From bc0218d4223494409d2d5b62a8d6299f38a87b00 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 21 Sep 2026 11:09:15 +0200
Subject: [PATCH 01/22] chore: replace the code owners with the people who can
 approve

The file named @waytwotall and @sphamjoli. @sphamjoli has read access and has
left the organisation, so they cannot approve a pull request, which left one
person able to satisfy a code-owner review on the whole repository.

That is about to matter. The "main" ruleset is active but its target list is
empty, so it currently matches no branches and master is unprotected. Once its
targets are set, every pull request needs a code-owner approval, and with the
old list that meant @waytwotall or nothing.

Replaces them with @re-gius and @GHkrishna, both of whom can approve. Two
owners rather than one, because a code owner cannot approve their own pull
request, so a single owner cannot merge anything they wrote.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6b635390f..b4950d95a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @waytwotall @sphamjoli
+* @re-gius @GHkrishna

From 3fc0638b4f245c8f4c18af52f121d6dc0567fa0c Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 21 Sep 2026 13:53:12 +0200
Subject: [PATCH 02/22] chore: own the repository as a team, not as two names

The team outlives its membership: people joining and leaving @paritytech/dotns
is a team-settings change, and this file stops needing a pull request every
time that happens, which is exactly how it went stale last time.

Inert until the team is granted write on this repository: CODEOWNERS ignores
teams without access, so that grant lands before this merges.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index b4950d95a..1de1318fe 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @re-gius @GHkrishna
+* @paritytech/dotns

From 6bbd97d80d834cf0980404870aec7ac686344c1f Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Tue, 22 Sep 2026 09:39:59 +0200
Subject: [PATCH 03/22] Upgrade testnet manifests

---
 deployments/paseo-assethub/420420417.json |  2 +-
 deployments/previewnet/420420417.json     |  1 +
 deployments/previewnet/README.md          | 18 ++++++++++++++++++
 scripts/js/release-metadata.mjs           | 18 ++++++++++++++++++
 4 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 deployments/previewnet/420420417.json
 create mode 100644 deployments/previewnet/README.md

diff --git a/deployments/paseo-assethub/420420417.json b/deployments/paseo-assethub/420420417.json
index bbb35225e..968901c10 100644
--- a/deployments/paseo-assethub/420420417.json
+++ b/deployments/paseo-assethub/420420417.json
@@ -1 +1 @@
-{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
+{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","LabelStoreBeaconLegacy":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","StoreFactoryLegacy":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad","UserStoreBeaconLegacy":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
diff --git a/deployments/previewnet/420420417.json b/deployments/previewnet/420420417.json
new file mode 100644
index 000000000..2f36c9126
--- /dev/null
+++ b/deployments/previewnet/420420417.json
@@ -0,0 +1 @@
+{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xfe5A45f7fD58D1A6FE09455DB799405b1dcE9411","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad"}
diff --git a/deployments/previewnet/README.md b/deployments/previewnet/README.md
new file mode 100644
index 000000000..420ca9599
--- /dev/null
+++ b/deployments/previewnet/README.md
@@ -0,0 +1,18 @@
+# previewnet
+
+The Product Preview Network's Asset Hub (`wss://previewnet.substrate.dev/asset-hub`,
+ETH RPC `https://previewnet.substrate.dev/eth-rpc`), TLD `.dot`. Deployed from a v0.8.0
+genesis, so every address matches the fresh-deploy set in `deployments/expected.json`.
+
+The chain id is `420420417`, the same as `paseo-assethub`: pallet-revive testnets share it,
+so the network folder, not the chain id, is what identifies a deployment. The two manifests
+differ where their histories do: a network upgraded in place carries `*Legacy` entries for
+addresses its upgrades superseded, and can hold contracts deployed before the current set.
+
+This network is wiped and redeployed periodically; verify against the chain before relying
+on this file after a wipe:
+
+```bash
+node scripts/js/release-metadata.mjs verify --network previewnet \
+  --rpc https://previewnet.substrate.dev/eth-rpc --tag v0.8.0
+```
diff --git a/scripts/js/release-metadata.mjs b/scripts/js/release-metadata.mjs
index 0f48deb63..5fd2975b3 100644
--- a/scripts/js/release-metadata.mjs
+++ b/scripts/js/release-metadata.mjs
@@ -637,6 +637,15 @@ function verify(args) {
         rpc,
       ]);
       if (declared === ZERO_HASH) {
+        // A key that is tolerated unset is also tolerated undeclared. Such keys are outside
+        // the declared release surface, so the declaration pass never writes a codehash for
+        // them; a network whose genesis predates the current policy can still have one set,
+        // and that combination (set, no code identity) is expected there.
+        if (UNSET_TOLERATED[key]) {
+          resolved.add(address.toLowerCase());
+          console.log(`  skip ${key} ${address} (${label}: no declaration, ${UNSET_TOLERATED[key]})`);
+          continue;
+        }
         problems.push(`key '${key}' (${label}) has no declared codehash`);
         continue;
       }
@@ -669,6 +678,15 @@ function verify(args) {
   const notExpected = new Set(unpointed);
   for (const [address, label] of byAddress) {
     if (!resolved.has(address) && !notExpected.has(address)) {
+      // A `*Legacy` entry records an address that became stale or unused after an in-place
+      // upgrade: when a contract moves to a new address, the outgoing one keeps its manifest
+      // entry under the `Legacy` suffix instead of being erased, because live state can keep
+      // depending on it after nothing points at it. Unkeyed by design, so the reverse check
+      // skips it instead of reading it as an orphan.
+      if (label.endsWith("Legacy")) {
+        console.log(`  skip ${label} ${contracts[label]} (superseded deployment, kept for the beacon upgrade path)`);
+        continue;
+      }
       problems.push(`${label} ${contracts[label]} is in the manifest but no key points at it`);
     }
   }

