unresolved_asset_lock_tx_records`), so the next
+        // chain-lock event picked up by SPV will cascade through
+        // `apply_chain_lock` and promote each funding tx; the
+        // catch-up `Task` parks on `wait_for_proof` until that
+        // happens and on success the Rust changeset writes
+        // `statusRaw = 3 + proofBytes` back to SwiftData. UI updates
+        // reactively via `@Query`.
+        catchUpStuckAssetLocks(wallets: restored)
+
         return restored
     }
 
+    /// For every persisted asset lock at `statusRaw < 2` (Built /
+    /// Broadcast), kick off a background `Task` that drives
+    /// `asset_lock_manager_catch_up_blocking` to completion or
+    /// timeout. Fire-and-forget — the proof reaches the UI via the
+    /// `AssetLockChangeSet` that the catch-up call queues internally.
+    ///
+    /// Called from `loadFromPersistor` after every wallet is
+    /// inserted. App-foreground / network-reconnect callers can
+    /// invoke this directly to retry whatever was still pending.
+    public func catchUpStuckAssetLocks(wallets: [ManagedPlatformWallet]) {
+        guard let persistenceHandler = persistenceHandler else { return }
+        // Release the previous batch's manager wrappers now that we
+        // know their tasks have either completed or timed out (any
+        // task still running past the 300s timeout is misbehaving
+        // and the bound is on the Rust side anyway). Without this
+        // the array would grow unboundedly across foregroundings.
+        retainedAssetLockManagers.removeAll(keepingCapacity: true)
+        for wallet in wallets {
+            let walletId = wallet.walletId
+            let locks = persistenceHandler.loadCachedAssetLocks(walletId: walletId)
+            let pending = locks.filter { $0.statusRaw < 2 }
+            if pending.isEmpty { continue }
+
+            // Snapshot the asset-lock manager handle ON the main
+            // actor (where `wallet` lives). The `ManagedAssetLockManager`
+            // class isn't `Sendable` (its `deinit` calls
+            // `asset_lock_manager_destroy`), so the detached Task
+            // captures the bare `Handle` value (an `Int64`) and
+            // calls the FFI directly. Lifetime: stash the manager
+            // wrapper on `retainedAssetLockManagers` so its `deinit`
+            // (which would invalidate the handle) waits for the
+            // tasks to complete; the wrapper is dropped on the next
+            // call to `catchUpStuckAssetLocks` or on manager
+            // shutdown, whichever comes first.
+            let assetLockManager: ManagedAssetLockManager
+            do {
+                assetLockManager = try wallet.assetLockManager()
+            } catch {
+                self.lastError = error
+                continue
+            }
+            // The previous batch's manager wrappers (if any) are
+            // dropped here — their tasks have either completed
+            // (success path persisted via the changeset) or hit the
+            // 300s timeout long ago. The replacement keeps the
+            // current batch's handles alive for the duration of the
+            // new tasks.
+            retainedAssetLockManagers.append(assetLockManager)
+            let handle = assetLockManager.handle
+
+            // Cap concurrency to avoid saturating iOS's cooperative
+            // thread pool. Each catch-up `block_on` parks a worker
+            // thread for up to 300s; N stuck locks at launch (after a
+            // multi-identity registration interrupted by an app kill)
+            // would otherwise spawn N parallel parked threads,
+            // starving every other `Task` in the app (UI updates,
+            // SwiftData writes, network calls).
+            //
+            // `MAX_CONCURRENT_CATCH_UPS = 4` is conservative for a
+            // 4-8 worker pool typical on iPhones. The real bottleneck
+            // is per-lock SPV chainlock arrival, not the catch-up
+            // throughput — running 4 in parallel vs 50 changes nothing
+            // about how fast each individual lock resolves.
+            let outpoints: [(txid: Data, vout: UInt32)] = pending.compactMap {
+                PlatformWalletManager.decodeOutPointForCatchUp($0.outPointHex)
+            }
+            guard !outpoints.isEmpty else { continue }
+            Task.detached(priority: .background) {
+                await withTaskGroup(of: Void.self) { group in
+                    let maxConcurrent = 4
+                    var nextIndex = 0
+                    // Seed the group with up to `maxConcurrent` tasks.
+                    while nextIndex < outpoints.count && nextIndex < maxConcurrent {
+                        let (txid, vout) = outpoints[nextIndex]
+                        group.addTask {
+                            Self.runCatchUp(handle: handle, txid: txid, vout: vout)
+                        }
+                        nextIndex += 1
+                    }
+                    // As each finishes, queue the next pending entry.
+                    while await group.next() != nil {
+                        if nextIndex < outpoints.count {
+                            let (txid, vout) = outpoints[nextIndex]
+                            group.addTask {
+                                Self.runCatchUp(handle: handle, txid: txid, vout: vout)
+                            }
+                            nextIndex += 1
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// Single catch-up invocation body. Extracted from the inline
+    /// `Task.detached` so the `withTaskGroup` coordinator can call it
+    /// directly. Sendable inputs only: `Handle` is `Int64`, `Data`
+    /// captures the txid bytes, `UInt32` is trivially Sendable.
+    ///
+    /// `nonisolated` because `PlatformWalletManager` is
+    /// `@MainActor`-isolated by default and the detached task body
+    /// runs off the main actor — the FFI call is synchronous and
+    /// reads no `PlatformWalletManager` state.
+    nonisolated private static func runCatchUp(handle: Handle, txid: Data, vout: UInt32) {
+        // Build the txid tuple inline so the Task body captures only
+        // Sendable values.
+        var txidTuple: FFIByteTuple32 =
+            (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+             0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
+        txid.withUnsafeBytes { buf in
+            withUnsafeMutableBytes(of: &txidTuple) { dst in
+                dst.copyBytes(from: buf.prefix(32))
+            }
+        }
+        // Five-minute ceiling matches the `wait_for_proof` deadline
+        // the production resume path uses.
+        let result = asset_lock_manager_catch_up_blocking(
+            handle, &txidTuple, vout, 300
+        )
+        // Timeouts and proof-wait failures (catch-up
+        // `errorWalletOperation`) are expected during normal
+        // operation (SPV not yet caught up to the funding block,
+        // chain-lock hasn't fired yet) — discard.
+        // `errorInvalidHandle` is NOT expected and indicates the
+        // manager wrapper was released mid-task (lifecycle race /
+        // programmer error); log it loudly via NSLog so an operator
+        // running without `tracing` capture still sees it.
+        let code = PlatformWalletResultCode(ffi: result.code)
+        if code == .errorInvalidHandle {
+            NSLog(
+                "[catch-up] asset_lock_manager_catch_up_blocking returned errorInvalidHandle for outpoint %@:%u — wrapper released before task finished",
+                txid.map { String(format: "%02x", $0) }.joined(),
+                vout
+            )
+        }
+    }
+
+    /// Parse `<txid_hex (display order)>:<vout>` into the wire-order
+    /// 32-byte `txid` + `vout` pair the FFI expects. Internal to
+    /// `catchUpStuckAssetLocks`; mirrors the Swift-side
+    /// `decodeOutPointHex` helper without taking a dependency on the
+    /// private one in the persistence handler.
+    private static func decodeOutPointForCatchUp(
+        _ hex: String
+    ) -> (txid: Data, vout: UInt32)? {
+        let parts = hex.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count == 2 else { return nil }
+        let txidHex = String(parts[0])
+        guard let vout = UInt32(parts[1]) else { return nil }
+        guard txidHex.count == 64 else { return nil }
+        var txid = Data(capacity: 32)
+        var idx = txidHex.startIndex
+        for _ in 0..<32 {
+            let end = txidHex.index(idx, offsetBy: 2)
+            guard let byte = UInt8(txidHex[idx..<end], radix: 16) else { return nil }
+            txid.append(byte)
+            idx = end
+        }
+        // outPointHex is display-order; the FFI expects wire-order
+        // (the same orientation `PersistentTransaction.txid` is
+        // stored in).
+        return (txid: Data(txid.reversed()), vout: vout)
+    }
+
     // MARK: - Per-wallet lookup
 
     /// Return the managed wallet with the given 32-byte id, or `nil`
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerSPV.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerSPV.swift
index 832910c9423..88f17da998a 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerSPV.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManagerSPV.swift
@@ -99,6 +99,12 @@ public struct PlatformSpvSyncProgress: Sendable, Equatable {
 }
 
 /// Config for starting the SPV sync.
+///
+/// Masternode sync (and the IS/CL P2P subscriptions that come with it)
+/// is always enabled — `AssetLockManager::wait_for_proof` requires it
+/// to receive InstantSend and ChainLock signatures from peers, so
+/// exposing a toggle here would silently break asset-lock-funded
+/// identity registration in trusted-SDK setups.
 public struct PlatformSpvStartConfig {
     public var dataDir: String
     public var network: Network
@@ -106,7 +112,6 @@ public struct PlatformSpvStartConfig {
     public var peers: [String]
     public var restrictToConfiguredPeers: Bool
     public var startFromHeight: UInt32
-    public var masternodeSyncEnabled: Bool
 
     public init(
         dataDir: String,
@@ -114,8 +119,7 @@ public struct PlatformSpvStartConfig {
         userAgent: String? = nil,
         peers: [String] = [],
         restrictToConfiguredPeers: Bool = false,
-        startFromHeight: UInt32 = 0,
-        masternodeSyncEnabled: Bool = true
+        startFromHeight: UInt32 = 0
     ) {
         self.dataDir = dataDir
         self.network = network
@@ -123,7 +127,6 @@ public struct PlatformSpvStartConfig {
         self.peers = peers
         self.restrictToConfiguredPeers = restrictToConfiguredPeers
         self.startFromHeight = startFromHeight
-        self.masternodeSyncEnabled = masternodeSyncEnabled
     }
 }
 
@@ -203,8 +206,7 @@ extension PlatformWalletManager {
                     peersPtr,
                     UInt(peerCStrings.count),
                     config.restrictToConfiguredPeers,
-                    config.startFromHeight,
-                    config.masternodeSyncEnabled
+                    config.startFromHeight
                 ).check()
             }
         }
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
index 965e236e55d..758d9300c8a 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletPersistenceHandler.swift
@@ -113,6 +113,115 @@ public class PlatformWalletPersistenceHandler {
         }
     }
 
+    // MARK: - Asset locks
+
+    /// Apply an `AssetLockChangeSet` projection to SwiftData.
+    ///
+    /// The Rust-side asset-lock manager emits a changeset on every
+    /// status transition (`Built → Broadcast → InstantSendLocked →
+    /// ChainLocked`) and on consumption (the registration flow drops
+    /// the row once the IdentityCreate state transition lands). Each
+    /// `upsert` maps onto a `PersistentAssetLock` row keyed by
+    /// `outPointHex` (the 36-byte outpoint encoded as
+    /// `<txid_display_hex>:<vout>`); each `removed` entry deletes the
+    /// matching row. `RegistrationProgressView` watches these rows
+    /// via `@Query` to drive the stage progress bar.
+    ///
+    /// No `save()` here — bracketed by `beginChangeset` /
+    /// `endChangeset` from the Rust `store()` round.
+    func persistAssetLocks(
+        walletId: Data,
+        upserts: [AssetLockEntrySnapshot],
+        removed: [Data]
+    ) {
+        onQueue {
+            for entry in upserts {
+                let outPointHex = entry.outPointHex
+                let descriptor = FetchDescriptor<PersistentAssetLock>(
+                    predicate: #Predicate { $0.outPointHex == outPointHex }
+                )
+                if let existing = try? backgroundContext.fetch(descriptor).first {
+                    existing.walletId = walletId
+                    existing.transactionBytes = entry.transactionBytes
+                    existing.fundingTypeRaw = entry.fundingTypeRaw
+                    existing.identityIndexRaw = entry.identityIndexRaw
+                    existing.amountDuffs = entry.amountDuffs
+                    existing.statusRaw = entry.statusRaw
+                    existing.proofBytes = entry.proofBytes
+                    existing.updatedAt = Date()
+                } else {
+                    let record = PersistentAssetLock(
+                        outPointHex: outPointHex,
+                        walletId: walletId,
+                        transactionBytes: entry.transactionBytes,
+                        fundingTypeRaw: entry.fundingTypeRaw,
+                        identityIndexRaw: entry.identityIndexRaw,
+                        amountDuffs: entry.amountDuffs,
+                        statusRaw: entry.statusRaw,
+                        proofBytes: entry.proofBytes
+                    )
+                    backgroundContext.insert(record)
+                }
+            }
+
+            for outPointHex in removed {
+                let hex = PersistentAssetLock.encodeOutPoint(rawBytes: outPointHex)
+                let descriptor = FetchDescriptor<PersistentAssetLock>(
+                    predicate: #Predicate { $0.outPointHex == hex }
+                )
+                if let existing = try? backgroundContext.fetch(descriptor).first {
+                    backgroundContext.delete(existing)
+                }
+            }
+        }
+    }
+
+    /// Load all persisted tracked asset locks for a wallet — used by
+    /// the wallet load path to rebuild `unused_asset_locks` on the
+    /// Rust side so an in-flight registration that was interrupted by
+    /// an app kill can resume from the latest status without
+    /// rebroadcasting the asset-lock transaction.
+    public func loadCachedAssetLocks(walletId: Data) -> [AssetLockEntrySnapshot] {
+        onQueue { loadCachedAssetLocksOnQueue(walletId: walletId) }
+    }
+
+    /// On-queue implementation reused by the load-wallet-list path
+    /// without re-entering `onQueue`.
+    func loadCachedAssetLocksOnQueue(walletId: Data) -> [AssetLockEntrySnapshot] {
+        let descriptor = FetchDescriptor<PersistentAssetLock>(
+            predicate: PersistentAssetLock.predicate(walletId: walletId)
+        )
+        guard let records = try? backgroundContext.fetch(descriptor) else {
+            return []
+        }
+        return records.map { record in
+            AssetLockEntrySnapshot(
+                outPointHex: record.outPointHex,
+                transactionBytes: record.transactionBytes,
+                fundingTypeRaw: record.fundingTypeRaw,
+                identityIndexRaw: record.identityIndexRaw,
+                amountDuffs: record.amountDuffs,
+                statusRaw: record.statusRaw,
+                proofBytes: record.proofBytes
+            )
+        }
+    }
+
+    /// Owned snapshot of an `AssetLockEntryFFI` row. Same lifetime
+    /// rationale as `IdentityEntrySnapshot` — the callback copies
+    /// every byte buffer into owned `Data` before invoking the
+    /// handler, so the handler runs against pure-Swift values
+    /// regardless of when the Rust-side allocation gets reclaimed.
+    public struct AssetLockEntrySnapshot {
+        public let outPointHex: String
+        public let transactionBytes: Data
+        public let fundingTypeRaw: Int
+        public let identityIndexRaw: Int32
+        public let amountDuffs: Int64
+        public let statusRaw: Int
+        public let proofBytes: Data?
+    }
+
     /// Load all cached platform-address balances for a wallet. Tuple
     /// shape matches the Rust-side `AddressBalanceEntryFFI` layout so
     /// the load-wallet-list path can re-seed the provider on startup
@@ -243,6 +352,25 @@ public class PlatformWalletPersistenceHandler {
                 wallet.lastUpdated = Date()
             }
 
+            // Persisted `last_applied_chain_lock` — bincode bytes
+            // from the FFI carry the wallet's
+            // `WalletMetadata::last_applied_chain_lock` snapshot for
+            // restart roundtrip. Stored as opaque `Data` (decoded on
+            // the Rust load side); SPV persists its own
+            // `best_chainlock` independently so this column is the
+            // wallet-side mirror, not a duplicate of SPV state.
+            // Pre-feature rows / wallets that have never observed a
+            // ChainLock carry `null` from Rust and stay `nil` here.
+            if cs.last_applied_chain_lock_bytes_len > 0,
+               let clPtr = cs.last_applied_chain_lock_bytes {
+                let bytes = Data(
+                    bytes: clPtr,
+                    count: Int(cs.last_applied_chain_lock_bytes_len)
+                )
+                wallet.lastAppliedChainLockBytes = bytes
+                wallet.lastUpdated = Date()
+            }
+
             // Balance delta — Rust still emits per-round deltas, but the
             // PersistentWallet `balance*` fields they used to update were
             // removed (canonical source is now the in-memory account
@@ -445,6 +573,7 @@ public class PlatformWalletPersistenceHandler {
         if let typeName = tx.transaction_type {
             record.transactionType = String(cString: typeName)
         }
+        record.transactionTypeKind = tx.transaction_type_kind
         record.netAmount = tx.net_amount
         record.fee = tx.has_fee ? tx.fee : nil
         if let labelPtr = tx.label {
@@ -799,6 +928,7 @@ public class PlatformWalletPersistenceHandler {
         cb.on_persist_identity_keys_fn = persistIdentityKeysCallback
         cb.on_persist_token_balances_fn = persistTokenBalancesCallback
         cb.on_persist_contacts_fn = persistContactsCallback
+        cb.on_persist_asset_locks_fn = persistAssetLocksCallback
         cb.on_get_core_tx_record_fn = getCoreTxRecordCallback
         cb.on_get_core_tx_record_free_fn = getCoreTxRecordFreeCallback
         return cb
@@ -2418,6 +2548,30 @@ public class PlatformWalletPersistenceHandler {
             entry.last_processed_height = w.syncedHeight
             entry.last_synced = w.lastSynced
 
+            // Persisted `last_applied_chain_lock` bincode bytes from
+            // the previous session. Rust's `build_wallet_start_state`
+            // decodes these and stamps `wallet_info.metadata.
+            // last_applied_chain_lock`, so the asset-lock-resume
+            // CL-from-metadata fallback in `proof.rs` can fire on
+            // catch-up tasks at app launch without waiting for SPV
+            // to re-apply a fresh chainlock. Wallets that have
+            // never observed a chainlock (fresh creations,
+            // pre-feature rows) carry `nil` here and the FFI fields
+            // stay null / zero — Rust load falls back to leaving
+            // `metadata.last_applied_chain_lock = None`.
+            if let clBytes = w.lastAppliedChainLockBytes, !clBytes.isEmpty {
+                let buffer = UnsafeMutablePointer<UInt8>.allocate(
+                    capacity: clBytes.count
+                )
+                clBytes.copyBytes(to: buffer, count: clBytes.count)
+                allocation.scalarBuffers.append((buffer, clBytes.count))
+                entry.last_applied_chain_lock_bytes = UnsafePointer(buffer)
+                entry.last_applied_chain_lock_bytes_len = UInt(clBytes.count)
+            } else {
+                entry.last_applied_chain_lock_bytes = nil
+                entry.last_applied_chain_lock_bytes_len = 0
+            }
+
             // Persisted unspent UTXOs for this wallet. The SPV inbound
             // path writes `PersistentTxo` rows and flips `isSpent`
             // (rather than deleting) on spend, so the unspent set is
@@ -2439,6 +2593,45 @@ public class PlatformWalletPersistenceHandler {
             }
             entry.utxos = utxoBuf.map { UnsafePointer($0) }
             entry.utxos_count = UInt(utxoCount)
+
+            // Tracked asset-lock rows. The Rust side rehydrates these
+            // into `unused_asset_locks` so an in-flight registration
+            // that was killed mid-flight can resume from the latest
+            // status without rebroadcasting. Empty / null when the
+            // wallet has no persisted locks.
+            let assetLockRows = loadCachedAssetLocksOnQueue(walletId: w.walletId)
+            let (assetLockBuf, assetLockCount) = buildAssetLockRestoreBuffer(
+                rows: assetLockRows,
+                allocation: allocation
+            )
+            entry.tracked_asset_locks = assetLockBuf.map { UnsafePointer($0) }
+            entry.tracked_asset_locks_count = UInt(assetLockCount)
+
+            // Funding tx records for asset locks at `statusRaw < 2`
+            // (Built / Broadcast). The Rust load path re-inserts each
+            // entry into the matching `standard_bip44_accounts[
+            // account_index].transactions_mut()` bucket so the next
+            // incoming chain-lock event can cascade-promote them.
+            // Without this, the in-memory transactions map starts
+            // empty after every restart, `apply_chain_lock` finds
+            // nothing to promote at that height, and any asset lock
+            // whose funding block has already been chain-locked
+            // stays stuck at `Broadcast` indefinitely.
+            //
+            // Rows are filtered to `statusRaw < 2` so already-IS-
+            // locked / already-chain-locked locks (which already
+            // carry their proof on the `PersistentAssetLock` row and
+            // don't need cascade-promotion) don't take up FFI
+            // bandwidth. Empty / null when the wallet has no
+            // unresolved locks.
+            let (unresolvedBuf, unresolvedCount) =
+                buildUnresolvedAssetLockTxRecordBuffer(
+                    walletId: w.walletId,
+                    allocation: allocation
+                )
+            entry.unresolved_asset_lock_tx_records = unresolvedBuf.map { UnsafePointer($0) }
+            entry.unresolved_asset_lock_tx_records_count = UInt(unresolvedCount)
+
             // Primary-identity selection + gap-limit scan watermark
             // were dropped from the FFI shape — both moved off the
             // Rust manager (UI owns selection now, scan resume is
@@ -2591,6 +2784,233 @@ public class PlatformWalletPersistenceHandler {
         return (buf, written, false)
     }
 
