I have avoided calling transaction.finish() on the client for this reason. The comment about self-validating the JWS is new to me. Is that documented anywhere?

A little yes, and a little no. I have managed to get better transactionIDs: 2000000328415040 and 2000000328446334. But the history results were not useful: "{"revision":"0","bundleId":"com.mycompany.mytestapp","environment":"Sandbox","hasMore":false,"signedTransactions":[]}" The documentation says signedTransactions should contain the transaction I just completed, but it's empty. And other invalid TransactionIDs like: 2000000200000000, 2000000299999999 show the same result.