From 2dd93fb5c610eed16666db0f507791c91447286d Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Tue, 22 Sep 2026 09:45:55 +0200
Subject: [PATCH 04/22] Revert "Upgrade testnet manifests"

Pushed to master directly by mistake; it belongs in a reviewed PR.
This reverts commit 6bbd97d80d834cf0980404870aec7ac686344c1f.
---
 deployments/paseo-assethub/420420417.json |  2 +-
 deployments/previewnet/420420417.json     |  1 -
 deployments/previewnet/README.md          | 18 ------------------
 scripts/js/release-metadata.mjs           | 18 ------------------
 4 files changed, 1 insertion(+), 38 deletions(-)
 delete mode 100644 deployments/previewnet/420420417.json
 delete mode 100644 deployments/previewnet/README.md

diff --git a/deployments/paseo-assethub/420420417.json b/deployments/paseo-assethub/420420417.json
index 968901c10..bbb35225e 100644
--- a/deployments/paseo-assethub/420420417.json
+++ b/deployments/paseo-assethub/420420417.json
@@ -1 +1 @@
-{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","LabelStoreBeaconLegacy":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","StoreFactoryLegacy":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad","UserStoreBeaconLegacy":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
+{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
diff --git a/deployments/previewnet/420420417.json b/deployments/previewnet/420420417.json
deleted file mode 100644
index 2f36c9126..000000000
--- a/deployments/previewnet/420420417.json
+++ /dev/null
@@ -1 +0,0 @@
-{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xfe5A45f7fD58D1A6FE09455DB799405b1dcE9411","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad"}
diff --git a/deployments/previewnet/README.md b/deployments/previewnet/README.md
deleted file mode 100644
index 420ca9599..000000000
--- a/deployments/previewnet/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# previewnet
-
-The Product Preview Network's Asset Hub (`wss://previewnet.substrate.dev/asset-hub`,
-ETH RPC `https://previewnet.substrate.dev/eth-rpc`), TLD `.dot`. Deployed from a v0.8.0
-genesis, so every address matches the fresh-deploy set in `deployments/expected.json`.
-
-The chain id is `420420417`, the same as `paseo-assethub`: pallet-revive testnets share it,
-so the network folder, not the chain id, is what identifies a deployment. The two manifests
-differ where their histories do: a network upgraded in place carries `*Legacy` entries for
-addresses its upgrades superseded, and can hold contracts deployed before the current set.
-
-This network is wiped and redeployed periodically; verify against the chain before relying
-on this file after a wipe:
-
-```bash
-node scripts/js/release-metadata.mjs verify --network previewnet \
-  --rpc https://previewnet.substrate.dev/eth-rpc --tag v0.8.0
-```
diff --git a/scripts/js/release-metadata.mjs b/scripts/js/release-metadata.mjs
index 5fd2975b3..0f48deb63 100644
--- a/scripts/js/release-metadata.mjs
+++ b/scripts/js/release-metadata.mjs
@@ -637,15 +637,6 @@ function verify(args) {
         rpc,
       ]);
       if (declared === ZERO_HASH) {
-        // A key that is tolerated unset is also tolerated undeclared. Such keys are outside
-        // the declared release surface, so the declaration pass never writes a codehash for
-        // them; a network whose genesis predates the current policy can still have one set,
-        // and that combination (set, no code identity) is expected there.
-        if (UNSET_TOLERATED[key]) {
-          resolved.add(address.toLowerCase());
-          console.log(`  skip ${key} ${address} (${label}: no declaration, ${UNSET_TOLERATED[key]})`);
-          continue;
-        }
         problems.push(`key '${key}' (${label}) has no declared codehash`);
         continue;
       }
@@ -678,15 +669,6 @@ function verify(args) {
   const notExpected = new Set(unpointed);
   for (const [address, label] of byAddress) {
     if (!resolved.has(address) && !notExpected.has(address)) {
-      // A `*Legacy` entry records an address that became stale or unused after an in-place
-      // upgrade: when a contract moves to a new address, the outgoing one keeps its manifest
-      // entry under the `Legacy` suffix instead of being erased, because live state can keep
-      // depending on it after nothing points at it. Unkeyed by design, so the reverse check
-      // skips it instead of reading it as an orphan.
-      if (label.endsWith("Legacy")) {
-        console.log(`  skip ${label} ${contracts[label]} (superseded deployment, kept for the beacon upgrade path)`);
-        continue;
-      }
       problems.push(`${label} ${contracts[label]} is in the manifest but no key points at it`);
     }
   }

From 027e763130f3b2262bb9843a3d8ccfd0f4e47a97 Mon Sep 17 00:00:00 2001
From: Giuseppe Re <giuseppe.re@parity.io>
Date: Tue, 22 Sep 2026 11:21:31 +0200
Subject: [PATCH 05/22] chore: record the live testnet manifests (#315)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

 Records what the two live testnets actually run.

- `paseo-assethub` is updated to the post-v0.8.0 in-place-upgrade state:
the store factory lives behind a proxy at `0x99605a92…71f6`, its beacons
moved with it, and the outgoing factory and beacons stay recorded under
`*Legacy` keys because the migrated stores remain on them (see #312).
- `previewnet` gets its first committed manifest, read from its chain.
It runs an unmodified v0.8.0 genesis, so every address equals
`deployments/expected.json`. A README explains the chain id shared with
`paseo-assethub` and the `*Legacy` convention.
- `release-metadata.mjs verify` learns two general rules: a `*Legacy`
manifest entry is a superseded deployment that holds no registry key by
design, and a key tolerated unset is also tolerated undeclared where an
older genesis set it.

## Type

- [ ] Bug fix
- [ ] Feature
- [ ] Breaking change
- [ ] Documentation
- [x] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [x] Deployment scripts
- [ ] Tests

## Related Issues

## Fixes

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [x] `forge test` passes
- [x] No new compiler warnings

### Testing

- [x] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [ ] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**

## How to test

```bash
node scripts/js/release-metadata.mjs validate

node scripts/js/release-metadata.mjs verify --network paseo-assethub \
  --rpc https://eth-rpc-paseo-next.polkadot.io --tag v0.8.0

node scripts/js/release-metadata.mjs verify --network previewnet \
  --rpc https://previewnet.substrate.dev/eth-rpc --tag v0.8.0
```

Both verifies end with "matches the chain".