+    /// Build a contiguous `[AssetLockEntryFFI]` buffer for one wallet's
+    /// tracked asset locks. Walks `PersistentAssetLock` rows scoped to
+    /// `walletId`, copies the consensus-encoded transaction + optional
+    /// bincode-encoded proof into Swift-owned heap buffers, and emits
+    /// one row per lock. Returns `(nil, 0)` for empty input — Rust
+    /// treats `null` + `count == 0` as "no tracked locks to restore".
+    ///
+    /// Per-row transaction/proof buffers and the outer array are
+    /// tracked on `allocation` so `loadWalletListFree` releases them.
+    /// Rows whose `outPointHex` doesn't parse back to 36 bytes are
+    /// skipped — the model writes them in a known shape, so a
+    /// mismatch indicates corruption that would crash Rust's decoder
+    /// anyway.
+    private func buildAssetLockRestoreBuffer(
+        rows: [AssetLockEntrySnapshot],
+        allocation: LoadAllocation
+    ) -> (UnsafeMutablePointer<AssetLockEntryFFI>?, Int) {
+        if rows.isEmpty {
+            return (nil, 0)
+        }
+        let buf = UnsafeMutablePointer<AssetLockEntryFFI>.allocate(capacity: rows.count)
+        var written = 0
+        for record in rows {
+            // Parse `<txid_hex>:<vout>` back into the 36-byte raw form
+            // the Rust side expects. Any parse failure drops the row
+            // — we can't manufacture a valid outpoint and a malformed
+            // row indicates an old / corrupt snapshot.
+            guard let outPoint = decodeOutPointHex(record.outPointHex) else {
+                NSLog(
+                    "[persistor-load:swift] dropping asset-lock row with malformed outPointHex: %@",
+                    record.outPointHex
+                )
+                continue
+            }
+
+            // Allocate + copy the transaction bytes (Rust-owned for
+            // the callback window via the allocation).
+            let txBytes = record.transactionBytes
+            let txPtr: UnsafePointer<UInt8>?
+            let txLen = txBytes.count
+            if txLen > 0 {
+                let buffer = UnsafeMutablePointer<UInt8>.allocate(capacity: txLen)
+                txBytes.copyBytes(to: buffer, count: txLen)
+                allocation.scalarBuffers.append((buffer, txLen))
+                txPtr = UnsafePointer(buffer)
+            } else {
+                // A row with no transaction bytes is broken — Rust's
+                // load path will reject it; drop here.
+                NSLog(
+                    "[persistor-load:swift] dropping asset-lock row with empty transactionBytes: %@",
+                    record.outPointHex
+                )
+                continue
+            }
+
+            // Optional proof bytes.
+            let proofPtr: UnsafePointer<UInt8>?
+            let proofLen: Int
+            if let bytes = record.proofBytes, !bytes.isEmpty {
+                let buffer = UnsafeMutablePointer<UInt8>.allocate(capacity: bytes.count)
+                bytes.copyBytes(to: buffer, count: bytes.count)
+                allocation.scalarBuffers.append((buffer, bytes.count))
+                proofPtr = UnsafePointer(buffer)
+                proofLen = bytes.count
+            } else {
+                proofPtr = nil
+                proofLen = 0
+            }
+
+            var entry = AssetLockEntryFFI()
+            copyBytes(outPoint, into: &entry.out_point)
+            entry.transaction_bytes = txPtr
+            entry.transaction_bytes_len = UInt(txLen)
+            // `accountIndex` isn't stored on the SwiftData model
+            // (Rust derives it from the funding path), so default to
+            // 0. The Rust load path doesn't read this field for
+            // anything load-bearing — it's a breadcrumb for the
+            // FFI persist path going forward.
+            entry.account_index = 0
+            entry.funding_type = UInt8(clamping: record.fundingTypeRaw)
+            entry.identity_index = UInt32(bitPattern: record.identityIndexRaw)
+            entry.amount_duffs = UInt64(bitPattern: record.amountDuffs)
+            entry.status = UInt8(clamping: record.statusRaw)
+            entry.proof_bytes = proofPtr
+            entry.proof_bytes_len = UInt(proofLen)
+            buf[written] = entry
+            written += 1
+        }
+        if written == 0 {
+            buf.deallocate()
+            return (nil, 0)
+        }
+        allocation.assetLockArrays.append((buf, written))
+        return (buf, written)
+    }
+
+    /// Build the per-wallet `UnresolvedAssetLockTxRecordFFI` array
+    /// for the load callback. One entry per `PersistentAssetLock` row
+    /// at `statusRaw < 2` (Built / Broadcast) whose funding tx has a
+    /// matching `PersistentTransaction` row. Returns `(nil, 0)` when
+    /// there are no eligible rows.
+    ///
+    /// The Rust side reads each row and re-inserts the decoded
+    /// transaction into the matching BIP44 account's in-memory
+    /// `transactions()` map so the next chain-lock event can promote
+    /// it via `apply_chain_lock`. See
+    /// `restore_unresolved_asset_lock_tx_records` for the Rust-side
+    /// contract.
+    ///
+    /// Rows with no matching `PersistentTransaction` (e.g. an
+    /// orphaned asset-lock row whose tx never made it into the
+    /// transaction table) are skipped — the Rust side has no way to
+    /// reconstruct the funding tx without its consensus bytes, so
+    /// projecting an empty row would just bloat the FFI surface.
+    private func buildUnresolvedAssetLockTxRecordBuffer(
+        walletId: Data,
+        allocation: LoadAllocation
+    ) -> (UnsafeMutablePointer<UnresolvedAssetLockTxRecordFFI>?, Int) {
+        // Filter to `statusRaw < 2` so already-IS-locked /
+        // already-chain-locked rows don't end up in the array —
+        // those locks have their proof bytes persisted on the
+        // `PersistentAssetLock` row and the Rust side doesn't need
+        // the funding tx in the in-memory map to use them.
+        let descriptor = FetchDescriptor<PersistentAssetLock>(
+            predicate: #Predicate { entry in
+                entry.walletId == walletId && entry.statusRaw < 2
+            }
+        )
+        guard let locks = try? backgroundContext.fetch(descriptor), !locks.isEmpty else {
+            return (nil, 0)
+        }
+
+        // Pre-query the matching `PersistentTransaction` rows.
+        // `PersistentAssetLock.outPointHex` carries the txid in
+        // display order; `PersistentTransaction.txid` is wire order
+        // — the same flip `decodeOutPointHex` already performs.
+        let buf = UnsafeMutablePointer<UnresolvedAssetLockTxRecordFFI>.allocate(
+            capacity: locks.count
+        )
+        var written = 0
+        for lock in locks {
+            guard let outpoint = decodeOutPointHex(lock.outPointHex) else {
+                continue
+            }
+            let txid = outpoint.prefix(32)
+            let txidData = Data(txid)
+            let txDescriptor = FetchDescriptor<PersistentTransaction>(
+                predicate: #Predicate { $0.txid == txidData }
+            )
+            guard let txRow = try? backgroundContext.fetch(txDescriptor).first else {
+                // No matching tx — Rust can't reconstruct the
+                // funding body without its consensus bytes. Skip.
+                continue
+            }
+            let txBytes = txRow.transactionData
+            guard !txBytes.isEmpty else {
+                // A stub row whose real upsert never arrived;
+                // skip rather than emit an undecodable buffer.
+                continue
+            }
+
+            // Allocate the consensus-bytes buffer. Lifetime is
+            // owned by `allocation.scalarBuffers`, freed by
+            // `LoadAllocation.release()` after Rust returns.
+            let txBuf = UnsafeMutablePointer<UInt8>.allocate(capacity: txBytes.count)
+            txBytes.copyBytes(to: txBuf, count: txBytes.count)
+            allocation.scalarBuffers.append((txBuf, txBytes.count))
+
+            var entry = UnresolvedAssetLockTxRecordFFI()
+            // `accountIndex` isn't stored on `PersistentAssetLock`
+            // (the existing `buildAssetLockRestoreBuffer` makes the
+            // same assumption). In production iOS the funding
+            // account is always BIP44 index 0 — the same default
+            // used by `recover_asset_lock_blocking`. The Rust side
+            // looks up `standard_bip44_accounts.get(&account_index)`
+            // so a wrong value here would silently drop the
+            // restore; documented as a known limit until per-row
+            // `accountIndex` lands on the SwiftData model.
+            entry.account_index = 0
+            entry.tx_bytes = txBuf
+            entry.tx_bytes_len = UInt(txBytes.count)
+            entry.context_raw = txRow.context
+            entry.block_height = txRow.blockHeight
+            if let hash = txRow.blockHash, hash.count == 32 {
+                withUnsafeMutableBytes(of: &entry.block_hash) { raw in
+                    raw.copyBytes(from: hash)
+                }
+            }
+            entry.block_timestamp = UInt64(txRow.blockTimestamp)
+            entry.first_seen = txRow.firstSeen
+            buf[written] = entry
+            written += 1
+        }
+        if written == 0 {
+            buf.deallocate()
+            return (nil, 0)
+        }
+        allocation.unresolvedAssetLockTxRecordArrays.append((buf, written))
+        return (buf, written)
+    }
+
+    /// Parse `<txid_hex (display order)>:<vout>` back into the 36-byte
+    /// raw outpoint Rust expects (32-byte raw txid + 4-byte
+    /// little-endian vout). Mirror of
+    /// `PersistentAssetLock.encodeOutPoint`. Returns `nil` for any
+    /// parse failure.
+    private func decodeOutPointHex(_ hex: String) -> Data? {
+        let parts = hex.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count == 2 else { return nil }
+        let txidHex = String(parts[0])
+        guard let vout = UInt32(parts[1]) else { return nil }
+        guard txidHex.count == 64 else { return nil }
+        var txid = Data(capacity: 32)
+        var idx = txidHex.startIndex
+        for _ in 0..<32 {
+            let end = txidHex.index(idx, offsetBy: 2)
+            guard let byte = UInt8(txidHex[idx..<end], radix: 16) else { return nil }
+            txid.append(byte)
+            idx = end
+        }
+        // Reverse from display-order back to raw byte order.
+        let raw = Data(txid.reversed())
+        var out = Data(raw)
+        out.append(contentsOf: withUnsafeBytes(of: vout.littleEndian) { Data($0) })
+        return out
+    }
+
     private func buildIdentityRestoreBuffer(
         identities: [PersistentIdentity],
         allocation: LoadAllocation
@@ -2939,6 +3359,16 @@ private final class LoadAllocation {
     /// Per-wallet `UtxoRestoreEntryFFI` arrays. The script bytes each
     /// row references live in `scalarBuffers`.
     var utxoArrays: [(UnsafeMutablePointer<UtxoRestoreEntryFFI>, Int)] = []
+    /// Per-wallet `AssetLockEntryFFI` arrays. The transaction-bytes
+    /// and proof-bytes buffers each row references live in
+    /// `scalarBuffers`.
+    var assetLockArrays: [(UnsafeMutablePointer<AssetLockEntryFFI>, Int)] = []
+    /// Per-wallet `UnresolvedAssetLockTxRecordFFI` arrays — the funding
+    /// tx records for asset locks at `statusRaw < 2` that the Rust
+    /// load path re-inserts into the in-memory `transactions()` map
+    /// so the next chain-lock event can cascade-promote them. The
+    /// `tx_bytes` buffer each row references lives in `scalarBuffers`.
+    var unresolvedAssetLockTxRecordArrays: [(UnsafeMutablePointer<UnresolvedAssetLockTxRecordFFI>, Int)] = []
 
     func release() {
         if let entries = entries {
@@ -2982,6 +3412,14 @@ private final class LoadAllocation {
             ptr.deinitialize(count: count)
             ptr.deallocate()
         }
+        for (ptr, count) in assetLockArrays {
+            ptr.deinitialize(count: count)
+            ptr.deallocate()
+        }
+        for (ptr, count) in unresolvedAssetLockTxRecordArrays {
+            ptr.deinitialize(count: count)
+            ptr.deallocate()
+        }
     }
 }
 
@@ -3511,6 +3949,76 @@ private func persistTokenBalancesCallback(
     return 0
 }
 
+/// C shim for `on_persist_asset_locks_fn`. Copies every
+/// `AssetLockEntryFFI` row + every removed-outpoint tuple into
+/// Swift-owned `Data` snapshots before invoking the handler so the
+/// Rust-side `_storage` Vec can release the byte buffers as soon as
+/// this trampoline returns.
+private func persistAssetLocksCallback(
+    context: UnsafeMutableRawPointer?,
+    walletIdPtr: UnsafePointer<UInt8>?,
+    upsertsPtr: UnsafePointer<AssetLockEntryFFI>?,
+    upsertsCount: UInt,
+    removedPtr: UnsafePointer<FFIByteTuple36>?,
+    removedCount: UInt
+) -> Int32 {
+    guard let context = context,
+          let walletIdPtr = walletIdPtr else {
+        return 0
+    }
+    let handler = Unmanaged<PlatformWalletPersistenceHandler>
+        .fromOpaque(context)
+        .takeUnretainedValue()
+    let walletId = Data(bytes: walletIdPtr, count: 32)
+
+    var upserts: [PlatformWalletPersistenceHandler.AssetLockEntrySnapshot] = []
+    if upsertsCount > 0, let upsertsPtr = upsertsPtr {
+        upserts.reserveCapacity(Int(upsertsCount))
+        for i in 0..<Int(upsertsCount) {
+            let e = upsertsPtr[i]
+            // Outpoint tuple → 36-byte raw → display-order hex string.
+            let outPointRaw = Swift.withUnsafeBytes(of: e.out_point) { Data($0) }
+            let outPointHex = PersistentAssetLock.encodeOutPoint(rawBytes: outPointRaw)
+            // Consensus-encoded transaction bytes.
+            let txBytes: Data
+            if let ptr = e.transaction_bytes, e.transaction_bytes_len > 0 {
+                txBytes = Data(bytes: ptr, count: Int(e.transaction_bytes_len))
+            } else {
+                txBytes = Data()
+            }
+            // Optional bincode-encoded proof.
+            let proofBytes: Data?
+            if let ptr = e.proof_bytes, e.proof_bytes_len > 0 {
+                proofBytes = Data(bytes: ptr, count: Int(e.proof_bytes_len))
+            } else {
+                proofBytes = nil
+            }
+            upserts.append(.init(
+                outPointHex: outPointHex,
+                transactionBytes: txBytes,
+                fundingTypeRaw: Int(e.funding_type),
+                identityIndexRaw: Int32(bitPattern: e.identity_index),
+                amountDuffs: Int64(bitPattern: e.amount_duffs),
+                statusRaw: Int(e.status),
+                proofBytes: proofBytes
+            ))
+        }
+    }
+
+    var removed: [Data] = []
+    if removedCount > 0, let removedPtr = removedPtr {
+        removed.reserveCapacity(Int(removedCount))
+        for i in 0..<Int(removedCount) {
+            var tuple = removedPtr[i]
+            let bytes = Swift.withUnsafeBytes(of: &tuple) { Data($0) }
+            removed.append(bytes)
+        }
+    }
+
+    handler.persistAssetLocks(walletId: walletId, upserts: upserts, removed: removed)
+    return 0
+}
+
 /// C shim for `on_persist_contacts_fn`. Same snapshot + cast pattern
 /// as the identities callback — copies every `ContactRequestFFI` /
 /// `ContactRequestRemovalFFI` row into Swift-owned tuples before
diff --git a/packages/swift-sdk/Sources/SwiftDashSDK/Security/KeychainManager.swift b/packages/swift-sdk/Sources/SwiftDashSDK/Security/KeychainManager.swift
index b096b2d8043..7dcc39bfb77 100644
--- a/packages/swift-sdk/Sources/SwiftDashSDK/Security/KeychainManager.swift
+++ b/packages/swift-sdk/Sources/SwiftDashSDK/Security/KeychainManager.swift
@@ -624,7 +624,25 @@ extension KeychainManager {
         // Delete-then-add pattern lets the row settle into the new
         // `kSecValueData` + `kSecAttrGeneric` without fighting
         // SecItemUpdate's attribute-preservation quirks.
-        SecItemDelete(query as CFDictionary)
+        //
+        // The DELETE query must be ATTRIBUTE-ONLY: Apple Keychain
+        // treats `kSecValueData` and `kSecAttrGeneric` (the value
+        // payloads) as *value filters* on delete queries — including
+        // them would only delete rows whose data ALREADY equals the
+        // new bytes, which by definition is never true on an update.
+        // Without this fix, every prior failed attempt left a stale
+        // row that we could neither delete (data mismatch) nor add
+        // (uniqueness conflict on service+account → errSecDuplicateItem).
+        var deleteQuery: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: serviceName,
+            kSecAttrAccount as String: account,
+        ]
+        if let accessGroup = accessGroup {
+            deleteQuery[kSecAttrAccessGroup as String] = accessGroup
+        }
+        SecItemDelete(deleteQuery as CFDictionary)
+
         let status = SecItemAdd(query as CFDictionary, nil)
         return status == errSecSuccess ? account : nil
     }
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CoreContentView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CoreContentView.swift
index cf3044aaec5..258cc693c95 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CoreContentView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/CoreContentView.swift
@@ -572,8 +572,7 @@ var body: some View {
                 dataDir: dataDirURL.path,
                 network: platformState.currentNetwork,
                 peers: peers,
-                restrictToConfiguredPeers: restrictToConfiguredPeers,
-                masternodeSyncEnabled: masternodesEnabled
+                restrictToConfiguredPeers: restrictToConfiguredPeers
             )
             try walletManager.startSpv(config: config)
         } catch {
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/IdentitiesContentView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/IdentitiesContentView.swift
index 36164a25941..c7a8b483e49 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/IdentitiesContentView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/IdentitiesContentView.swift
@@ -11,9 +11,23 @@ import SwiftData
 struct IdentitiesContentView: View {
     @EnvironmentObject var platformState: AppState
     @EnvironmentObject var platformBalanceSyncService: PlatformBalanceSyncService
+    @EnvironmentObject var walletManager: PlatformWalletManager
     @Environment(\.modelContext) private var modelContext
     @Query(sort: \PersistentIdentity.identityIndex)
     private var identities: [PersistentIdentity]
+    /// All tracked asset locks across wallets. Filtered into
+    /// "resumable" rows (status >= `InstantSendLocked` AND no
+    /// `PersistentIdentity` at the same `(walletId, identityIndex)`
+    /// slot) by `resumableAssetLocks` so the orphan-lock-after-crash
+    /// case surfaces as a tappable Resume row. Sorted newest-first
+    /// by `updatedAt` so the most recent unfinished registration
+    /// sits at the top of the section.
+    @Query(sort: [SortDescriptor(\PersistentAssetLock.updatedAt, order: .reverse)])
+    private var allAssetLocks: [PersistentAssetLock]
+    /// All wallets, used purely for the "wallet name" lookup on the
+    /// Resume row label. Cheap query — wallet rows are few and
+    /// the matching is on the in-memory array.
+    @Query private var allWallets: [PersistentWallet]
     @State private var showingLoadIdentity = false
     @State private var showingCreateIdentity = false
     @State private var showingSearchWallets = false
@@ -22,9 +36,15 @@ struct IdentitiesContentView: View {
     /// an id so the dialog can show the display name / truncated id
     /// without a second fetch.
     @State private var identityPendingRemoval: PersistentIdentity?
+    /// Asset lock the user tapped Resume on. Drives the `.sheet(item:)`
+    /// presentation of a pre-configured `CreateIdentityView`. Cleared
+    /// when the sheet dismisses (SwiftUI nils the binding for us).
+    @State private var resumingAssetLock: PersistentAssetLock?
 
     var body: some View {
         List {
+            pendingRegistrationsSection
+            resumableRegistrationsSection
             if identities.isEmpty {
                 Section {
                     VStack(spacing: 12) {
@@ -149,6 +169,16 @@ struct IdentitiesContentView: View {
             CreateIdentityView()
                 .environmentObject(platformState)
         }
+        .sheet(item: $resumingAssetLock) { lock in
+            // Pre-configured resume of an orphan asset lock. Same
+            // view, same code path — the constructor seeds the
+            // four selection `@State`s as initial values so the
+            // form opens already on the "Fund from unused Asset
+            // Lock" step with this specific lock highlighted, and
+            // the user only has to tap "Create Identity".
+            CreateIdentityView(preselectedAssetLock: lock)
+                .environmentObject(platformState)
+        }
         .sheet(isPresented: $showingSearchWallets) {
             SearchWalletsForIdentitiesView()
         }
@@ -157,6 +187,136 @@ struct IdentitiesContentView: View {
         }
     }
 
+    /// "Pending registrations" row group. Surfaces every controller
+    /// the `RegistrationCoordinator` is tracking — both in-flight
+    /// flows (the user dismissed `CreateIdentityView` but the
+    /// registration is still running) and terminal-but-undismissed
+    /// flows (`.completed` rows linger ~30s, `.failed` rows linger
+    /// indefinitely until the user manually dismisses). Empty when
+    /// the coordinator's map is empty, in which case the section
+    /// collapses to nothing so the rest of the screen isn't pushed
+    /// down by an "empty" header.
+    ///
+    /// Observation: wrap the coordinator in a dedicated
+    /// `PendingRegistrationsList` so its `@ObservedObject` reads
+    /// the coordinator directly. Reading
+    /// `walletManager.registrationCoordinator` inside this view's
+    /// body would not subscribe — `walletManager` is the
+    /// `EnvironmentObject` we observe, not the coordinator hung off
+    /// it — so map mutations wouldn't trigger a redraw.
+    @ViewBuilder
+    private var pendingRegistrationsSection: some View {
+        PendingRegistrationsList(
+            coordinator: walletManager.registrationCoordinator
+        )
+    }
+
+    /// "Resumable Registrations" row group. Surfaces orphan
+    /// `PersistentAssetLock` rows — those at status >= `Broadcast`
+    /// (`statusRaw >= 1`) with no `PersistentIdentity` at the same
+    /// `(walletId, identityIndex)` slot — that the in-memory
+    /// `RegistrationCoordinator` can't know about because its map
+    /// is wiped on app restart. Without this section, an app kill
+    /// mid-registration leaves the user with no surface signal
+    /// that there's an in-flight lock: the lock still lives in
+    /// SwiftData, but the "Pending Registrations" section above
+    /// only reflects the in-memory coordinator state.
+    ///
+    /// Each row's trailing affordance is staged on the lock's
+    /// `statusRaw`:
+    /// - `1` Broadcast: spinner + "Waiting for InstantSendLock or
+    ///   ChainLock…" — the lock can't fund a Platform identity
+    ///   until the masternodes sign either lock type. For
+    ///   freshly broadcast funding txs the IS lock typically
+    ///   arrives within seconds; for aged stuck locks (catch-up
+    ///   case) the IS quorum has rotated so only a ChainLock
+    ///   can resolve them. Either path lands as
+    ///   `statusRaw = 2` or `3`. SPV is running; the persister
+    ///   will flip the row when the event arrives, and
+    ///   SwiftData `@Query` re-renders the row into the
+    ///   actionable state without any extra wiring.
+    /// - `2` / `3` InstantSendLocked / ChainLocked: Resume
+    ///   button. Tapping opens `CreateIdentityView` pre-configured
+    ///   for the `.unusedAssetLock` funding path with this lock
+    ///   pinned.
+    ///
+    /// Empty when there are no orphan locks; collapses to nothing
+    /// in that case so the rest of the screen isn't pushed down by
+    /// an empty header.
+    /// Wraps the Resumable Registrations section in a dedicated view
+    /// that observes `RegistrationCoordinator` directly. Necessary
+    /// because the section's filter needs to consult **both** the
+    /// SwiftData @Query results AND the coordinator's in-memory
+    /// controller map: an in-flight registration owns its slot
+    /// transiently between `asset-lock-broadcast` and `PersistentIdentity-
+    /// written`, and during that window the orphan-lock anti-join
+    /// alone would let the same slot surface as both "Pending" and
+    /// "Resumable" → user could tap Resume and race a duplicate
+    /// FFI against the original.
+    @ViewBuilder
+    private var resumableRegistrationsSection: some View {
+        ResumableRegistrationsList(
+            coordinator: walletManager.registrationCoordinator,
+            allAssetLocks: allAssetLocks,
+            allWallets: allWallets,
+            allIdentities: identities,
+            resumingAssetLock: $resumingAssetLock
+        )
+    }
+
+    /// Pure anti-join across all wallets. A lock is *visible* on the
+    /// Resumable Registrations surface iff
+    /// - `statusRaw >= 1` (Broadcast or higher), AND
+    /// - no `(walletId, identityIndex)` slot is in `usedSlots`.
+    ///
+    /// `usedSlots` is the **union** of two sources of slot
+    /// occupancy (the caller assembles it):
+    /// 1. Persisted `PersistentIdentity` rows — registrations that
+    ///    have completed and written an identity to SwiftData.
+    /// 2. In-memory `RegistrationCoordinator` controllers in
+    ///    `.preparingKeys` or `.inFlight` — registrations whose
+    ///    asset lock has been broadcast but whose identity row
+    ///    hasn't landed yet. Including these prevents a transient
+    ///    window where the same lock would surface here *and* in
+    ///    the in-memory Pending Registrations list, letting the
+    ///    user race a duplicate Resume tap against the original.
+    ///
+    /// The status floor (`>= 1`, Broadcast) is intentionally low:
+    /// a lock at Broadcast (1) is in mid-handoff — SPV will
+    /// deliver the InstantSendLock shortly and the persister will
+    /// flip it to (2), at which point the row's trailing affordance
+    /// flips from a spinner to a Resume button automatically
+    /// (SwiftData `@Query` is reactive). Hiding (1) entirely would
+    /// create a UX asymmetry where the just-broadcast lock vanishes
+    /// from the UI then reappears seconds later at (2).
+    ///
+    /// `statusRaw == 0` (Built but never broadcast) is filtered
+    /// out: a tight crash window between TX build and broadcast
+    /// with no useful UX action to take.
+    ///
+    /// Generic over `AssetLockResumeRow` so the pure filter is
+    /// unit-testable without a SwiftData container.
+    nonisolated static func crossWalletResumableLocks<R: AssetLockResumeRow>(
+        in locks: [R],
+        usedSlots: Set<UsedSlot>
+    ) -> [R] {
+        locks.filter { lock in
+            guard lock.statusRaw >= 1 else { return false }
+            let slot = UInt32(bitPattern: lock.identityIndexRaw)
+            return !usedSlots.contains(
+                UsedSlot(walletId: lock.walletId, slot: slot)
+            )
+        }
+    }
+
+    /// Composite key for the per-`(walletId, identityIndex)`
+    /// anti-join. Public visibility so unit tests in the same
+    /// module can build the set directly.
+    struct UsedSlot: Hashable {
+        let walletId: Data
+        let slot: UInt32
+    }
+
     /// Short title for the removal confirmation dialog. Uses
     /// `displayName` so the user sees the DPNS name / alias when
     /// available, and a truncated-hex id otherwise — matches the
@@ -227,3 +387,172 @@ struct IdentitiesContentView: View {
         }
     }
 }
+
+/// Section view backing the Identities tab's "Resumable Registrations"
+/// surface. Observes `RegistrationCoordinator` (`@ObservedObject`) so
+/// the in-memory controller map is part of the filter input, not just
+/// the SwiftData-backed identity rows: a controller in `.preparingKeys`
+/// or `.inFlight` owns its slot transiently before a `PersistentIdentity`
+/// row exists for it, and during that window the orphan-lock anti-join
+/// would otherwise surface the same slot as both "Pending" and
+/// "Resumable" → a duplicate Resume tap could race a second FFI for
+/// the same outpoint.
+///
+/// Phase-change reactivity within an existing controller is best-
+/// effort. The coordinator's `@Published controllers` dict re-emits
+/// on add/remove but not on phase transitions inside an existing
+/// entry. The two transitions that need re-render are
+/// `.inFlight → .completed` (handled — the persister writes a
+/// `PersistentIdentity` row, the @Query re-fires) and
+/// `.inFlight → .failed` (not handled directly; the row re-surfaces
+/// once the user dismisses the failed Pending entry, which mutates
+/// the dict). The latter delay is acceptable given the explicit
+/// dismiss UX on `.failed` rows.
+private struct ResumableRegistrationsList: View {
+    @ObservedObject var coordinator: RegistrationCoordinator
+    let allAssetLocks: [PersistentAssetLock]
+    let allWallets: [PersistentWallet]
+    let allIdentities: [PersistentIdentity]
+    @Binding var resumingAssetLock: PersistentAssetLock?
+
+    var body: some View {
+        let locks = resumableLocks
+        if !locks.isEmpty {
+            Section("Resumable Registrations (\(locks.count))") {
+                ForEach(locks) { lock in
+                    ResumableRegistrationRow(
+                        lock: lock,
+                        walletLabel: walletDisplayLabel(for: lock.walletId),
+                        onResume: {
+                            resumingAssetLock = lock
+                        }
+                    )
+                }
+            }
+        }
+    }
+
+    /// Filter is `anti-join(identity-claimed slots ∪ in-flight slots)`
+    /// over `crossWalletResumableLocks`. The union is the key
+    /// fix: identity rows alone leave a window where the asset
+    /// lock is already broadcast but the registration hasn't
+    /// persisted an identity yet, and during that window the
+    /// row would double-count in both Pending and Resumable.
+    private var resumableLocks: [PersistentAssetLock] {
+        let identitySlots: Set<IdentitiesContentView.UsedSlot> = Set(
+            allIdentities.compactMap { identity in
+                guard let walletId = identity.wallet?.walletId else {
+                    return nil
+                }
+                return IdentitiesContentView.UsedSlot(
+                    walletId: walletId,
+                    slot: identity.identityIndex
+                )
+            }
+        )
+        let activeSlots: Set<IdentitiesContentView.UsedSlot> = Set(
+            coordinator.controllers
+                .filter { _, controller in controller.phase.isActive }
+                .map { (key, _) in
+                    IdentitiesContentView.UsedSlot(
+                        walletId: key.walletId,
+                        slot: key.identityIndex
+                    )
+                }
+        )
+        return IdentitiesContentView.crossWalletResumableLocks(
+            in: allAssetLocks,
+            usedSlots: identitySlots.union(activeSlots)
+        )
+    }
+
+    private func walletDisplayLabel(for walletId: Data) -> String {
+        if let wallet = allWallets.first(where: { $0.walletId == walletId }) {
+            return wallet.label
+        }
+        let hex = walletId.prefix(4)
+            .map { String(format: "%02x", $0) }
+            .joined()
+        return hex.isEmpty ? "Wallet" : "Wallet \(hex)…"
+    }
+}
+
+/// Single row in the "Resumable Registrations" section. Renders the
+/// lock summary (txid prefix, amount, status, owning wallet, slot)
+/// plus a compact Resume button that fires the caller-supplied
+/// `onResume` closure. Visually matches the row density of
+/// `IdentityRow` and the storage-explorer's `AssetLockStorageListView`
+/// row at `StorageModelListViews.swift:1636`.
+private struct ResumableRegistrationRow: View {
+    let lock: PersistentAssetLock
+    let walletLabel: String
+    let onResume: () -> Void
+
+    var body: some View {
+        HStack(alignment: .top) {
+            VStack(alignment: .leading, spacing: 4) {
+                Text("Asset Lock \(lock.shortOutPointDisplay)")
+                    .font(.body)
+                    .lineLimit(1)
+                HStack(spacing: 6) {
+                    Text(formatDuffs(lock.amountDuffs))
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                    Text("·")
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                    Text(lock.statusLabel)
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                    Text("·")
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                    Text("#\(UInt32(bitPattern: lock.identityIndexRaw))")
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                        .monospacedDigit()
+                }
+                Text(walletLabel)
+                    .font(.caption2)
+                    .foregroundColor(.secondary)
+                    .lineLimit(1)
+            }
+            Spacer(minLength: 8)
+            trailingAffordance
+        }
+        .padding(.vertical, 2)
+    }
+
+    /// Trailing view that depends on the lock's stage. At Broadcast
+    /// (`!canFundIdentity`) the lock isn't usable yet — SPV is waiting
+    /// on the masternodes to sign an InstantSendLock — so we show
+    /// a spinner instead of a button. SwiftData `@Query` is
+    /// reactive, so when the persister flips the row to
+    /// `InstantSendLocked` this view re-renders into the Resume
+    /// button without any extra plumbing.
+    @ViewBuilder
+    private var trailingAffordance: some View {
+        if lock.canFundIdentity {
+            Button(action: onResume) {
+                Label("Resume", systemImage: "arrow.clockwise")
+                    .labelStyle(.titleAndIcon)
+                    .font(.callout)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.small)
+        } else {
+            HStack(spacing: 6) {
+                ProgressView()
+                    .controlSize(.small)
+                Text("Waiting for InstantSendLock or ChainLock…")
+                    .font(.caption)
+                    .foregroundColor(.secondary)
+            }
+        }
+    }
+
+    private func formatDuffs(_ amountDuffs: Int64) -> String {
+        let dash = Double(amountDuffs) / 1e8
+        return String(format: "%g DASH", dash)
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionDetailView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionDetailView.swift
index 7ef455cfdc9..247c82fdaaf 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionDetailView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionDetailView.swift
@@ -3,10 +3,35 @@ import SwiftDashSDK
 
 struct TransactionDetailView: View {
     let transaction: PersistentTransaction
+    /// Override amount for asset-lock txs. The wallet's `netAmount`
+    /// shows ~0 for these (credit output is structurally self-owned),
+    /// so the list view passes the linked
+    /// `PersistentAssetLock.amountDuffs`. `nil` for non-asset-lock
+    /// rows OR consumed asset locks whose tracking row was cleaned
+    /// up after successful identity registration.
+    var assetLockAmountDuffs: Int64? = nil
     @Environment(\.dismiss) private var dismiss
     @State private var showCopiedAlert = false
 
+    /// Amount label rendered prominently at the top of the sheet.
+    /// Same precedence rule as the row: asset-lock duffs when we
+    /// have them, else an explicit "amount unknown" label for the
+    /// historical-asset-lock case (rather than the misleading
+    /// `+0.00000000 DASH` from `transaction.formattedAmount`).
+    private var displayAmount: String {
+        if transaction.isAssetLock {
+            if let duffs = assetLockAmountDuffs {
+                let dash = Double(duffs) / 100_000_000.0
+                return String(format: "-%.8f DASH", dash)
+            }
+            return "Asset Lock (amount unknown)"
+        }
+        return transaction.formattedAmount
+    }
+
     private var typeDescription: String {
+        if transaction.isAssetLock { return "Asset Lock" }
+        if transaction.isAssetUnlock { return "Asset Unlock" }
         switch transaction.netAmount {
         case let amount where amount > 0:
             return "Received"
@@ -18,6 +43,8 @@ struct TransactionDetailView: View {
     }
 
     private var typeIcon: String {
+        if transaction.isAssetLock { return "lock.fill" }
+        if transaction.isAssetUnlock { return "lock.open.fill" }
         switch transaction.netAmount {
         case let amount where amount > 0:
             return "arrow.down.circle.fill"
@@ -29,6 +56,9 @@ struct TransactionDetailView: View {
     }
 
     private var typeColor: Color {
+        if transaction.isAssetLock || transaction.isAssetUnlock {
+            return .purple
+        }
         switch transaction.netAmount {
         case let amount where amount > 0:
             return .green
@@ -72,7 +102,7 @@ struct TransactionDetailView: View {
                             .font(.headline)
                             .foregroundColor(.secondary)
 
-                        Text(transaction.formattedAmount)
+                        Text(displayAmount)
                             .font(.system(size: 32, weight: .bold, design: .rounded))
                             .foregroundColor(typeColor)
                     }
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionListView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionListView.swift
index e0aac4e7a18..1c3a88c3321 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionListView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Core/Views/TransactionListView.swift
@@ -20,14 +20,45 @@ struct TransactionListView: View {
     /// denormalized `walletId` on TXOs.
     @Query private var walletTxos: [PersistentTxo]
     @Query private var transactionObservation: [PersistentTransaction]
+    /// Per-wallet asset-lock rows. Used to look up the *locked* amount
+    /// for each asset-lock tx — `PersistentTransaction.netAmount` is
+    /// the wallet's input-vs-output diff, which sees the credit
+    /// output as "to-self" and reports ~0 for asset locks. The
+    /// `amountDuffs` on the asset-lock row is the actual L1 burn.
+    @Query private var assetLocks: [PersistentAssetLock]
     @State private var selectedTransaction: PersistentTransaction?
 
     init(walletId: Data) {
         self.walletId = walletId
-        let descriptor = FetchDescriptor<PersistentTxo>(
+        let txoDescriptor = FetchDescriptor<PersistentTxo>(
             predicate: #Predicate { $0.walletId == walletId }
         )
-        _walletTxos = Query(descriptor)
+        _walletTxos = Query(txoDescriptor)
+        let assetLockDescriptor = FetchDescriptor<PersistentAssetLock>(
+            predicate: PersistentAssetLock.predicate(walletId: walletId)
+        )
+        _assetLocks = Query(assetLockDescriptor)
+    }
+
+    /// Lookup `txid (display-order hex) → total asset-lock amount in
+    /// duffs`, built once per @Query invalidation so the row's amount
+    /// label can swap in the real funded amount without re-fetching.
+    ///
+    /// `PersistentAssetLock.outPointHex` is `"<txidHex>:<vout>"`. A
+    /// single funding tx can carry multiple credit outputs (DIP-0027
+    /// allows up to 255), each becoming its own `PersistentAssetLock`
+    /// row at a distinct `vout`. We sum amounts across all rows
+    /// sharing a txid so the list shows the *total* DASH burned by
+    /// that funding tx, not whichever row SwiftData happened to
+    /// enumerate last.
+    private var assetLockAmountByTxid: [String: Int64] {
+        var map: [String: Int64] = [:]
+        for lock in assetLocks {
+            let parts = lock.outPointHex.split(separator: ":", maxSplits: 1)
+            guard let txidHex = parts.first.map(String.init) else { continue }
+            map[txidHex, default: 0] += lock.amountDuffs
+        }
+        return map
     }
 
     private var transactions: [PersistentTransaction] {
@@ -61,7 +92,10 @@ struct TransactionListView: View {
         .navigationTitle("Transactions")
         .navigationBarTitleDisplayMode(.inline)
         .sheet(item: $selectedTransaction) { transaction in
-            TransactionDetailView(transaction: transaction)
+            TransactionDetailView(
+                transaction: transaction,
+                assetLockAmountDuffs: assetLockAmountByTxid[transaction.txidHex]
+            )
         }
     }
 
@@ -84,11 +118,15 @@ struct TransactionListView: View {
     }
 
     private var transactionsList: some View {
-        List(transactions) { transaction in
+        let assetLockAmounts = assetLockAmountByTxid
+        return List(transactions) { transaction in
             Button {
                 selectedTransaction = transaction
             } label: {
-                TransactionRowView(transaction: transaction)
+                TransactionRowView(
+                    transaction: transaction,
+                    assetLockAmountDuffs: assetLockAmounts[transaction.txidHex]
+                )
             }
             .buttonStyle(.plain)
         }
@@ -100,8 +138,22 @@ struct TransactionListView: View {
 
 struct TransactionRowView: View {
     let transaction: PersistentTransaction
+    /// Override amount displayed for asset-lock rows. The wallet's
+    /// `netAmount` shows ~0 for these (credit output is structurally
+    /// self-owned), so the list view passes the linked
+    /// `PersistentAssetLock.amountDuffs` — the actual L1 DASH burned
+    /// to mint platform credits. `nil` for non-asset-lock rows or
+    /// when no matching row was found.
+    var assetLockAmountDuffs: Int64? = nil
 
     private var typeIcon: String {
+        // Asset-lock / asset-unlock txs override direction-based icons
+        // since the `direction` classifier reports `Internal` (the
+        // credit output is structurally self-owned), but the intent
+        // is L1→L2 / L2→L1 credit conversion — neither "send" nor
+        // "receive" applies cleanly.
+        if transaction.isAssetLock { return "lock.fill" }
+        if transaction.isAssetUnlock { return "lock.open.fill" }
         // direction: 0=incoming, 1=outgoing, 2=internal, 3=coinJoin
         switch transaction.direction {
         case 0: return "arrow.down.circle.fill"
@@ -113,6 +165,12 @@ struct TransactionRowView: View {
     }
 
     private var typeColor: Color {
+        // Asset-lock txs render purple — distinct from the red
+        // outgoing / green incoming axis so the user can scan the
+        // list and immediately spot identity-funding rows.
+        if transaction.isAssetLock || transaction.isAssetUnlock {
+            return .purple
+        }
         switch transaction.direction {
         case 0: return .green
         case 1, 2: return .red
@@ -194,7 +252,7 @@ struct TransactionRowView: View {
                     Spacer()
 
                     VStack(alignment: .trailing, spacing: 2) {
-                        Text(transaction.formattedAmount)
+                        Text(displayAmount)
                             .font(.headline)
                             .foregroundColor(typeColor)
 