## Notes

Manifests are records of live networks; the Paseo one diverges from
expected.json where its history does (Legacy entries, a lens deployed
before the current set), and the previewnet one matches it exactly
---
 deployments/paseo-assethub/420420417.json |  2 +-
 deployments/previewnet/420420417.json     |  1 +
 deployments/previewnet/README.md          | 18 ++++++++++++++++++
 scripts/js/release-metadata.mjs           | 18 ++++++++++++++++++
 4 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 deployments/previewnet/420420417.json
 create mode 100644 deployments/previewnet/README.md

diff --git a/deployments/paseo-assethub/420420417.json b/deployments/paseo-assethub/420420417.json
index bbb35225e..968901c10 100644
--- a/deployments/paseo-assethub/420420417.json
+++ b/deployments/paseo-assethub/420420417.json
@@ -1 +1 @@
-{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
+{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","LabelStoreBeaconLegacy":"0xb57Ebc2e7085616d4906D1fE49af1cE13f7dffeF","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","StoreFactoryLegacy":"0x709A027F446a9e2a4BB9cb9a9c754435b19e32B7","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad","UserStoreBeaconLegacy":"0xb7C995601679840d36F37E86DB2d7dF30797eC5C","_seed":"0x0000000000000000000000000000000000000000"}
diff --git a/deployments/previewnet/420420417.json b/deployments/previewnet/420420417.json
new file mode 100644
index 000000000..2f36c9126
--- /dev/null
+++ b/deployments/previewnet/420420417.json
@@ -0,0 +1 @@
+{"Create3Factory":"0x8533c79E058c5a6489CAFeCA86dc600E029D75f5","DotnsContentResolver":"0x7F74D7CD50f5a834270E2ad395a01b01891AB37d","DotnsCostModelRegistry":"0x8bfd1f0957e73716732e725802f13830B5682da4","DotnsFlatPricing":"0xD839B281dF72Df44fF275305E72cAEEc0fDAA648","DotnsNameEscrow":"0x4881Afb78e7C908cAe818168B926229D93376520","DotnsNameWhitelist":"0x420166cD67Ca0233094E492a4BbA67045eD7C38C","DotnsPopController":"0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b","DotnsPopLens":"0xfe5A45f7fD58D1A6FE09455DB799405b1dcE9411","DotnsPopResolver":"0xDaC984884EcA8Fc44011f1D6C49B27828390A72B","DotnsProtocolRegistry":"0xD19e3D0C97CF501125a04A97405e3e6592fa846E","DotnsRegistrar":"0x4f06E818Ba3d987704fd91cf3d868E4b019106Ab","DotnsRegistrarController":"0xBdaA01bD1bA67d709F2b1fF286Da0d854977EA30","DotnsRegistry":"0xf34054fd76BbF85f216cf9908226D5f0A72E50CA","DotnsResolver":"0xbd1165E549DF96F083c0A16f61590927bC187009","DotnsReverseResolver":"0xee3883d7eB60Ee9BCD7F3bcD8f2f05302A9Cc035","LabelStoreBeacon":"0x2227d9807F5A71332Aaa0640643030f2A3bf84cD","Multicall3":"0xB4468000abD87D3c56cbFBd153161223D7b109e5","PopRules":"0x747B456bE03aec0b42bd85C51513730FBD45DA31","StoreFactory":"0x99605a926FcB40aB520F659c6505E5ff862771f6","UserStoreBeacon":"0x3d1Ca165f7A5e387C2df02DB2FadD3149c1C72ad"}
diff --git a/deployments/previewnet/README.md b/deployments/previewnet/README.md
new file mode 100644