@@ -214,4 +272,28 @@ struct TransactionRowView: View {
         let dash = Double(fee) / 100_000_000.0
         return String(format: "%.8f DASH", dash)
     }
+
+    /// Amount label for the row. For asset-lock txs we substitute
+    /// the linked `PersistentAssetLock.amountDuffs` (the L1 DASH
+    /// actually burned to mint platform credits); the wallet's
+    /// `netAmount` is ~0 for these because the credit output is a
+    /// self-owned address. Rendered as a negative (DASH leaving L1).
+    ///
+    /// If we know the row is an asset lock but the linked
+    /// `PersistentAssetLock` is missing (e.g. a historical record
+    /// from before the `Consumed`-status retention change shipped),
+    /// we render "Asset Lock (amount unknown)" instead of falling
+    /// through to `transaction.formattedAmount` — that would say
+    /// `+0.00000000 DASH`, which is misleading for a row the user
+    /// can see was a funding tx.
+    private var displayAmount: String {
+        if transaction.isAssetLock {
+            if let duffs = assetLockAmountDuffs {
+                let dash = Double(duffs) / 100_000_000.0
+                return String(format: "-%.8f DASH", dash)
+            }
+            return "Asset Lock (amount unknown)"
+        }
+        return transaction.formattedAmount
+    }
 }
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/IdentityRegistrationController.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/IdentityRegistrationController.swift
new file mode 100644
index 00000000000..55456119bd2
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/IdentityRegistrationController.swift
@@ -0,0 +1,142 @@
+import Foundation
+import SwiftDashSDK
+
+/// Per-slot state owned by a single identity registration attempt.
+///
+/// One controller is created per `(walletId, identityIndex)` slot
+/// when the user submits `CreateIdentityView`. The controller owns
+/// the in-flight `Task`, exposes its current `phase` via
+/// `@Published`, and survives view dismissal via
+/// `RegistrationCoordinator` on `PlatformWalletManager`. Multiple
+/// controllers can be active simultaneously (one per slot); each
+/// runs on `@MainActor` so SwiftUI observers see consistent
+/// transitions.
+///
+/// The 5-step progress bar in `RegistrationProgressView` derives its
+/// step from a combination of `phase` (Step 1, 4, 5) and the live
+/// `PersistentAssetLock` row queried via `@Query` filtered by
+/// `(walletId, identityIndex)` (Step 2/3, driven by `statusRaw`).
+@MainActor
+final class IdentityRegistrationController: ObservableObject {
+    enum Phase: Equatable {
+        /// Pre-submit. The controller exists but `submit` hasn't
+        /// fired yet. Not surfaced by `RegistrationProgressView`
+        /// (the view only opens after a submit).
+        case idle
+        /// Step 1: pre-deriving + Keychain-persisting the identity
+        /// keys via `prePersistIdentityKeysForRegistration`. The
+        /// caller drives this transition before invoking `submit`.
+        case preparingKeys
+        /// Steps 2–4 inclusive: the FFI registration call is in
+        /// flight. Stage within this phase is read from the
+        /// matching `PersistentAssetLock.statusRaw` row.
+        case inFlight
+        /// Step 5: identity is registered. `identityId` is the
+        /// 32-byte identifier the caller should persist /
+        /// navigate to.
+        case completed(identityId: Data)
+        /// Failure terminal state. The message is shown inline in
+        /// `RegistrationProgressView`'s step 5; the row stays in
+        /// the coordinator's map until the user dismisses it
+        /// manually.
+        case failed(String)
+
+        /// Whether the controller is currently holding its slot
+        /// against a fresh registration. Used by the Resumable
+        /// Registrations surface to hide orphan asset locks whose
+        /// slot is mid-flight — otherwise the same lock could
+        /// appear in both Pending and Resumable lists during the
+        /// window between asset-lock broadcast and PersistentIdentity
+        /// write, letting the user race a duplicate Resume tap
+        /// against the original FFI call.
+        ///
+        /// `.completed` is NOT active here: by the time the
+        /// controller flips to `.completed` the persister has
+        /// (or is about to) write a `PersistentIdentity` row,
+        /// which the identity-slot anti-join already covers.
+        /// `.failed` is NOT active either: the user is expected
+        /// to retry, so the lock should resurface for selection.
+        var isActive: Bool {
+            switch self {
+            case .preparingKeys, .inFlight:
+                return true
+            case .idle, .completed, .failed:
+                return false
+            }
+        }
+    }
+
+    /// Current phase. Updates flow:
+    /// `.idle` → `.preparingKeys` (caller) → `.inFlight` (submit) →
+    /// `.completed(id) | .failed(message)`.
+    @Published private(set) var phase: Phase = .idle
+
+    /// Slot this controller is bound to. Stored so the coordinator
+    /// and the progress view can filter `PersistentAssetLock` rows
+    /// by `(walletId, identityIndex)`.
+    let walletId: Data
+    let identityIndex: UInt32
+
+    /// Timestamp of the most recent `submit` call. Used by the
+    /// coordinator's TTL-based retention policy (`.completed` rows
+    /// purge ~30s after the success transition).
+    private(set) var lastSubmittedAt: Date?
+
+    /// Active registration task. Holds a reference so the
+    /// coordinator's stash retains the work until completion;
+    /// cancellation isn't wired today (the FFI call doesn't yet
+    /// support clean abort), but the field lets future work hang
+    /// off the same shape.
+    private var task: Task<Void, Never>?
+
+    init(walletId: Data, identityIndex: UInt32) {
+        self.walletId = walletId
+        self.identityIndex = identityIndex
+    }
+
+    /// Transition to `.preparingKeys`. Called by the caller before
+    /// `submit` while it pre-derives the identity public keys via
+    /// `prePersistIdentityKeysForRegistration`.
+    func enterPreparingKeys() {
+        phase = .preparingKeys
+    }
+
+    /// Submit the registration. Defensively rejects any phase that
+    /// shouldn't fire a fresh FFI call:
+    ///   - `.inFlight`: a second FFI call would race the first,
+    ///     ending with a misleading "asset lock consumed" failure.
+    ///   - `.completed`: re-submitting after success would flip the
+    ///     UI from "Done" back to a spinner before failing on the
+    ///     consumed lock.
+    /// `.idle`, `.preparingKeys`, and `.failed` are allowed — the
+    /// coordinator drives the legitimate-restart flow through them
+    /// (callers must call `enterPreparingKeys()` before `submit()`,
+    /// `failed → preparingKeys → submit` is how a user retries).
+    ///
+    /// `body` performs the actual FFI call. It runs detached on a
+    /// background priority and reports the identity id on success
+    /// or rethrows on failure. The controller flips `phase` to
+    /// `.completed` / `.failed` accordingly.
+    func submit(body: @escaping () async throws -> Data) {
+        switch phase {
+        case .idle, .preparingKeys, .failed:
+            break
+        case .inFlight, .completed:
+            return
+        }
+        phase = .inFlight
+        lastSubmittedAt = Date()
+        task = Task { [weak self] in
+            do {
+                let identityId = try await body()
+                await MainActor.run {
+                    self?.phase = .completed(identityId: identityId)
+                }
+            } catch {
+                await MainActor.run {
+                    self?.phase = .failed(error.localizedDescription)
+                }
+            }
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/PlatformWalletManager+RegistrationCoordinator.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/PlatformWalletManager+RegistrationCoordinator.swift
new file mode 100644
index 00000000000..a401ac67316
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/PlatformWalletManager+RegistrationCoordinator.swift
@@ -0,0 +1,53 @@
+import Foundation
+import ObjectiveC
+import SwiftDashSDK
+
+/// Per-manager `RegistrationCoordinator` accessor. Lazy-initialized
+/// on first access and lifetime-tied to the
+/// [`PlatformWalletManager`](SwiftDashSDK.PlatformWalletManager)
+/// instance via an `objc_getAssociatedObject` slot.
+///
+/// Why this shape: the coordinator is example-app-only state (it
+/// stores `IdentityRegistrationController` instances, which live in
+/// the app, not the SDK), but the call site convention from the
+/// plan reads as `walletManager.registrationCoordinator.startRegistration(...)`.
+/// Storing it directly on the SDK type would push the controller
+/// type into `SwiftDashSDK`, which violates the architectural rule
+/// in `swift-sdk/CLAUDE.md` ("SDK does persist / load / bridge — no
+/// business logic"). The associated-object hook keeps the call site
+/// clean while leaving the SDK module untouched.
+///
+/// The coordinator's lifetime matches the manager's: when
+/// `WalletManagerStore` deallocs an inactive manager (none does
+/// today, but in principle), the associated object is released
+/// alongside it. Switching networks at runtime tears down the
+/// active manager and any in-flight registrations belong to the
+/// prior network anyway — this matches the
+/// `hasInFlightRegistrations` gate on the network toggle in
+/// `CoreContentView`.
+@MainActor
+extension PlatformWalletManager {
+    /// Backing key for the associated-object slot. A static address
+    /// is required by the runtime; `let _key = UInt8(0)` produces a
+    /// stable per-program-address that's unique to this extension.
+    private static var coordinatorKey: UInt8 = 0
+
+    /// Per-manager registration coordinator. Created on first
+    /// access; subsequent reads return the same instance.
+    var registrationCoordinator: RegistrationCoordinator {
+        if let existing = objc_getAssociatedObject(
+            self,
+            &PlatformWalletManager.coordinatorKey
+        ) as? RegistrationCoordinator {
+            return existing
+        }
+        let fresh = RegistrationCoordinator()
+        objc_setAssociatedObject(
+            self,
+            &PlatformWalletManager.coordinatorKey,
+            fresh,
+            .OBJC_ASSOCIATION_RETAIN_NONATOMIC
+        )
+        return fresh
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/RegistrationCoordinator.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/RegistrationCoordinator.swift
new file mode 100644
index 00000000000..339d367ba51
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/RegistrationCoordinator.swift
@@ -0,0 +1,179 @@
+import Foundation
+import SwiftDashSDK
+
+/// Singleton hub for in-flight identity registrations, hosted on
+/// `PlatformWalletManager` so registrations survive view dismissal
+/// and network-toggle pressure.
+///
+/// Why on PlatformWalletManager (not AppState):
+/// - `PlatformWalletManager` is the per-network operational hub
+///   and outlives any individual view's lifetime.
+/// - `AppState` is a bootstrap host whose lifetime is the whole
+///   app, but it doesn't own the wallet / FFI handle the
+///   registration call needs.
+/// - Registration state has the same lifetime as the
+///   wallet/network pairing: switching networks blows away the
+///   manager and any in-flight registrations belong to the prior
+///   network anyway.
+///
+/// Keyed by `(walletId, identityIndex)`. The slot model enforces
+/// "one registration in flight per identity slot" naturally because
+/// the wallet's `unusedIdentityIndices` invariant only ever
+/// surfaces a slot to the UI once.
+@MainActor
+final class RegistrationCoordinator: ObservableObject {
+    /// Composite key — needs `Hashable` so the map can index by it.
+    /// The `walletId` is treated as 32 raw bytes; the `identityIndex`
+    /// is the HD slot the caller is registering against.
+    struct SlotKey: Hashable {
+        let walletId: Data
+        let identityIndex: UInt32
+    }
+
+    /// Active controllers keyed by slot. Stored as `@Published` so
+    /// the "Pending registrations" row on the identities tab can
+    /// observe map mutations via `objectWillChange`.
+    @Published private(set) var controllers: [SlotKey: IdentityRegistrationController] = [:]
+
+    /// True when at least one slot is currently in flight (phase
+    /// `.preparingKeys` or `.inFlight`). Used by the network
+    /// toggle's `.disabled(_:)` modifier — switching testnet ↔
+    /// mainnet mid-flight tears down the FFI manager and would
+    /// abort the in-flight call mid-stream. The UI guards against
+    /// that race by reading this flag.
+    var hasInFlightRegistrations: Bool {
+        controllers.contains { _, controller in
+            switch controller.phase {
+            case .preparingKeys, .inFlight:
+                return true
+            default:
+                return false
+            }
+        }
+    }
+
+    /// Look up the controller for a slot if one exists. Returns
+    /// `nil` when there's no active registration for the slot —
+    /// callers use that to decide whether to spawn a new controller
+    /// or reuse the existing one.
+    func controller(walletId: Data, identityIndex: UInt32) -> IdentityRegistrationController? {
+        controllers[SlotKey(walletId: walletId, identityIndex: identityIndex)]
+    }
+
+    /// Snapshot of every active controller, sorted by recency of
+    /// last submit (most recent first). Used by the "Pending
+    /// registrations" row so dismissed-but-still-running flows
+    /// remain reachable.
+    func activeControllers() -> [IdentityRegistrationController] {
+        controllers.values.sorted { lhs, rhs in
+            (lhs.lastSubmittedAt ?? .distantPast) > (rhs.lastSubmittedAt ?? .distantPast)
+        }
+    }
+
+    /// Start a registration for the slot, or reuse an existing
+    /// controller if one is already in flight for it. Returns the
+    /// controller for `CreateIdentityView` to bind a
+    /// `RegistrationProgressView` against.
+    ///
+    /// Single-flighting is enforced here at the coordinator level
+    /// (rather than just inside `IdentityRegistrationController.submit`)
+    /// because the controller's `enterPreparingKeys()` unconditionally
+    /// overwrites `phase`; without a phase check before that call, a
+    /// second tap on the same slot during the FFI window would set
+    /// `.inFlight → .preparingKeys → .inFlight`, racing two FFI calls
+    /// for the same asset lock. The Resumable Registrations section
+    /// surfaces orphan locks based on the absence of a
+    /// `PersistentIdentity` row, which only lands after the FFI
+    /// returns — so during the lock-broadcast-to-identity-write
+    /// window, the same slot was visible in both Pending and
+    /// Resumable surfaces and could be double-tapped.
+    func startRegistration(
+        walletId: Data,
+        identityIndex: UInt32,
+        body: @escaping () async throws -> Data
+    ) -> IdentityRegistrationController {
+        let key = SlotKey(walletId: walletId, identityIndex: identityIndex)
+        if let existing = controllers[key] {
+            switch existing.phase {
+            case .preparingKeys, .inFlight, .completed:
+                // Active or just-completed — don't re-enter. Returning
+                // the existing controller lets the caller bind to its
+                // progress / terminal state without disrupting it.
+                return existing
+            case .idle, .failed:
+                // Legitimate restart paths: a brand-new idle
+                // controller (shouldn't happen via the standard
+                // entry but safe to allow), or a user-initiated
+                // retry after a failure.
+                existing.enterPreparingKeys()
+                existing.submit(body: body)
+                scheduleRetentionSweep(key: key, controller: existing)
+                return existing
+            }
+        }
+        let controller = IdentityRegistrationController(
+            walletId: walletId,
+            identityIndex: identityIndex
+        )
+        controllers[key] = controller
+        controller.enterPreparingKeys()
+        controller.submit(body: body)
+        scheduleRetentionSweep(key: key, controller: controller)
+        return controller
+    }
+
+    /// Manually drop a controller from the map. Used by the UI's
+    /// "Dismiss" action on a `.failed` row (failures stay
+    /// indefinitely until acknowledged so the user can read the
+    /// error).
+    func dismiss(walletId: Data, identityIndex: UInt32) {
+        let key = SlotKey(walletId: walletId, identityIndex: identityIndex)
+        controllers.removeValue(forKey: key)
+    }
+
+    // MARK: - Retention sweep
+
+    /// Auto-purge `.completed` controllers ~30s after the success
+    /// transition so the home tab's pending list doesn't accumulate
+    /// stale rows. `.failed` controllers stay indefinitely until
+    /// the user dismisses them (their error message is the only
+    /// surface where the failure is reported).
+    private func scheduleRetentionSweep(
+        key: SlotKey,
+        controller: IdentityRegistrationController
+    ) {
+        // Observe phase transitions on the controller and arm a
+        // 30s sweep after a `.completed` flip. `Combine`'s sink is
+        // overkill for a single observer — we poll via a Task that
+        // re-checks every second until either:
+        //   - the controller is gone (already dismissed), or
+        //   - 30s have elapsed since the success transition.
+        Task { [weak self, weak controller] in
+            guard let controller = controller else { return }
+            var completedAt: Date?
+            while !Task.isCancelled {
+                let phase = await MainActor.run { controller.phase }
+                switch phase {
+                case .completed:
+                    if completedAt == nil {
+                        completedAt = Date()
+                    } else if let at = completedAt,
+                              Date().timeIntervalSince(at) >= 30 {
+                        await MainActor.run {
+                            _ = self?.controllers.removeValue(forKey: key)
+                        }
+                        return
+                    }
+                case .failed:
+                    // Keep indefinitely; the user dismisses manually
+                    // via the "Dismiss" action. Return so the poll
+                    // loop doesn't spin.
+                    return
+                default:
+                    completedAt = nil
+                }
+                try? await Task.sleep(nanoseconds: 1_000_000_000)
+            }
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/PersistentAssetLockDisplay.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/PersistentAssetLockDisplay.swift
new file mode 100644
index 00000000000..16092725913
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/PersistentAssetLockDisplay.swift
@@ -0,0 +1,66 @@
+// PersistentAssetLockDisplay.swift
+// SwiftExampleApp
+//
+// Consolidates the asset-lock display properties (status label,
+// short outpoint, fundability predicate) that previously lived as
+// inline switches and duplicated helpers across several views.
+// Keeping them on `PersistentAssetLock` itself means the 0/1/2/3
+// `AssetLockStatus` discriminants — a protocol-mirrored constant
+// from the Rust side — exist in exactly one place in the example
+// app. If/when we push these to a Rust-derived FFI property on the
+// persistent row, this file is the single point to update.
+
+import Foundation
+import SwiftDashSDK
+
+/// Visibility / actionability predicates over the `AssetLockStatus`
+/// discriminants, plus the human-facing label. The predicates are
+/// defined on `AssetLockResumeRow` so they're free at every
+/// conformer (including `FakeAssetLockRow` in tests).
+extension AssetLockResumeRow {
+    /// `true` when the lock has a usable IS-lock or chain-lock
+    /// proof. Only these locks can fund a Platform identity right
+    /// now; the Resumable Registrations row's Resume button gates
+    /// on this. Built (0) and Broadcast (1) have no signed proof
+    /// yet — submitting them would fail at the Platform layer.
+    var canFundIdentity: Bool { statusRaw >= 2 }
+
+    /// `true` when the lock should be surfaced on the Resumable
+    /// Registrations section at all. Lower bar than `canFundIdentity`
+    /// — a Broadcast (1) lock isn't actionable yet but the user
+    /// should see it (as "Waiting for InstantSendLock…") so an
+    /// in-flight crash-recovery situation has visible continuity
+    /// through the IS-lock arrival.
+    var isVisibleAsResumable: Bool { statusRaw >= 1 }
+}
+
+/// Human-readable label for `PersistentAssetLock.statusRaw`. Kept
+/// here (rather than as a `case` block re-implemented in every
+/// view) so the 0/1/2/3 → label mapping has one home. Mirrors the
+/// Rust-side `AssetLockStatus` enum.
+extension PersistentAssetLock {
+    var statusLabel: String {
+        switch statusRaw {
+        case 0: return "Built"
+        case 1: return "Broadcast"
+        case 2: return "InstantSendLocked"
+        case 3: return "ChainLocked"
+        case 4: return "Consumed"
+        default: return "Unknown(\(statusRaw))"
+        }
+    }
+
+    /// First 8 hex chars of the txid plus the vout, derived from
+    /// the canonical `<txid>:<vout>` outpoint encoding. Used by
+    /// every UI that lists asset-lock rows so the txid prefix
+    /// reads the same way across surfaces.
+    var shortOutPointDisplay: String {
+        let parts = outPointHex.split(
+            separator: ":",
+            maxSplits: 1,
+            omittingEmptySubsequences: false
+        )
+        guard parts.count == 2 else { return outPointHex }
+        return "\(parts[0].prefix(8)):\(parts[1])"
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/CreateIdentityView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/CreateIdentityView.swift
index fdb1b95595f..3fd5597687b 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/CreateIdentityView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/CreateIdentityView.swift
@@ -19,6 +19,23 @@ import SwiftUI
 import SwiftDashSDK
 import SwiftData
 
+/// Minimum surface of a tracked asset-lock row needed by the
+/// cross-wallet anti-join behind the Identities-tab "Resumable
+/// Registrations" section. Exists so the pure filter
+/// `IdentitiesContentView.crossWalletResumableLocks(in:usedSlots:)`
+/// can be unit-tested with lightweight structs instead of forcing
+/// tests to spin up a SwiftData `ModelContainer` just to construct
+/// `PersistentAssetLock` `@Model` instances. `PersistentAssetLock`
+/// conforms automatically because it already exposes all three
+/// properties on its public surface.
+protocol AssetLockResumeRow {
+    var walletId: Data { get }
+    var statusRaw: Int { get }
+    var identityIndexRaw: Int32 { get }
+}
+
+extension PersistentAssetLock: AssetLockResumeRow {}
+
 struct CreateIdentityView: View {
     @Environment(\.dismiss) private var dismiss
     @Environment(\.modelContext) private var modelContext
@@ -36,6 +53,30 @@ struct CreateIdentityView: View {
     /// docstring; kept here so the conversion logic stays local.
     private static let creditsPerDash: UInt64 = 100_000_000_000
 
+    /// Duffs per DASH (1e8) — Core-side scale, used by the Core-funded
+    /// identity path.
+    private static let duffsPerDash: UInt64 = 100_000_000
+
+    /// Protocol minimum asset-lock funding for an identity create.
+    /// Mirrors `IdentityCreateTransition::calculate_min_required_fee_v1`
+    /// in `rs-platform-version`:
+    ///   identity_create_base_cost (2_000_000 credits)
+    ///   + asset_lock_base (200_000 duffs * 1000 credits/duff = 200_000_000)
+    ///   + identity_key_in_creation_cost (6_500_000) * defaultKeyCount (3)
+    ///   = 221_500_000 credits / 1000 = 221_500 duffs (0.002215 DASH).
+    /// The v0 floor was 200_000 duffs but with key_in_creation_cost
+    /// dynamic at v1, the per-key surcharge has to be added. Submitting
+    /// below this gets rejected by Platform with
+    /// `IdentityAssetLockTransactionOutPointNotEnoughBalance`. Keep this
+    /// in sync if `defaultKeyCount` changes.
+    private static let minIdentityFundingDuffs: UInt64 = 221_500
+
+    /// Default funding amount pre-filled into the field for the Core
+    /// path. Sits 12.5% above the protocol minimum to give headroom
+    /// for the resulting identity's initial credit balance after the
+    /// processing fee is deducted.
+    private static let defaultCoreFundingDuffs: UInt64 = 250_000
+
     /// All locally-persisted wallets. Drives the Source Wallet
     /// picker along with the synthetic "no wallet" sentinel.
     @Query(sort: \PersistentWallet.createdAt) private var wallets: [PersistentWallet]
@@ -54,6 +95,16 @@ struct CreateIdentityView: View {
     /// Core-address `isUsed` flag).
     @Query private var allIdentities: [PersistentIdentity]
 
+    /// All tracked asset locks across wallets. Used here only to
+    /// resolve `selectedAssetLockId` (the resume-flow init seed
+    /// from Path B) back to a concrete row so the submit gate can
+    /// hand its outpoint to the FFI. The cross-wallet anti-join
+    /// that drives the Identities-tab Resumable Registrations
+    /// section lives in `IdentitiesContentView` and runs against
+    /// its own `@Query`.
+    @Query(sort: [SortDescriptor(\PersistentAssetLock.updatedAt, order: .reverse)])
+    private var allAssetLocks: [PersistentAssetLock]
+
     // MARK: - Selection state
 
     /// The source wallet selection. `nil` encodes "pick nothing yet";
@@ -74,6 +125,12 @@ struct CreateIdentityView: View {
     /// logic (future) will detect + decode.
     @State private var walletlessProof: String = ""
 
+    /// Persistent-id of the asset-lock row the user picked under
+    /// `.unusedAssetLock`. Nil until they tap one. Identifying via
+    /// `PersistentIdentifier` (not `outPointHex`) keeps the picker
+    /// resilient if the underlying row updates its status mid-pick.
+    @State private var selectedAssetLockId: PersistentIdentifier? = nil
+
     /// Amount (in DASH) to fund the new identity with. Populated
     /// automatically from the selected account's balance; the user
     /// can lower it but not exceed the available balance.
@@ -93,16 +150,79 @@ struct CreateIdentityView: View {
     /// the submit section swaps to a success banner and auto-dismiss.
     @State private var createdIdentityId: Data? = nil
 
+    /// Active registration controller for the Core-funded path.
+    /// Stored only so `submitCoreFunded` has a local reference
+    /// after spawning it; the canonical lifetime owner is
+    /// `walletManager.registrationCoordinator`, which keeps the
+    /// controller available to the "Pending Registrations" row
+    /// on the Identities tab after this sheet dismisses.
+    @State private var activeController: IdentityRegistrationController? = nil
+
+    /// Optional pre-pick wired up by the Identities-tab "Resumable
+    /// Registrations" section. When non-nil, the four selection
+    /// `@State`s below are seeded in `init` so the form opens
+    /// already-configured for the resume path — same final state
+    /// the user would land on by hand-picking the wallet, choosing
+    /// "Fund from unused Asset Lock", and tapping the lock in the
+    /// picker. Seeding in `init` (via `_state = State(initialValue:
+    /// …)`) — rather than mutating in `.onAppear` / `.task` —
+    /// matters because the form's `.onChange(of: walletSelection)`
+    /// handler resets `fundingSelection` and `identityIndex` on any
+    /// runtime mutation; treating the preselect as the *initial*
+    /// state instead never trips that reset cascade.
+    /// Default `nil` keeps the original "Identities tab → + →
+    /// Create Identity" entry point unchanged.
+    let preselectedAssetLock: PersistentAssetLock?
+
+    init(preselectedAssetLock: PersistentAssetLock? = nil) {
+        self.preselectedAssetLock = preselectedAssetLock
+        if let lock = preselectedAssetLock {
+            // Explicit `Optional(…)` wraps so the `@State` initial
+            // values match the underlying Optional types — Swift
+            // can't infer a `T?` from a bare `.wallet(...)` literal
+            // here because the inferred type lands on `T`.
+            _walletSelection = State(
+                initialValue: Optional(WalletSelection.wallet(id: lock.walletId))
+            )
+            _fundingSelection = State(
+                initialValue: Optional(FundingSelection.unusedAssetLock)
+            )
+            _selectedAssetLockId = State(
+                initialValue: Optional(lock.persistentModelID)
+            )
+            _identityIndex = State(
+                initialValue: Optional(UInt32(bitPattern: lock.identityIndexRaw))
+            )
+        }
+    }
+
     var body: some View {
         NavigationStack {
             Form {
-                // Once registration succeeds, collapse the form down to
-                // just the success banner — the input sections (funding
-                // source, amount, registration-index stepper with its
-                // now-irrelevant collision warning) are noise at that
-                // point.
-                if createdIdentityId != nil {
-                    successSection
+                if let controller = activeController {
+                    // While registration is in flight (or has just
+                    // reached a terminal phase), swap the entire
+                    // form for the 5-step progress section + the
+                    // terminal banner (success "Done" / failure
+                    // error). The form's input sections would be
+                    // noise at this point — the user has already
+                    // committed; the controller lives on
+                    // `walletManager.registrationCoordinator` and
+                    // continues to run if this sheet is dismissed.
+                    RegistrationProgressSection(controller: controller)
+                    terminalSection(for: controller)
+                } else if let lock = preselectedAssetLock {
+                    // Path B (Resumable Registrations → Resume):
+                    // wallet + lock + slot are all pinned by the
+                    // tapped row, so the form collapses to a
+                    // read-only summary and a single submit button.
+                    // The picker UI is intentionally absent — the
+                    // user already chose the lock on the Identities
+                    // tab; re-prompting would be noise.
+                    resumeSummarySection(for: lock)
+                    if canSubmit {
+                        submitSection
+                    }
                 } else {
                     sourceWalletSection
                     fundingSection
@@ -131,6 +251,62 @@ struct CreateIdentityView: View {
         }
     }
 
+    /// Inline terminal banner that appears under the progress
+    /// section once the controller has reached `.completed` or
+    /// `.failed`. On success, shows the new identity id + a
+    /// "Done" button that dismisses the sheet (the new identity
+    /// appears in the Identities tab's `@Query` automatically).
+    /// On failure, shows the error message inline.
+    @ViewBuilder
+    private func terminalSection(for controller: IdentityRegistrationController) -> some View {
+        switch controller.phase {
+        case .completed(let identityId):
+            Section {
+                VStack(alignment: .leading, spacing: 8) {
+                    Label("Identity created", systemImage: "checkmark.seal.fill")
+                        .foregroundColor(.green)
+                        .font(.headline)
+                    Text(identityId.toBase58String())
+                        .font(.system(.caption, design: .monospaced))
+                        .foregroundColor(.secondary)
+                        .textSelection(.enabled)
+                    Button {
+                        // User acknowledged success — drop the
+                        // controller from the coordinator's map so
+                        // the "Pending Registrations" row on the
+                        // Identities tab clears immediately
+                        // (otherwise it lingers ~30 s until the
+                        // post-completion retention sweep runs).
+                        walletManager.registrationCoordinator.dismiss(
+                            walletId: controller.walletId,
+                            identityIndex: controller.identityIndex
+                        )
+                        dismiss()
+                    } label: {
+                        Text("Done")
+                            .frame(maxWidth: .infinity)
+                    }
+                    .buttonStyle(.borderedProminent)
+                    .padding(.top, 4)
+                }
+            }
+        case .failed(let message):
+            Section {
+                VStack(alignment: .leading, spacing: 8) {
+                    Label("Registration failed", systemImage: "xmark.octagon.fill")
+                        .foregroundColor(.red)
+                        .font(.headline)
+                    Text(message)
+                        .font(.callout)
+                        .foregroundColor(.primary)
+                        .textSelection(.enabled)
+                }
+            }
+        default:
+            EmptyView()
+        }
+    }
+
     // MARK: - Sections
 
     private var sourceWalletSection: some View {
@@ -185,6 +361,75 @@ struct CreateIdentityView: View {
         }
     }
 
+    /// Read-only summary shown in place of the source-wallet /
+    /// funding-source / amount / identity-index sections when the
+    /// caller pre-pinned an asset lock via `init(preselectedAssetLock:)`
+    /// (Path B — Identities tab → "Resumable Registrations" → Resume).
+    /// The choices are already made; this view confirms them so the
+    /// user can sanity-check before tapping Create Identity.
+    @ViewBuilder
+    private func resumeSummarySection(for lock: PersistentAssetLock) -> some View {
+        let walletLabel = wallets
+            .first(where: { $0.walletId == lock.walletId })?
+            .label ?? "Wallet"
+        Section {
+            summaryRow("Wallet", value: walletLabel)
+            summaryRow(
+                "Asset Lock",
+                value: lock.shortOutPointDisplay,
+                monospaced: true
+            )
+            summaryRow(
+                "Amount",
+                value: Self.formatDash(
+                    raw: UInt64(bitPattern: Int64(lock.amountDuffs)),
+                    divisor: Double(Self.duffsPerDash)
+                )
+            )
+            summaryRow(
+                "Status",
+                value: lock.statusLabel
+            )
+            summaryRow(
+                "Identity Slot",
+                value: "#\(UInt32(bitPattern: lock.identityIndexRaw))"
+            )
+        } header: {
+            Text("Resuming Registration")
+        } footer: {
+            Text(
+                "Tap Create Identity to complete this in-flight "
+                + "registration. The wallet, slot, and asset lock are "
+                + "fixed by the original registration."
+            )
+        }
+    }
+
+    /// One key/value row used by `resumeSummarySection`. Plain
+    /// `HStack` rather than `LabeledContent` because the value should
+    /// flow with the row's content style (so the txid prefix can be
+    /// monospaced) and `LabeledContent` resists styling overrides
+    /// on its value slot.
+    @ViewBuilder
+    private func summaryRow(
+        _ label: String,
+        value: String,
+        monospaced: Bool = false
+    ) -> some View {
+        HStack {
+            Text(label)
+            Spacer()
+            let valueText = Text(value)
+                .foregroundColor(.secondary)
+            if monospaced {
+                valueText.font(.system(.body, design: .monospaced))
+            } else {
+                valueText
+            }
+        }
+    }
+
+
     @ViewBuilder
     private func walletAccountSection(for walletId: Data) -> some View {
         let options = accountOptions(for: walletId)
@@ -196,9 +441,6 @@ struct CreateIdentityView: View {
                     Text("\(option.label) — \(option.balanceText)")
                         .tag(Optional(FundingSelection.account(id: option.persistentId)))
                 }
-                Divider()
-                Text("Fund from unused Asset Lock")
-                    .tag(Optional(FundingSelection.unusedAssetLock))
             }
             .onChange(of: fundingSelection) { _, newValue in
                 // Pre-fill the amount with the full available balance
@@ -212,15 +454,14 @@ struct CreateIdentityView: View {
             Text(
                 "Any account on the selected wallet with a balance can fund "
                 + "the identity — Core or Platform Payment. Empty accounts "
-                + "are hidden. \"Fund from unused Asset Lock\" picks an "
-                + "existing tracked asset lock instead."
+                + "are hidden. To resume a prior in-flight registration, "
+                + "use the Resumable Registrations section on the Identities tab."
             )
         }
     }
 
-    /// Amount (in DASH) to fund the new identity with. Only shown
-    /// once the user has picked a funding source the current flow
-    /// can actually spend from (Platform Payment account).
+    /// Amount (in DASH) to fund the new identity with. Shown for
+    /// Platform Payment and Core / CoinJoin funding sources.
     @ViewBuilder
     private var amountSection: some View {
         if let account = selectedPlatformAccount {
@@ -242,6 +483,29 @@ struct CreateIdentityView: View {
                 )
                 Text("Available: \(available). The new identity will start with this amount funded from the selected addresses.")
             }
+        } else if let account = selectedCoreAccount {
+            Section {
+                HStack {
+                    TextField("Amount", text: $amountDash)
+                        .keyboardType(.decimalPad)
+                        .textFieldStyle(.roundedBorder)
+                        .disabled(isCreating)
+                    Text("DASH")
+                        .foregroundColor(.secondary)
+                }
+            } header: {
+                Text("Amount")
+            } footer: {
+                let available = Self.formatDash(
+                    raw: coreAccountBalanceDuffs(account),
+                    divisor: Double(Self.duffsPerDash)
+                )
+                let minimum = Self.formatDash(
+                    raw: Self.minIdentityFundingDuffs,
+                    divisor: Double(Self.duffsPerDash)
+                )
+                Text("Available: \(available). Minimum: \(minimum). Rust builds an asset-lock transaction from your Core UTXOs and the locked funds become the new identity's initial credit balance.")
+            }
         }
     }
 
@@ -265,44 +529,77 @@ struct CreateIdentityView: View {
         // creations don't burn an identity-registration slot off our
         // HD tree.
         if case .wallet(let walletId) = walletSelection {
-            let used = usedIdentityIndices(for: walletId)
-            let collision = identityIndex.map { used.contains($0) } ?? false
-            Section {
-                Stepper(value: Binding(
-                    get: { identityIndex ?? 0 },
-                    set: { identityIndex = $0 }
-                ), in: 0...UInt32.max) {
+            // Resume path: the lock fixes the slot. Render a read-
+            // only summary so the user can confirm which slot the
+            // tracked lock is anchored to, but the stepper is
+            // disabled.
+            if fundingSelection == .unusedAssetLock {
+                Section {
                     HStack {
                         Text("Identity Registration Index")
                         Spacer()
-                        Text("#\(identityIndex ?? 0)")
-                            .foregroundColor(collision ? .red : .secondary)
-                            .monospacedDigit()
+                        if let identityIndex = identityIndex {
+                            Text("#\(identityIndex)")
+                                .foregroundColor(.secondary)
+                                .monospacedDigit()
+                        } else {
+                            Text("—")
+                                .foregroundColor(.secondary)
+                        }
                     }
+                } header: {
+                    Text("Identity Registration Index")
+                } footer: {
+                    Text(
+                        "Resuming uses the asset lock's original slot — "
+                        + "the index can't be overridden on this path."
+                    )
                 }
-                if collision {
+            } else {
+                let used = usedIdentityIndices(for: walletId)
+                let collision = identityIndex.map { used.contains($0) } ?? false
+                Section {
+                    Stepper(value: Binding(
+                        get: { identityIndex ?? 0 },
+                        set: { identityIndex = $0 }
+                    ), in: 0...UInt32.max) {
+                        HStack {
+                            Text("Identity Registration Index")
+                            Spacer()
+                            Text("#\(identityIndex ?? 0)")
+                                .foregroundColor(collision ? .red : .secondary)
+                                .monospacedDigit()
+                        }
+                    }
+                    if collision {
+                        Text(
+                            "Index #\(identityIndex ?? 0) is already taken on "
+                            + "this wallet. Pick a different index."
+                        )
+                        .font(.caption)
+                        .foregroundColor(.red)
+                    }
+                } header: {
+                    Text("Identity Registration Index")
+                } footer: {
                     Text(
-                        "Index #\(identityIndex ?? 0) is already taken on "
-                        + "this wallet. Pick a different index."
+                        "The DIP-9 identity-registration slot the new identity "
+                        + "will consume "
+                        + "(`m/9'/coin'/5'/0'/0'/N'/0'`). Defaults to one past "
+                        + "the highest index already used on this wallet; "
+                        + "override to pick any other unused index."
                     )
-                    .font(.caption)
-                    .foregroundColor(.red)
                 }
-            } header: {
-                Text("Identity Registration Index")
-            } footer: {
-                Text(
-                    "The DIP-9 identity-registration slot the new identity "
-                    + "will consume "
-                    + "(`m/9'/coin'/5'/0'/0'/N'/0'`). Defaults to one past "
-                    + "the highest index already used on this wallet; "
-                    + "override to pick any other unused index."
-                )
             }
         }
     }
 
     private var submitSection: some View {
+        // The active progress / success / error UI lives on the
+        // pushed `RegistrationProgressView` destination, NOT
+        // inline. Once `submit()` spawns a controller and flips
+        // `showProgressDestination` to true, the user is navigated
+        // there and this form steps off-screen.
         Section {
             Button {
                 submit()
@@ -324,32 +621,12 @@ struct CreateIdentityView: View {
         }
     }
 
-    /// Success banner + "Done" button shown after the identity is
-    /// registered and persisted. Replaces the submit section so
-    /// the user can't accidentally double-submit.
-    private var successSection: some View {
-        Section {
-            VStack(alignment: .leading, spacing: 8) {
-                Label("Identity created", systemImage: "checkmark.seal.fill")
-                    .foregroundColor(.green)
-                    .font(.headline)
-                if let id = createdIdentityId {
-                    Text(id.toBase58String())
-                        .font(.system(.caption, design: .monospaced))
-                        .foregroundColor(.secondary)
-                        .textSelection(.enabled)
-                }
-                Button {
-                    dismiss()
-                } label: {
-                    Text("Done")
-                        .frame(maxWidth: .infinity)
-                }
-                .buttonStyle(.borderedProminent)
-                .padding(.top, 4)
-            }
-        }
-    }
+    // `successSection` was removed when the dedicated
+    // `RegistrationProgressView` destination took ownership of the
+    // success / failure terminal UI (including the "View Identity"
+    // navigation). The form here is input-only; submission pushes
+    // to the progress destination, which renders the post-
+    // registration state.
 
     // MARK: - Derived state
 
@@ -367,6 +644,26 @@ struct CreateIdentityView: View {
                 .isEmpty
         case (.wallet(let walletId), .some):
             guard let identityIndex = identityIndex else { return false }
+            // The resume path is bound to the lock's original
+            // identity-index slot. Path B's init seeds
+            // `identityIndex` to the lock's `identityIndexRaw`,
+            // so the collision check below would always trip
+            // (the lock's slot has been "taken" by the lock
+            // itself). Resume specifically needs the slot to NOT
+            // have a `PersistentIdentity` — the cross-wallet
+            // anti-join in `IdentitiesContentView` already filtered
+            // for that on the row the user tapped Resume on, so
+            // we trust the seed.
+            if fundingSelection == .unusedAssetLock {
+                // Resolve the id to a live row before enabling
+                // submit — the row could have been deleted between
+                // Path B's init-seed and now (e.g. another flow
+                // consumed the same outpoint, or SwiftData pruning
+                // collapsed it). Submitting with a stale id would
+                // fall into the dispatch's "not yet supported"
+                // branch and show a confusing error.
+                return selectedAssetLock != nil
+            }
             // Block submit on collision with an existing identity's
             // registration index. The picker shows a red collision
             // hint, but the button stays disabled regardless so the
@@ -378,8 +675,11 @@ struct CreateIdentityView: View {
                 guard let credits = parsedAmountCredits else { return false }
                 return credits > 0 && credits <= accountBalance(account)
             }
-            // Non-Platform-payment wallet-backed paths are still
-            // stubbed — don't light the button until they're wired.
+            if let account = selectedCoreAccount {
+                guard let duffs = parsedAmountDuffs else { return false }
+                let available = coreAccountBalanceDuffs(account)
+                return duffs >= Self.minIdentityFundingDuffs && duffs <= available
+            }
             return false
         default:
             return false
@@ -388,15 +688,15 @@ struct CreateIdentityView: View {
 
     // MARK: - Submit
 
-    /// Runs the Platform-payment-funded identity registration path.
-    /// Other funding branches are intentionally stubbed — the button
-    /// stays disabled for them via `canSubmit`.
+    /// Dispatches identity registration to the correct funding path.
+    /// Platform-Payment funding uses `registerIdentityFromAddresses`;
+    /// Core / CoinJoin funding uses `registerIdentityWithFunding`
+    /// (asset-lock proof built Rust-side from wallet UTXOs). Other
+    /// funding branches (unused asset-lock, walletless) stay disabled
+    /// via `canSubmit` until later iterations.
     private func submit() {
         guard
-            let account = selectedPlatformAccount,
             let identityIndex = identityIndex,
-            let targetCredits = parsedAmountCredits,
-            targetCredits > 0,
             case .wallet(let walletId) = walletSelection
         else {
             submitError = .init(message: "Selection is incomplete.")
@@ -451,6 +751,111 @@ struct CreateIdentityView: View {
             return
         }
 
+        let network: Network = platformState.currentNetwork
+
+        // Dispatch by funding source.
+        if let account = selectedPlatformAccount {
+            submitPlatformPayment(
+                account: account,
+                walletId: walletId,
+                identityIndex: identityIndex,
+                identityPubkeys: identityPubkeys,
+                signer: signer,
+                managedWallet: managedWallet,
+                network: network
+            )
+        } else if selectedCoreAccount != nil {
+            submitCoreFunded(
+                walletId: walletId,
+                identityIndex: identityIndex,
+                identityPubkeys: identityPubkeys,
+                signer: signer,
+                managedWallet: managedWallet,
+                network: network
+            )
+        } else if fundingSelection == .unusedAssetLock,
+                  let lock = selectedAssetLock {
+            submitResumed(
+                lock: lock,
+                walletId: walletId,
+                identityIndex: identityIndex,
+                identityPubkeys: identityPubkeys,
+                signer: signer,
+                managedWallet: managedWallet,
+                network: network
+            )
+        } else {
+            submitError = .init(message: "Selected funding source is not yet supported.")
+        }
+    }
+
+    /// Resume registration against an existing tracked asset lock.
+    /// Same shape as `submitCoreFunded` — the only differences are
+    /// (a) the body closure invokes
+    /// `resumeIdentityWithAssetLock(...)` instead of
+    /// `registerIdentityWithFunding(amountDuffs:...)`, and (b) the
+    /// outpoint is decoded from the lock row's display-order
+    /// `outPointHex` to the raw 32-byte txid + u32 vout the FFI
+    /// wants.
+    private func submitResumed(
+        lock: PersistentAssetLock,
+        walletId: Data,
+        identityIndex: UInt32,
+        identityPubkeys: [ManagedPlatformWallet.IdentityPubkey],
+        signer: KeychainSigner,
+        managedWallet: ManagedPlatformWallet,
+        network: Network
+    ) {
+        guard let parts = Self.parseOutPointHex(lock.outPointHex) else {
+            submitError = .init(
+                message: "Tracked asset lock has a malformed outpoint and can't be resumed: \(lock.outPointHex)"
+            )
+            return
+        }
+        let (txidRaw, vout) = parts
+
+        isCreating = true
+
+        let coordinator = walletManager.registrationCoordinator
+        let controller = coordinator.startRegistration(
+            walletId: walletId,
+            identityIndex: identityIndex,
+            body: {
+                let (identityId, _) = try await managedWallet.resumeIdentityWithAssetLock(
+                    outPointTxid: txidRaw,
+                    outPointVout: vout,
+                    identityIndex: identityIndex,
+                    identityPubkeys: identityPubkeys,
+                    signer: signer
+                )
+                return identityId
+            }
+        )
+
+        self.activeController = controller
+        observeController(
+            controller,
+            walletId: walletId,
+            identityIndex: identityIndex,
+            network: network
+        )
+    }
+
+    /// Platform-Payment funded registration. Spends credits from
+    /// `PersistentPlatformAddress` rows on the selected account.
+    private func submitPlatformPayment(
+        account: PersistentAccount,
+        walletId: Data,
+        identityIndex: UInt32,
+        identityPubkeys: [ManagedPlatformWallet.IdentityPubkey],
+        signer: KeychainSigner,
+        managedWallet: ManagedPlatformWallet,
+        network: Network
+    ) {
+        guard let targetCredits = parsedAmountCredits, targetCredits > 0 else {
+            submitError = .init(message: "Enter a positive amount.")
+            return
+        }
         // Greedy-select addresses to cover `targetCredits`. The
         // last address's credits field is capped to the remaining
         // amount so the total spent matches exactly.
@@ -465,8 +870,6 @@ struct CreateIdentityView: View {
 
         isCreating = true
 
-        let network: Network = platformState.currentNetwork
-
         Task {
             do {
                 let created = try await managedWallet.registerIdentityFromAddresses(
@@ -480,7 +883,7 @@ struct CreateIdentityView: View {
 
                 try await MainActor.run {
                     try persistCreatedIdentity(
-                        created,
+                        identityId: created.identityId,
                         network: network
                     )
                     markIdentitySlotUsed(
@@ -502,6 +905,169 @@ struct CreateIdentityView: View {
         }
     }
 