index 000000000..420ca9599
--- /dev/null
+++ b/deployments/previewnet/README.md
@@ -0,0 +1,18 @@
+# previewnet
+
+The Product Preview Network's Asset Hub (`wss://previewnet.substrate.dev/asset-hub`,
+ETH RPC `https://previewnet.substrate.dev/eth-rpc`), TLD `.dot`. Deployed from a v0.8.0
+genesis, so every address matches the fresh-deploy set in `deployments/expected.json`.
+
+The chain id is `420420417`, the same as `paseo-assethub`: pallet-revive testnets share it,
+so the network folder, not the chain id, is what identifies a deployment. The two manifests
+differ where their histories do: a network upgraded in place carries `*Legacy` entries for
+addresses its upgrades superseded, and can hold contracts deployed before the current set.
+
+This network is wiped and redeployed periodically; verify against the chain before relying
+on this file after a wipe:
+
+```bash
+node scripts/js/release-metadata.mjs verify --network previewnet \
+  --rpc https://previewnet.substrate.dev/eth-rpc --tag v0.8.0
+```
diff --git a/scripts/js/release-metadata.mjs b/scripts/js/release-metadata.mjs
index 0f48deb63..5fd2975b3 100644
--- a/scripts/js/release-metadata.mjs
+++ b/scripts/js/release-metadata.mjs
@@ -637,6 +637,15 @@ function verify(args) {
         rpc,
       ]);
       if (declared === ZERO_HASH) {
+        // A key that is tolerated unset is also tolerated undeclared. Such keys are outside
+        // the declared release surface, so the declaration pass never writes a codehash for
+        // them; a network whose genesis predates the current policy can still have one set,
+        // and that combination (set, no code identity) is expected there.
+        if (UNSET_TOLERATED[key]) {
+          resolved.add(address.toLowerCase());
+          console.log(`  skip ${key} ${address} (${label}: no declaration, ${UNSET_TOLERATED[key]})`);
+          continue;
+        }
         problems.push(`key '${key}' (${label}) has no declared codehash`);
         continue;
       }
@@ -669,6 +678,15 @@ function verify(args) {
   const notExpected = new Set(unpointed);
   for (const [address, label] of byAddress) {
     if (!resolved.has(address) && !notExpected.has(address)) {
+      // A `*Legacy` entry records an address that became stale or unused after an in-place
+      // upgrade: when a contract moves to a new address, the outgoing one keeps its manifest
+      // entry under the `Legacy` suffix instead of being erased, because live state can keep
+      // depending on it after nothing points at it. Unkeyed by design, so the reverse check
+      // skips it instead of reading it as an orphan.
+      if (label.endsWith("Legacy")) {
+        console.log(`  skip ${label} ${contracts[label]} (superseded deployment, kept for the beacon upgrade path)`);
+        continue;
+      }
       problems.push(`${label} ${contracts[label]} is in the manifest but no key points at it`);
     }
   }