+    /// Core / CoinJoin funded registration. Rust builds an asset-lock
+    /// transaction from BIP44 account #0's UTXOs (mempool `account_index = 0`
+    /// in `create_funded_asset_lock_proof`), broadcasts it, waits for
+    /// the instant-send lock, and submits the IdentityCreate state
+    /// transition.
+    ///
+    /// Iter 3 swap (the previous iter-1 path was a single in-flight
+    /// spinner inside this view): the FFI call moves to a
+    /// `RegistrationCoordinator`-hosted `IdentityRegistrationController`
+    /// hung off the `PlatformWalletManager`. The view binds the
+    /// "Registering…" indicator to the controller's `phase` so
+    /// dismissing the sheet doesn't abort the registration —
+    /// `RegistrationProgressView` can be opened from the home /
+    /// identities tab to follow the same controller through.
+    private func submitCoreFunded(
+        walletId: Data,
+        identityIndex: UInt32,
+        identityPubkeys: [ManagedPlatformWallet.IdentityPubkey],
+        signer: KeychainSigner,
+        managedWallet: ManagedPlatformWallet,
+        network: Network
+    ) {
+        guard let amountDuffs = parsedAmountDuffs, amountDuffs > 0 else {
+            submitError = .init(message: "Enter a positive amount.")
+            return
+        }
+
+        isCreating = true
+
+        // Reuse an existing controller for this slot if one is in
+        // flight (the coordinator's single-flight gate makes the
+        // re-submit a no-op at the controller layer), otherwise
+        // spawn a fresh one. The persistence side-effects
+        // (`persistCreatedIdentity`, `markIdentitySlotUsed`) live
+        // here in the view so we still have access to
+        // `modelContext` / `platformState`; the controller's body
+        // is responsible only for the FFI call + the success
+        // identifier.
+        let coordinator = walletManager.registrationCoordinator
+        let controller = coordinator.startRegistration(
+            walletId: walletId,
+            identityIndex: identityIndex,
+            body: {
+                let (identityId, _) = try await managedWallet.registerIdentityWithFunding(
+                    amountDuffs: amountDuffs,
+                    identityIndex: identityIndex,
+                    identityPubkeys: identityPubkeys,
+                    signer: signer
+                )
+                return identityId
+            }
+        )
+
+        // Stash the controller; setting it flips the body to the
+        // inline progress + terminal section in place of the
+        // form. The controller's canonical lifetime owner is
+        // `walletManager.registrationCoordinator` — if the user
+        // dismisses the sheet mid-flight, the same controller is
+        // reachable via the "Pending Registrations" row on the
+        // Identities tab.
+        self.activeController = controller
+
+        // Observe phase transitions to mirror onto this view's
+        // local success / error state. The controller stays in the
+        // coordinator independently of this view's lifetime, so
+        // the same flow remains reachable from
+        // `RegistrationProgressView` after dismissal.
+        observeController(
+            controller,
+            walletId: walletId,
+            identityIndex: identityIndex,
+            network: network
+        )
+    }
+
+    /// Bridge a controller's phase transitions to this view's
+    /// `createdIdentityId` / `submitError` / `isCreating` state.
+    /// The observer task auto-cancels when this view deallocates
+    /// (Swift task lifecycle on the captured `self`), but the
+    /// controller itself outlives the view.
+    private func observeController(
+        _ controller: IdentityRegistrationController,
+        walletId: Data,
+        identityIndex: UInt32,
+        network: Network
+    ) {
+        Task {
+            for await phase in phaseStream(controller: controller) {
+                switch phase {
+                case .completed(let identityId):
+                    do {
+                        try persistCreatedIdentity(
+                            identityId: identityId,
+                            network: network
+                        )
+                        markIdentitySlotUsed(
+                            walletId: walletId,
+                            identityIndex: identityIndex
+                        )
+                        try modelContext.save()
+                        self.createdIdentityId = identityId
+                    } catch {
+                        self.submitError = .init(
+                            message: error.localizedDescription
+                        )
+                    }
+                    self.isCreating = false
+                    // Do NOT clear `activeController` here — the
+                    // pushed `RegistrationProgressView` destination
+                    // is bound to `if let controller = activeController`,
+                    // so nilling it tears the destination down and
+                    // SwiftUI pops back to the form before the user
+                    // sees the success state. The controller lives
+                    // on `walletManager.registrationCoordinator`
+                    // anyway and is purged by the coordinator's
+                    // ~30 s post-completion retention.
+                    return
+                case .failed(let message):
+                    self.submitError = .init(message: message)
+                    self.isCreating = false
+                    // Same rationale as `.completed`: keep the
+                    // controller so the destination can render
+                    // the inline failure state.
+                    return
+                default:
+                    continue
+                }
+            }
+        }
+    }
+
+    /// Poll the controller's `phase` until it reaches a terminal
+    /// state (`.completed` / `.failed`) and yield each transition.
+    /// Combine's `$phase.values` would be more idiomatic, but
+    /// `AnyCancellable` isn't `Sendable` and the @Sendable closure
+    /// of `AsyncStream`'s builder rejects it. A small polling loop
+    /// avoids the bridge entirely.
+    private func phaseStream(
+        controller: IdentityRegistrationController
+    ) -> AsyncStream<IdentityRegistrationController.Phase> {
+        AsyncStream { continuation in
+            Task { @MainActor in
+                var lastEmitted: IdentityRegistrationController.Phase? = nil
+                while !Task.isCancelled {
+                    let phase = controller.phase
+                    if phase != lastEmitted {
+                        continuation.yield(phase)
+                        lastEmitted = phase
+                    }
+                    switch phase {
+                    case .completed, .failed:
+                        continuation.finish()
+                        return
+                    default:
+                        break
+                    }
+                    try? await Task.sleep(nanoseconds: 100_000_000)
+                }
+                continuation.finish()
+            }
+        }
+    }
+
     /// Convert the selected Platform Payment account's
     /// `PersistentPlatformAddress` rows into the flat FFI input list,
     /// stopping once we have enough credits to cover `targetCredits`.
@@ -570,20 +1136,19 @@ struct CreateIdentityView: View {
     /// variants that flow through the callback as namespaced
     /// `"derived:<path>"` identifiers — no Keychain write needed.
     private func persistCreatedIdentity(
-        _ created: ManagedPlatformWallet.CreatedIdentity,
+        identityId: Data,
         network: Network
     ) throws {
-        let identityId = created.identityId
         let descriptor = FetchDescriptor<PersistentIdentity>(
             predicate: #Predicate { $0.identityId == identityId }
         )
         guard let row = try modelContext.fetch(descriptor).first else {
             // Row hasn't landed yet — shouldn't happen in
-            // production (Rust emits the changeset before
-            // `registerIdentityFromAddresses` returns), but if the
-            // persister callback isn't wired the UI-side fields
-            // stay unset until a subsequent refresh. Log + fall
-            // through so the registration doesn't fail.
+            // production (Rust emits the changeset before the
+            // registration FFI returns), but if the persister
+            // callback isn't wired the UI-side fields stay unset
+            // until a subsequent refresh. Log + fall through so the
+            // registration doesn't fail.
             print("⚠️ persistCreatedIdentity: no PersistentIdentity row for \(identityId.toHexString()) — persister callback likely not wired")
             return
         }
@@ -626,28 +1191,85 @@ struct CreateIdentityView: View {
         return account
     }
 
+    /// The tracked asset lock the user picked in the resume flow.
+    /// Looked up via `persistentModelID` so it stays valid even if
+    /// the row's mutable fields (status, updatedAt) tick after
+    /// selection.
+    private var selectedAssetLock: PersistentAssetLock? {
+        guard let id = selectedAssetLockId else { return nil }
+        return allAssetLocks.first { $0.persistentModelID == id }
+    }
+
+    /// The currently-selected Core / CoinJoin account, if any. Used
+    /// for the Core-funded identity-creation path (Standard BIP44/BIP32
+    /// or CoinJoin). The Rust function `create_funded_asset_lock_proof`
+    /// reads UTXOs from BIP44 account #0 by convention; for a fresh
+    /// wallet this matches what the user has.
+    private var selectedCoreAccount: PersistentAccount? {
+        guard
+            case .account(let persistentId) = fundingSelection,
+            let account = allAccounts.first(where: {
+                $0.persistentModelID == persistentId
+            }),
+            account.accountType == 0 || account.accountType == 1
+        else {
+            return nil
+        }
+        return account
+    }
+
     /// Raw credit balance across all addresses in a PlatformPayment
     /// account.
     private func accountBalance(_ account: PersistentAccount) -> UInt64 {
         account.platformAddresses.reduce(0) { $0 + $1.balance }
     }
 
-    /// Default amount string (DASH) for the amount field — the full
-    /// balance of the selected Platform Payment account.
+    /// Spendable balance (duffs) for a Core / CoinJoin account.
+    /// Reads live FFI-backed balance from the platform-wallet manager
+    /// (the SwiftData per-account `balanceConfirmed` scalar isn't
+    /// maintained by the persister — `AccountDetailView.balanceCard`
+    /// uses the same live source). Returns 0 if no match.
+    private func coreAccountBalanceDuffs(_ account: PersistentAccount) -> UInt64 {
+        let balances = walletManager.accountBalances(for: account.wallet.walletId)
+        guard let match = balances.first(where: { b in
+            UInt32(b.typeTag) == account.accountType
+                && b.standardTag == account.standardTag
+                && b.index == account.accountIndex
+        }) else {
+            return 0
+        }
+        return match.confirmed + match.unconfirmed
+    }
+
+    /// Default amount string (DASH) for the amount field.
+    /// Platform Payment → full account balance (one-tap happy path).
+    /// Core / CoinJoin → 0.001 DASH (the asset-lock minimum-with-
+    /// headroom default); user dials up if they want a larger
+    /// initial credit balance.
     private func defaultAmountString(for funding: FundingSelection?) -> String {
         guard
             case .account(let persistentId) = funding,
             let account = allAccounts.first(where: {
                 $0.persistentModelID == persistentId
-            }),
-            account.accountType == 14
+            })
         else {
             return ""
         }
-        let balance = accountBalance(account)
-        if balance == 0 { return "" }
-        let dash = Double(balance) / Double(Self.creditsPerDash)
-        return String(format: "%g", dash)
+        switch account.accountType {
+        case 14:
+            let balance = accountBalance(account)
+            if balance == 0 { return "" }
+            let dash = Double(balance) / Double(Self.creditsPerDash)
+            return String(format: "%g", dash)
+        case 0, 1:
+            let available = coreAccountBalanceDuffs(account)
+            let defaultDuffs = min(available, Self.defaultCoreFundingDuffs)
+            if defaultDuffs == 0 { return "" }
+            let dash = Double(defaultDuffs) / Double(Self.duffsPerDash)
+            return String(format: "%g", dash)
+        default:
+            return ""
+        }
     }
 
     /// Parse the amount text back into credits. Returns `nil` on
@@ -663,6 +1285,18 @@ struct CreateIdentityView: View {
         return UInt64(credits)
     }
 
+    /// Parse the amount text into Core duffs (1e8 per DASH). Used for
+    /// the Core-funded identity path.
+    private var parsedAmountDuffs: UInt64? {
+        let trimmed = amountDash.trimmingCharacters(in: .whitespaces)
+        guard let dash = Double(trimmed), dash.isFinite, dash > 0 else {
+            return nil
+        }
+        let duffs = (dash * Double(Self.duffsPerDash)).rounded()
+        guard duffs >= 1, duffs <= Double(UInt64.max) else { return nil }
+        return UInt64(duffs)
+    }
+
     // MARK: - Helpers
 
     private func walletLabel(for wallet: PersistentWallet) -> String {
@@ -687,11 +1321,19 @@ struct CreateIdentityView: View {
     /// child rows. Ordering matches `AccountListView`: BIP44 →
     /// PlatformPayment → BIP32 → CoinJoin.
     private func accountOptions(for walletId: Data) -> [FundingAccountOption] {
-        allAccounts
+        // Live balances from the Rust side. The persister doesn't
+        // maintain `PersistentAccount.balanceConfirmed`, so we read
+        // from the platform-wallet manager (same source as
+        // `AccountDetailView.balanceCard`).
+        let liveBalances = walletManager.accountBalances(for: walletId)
+        return allAccounts
             .filter { account in
                 guard account.wallet.walletId == walletId else { return false }
                 guard CreateIdentityView.isFundingAccount(account) else { return false }
-                return CreateIdentityView.accountBalanceSummary(account).hasBalance
+                return CreateIdentityView.hasBalance(
+                    account: account,
+                    liveBalances: liveBalances
+                )
             }
             .sorted { lhs, rhs in
                 let lhsKey = CreateIdentityView.sortKey(for: lhs)
@@ -699,7 +1341,10 @@ struct CreateIdentityView: View {
                 return lhsKey < rhsKey
             }
             .map { account in
-                let (_, balanceText) = Self.accountBalanceSummary(account)
+                let balanceText = Self.balanceText(
+                    for: account,
+                    liveBalances: liveBalances
+                )
                 return FundingAccountOption(
                     persistentId: account.persistentModelID,
                     label: Self.fundingLabel(for: account),
@@ -708,6 +1353,48 @@ struct CreateIdentityView: View {
             }
     }
 
+    /// Whether an account has any spendable balance for the picker
+    /// filter. Same data sources as `balanceText` (live FFI for Core /
+    /// CoinJoin, SwiftData for PlatformPayment).
+    private static func hasBalance(
+        account: PersistentAccount,
+        liveBalances: [PlatformWalletManager.AccountBalance]
+    ) -> Bool {
+        switch account.accountType {
+        case 14:
+            return account.platformAddresses.contains { $0.balance > 0 }
+        default:
+            let match = liveBalances.first { b in
+                UInt32(b.typeTag) == account.accountType
+                    && b.standardTag == account.standardTag
+                    && b.index == account.accountIndex
+            }
+            return (match?.confirmed ?? 0) + (match?.unconfirmed ?? 0) > 0
+        }
+    }
+
+    /// Picker-row balance text for an account. Core / CoinJoin reads
+    /// from `liveBalances` (FFI snapshot); PlatformPayment sums
+    /// `platformAddresses[].balance` from SwiftData.
+    private static func balanceText(
+        for account: PersistentAccount,
+        liveBalances: [PlatformWalletManager.AccountBalance]
+    ) -> String {
+        switch account.accountType {
+        case 14:
+            let credits = account.platformAddresses.reduce(0) { $0 + $1.balance }
+            return credits > 0 ? formatDash(raw: credits, divisor: 100_000_000_000.0) : "empty"
+        default:
+            let match = liveBalances.first { b in
+                UInt32(b.typeTag) == account.accountType
+                    && b.standardTag == account.standardTag
+                    && b.index == account.accountIndex
+            }
+            let duffs = (match?.confirmed ?? 0) + (match?.unconfirmed ?? 0)
+            return duffs > 0 ? formatDash(raw: duffs, divisor: 100_000_000.0) : "empty"
+        }
+    }
+
     /// Unused identity-registration key indices on the wallet's
     /// Identity Registration account (FFI type tag 2). Each
     /// `PersistentCoreAddress` under that account represents one
@@ -758,28 +1445,41 @@ struct CreateIdentityView: View {
         }
     }
 
-    /// Formatted balance for the picker row and the disabled flag.
-    /// Core / CoinJoin use the SPV-maintained
-    /// `balanceConfirmed + balanceUnconfirmed` duffs (1e8/DASH);
-    /// PlatformPayment sums the BLAST-synced credit balances across
-    /// its addresses (1e11/DASH).
-    private static func accountBalanceSummary(
-        _ account: PersistentAccount
-    ) -> (hasBalance: Bool, balanceText: String) {
-        switch account.accountType {
-        case 14:
-            let credits = account.platformAddresses.reduce(0) { $0 + $1.balance }
-            return (
-                credits > 0,
-                credits > 0 ? formatDash(raw: credits, divisor: 100_000_000_000.0) : "empty"
-            )
-        default:
-            let duffs = account.balanceConfirmed + account.balanceUnconfirmed
-            return (
-                duffs > 0,
-                duffs > 0 ? formatDash(raw: duffs, divisor: 100_000_000.0) : "empty"
-            )
+    /// Decode the display-order `outPointHex` (`<txid hex>:<vout>`)
+    /// stored on `PersistentAssetLock` back into `(rawTxidBytes,
+    /// vout)`. The rawTxidBytes are 32 bytes in wire / little-
+    /// endian order — what the FFI's `OutPointFFI.txid` field
+    /// expects. Reverse of `PersistentAssetLock.encodeOutPoint`.
+    /// Returns `nil` on any parse failure.
+    ///
+    /// Internal (not private) so the unit test target can pin the
+    /// round-trip with `encodeOutPoint`. Wrong endianness on either
+    /// side would silently address a different outpoint and produce
+    /// confusing Platform-side proof-verification failures, so the
+    /// round-trip invariant is worth pinning explicitly.
+    static func parseOutPointHex(_ hex: String) -> (Data, UInt32)? {
+        let parts = hex.split(
+            separator: ":",
+            maxSplits: 1,
+            omittingEmptySubsequences: false
+        )
+        guard parts.count == 2 else { return nil }
+        let txidHex = String(parts[0])
+        guard let vout = UInt32(parts[1]) else { return nil }
+        guard txidHex.count == 64 else { return nil }
+        var txidDisplay = Data(capacity: 32)
+        var idx = txidHex.startIndex
+        for _ in 0..<32 {
+            let end = txidHex.index(idx, offsetBy: 2)
+            guard let byte = UInt8(txidHex[idx..<end], radix: 16) else {
+                return nil
+            }
+            txidDisplay.append(byte)
+            idx = end
         }
+        // Reverse to raw wire-order to match OutPointFFI.txid.
+        let txidRaw = Data(txidDisplay.reversed())
+        return (txidRaw, vout)
     }
 
     /// `"0.01 DASH"` — stripped of trailing zeros, uses up to 8 decimals.
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/OptionsView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/OptionsView.swift
index a4729c489ae..cd13c72926e 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/OptionsView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/OptionsView.swift
@@ -130,8 +130,24 @@ struct OptionsView: View {
                             Text(network.displayName).tag(network)
                         }
                     }
+                    // Disable + footer driven by the in-flight gate;
+                    // wrapped in a sub-view so the
+                    // `RegistrationCoordinator`'s `@Published`
+                    // mutations are observed reactively (a plain
+                    // `walletManager.registrationCoordinator.hasInFlightRegistrations`
+                    // read here wouldn't subscribe — the env object
+                    // is `walletManager`, not the coordinator).
                     .pickerStyle(SegmentedPickerStyle())
-                    .disabled(isSwitchingNetwork)
+                    .modifier(
+                        NetworkPickerInFlightGate(
+                            coordinator: walletManager.registrationCoordinator,
+                            isSwitching: isSwitchingNetwork
+                        )
+                    )
+
+                    NetworkInFlightFooter(
+                        coordinator: walletManager.registrationCoordinator
+                    )
 
                     if appState.currentNetwork == .regtest {
                         Toggle("Use Docker Setup", isOn: $appState.useDockerSetup)
@@ -648,3 +664,39 @@ struct FeatureRow: View {
         }
     }
 }
+
+/// ViewModifier wrapper that observes the
+/// `RegistrationCoordinator` so the picker's `.disabled(_:)` state
+/// updates reactively when registrations start or finish. A direct
+/// read of `coordinator.hasInFlightRegistrations` from the parent
+/// view's `body` would not subscribe to the coordinator's
+/// `@Published` changes — the env object is the wallet manager, not
+/// the coordinator hung off it.
+private struct NetworkPickerInFlightGate: ViewModifier {
+    @ObservedObject var coordinator: RegistrationCoordinator
+    let isSwitching: Bool
+
+    func body(content: Content) -> some View {
+        content.disabled(isSwitching || coordinator.hasInFlightRegistrations)
+    }
+}
+
+/// Inline footer telling the user why the network picker is grayed
+/// out. Visible only while at least one registration is in flight;
+/// observes the coordinator the same way `NetworkPickerInFlightGate`
+/// does so the footer disappears the moment the last registration
+/// terminates.
+private struct NetworkInFlightFooter: View {
+    @ObservedObject var coordinator: RegistrationCoordinator
+
+    var body: some View {
+        if coordinator.hasInFlightRegistrations {
+            Text(
+                "Network switching is disabled while an identity "
+                + "registration is in flight."
+            )
+            .font(.caption2)
+            .foregroundColor(.orange)
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/PendingRegistrationsList.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/PendingRegistrationsList.swift
new file mode 100644
index 00000000000..4cbb55509e9
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/PendingRegistrationsList.swift
@@ -0,0 +1,94 @@
+import SwiftUI
+import SwiftDashSDK
+
+/// Section wrapper that observes a `RegistrationCoordinator` directly
+/// so its `@Published controllers` map mutations trigger SwiftUI
+/// re-renders. Hosted inside `IdentitiesContentView` — separated out
+/// because nesting an `@ObservedObject` inside a `@ViewBuilder`
+/// computed property doesn't subscribe (the property recomputes per
+/// parent body call, never owning a stable reference).
+struct PendingRegistrationsList: View {
+    @ObservedObject var coordinator: RegistrationCoordinator
+
+    var body: some View {
+        let active = coordinator.activeControllers()
+        if !active.isEmpty {
+            Section("Pending Registrations") {
+                ForEach(active, id: \.identityIndex) { controller in
+                    PendingRegistrationRow(controller: controller)
+                }
+            }
+        }
+    }
+}
+
+/// Single row in the "Pending Registrations" list. Each row hangs off
+/// an `IdentityRegistrationController` via `@ObservedObject` so the
+/// status label updates as the controller's phase transitions; tapping
+/// the row navigates into `RegistrationProgressView` so the user can
+/// follow the stage progression in detail.
+struct PendingRegistrationRow: View {
+    @ObservedObject var controller: IdentityRegistrationController
+    @EnvironmentObject var walletManager: PlatformWalletManager
+
+    var body: some View {
+        NavigationLink(destination: RegistrationProgressView(controller: controller)) {
+            VStack(alignment: .leading, spacing: 4) {
+                HStack {
+                    Image(systemName: phaseIcon)
+                        .foregroundColor(phaseTint)
+                    Text("Identity #\(controller.identityIndex)")
+                        .font(.body)
+                    Spacer()
+                    Text(phaseLabel)
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                }
+                Text(controller.walletId.prefix(8).map { String(format: "%02x", $0) }.joined() + "…")
+                    .font(.caption2)
+                    .foregroundColor(.secondary)
+                    .lineLimit(1)
+            }
+            .padding(.vertical, 2)
+        }
+        .swipeActions(edge: .trailing, allowsFullSwipe: false) {
+            if case .failed = controller.phase {
+                Button {
+                    walletManager.registrationCoordinator.dismiss(
+                        walletId: controller.walletId,
+                        identityIndex: controller.identityIndex
+                    )
+                } label: {
+                    Label("Dismiss", systemImage: "xmark")
+                }
+                .tint(.gray)
+            }
+        }
+    }
+
+    private var phaseIcon: String {
+        switch controller.phase {
+        case .idle, .preparingKeys, .inFlight: return "clock.fill"
+        case .completed: return "checkmark.circle.fill"
+        case .failed: return "xmark.octagon.fill"
+        }
+    }
+
+    private var phaseTint: Color {
+        switch controller.phase {
+        case .idle, .preparingKeys, .inFlight: return .blue
+        case .completed: return .green
+        case .failed: return .red
+        }
+    }
+
+    private var phaseLabel: String {
+        switch controller.phase {
+        case .idle: return "Queued"
+        case .preparingKeys: return "Preparing keys"
+        case .inFlight: return "In flight"
+        case .completed: return "Registered"
+        case .failed: return "Failed"
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/RegistrationProgressView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/RegistrationProgressView.swift
new file mode 100644
index 00000000000..7e43dd40b3b
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/RegistrationProgressView.swift
@@ -0,0 +1,428 @@
+import SwiftUI
+import SwiftData
+import SwiftDashSDK
+
+/// Embeddable 5-step progress section. Use inside any parent
+/// `Form` so the progress UI doesn't nest a second `Form`, which
+/// SwiftUI doesn't render cleanly. For the standalone navigation
+/// destination see `RegistrationProgressView` below.
+///
+/// Step mapping:
+///
+///   1. Building asset-lock tx        → activeLock `statusRaw == 0`
+///   2. Broadcasting                  → activeLock `statusRaw == 1` and
+///                                      < `broadcastingWindow` since
+///                                      the row's `updatedAt`
+///   3. Waiting for InstantSend proof → activeLock `statusRaw == 1` and
+///                                      between `broadcastingWindow`
+///                                      and `instantLockTimeout`
+///   4. Waiting for ChainLock proof   → activeLock `statusRaw == 1` and
+///                                      >= `instantLockTimeout` (the
+///                                      Rust side has fallen back to
+///                                      ChainLock); also done when
+///                                      `statusRaw == 3` because that
+///                                      proof type finalised the lock
+///   5. Registering identity          → activeLock `statusRaw == 2 or 3`
+///                                      AND controller still `.inFlight`
+///
+/// `.completed` is the *terminal* state and is not a separate step;
+/// `RegistrationProgressView` renders the "Identity created" banner
+/// + "View Identity" navigation below this section in its own
+/// terminalSection. `.failed` marks the current step with the error
+/// icon + message. Step 4 is shown as `.skipped` (faded checkmark)
+/// when the IS branch came back fast so the user can see step 4 was
+/// passed through without engaging the CL fallback.
+struct RegistrationProgressSection: View {
+    @ObservedObject var controller: IdentityRegistrationController
+
+    /// Asset-lock rows for this slot, queried live so step 2/3/4/5
+    /// transitions are reactive to status changes without polling.
+    @Query private var activeLocks: [PersistentAssetLock]
+
+    /// Cutoff (seconds since the row transitioned to `Broadcast`)
+    /// between the visually-brief "Broadcasting" step (3) and the
+    /// "Waiting for InstantSend proof" step (4). Tuned short so
+    /// step 3 doesn't visually linger — by the time the user sees
+    /// the page, the broadcast is already on the wire.
+    private static let broadcastingWindow: TimeInterval = 2.0
+
+    /// Cutoff (seconds since `Broadcast`) where the Rust side falls
+    /// back from InstantSend to ChainLock. Mirrors
+    /// `AssetLockManager`'s 300 s IS wait. If `statusRaw == 1` is
+    /// still the state after this window, the wallet is in the CL
+    /// fallback window (180 s); we mark step 4 done and step 5
+    /// active to communicate the shift.
+    private static let instantLockTimeout: TimeInterval = 300.0
+
+    init(controller: IdentityRegistrationController) {
+        self.controller = controller
+        let walletId = controller.walletId
+        let identityIndex = controller.identityIndex
+        _activeLocks = Query(
+            filter: PersistentAssetLock.predicate(
+                walletId: walletId,
+                identityIndex: identityIndex
+            ),
+            sort: [SortDescriptor(\PersistentAssetLock.updatedAt, order: .reverse)]
+        )
+    }
+
+    var body: some View {
+        // `TimelineView` re-fires the body every 1 s so the
+        // elapsed-time heuristic that distinguishes step 2 / 3 / 4
+        // refreshes without an external timer. The lock row's
+        // `updatedAt` is the anchor.
+        TimelineView(.periodic(from: .now, by: 1.0)) { timeline in
+            let now = timeline.date
+            let step = currentStep(now: now)
+            let isFailed = isFailed
+            let errorMessage = failureMessage
+
+            Section {
+                ForEach(1...5, id: \.self) { idx in
+                    stepRow(
+                        index: idx,
+                        title: stepTitle(idx),
+                        state: stepState(idx, currentStep: step, isFailed: isFailed)
+                    )
+                    if idx == 5, let message = errorMessage {
+                        Text(message)
+                            .font(.caption)
+                            .foregroundColor(.red)
+                            .padding(.leading, 32)
+                    }
+                }
+            } header: {
+                Text("Registration Progress")
+            } footer: {
+                Text(footerText(step: step, isFailed: isFailed))
+                    .font(.caption2)
+                    .foregroundColor(.secondary)
+            }
+        }
+    }
+
+    // MARK: - Step computation
+
+    /// 1...5, current active step. On `.completed` we report 6 (one
+    /// past the last visual step) so all rows render as `.done`;
+    /// the terminal "Identity created" banner is rendered by the
+    /// parent `RegistrationProgressView`, not by this section.
+    /// `now` is the time-of-rendering, used to drive the
+    /// Broadcasting → Waiting-IS → Waiting-CL transition within
+    /// `statusRaw == 1`.
+    private func currentStep(now: Date) -> Int {
+        switch controller.phase {
+        case .idle, .preparingKeys:
+            return 1
+        case .completed:
+            // No visible "registered" step — terminalSection on
+            // `RegistrationProgressView` carries that state. Return
+            // 6 so every step row (1...5) is marked `.done`.
+            return 6
+        case .failed:
+            // Pick the step at which we failed by reading the
+            // latest known lock status. The terminal indicator
+            // (red on the failed step) is what the user sees,
+            // but the partial fill of earlier steps tells them
+            // how far we got.
+            if let lock = activeLocks.first {
+                switch lock.statusRaw {
+                case 0: return 1
+                case 1: return broadcastSubStep(for: lock, now: now)
+                case 2, 3: return 5
+                default: return 1
+                }
+            }
+            return 5
+        case .inFlight:
+            guard let lock = activeLocks.first else {
+                // No lock row yet — Rust has the slot but hasn't
+                // emitted the first changeset. We're still
+                // logically in step 1 (building the asset-lock
+                // tx).
+                return 1
+            }
+            switch lock.statusRaw {
+            case 0:
+                return 1
+            case 1:
+                return broadcastSubStep(for: lock, now: now)
+            case 2:
+                // InstantSend-locked. We never went through step 4
+                // (CL fallback); it stays as `.skipped`. Step 5
+                // active.
+                return 5
+            case 3:
+                // ChainLock-locked. Step 3 (IS) is skipped (no IS
+                // proof was observed — either IS timed out and CL
+                // fallback ran, or the metadata.last_applied_chain_lock
+                // path built a CL proof directly). Step 4 done.
+                // Step 5 active. The `.skipped` rendering for step
+                // 3 is driven by `step3WasSkipped`.
+                return 5
+            default:
+                return 1
+            }
+        }
+    }
+
+    /// Resolve which of steps 2/3/4 is "active" while the lock is
+    /// at `statusRaw == 1`. Uses elapsed time since the row's last
+    /// update as the anchor: brief broadcasting window first, then
+    /// IS wait until the Rust-side timeout, then the CL fallback.
+    private func broadcastSubStep(for lock: PersistentAssetLock, now: Date) -> Int {
+        let elapsed = now.timeIntervalSince(lock.updatedAt)
+        if elapsed < Self.broadcastingWindow { return 2 }
+        if elapsed < Self.instantLockTimeout { return 3 }
+        return 4
+    }
+
+    /// True when step 4 should appear "skipped" rather than
+    /// "active" — i.e. the lock came back InstantSend-locked
+    /// (statusRaw == 2) so the CL fallback was never needed. Drives
+    /// a distinct pending visual on step 4 in the success path
+    /// without bleeding into other gray rows.
+    private var step4WasSkipped: Bool {
+        guard let lock = activeLocks.first else { return false }
+        return lock.statusRaw == 2
+    }
+
+    /// True when step 3 ("Waiting for InstantSend proof") should
+    /// appear "skipped" — i.e. no IS proof was observed during the
+    /// step-3 window. Symmetric to `step4WasSkipped`: that one fires
+    /// when `statusRaw == 2` (IS-locked, CL fallback never needed);
+    /// this one fires in every other "moved past step 3" case.
+    ///
+    /// The qualifying terminal / intermediate states:
+    ///
+    /// - `statusRaw == 3` — CL-locked. Either IS timed out and the
+    ///   CL fallback ran, OR `wait_for_proof`'s
+    ///   `metadata.last_applied_chain_lock` fallback (the Option B
+    ///   path) built a Chain proof directly without ever attempting
+    ///   IS. Either way step 3 was bypassed.
+    /// - `statusRaw == 1` + elapsed past the IS deadline. The lock
+    ///   is still Broadcast but `broadcastSubStep` has advanced to
+    ///   step 4 (CL wait) because IS didn't materialize within
+    ///   `instantLockTimeout`. The screenshot bug — the helper text
+    ///   already says "InstantSend timed out; falling back to
+    ///   ChainLock finality (~2 min)" while step 3 silently renders
+    ///   a green ✅. The guard on `idx < currentStep` in `stepState`
+    ///   means this branch only matters when we're past step 3
+    ///   anyway, so a simple `statusRaw != 2` covers it cleanly —
+    ///   `statusRaw == 0/1` with `currentStep <= 3` never asks about
+    ///   step 3's left-behind state.
+    ///
+    /// `.skipped` renders the dashed pending icon, matching step 4's
+    /// IS-success rendering.
+    private var step3WasSkipped: Bool {
+        guard let lock = activeLocks.first else { return false }
+        return lock.statusRaw != 2
+    }
+
+    private var isFailed: Bool {
+        if case .failed = controller.phase { return true }
+        return false
+    }
+
+    private var failureMessage: String? {
+        if case .failed(let msg) = controller.phase { return msg }
+        return nil
+    }
+
+    private func stepTitle(_ idx: Int) -> String {
+        switch idx {
+        case 1: return "Building asset-lock transaction"
+        case 2: return "Broadcasting"
+        case 3: return "Waiting for InstantSend proof"
+        case 4: return "Waiting for ChainLock proof"
+        case 5: return "Registering identity"
+        default: return ""
+        }
+    }
+
+    /// Step-state classification. Drives the icon + tint on the
+    /// row. `.skipped` is a softer pending variant for step 5 when
+    /// the IS branch returned the proof without needing ChainLock
+    /// fallback — visually distinguishable so users don't think
+    /// the step "didn't happen yet" once we've moved past it.
+    enum StepState { case done, active, pending, skipped, failed }
+
+    private func stepState(_ idx: Int, currentStep: Int, isFailed: Bool) -> StepState {
+        if isFailed && idx == currentStep {
+            return .failed
+        }
+        if idx < currentStep {
+            // Steps 3 and 4 are the IS / CL halves of the proof
+            // round: exactly one of them is skipped on a successful
+            // resolution. Step 4 skipped when IS came back first
+            // (statusRaw == 2); step 3 skipped when CL did (statusRaw
+            // == 3, whether via IS-timeout fallback or the
+            // `metadata.last_applied_chain_lock` direct path). The
+            // symmetric carve-out keeps the icons honest — without
+            // it, the CL-success path renders a green "InstantSend
+            // proof received ✅" check even though no IS proof was
+            // ever observed.
+            if idx == 3 && step3WasSkipped {
+                return .skipped
+            }
+            if idx == 4 && step4WasSkipped {
+                return .skipped
+            }
+            return .done
+        }
+        if idx == currentStep {
+            return .active
+        }
+        return .pending
+    }
+
+    // MARK: - Row UI
+
+    @ViewBuilder
+    private func stepRow(index: Int, title: String, state: StepState) -> some View {
+        HStack(spacing: 12) {
+            stepIcon(index: index, state: state)
+            VStack(alignment: .leading, spacing: 2) {
+                Text(title)
+                    .font(.callout)
+                    .foregroundColor(stepTextColor(state))
+            }
+            Spacer()
+        }
+    }
+
+    @ViewBuilder
+    private func stepIcon(index: Int, state: StepState) -> some View {
+        switch state {
+        case .done:
+            Image(systemName: "checkmark.circle.fill")
+                .foregroundColor(.green)
+                .font(.title3)
+        case .active:
+            ProgressView()
+                .scaleEffect(0.7)
+                .frame(width: 22, height: 22)
+        case .pending:
+            ZStack {
+                Circle()
+                    .stroke(Color.secondary.opacity(0.4), lineWidth: 1)
+                    .frame(width: 22, height: 22)
+                Text("\(index)")
+                    .font(.caption2)
+                    .foregroundColor(.secondary)
+            }
+        case .skipped:
+            // Lighter checkmark to communicate "we passed this
+            // step but didn't need it" — typically step 5 when
+            // the InstantSend branch returned the proof and the
+            // ChainLock fallback was never engaged.
+            Image(systemName: "checkmark.circle")
+                .foregroundColor(.secondary)
+                .font(.title3)
+        case .failed:
+            Image(systemName: "xmark.octagon.fill")
+                .foregroundColor(.red)
+                .font(.title3)
+        }
+    }
+
+    private func stepTextColor(_ state: StepState) -> Color {
+        switch state {
+        case .done: return .primary
+        case .active: return .primary
+        case .pending: return .secondary
+        case .skipped: return .secondary
+        case .failed: return .red
+        }
+    }
+
+    private func footerText(step: Int, isFailed: Bool) -> String {
+        if isFailed {
+            return "Tap Dismiss in Pending Registrations to clear this entry."
+        }
+        switch step {
+        case 1: return "Building a Core asset-lock transaction from wallet funds."
+        case 2: return "Sending the asset-lock transaction to peers."
+        case 3: return "Waiting for the InstantSend lock so the asset-lock proof is final."
+        case 4: return "InstantSend timed out; falling back to ChainLock finality (~2 min)."
+        case 5: return "Submitting the IdentityCreate state transition to Platform."
+        default: return ""
+        }
+    }
+}
+
+/// Standalone navigation destination for a registration in flight,
+/// completed, or failed. Pushed from `CreateIdentityView` on submit
+/// and from the "Pending Registrations" row on the identities tab.
+/// Renders the 7-step progress, plus the terminal section on
+/// `.completed` (success banner + "View Identity" navigation) or
+/// `.failed` (inline error). Embedders that already render a
+/// `Form` should use `RegistrationProgressSection` directly.
+struct RegistrationProgressView: View {
+    @ObservedObject var controller: IdentityRegistrationController
+    @Environment(\.dismiss) private var dismiss
+    @EnvironmentObject var walletManager: PlatformWalletManager
+
+    init(controller: IdentityRegistrationController) {
+        self.controller = controller
+    }
+
+    var body: some View {
+        Form {
+            RegistrationProgressSection(controller: controller)
+            terminalSection
+        }
+        .navigationTitle("Registration")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    @ViewBuilder
+    private var terminalSection: some View {
+        switch controller.phase {
+        case .completed(let identityId):
+            Section {
+                VStack(alignment: .leading, spacing: 8) {
+                    Label("Identity created", systemImage: "checkmark.seal.fill")
+                        .foregroundColor(.green)
+                        .font(.headline)
+                    Text(identityId.toBase58String())
+                        .font(.system(.caption, design: .monospaced))
+                        .foregroundColor(.secondary)
+                        .textSelection(.enabled)
+                    // Dismisses the pushed progress view AND drops
+                    // the controller from the coordinator so the
+                    // "Pending Registrations" row on the Identities
+                    // tab clears immediately (instead of lingering
+                    // ~30 s for the retention sweep).
+                    Button {
+                        walletManager.registrationCoordinator.dismiss(
+                            walletId: controller.walletId,
+                            identityIndex: controller.identityIndex
+                        )
+                        dismiss()
+                    } label: {
+                        Text("Done")
+                            .frame(maxWidth: .infinity)
+                    }
+                    .buttonStyle(.borderedProminent)
+                    .padding(.top, 4)
+                }
+            }
+        case .failed(let message):
+            Section {
+                VStack(alignment: .leading, spacing: 8) {
+                    Label("Registration failed", systemImage: "xmark.octagon.fill")
+                        .foregroundColor(.red)
+                        .font(.headline)
+                    Text(message)
+                        .font(.callout)
+                        .foregroundColor(.primary)
+                        .textSelection(.enabled)
+                }
+            }
+        default:
+            EmptyView()
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageExplorerView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageExplorerView.swift
index 6297ebdf2bf..82d02289f21 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageExplorerView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageExplorerView.swift
@@ -110,6 +110,9 @@ struct StorageExplorerView: View {
             modelRow("Pending Inputs", icon: "hourglass", type: PersistentPendingInput.self) {
                 PendingInputStorageListView(network: network)
             }
+            modelRow("Asset Locks", icon: "lock.shield", type: PersistentAssetLock.self) {
+                AssetLockStorageListView(network: network)
+            }
             modelRow("Manager Metadata", icon: "gearshape.2", type: PersistentWalletManagerMetadata.self) {
                 WalletManagerMetadataStorageListView(network: network)
             }
@@ -249,6 +252,9 @@ struct StorageExplorerView: View {
         filteredCount(PersistentPendingInput.self) {
             walletsOnNetwork.contains($0.walletId)
         }
+        filteredCount(PersistentAssetLock.self) {
+            walletsOnNetwork.contains($0.walletId)
+        }
 
         // Core / Platform addresses partition the same family of
         // tables by account type, so they need their own counts.
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageModelListViews.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageModelListViews.swift
index 08c4e4c2f27..7a3a4296071 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageModelListViews.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageModelListViews.swift
@@ -1019,36 +1019,7 @@ struct TransactionStorageListView: View {
                 }
             }
             ForEach(visible) { record in
-                NavigationLink(destination: TransactionStorageDetailView(record: record)) {
-                    VStack(alignment: .leading, spacing: 4) {
-                        Text(record.txidHex)
-                            .font(.system(.caption, design: .monospaced))
-                            .lineLimit(1).truncationMode(.middle)
-                        HStack(spacing: 8) {
-                            Text(record.directionName).font(.caption)
-                            // Only surface the type label when it
-                            // isn't the default Classic — saves a
-                            // line on the most-common row shape.
-                            let normalizedType =
-                                record.transactionType == "Standard"
-                                    ? "Classic Transaction"
-                                    : record.transactionType
-                            if normalizedType != "Classic Transaction" {
-                                Text(displayName(forType: normalizedType))
-                                    .font(.caption2)
-                                    .padding(.horizontal, 6)
-                                    .padding(.vertical, 2)
-                                    .background(Color.purple.opacity(0.15))
-                                    .foregroundColor(.purple)
-                                    .clipShape(Capsule())
-                            }
-                            Spacer()
-                            Text(record.formattedAmount)
-                                .font(.caption)
-                                .foregroundColor(record.netAmount >= 0 ? .green : .red)
-                        }
-                    }
-                }
+                transactionRow(record)
             }
         }
         .navigationTitle(
@@ -1075,6 +1046,46 @@ struct TransactionStorageListView: View {
         }
     }
 
+    /// Shared row builder for both sections ("Identity Funding" and
+    /// "Transactions"). Uses [`displayDirection`] so asset-lock rows
+    /// read as "Asset Lock" rather than the structurally-correct-but-
+    /// misleading "Internal" label.
+    @ViewBuilder
+    private func transactionRow(_ record: PersistentTransaction) -> some View {
+        NavigationLink(destination: TransactionStorageDetailView(record: record)) {
+            VStack(alignment: .leading, spacing: 4) {
+                Text(record.txidHex)
+                    .font(.system(.caption, design: .monospaced))
+                    .lineLimit(1).truncationMode(.middle)
+                HStack(spacing: 8) {
+                    Text(record.displayDirection).font(.caption)
+                    // Only surface the type label when it isn't the
+                    // default Classic — saves a line on the most-common
+                    // row shape. Asset-lock rows also get the badge so
+                    // the visual stays consistent if the user filters
+                    // away the Identity Funding section header.
+                    let normalizedType =
+                        record.transactionType == "Standard"
+                            ? "Classic Transaction"
+                            : record.transactionType
+                    if normalizedType != "Classic Transaction" {
+                        Text(displayName(forType: normalizedType))
+                            .font(.caption2)
+                            .padding(.horizontal, 6)
+                            .padding(.vertical, 2)
+                            .background(Color.purple.opacity(0.15))
+                            .foregroundColor(.purple)
+                            .clipShape(Capsule())
+                    }
+                    Spacer()
+                    Text(record.formattedAmount)
+                        .font(.caption)
+                        .foregroundColor(record.netAmount >= 0 ? .green : .red)
+                }
+            }
+        }
+    }
+
     /// Drop the redundant trailing "Transaction" word so the
     /// segmented row + picker stay readable. `"Asset Lock
     /// Transaction"` → `"Asset Lock"`, etc. The full string is what
@@ -1605,6 +1616,67 @@ struct PendingInputStorageListView: View {
     }
 }
 
+// MARK: - PersistentAssetLock
+
+/// Storage explorer surface for tracked asset locks. SwiftData-backed
+/// — every row is upserted by the Rust-side `on_persist_asset_locks_fn`
+/// callback as the lock advances through Built / Broadcast /
+/// InstantSendLocked / ChainLocked, and deleted when the registration
+/// consumes it. The same rows also drive `RegistrationProgressView`
+/// (iter 3 part 2).
+struct AssetLockStorageListView: View {
+    let network: Network
+    @Query(sort: [SortDescriptor(\PersistentAssetLock.updatedAt, order: .reverse)])
+    private var records: [PersistentAssetLock]
+
+    @Query private var allWallets: [PersistentWallet]
+
+    private var walletIdsOnNetwork: Set<Data> {
+        Set(allWallets.lazy
+            .filter { $0.networkRaw == network.rawValue }
+            .map(\.walletId))
+    }
+
+    private var scopedRecords: [PersistentAssetLock] {
+        let ids = walletIdsOnNetwork
+        return records.filter { ids.contains($0.walletId) }
+    }
+
+    var body: some View {
+        let visible = scopedRecords
+        List(visible) { record in
+            NavigationLink(destination: AssetLockStorageDetailView(record: record)) {
+                VStack(alignment: .leading, spacing: 4) {
+                    Text(record.outPointHex)
+                        .font(.system(.caption, design: .monospaced))
+                        .lineLimit(1).truncationMode(.middle)
+                    HStack(spacing: 8) {
+                        Text(record.statusLabel)
+                            .font(.caption2)
+                            .foregroundColor(.secondary)
+                        Spacer()
+                        Text("identity #\(record.identityIndexRaw)")
+                            .font(.caption2)
+                            .foregroundColor(.secondary)
+                        Text(record.updatedAt, style: .relative)
+                            .font(.caption2)
+                            .foregroundColor(.secondary)
+                    }
+                }
+            }
+        }
+        .navigationTitle("Asset Locks (\(visible.count))")
+        .overlay {
+            if visible.isEmpty {
+                ContentUnavailableView(
+                    "No Asset Locks",
+                    systemImage: "lock.shield"
+                )
+            }
+        }
+    }
+}
+
 // MARK: - PersistentWalletManagerMetadata
 
 struct WalletManagerMetadataStorageListView: View {
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageRecordDetailViews.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageRecordDetailViews.swift
index 5a5a947a89c..72c9e448bd9 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageRecordDetailViews.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/StorageRecordDetailViews.swift
@@ -57,6 +57,22 @@ struct IdentityStorageDetailView: View {
 
     var body: some View {
         Form {
+            Section {
+                // Surface the operational identity view from the
+                // storage explorer — the StorageExplorer page is
+                // metadata-only; the live view (balance, top-up,
+                // documents, etc.) lives in IdentityDetailView.
+                NavigationLink {
+                    IdentityDetailView(identityId: record.identityId)
+                } label: {
+                    HStack {
+                        Text("View Identity")
+                        Spacer()
+                        Image(systemName: "arrow.right")
+                            .foregroundColor(.secondary)
+                    }
+                }
+            }
             Section("Core") {
                 FieldRow(label: "ID (Base58)", value: record.identityIdBase58)
                 FieldRow(label: "ID (Hex)", value: record.identityIdString)
@@ -1459,7 +1475,7 @@ struct TransactionStorageDetailView: View {
         Form {
             Section("Core") {
                 FieldRow(label: "TXID", value: record.txidHex)
-                FieldRow(label: "Direction", value: record.directionName)
+                FieldRow(label: "Direction", value: record.displayDirection)
                 FieldRow(label: "Type", value: record.transactionType)
                 FieldRow(label: "Net Amount", value: record.formattedAmount)
                 if let fee = record.fee {
@@ -1774,3 +1790,145 @@ struct WalletManagerMetadataStorageDetailView: View {
         .navigationBarTitleDisplayMode(.inline)
     }
 }
+
+struct AssetLockStorageDetailView: View {
+    let record: PersistentAssetLock
+
+    /// Candidate identity rows at this asset lock's
+    /// `identityIndex`. Filtered down to the strict
+    /// `(walletId, identityIndex)` match in `linkedIdentity` —
+    /// using the predicate alone would miss legacy rows that
+    /// don't yet have the `wallet` relationship populated.
+    @Query private var candidateIdentities: [PersistentIdentity]
+
+    init(record: PersistentAssetLock) {
+        self.record = record
+        // `PersistentAssetLock.identityIndexRaw` is `Int32` (the
+        // changeset FFI uses i32 to match the upstream tracked
+        // type), but `PersistentIdentity.identityIndex` is `UInt32`
+        // (the DIP-9 slot is unsigned). Bridge with a `UInt32`
+        // cast captured in Swift before predicate construction —
+        // SwiftData's `#Predicate` macro doesn't allow inline
+        // conversions inside the closure body.
+        let identityIndex = UInt32(bitPattern: record.identityIndexRaw)
+        _candidateIdentities = Query(
+            filter: #Predicate<PersistentIdentity> { identity in
+                identity.identityIndex == identityIndex
+            }
+        )
+    }
+
+    /// Resolve the identity row this asset lock points at. Strict
+    /// `(walletId, identityIndex)` match preferred; legacy rows
+    /// that lack the `wallet` relationship fall back to a plain
+    /// `identityIndex` match (single candidate only — multiple
+    /// orphaned candidates at the same index are ambiguous and we
+    /// don't guess).
+    private var linkedIdentity: PersistentIdentity? {
+        if let strict = candidateIdentities.first(where: {
+            $0.wallet?.walletId == record.walletId
+        }) {
+            return strict
+        }
+        let orphaned = candidateIdentities.filter { $0.wallet == nil }
+        return orphaned.count == 1 ? orphaned.first : nil
+    }
+
+    var body: some View {
+        Form {
+            Section("Asset Lock") {
+                FieldRow(label: "Outpoint", value: record.outPointHex)
+                FieldRow(label: "Status", value: record.statusLabel)
+                FieldRow(label: "Funding Type", value: fundingTypeLabel(record.fundingTypeRaw))
+                FieldRow(label: "Identity Index", value: "\(record.identityIndexRaw)")
+                FieldRow(label: "Amount (duffs)", value: "\(record.amountDuffs)")
+                FieldRow(label: "Wallet ID", value: hexString(record.walletId))
+            }
+            if isIdentityFunding {
+                // Identity section is always shown for identity-
+                // funding asset locks (Registration / TopUp). If the
+                // linked identity is in SwiftData, drill-down link;
+                // otherwise surface the current registration status
+                // so partial / in-flight asset locks aren't silently
+                // hidden.
+                Section("Identity") {
+                    if let identity = linkedIdentity {
+                        // Static row — punted on navigation. Pushing
+                        // `IdentityDetailView` from this nested
+                        // Settings → Storage path hung the main
+                        // thread on iOS 26 and burned a session
+                        // chasing the cause. Tap-to-copy `Text` is
+                        // good enough for an explorer surface; the
+                        // operational identity view is reachable
+                        // from the Identities tab.
+                        Text(identity.identityIdBase58)
+                            .font(.system(.caption, design: .monospaced))
+                            .foregroundColor(.primary)
+                            .lineLimit(1)
+                            .truncationMode(.middle)
+                            .textSelection(.enabled)
+                    } else {
+                        // No matching identity row yet. Either the
+                        // asset lock is still pre-finality
+                        // (statusRaw 0/1) and the registration
+                        // hasn't been submitted, or it's IS/CL-
+                        // locked (2/3) but the IdentityCreate
+                        // transition failed or wasn't submitted —
+                        // surface either case with the current
+                        // status so the entry is self-explanatory.
+                        FieldRow(
+                            label: pendingLabel(record.statusRaw),
+                            value: record.statusLabel
+                        )
+                    }
+                }
+            }
+            Section("Bytes") {
+                FieldRow(label: "Transaction Bytes", value: "\(record.transactionBytes.count) bytes")
+                FieldRow(
+                    label: "Proof Bytes",
+                    value: record.proofBytes.map { "\($0.count) bytes" } ?? "—"
+                )
+            }
+            Section("Timestamps") {
+                FieldRow(label: "Created", value: dateString(record.createdAt))
+                FieldRow(label: "Updated", value: dateString(record.updatedAt))
+            }
+        }
+        .navigationTitle("Asset Lock")
+        .navigationBarTitleDisplayMode(.inline)
+    }
+
+    private func fundingTypeLabel(_ raw: Int) -> String {
+        switch raw {
+        case 0: return "IdentityRegistration"
+        case 1: return "IdentityTopUp"
+        case 2: return "IdentityTopUpNotBound"
+        case 3: return "IdentityInvitation"
+        case 4: return "AssetLockAddressTopUp"
+        case 5: return "AssetLockShieldedAddressTopUp"
+        default: return "Unknown(\(raw))"
+        }
+    }
+
+    /// True when this asset lock funded an identity at a specific
+    /// `(walletId, identityIndex)` slot — i.e. registration or
+    /// top-up. The other funding types don't deterministically
+    /// resolve to a single identity on this wallet.
+    private var isIdentityFunding: Bool {
+        record.fundingTypeRaw == 0 || record.fundingTypeRaw == 1
+    }
+
+    /// Label for the pending row shown when no identity row has
+    /// been persisted for this slot yet. Communicates whether the
+    /// lock is mid-flight (still on its way to finality) versus
+    /// IS/CL-locked but the IdentityCreate transition never
+    /// completed.
+    private func pendingLabel(_ raw: Int) -> String {
+        switch raw {
+        case 0, 1: return "In progress"
+        case 2, 3: return "Pending (unused)"
+        default: return "Pending"
+        }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/WalletMemoryExplorerView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/WalletMemoryExplorerView.swift
index 9275064c78c..c1b3544fc89 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/WalletMemoryExplorerView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/WalletMemoryExplorerView.swift
@@ -1429,6 +1429,7 @@ private func trackedAssetLockStatusLabel(_ tag: UInt8) -> String {
     case 1: return "Broadcast"
     case 2: return "InstantSendLocked"
     case 3: return "ChainLocked"
+    case 4: return "Consumed"
     default: return "Unknown(\(tag))"
     }
 }
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/CreateIdentityResumableTests.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/CreateIdentityResumableTests.swift
new file mode 100644
index 00000000000..270ac1e9db7
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/CreateIdentityResumableTests.swift
@@ -0,0 +1,291 @@
+import XCTest
+import SwiftDashSDK
+@testable import SwiftExampleApp
+
+/// Tests the pure anti-join that powers the Identities-tab
+/// "Resumable Registrations" section. This is the *only* surface
+/// the user has post-app-restart to see an in-flight registration:
+/// the in-memory `RegistrationCoordinator` map is wiped on relaunch,
+/// so without the SwiftData-backed cross-wallet filter the user
+/// would have no signal that an orphan asset lock is waiting.
+///
+/// The filter has four pieces of business logic that can silently
+/// regress:
+///
+///   1. `statusRaw >= 1` floor — Built (0) is rejected (tight
+///      crash window with no useful UX action), Broadcast (1) and
+///      every later status are accepted. The row's *trailing
+///      affordance* — spinner vs. Resume button — is staged on
+///      `statusRaw >= 2` separately inside `ResumableRegistrationRow`,
+///      not at the filter level.
+///   2. Anti-join on `(walletId, identityIndex)` — a slot taken
+///      by a `PersistentIdentity` row removes its lock from the
+///      surface even if the lock's own status would otherwise
+///      qualify. This is what makes the filter "orphan-only".
+///   3. The anti-join is **per-wallet**: slot 0 used on wallet A
+///      must not block slot 0 on wallet B. The `UsedSlot` value
+///      key (walletId + slot) carries that scoping.
+///   4. `identityIndexRaw` is stored as `Int32` but compared as
+///      `UInt32` via `UInt32(bitPattern:)`. A future cast change
+///      (e.g. `UInt32(lockIdentityIndexRaw)` — which would trap on
+///      negative inputs) must fail loudly here, not in production.
+///
+/// We exercise these with a lightweight `FakeAssetLockRow` so the
+/// test stays a pure function call — no SwiftData container needed.
+final class CreateIdentityResumableTests: XCTestCase {
+
+    private struct FakeAssetLockRow: AssetLockResumeRow, Equatable {
+        let walletId: Data
+        let statusRaw: Int
+        let identityIndexRaw: Int32
+    }
+
+    private let walletA = Data(repeating: 0xA1, count: 8)
+    private let walletB = Data(repeating: 0xB2, count: 8)
+
+    // MARK: - status floor
+
+    func testRejectsBuiltLocks() {
+        // Built (0) is the tight crash window between "build TX" and
+        // "broadcast TX". There's no useful resume action, so it
+        // shouldn't appear on the Identities tab at all.
+        let locks = [
+            FakeAssetLockRow(walletId: walletA, statusRaw: 0, identityIndexRaw: 0)
+        ]
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: locks,
+            usedSlots: []
+        )
+        XCTAssertTrue(result.isEmpty)
+    }
+
+    /// Broadcast (1) must surface even though it's not actionable —
+    /// the row renders a spinner ("Waiting for InstantSendLock…")
+    /// until SPV delivers the IS lock and the persister flips it
+    /// to (2). Hiding (1) would create the UX asymmetry where a
+    /// just-broadcast lock vanishes from the UI for ~10-30 seconds
+    /// and then reappears at (2) — confusing rather than reassuring.
+    func testAcceptsBroadcastForVisibility() {
+        let lock = FakeAssetLockRow(walletId: walletA, statusRaw: 1, identityIndexRaw: 0)
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: []
+        )
+        XCTAssertEqual(result, [lock])
+    }
+
+    func testAcceptsInstantSendLockedAndChainLocked() {
+        let locks = [
+            FakeAssetLockRow(walletId: walletA, statusRaw: 2, identityIndexRaw: 0),
+            FakeAssetLockRow(walletId: walletA, statusRaw: 3, identityIndexRaw: 1),
+        ]
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: locks,
+            usedSlots: []
+        )
+        XCTAssertEqual(result, locks)
+    }
+
+    /// Defensive: any unknown future status (e.g. 4) should still
+    /// pass the `>= 1` floor. If we ever flip from "≥1 means
+    /// surfaced" to a closed set, this test will need updating —
+    /// that's intentional, the surprise is signal.
+    func testForwardCompatibleStatusFloor() {
+        let lock = FakeAssetLockRow(walletId: walletA, statusRaw: 4, identityIndexRaw: 0)
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: []
+        )
+        XCTAssertEqual(result, [lock])
+    }
+
+    // MARK: - anti-join
+
+    func testFiltersOutLocksWhoseOwnWalletSlotIsAlreadyUsed() {
+        // A registration that completed normally leaves both a
+        // `PersistentAssetLock` and a `PersistentIdentity` row. The
+        // lock is "consumed" even if it hasn't been purged yet, so
+        // the surface must hide it.
+        let lock = FakeAssetLockRow(walletId: walletA, statusRaw: 2, identityIndexRaw: 7)
+        let usedSlots: Set<IdentitiesContentView.UsedSlot> = [
+            IdentitiesContentView.UsedSlot(walletId: walletA, slot: 7)
+        ]
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: usedSlots
+        )
+        XCTAssertTrue(result.isEmpty)
+    }
+
+    func testDoesNotBleedUsedSlotsAcrossWallets() {
+        // Same numerical slot (0) on both wallets, but only
+        // wallet-A's slot is taken by an existing identity. The
+        // lock on wallet B at slot 0 must stay surfaced — the
+        // user's identity on A has no bearing on B's slot pool.
+        let locks = [
+            FakeAssetLockRow(walletId: walletA, statusRaw: 2, identityIndexRaw: 0),
+            FakeAssetLockRow(walletId: walletB, statusRaw: 2, identityIndexRaw: 0),
+        ]
+        let usedSlots: Set<IdentitiesContentView.UsedSlot> = [
+            IdentitiesContentView.UsedSlot(walletId: walletA, slot: 0)
+        ]
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: locks,
+            usedSlots: usedSlots
+        )
+        XCTAssertEqual(result, [locks[1]])
+    }
+
+    // MARK: - Int32 -> UInt32 bridge
+
+    /// `identityIndexRaw` is `Int32` (the storage row type) but the
+    /// `UsedSlot.slot` field is `UInt32` (the FFI / wallet-side
+    /// type). The filter bridges via `UInt32(bitPattern:)`. A
+    /// negative `Int32` maps to a high `UInt32`. This test pins
+    /// the conversion so a future change to `UInt32(...)` —
+    /// which would trap on negative inputs — fails loudly here
+    /// instead of crashing in production.
+    func testNegativeIdentityIndexBridgesViaBitPattern() {
+        let negativeIndex: Int32 = -1
+        let bridged = UInt32(bitPattern: negativeIndex) // 0xFFFF_FFFF
+        let lock = FakeAssetLockRow(
+            walletId: walletA,
+            statusRaw: 2,
+            identityIndexRaw: negativeIndex
+        )
+
+        // With the bridged slot in `usedSlots`, the lock is filtered.
+        let blocked = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: [IdentitiesContentView.UsedSlot(walletId: walletA, slot: bridged)]
+        )
+        XCTAssertTrue(blocked.isEmpty)
+
+        // Without it, the lock stays.
+        let kept = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: []
+        )
+        XCTAssertEqual(kept, [lock])
+    }
+
+    // MARK: - empty inputs
+
+    func testEmptyLocksReturnsEmpty() {
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: [FakeAssetLockRow](),
+            usedSlots: [
+                IdentitiesContentView.UsedSlot(walletId: walletA, slot: 0)
+            ]
+        )
+        XCTAssertTrue(result.isEmpty)
+    }
+
+    // MARK: - in-flight controller exclusion
+
+    /// Regression for the double-counting bug: during a normal
+    /// in-session registration, the asset lock reaches `Broadcast`
+    /// (or higher) **before** the persister writes a
+    /// `PersistentIdentity` row. Without including in-flight
+    /// controller slots in `usedSlots`, the same lock would
+    /// appear in BOTH the in-memory Pending Registrations list
+    /// and the SwiftData-backed Resumable Registrations section
+    /// — and a second tap on Resume would race a duplicate FFI
+    /// call against the original. The fix is structural: the
+    /// `ResumableRegistrationsList` view unions identity-claimed
+    /// slots with `controller.phase.isActive` slots before
+    /// calling `crossWalletResumableLocks`. The unioned set is
+    /// what gets passed here; this test pins that the filter
+    /// honors active-slot occupancy the same way it honors
+    /// identity-row occupancy.
+    func testInFlightSlotIsExcludedFromResumableSurface() {
+        let lock = FakeAssetLockRow(walletId: walletA, statusRaw: 2, identityIndexRaw: 3)
+        // No `PersistentIdentity` exists at (walletA, 3) yet, but a
+        // controller in `.inFlight` does. The union of identity
+        // slots (empty) and active slots (one) must hide the lock.
+        let activeSlots: Set<IdentitiesContentView.UsedSlot> = [
+            IdentitiesContentView.UsedSlot(walletId: walletA, slot: 3)
+        ]
+        let result = IdentitiesContentView.crossWalletResumableLocks(
+            in: [lock],
+            usedSlots: activeSlots
+        )
+        XCTAssertTrue(result.isEmpty)
+    }
+
+    // MARK: - outpoint hex round-trip
+
+    /// `PersistentAssetLock.encodeOutPoint` (rawBytes → display
+    /// hex) and `CreateIdentityView.parseOutPointHex` (display hex
+    /// → rawBytes) are the two halves of the outpoint round-trip
+    /// the resume path depends on: the persister writes the
+    /// display-order hex, the submit path reads it and hands the
+    /// raw wire-order bytes to the FFI. If either side flips
+    /// endianness, the resume FFI silently addresses a different
+    /// outpoint and the Platform proof-verification failure that
+    /// follows is opaque. Pin the round-trip explicitly.
+    func testOutPointHexRoundTripPreservesRawBytes() {
+        // Deliberately asymmetric bytes so any endian flip is
+        // visible. txid wire-order = little-endian.
+        let originalTxid = Data([
+            0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+            0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10,
+            0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+            0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20,
+        ])
+        let originalVout: UInt32 = 7
+
+        // The persister writes the 36-byte (txid_le || vout_le)
+        // blob — assemble it the same way and encode.
+        var raw = Data(originalTxid)
+        withUnsafeBytes(of: originalVout.littleEndian) { raw.append(contentsOf: $0) }
+        XCTAssertEqual(raw.count, 36)
+        let hex = PersistentAssetLock.encodeOutPoint(rawBytes: raw)
+
+        // Decode via the submit-path parser.
+        guard let (rtTxid, rtVout) = CreateIdentityView.parseOutPointHex(hex) else {
+            XCTFail("parseOutPointHex returned nil for canonical encoding \(hex)")
+            return
+        }
+        XCTAssertEqual(rtTxid, originalTxid,
+                       "txid bytes round-tripped through display-hex must match")
+        XCTAssertEqual(rtVout, originalVout)
+    }
+
+    /// Defensive: parseOutPointHex must reject malformed inputs
+    /// instead of silently producing zeros. Same risk class as the
+    /// endianness flip — a "valid-looking" but wrong outpoint
+    /// would fail at the Platform layer with confusing errors.
+    func testParseOutPointHexRejectsMalformedInputs() {
+        XCTAssertNil(CreateIdentityView.parseOutPointHex(""))
+        XCTAssertNil(CreateIdentityView.parseOutPointHex("nope"))
+        XCTAssertNil(CreateIdentityView.parseOutPointHex("abc:1"))  // txid too short
+        XCTAssertNil(CreateIdentityView.parseOutPointHex(
+            String(repeating: "a", count: 64) + ":bogus"))            // vout NaN
+        XCTAssertNil(CreateIdentityView.parseOutPointHex(
+            String(repeating: "g", count: 64) + ":0"))                // non-hex chars
+    }
+
+    /// Exhaustive predicate test for which controller phases hold
+    /// the slot. The Resumable surface uses this to decide which
+    /// in-memory controllers block their lock from re-appearing
+    /// in the section. Changing this predicate without thinking
+    /// about both the Pending and Resumable surfaces is how
+    /// double-tap-Resume bugs come back.
+    func testControllerPhaseIsActivePredicate() {
+        XCTAssertFalse(IdentityRegistrationController.Phase.idle.isActive,
+                       ".idle: pre-submit — no slot occupancy yet")
+        XCTAssertTrue(IdentityRegistrationController.Phase.preparingKeys.isActive,
+                      ".preparingKeys: keys derived; FFI imminent — slot held")
+        XCTAssertTrue(IdentityRegistrationController.Phase.inFlight.isActive,
+                      ".inFlight: FFI mid-call — slot held")
+        XCTAssertFalse(
+            IdentityRegistrationController.Phase
+                .completed(identityId: Data(repeating: 0xCC, count: 32))
+                .isActive,
+            ".completed: PersistentIdentity row covers the slot via the identity anti-join — don't double-block"
+        )
+        XCTAssertFalse(IdentityRegistrationController.Phase.failed("nope").isActive,
+                       ".failed: user is expected to retry — let the lock resurface")
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyManagerTests.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyManagerTests.swift
index fff8bd68551..144f300b914 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyManagerTests.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyManagerTests.swift
@@ -175,7 +175,7 @@ final class KeyManagerTests: XCTestCase {
         ])
 
         // Encode to WIF
-        guard let wif = KeyFormatter.toWIF(originalKey, isTestnet: true) else {
+        guard let wif = KeyFormatter.toWIF(originalKey, network: .testnet) else {
             XCTFail("Failed to encode to WIF")
             return
         }
diff --git a/packages/wasm-sdk/src/state_transitions/identity.rs b/packages/wasm-sdk/src/state_transitions/identity.rs
index edf90726745..f03af7e37ce 100644
--- a/packages/wasm-sdk/src/state_transitions/identity.rs
+++ b/packages/wasm-sdk/src/state_transitions/identity.rs
@@ -114,7 +114,7 @@ impl WasmSdk {
 
         // Put identity to platform and wait
         identity
-            .put_to_platform_and_wait_for_response(
+            .put_to_platform_and_wait_for_response_with_private_key(
                 self.inner_sdk(),
                 asset_lock_proof,
                 &asset_lock_private_key,
@@ -203,11 +203,10 @@ impl WasmSdk {
 
         // Top up the identity
         let new_balance = identity
-            .top_up_identity(
+            .top_up_identity_with_private_key(
                 self.inner_sdk(),
                 asset_lock_proof,
                 &asset_lock_private_key,
-                None,
                 settings,
             )
             .await