From 14f55a67dda1a3083567ec862df31f056f9886fd Mon Sep 17 00:00:00 2001
From: Krishna Waske <krishna@parity.io>
Date: Wed, 23 Sep 2026 11:23:11 +0530
Subject: [PATCH 06/22] fix(security): minor security bugs (#307)

## Description

Three low severity findings from the internal audit, grouped together.

**Subname paths now have a length limit.** `isNamePath` checked that
each dot separated segment was at most 63 octets but never checked the
path as a whole, so a caller could build an arbitrarily long
`parentLabel` out of legal segments. `setSubnodeOwner` stores the
resulting full name in the new owner's `LabelStore`, and that row cannot
be deleted, so the text sat there permanently and made every enumeration
that reads it back more expensive. The path is now capped at 255 octets,
which is the DNS wire format ceiling. A path over that limit reverts
with `ParentLabelMismatch`, same as a malformed one. Nothing live comes
close: real parent paths are one or two labels.

**CI now enforces the live manifest rule.** `CONTRIBUTING.md` says a
code PR must not edit `deployments/<network>/<chainId>.json`, because
those files are records of what is actually deployed and they ship
straight into the `deployments.json` release asset. The CREATE3 parity
gates compare `deployments/expected.json` instead, so nothing was
checking the live files. A new job in `release-metadata.yml` fails a PR
that touches one, unless the PR carries the `deployment-record` label,
which is what a real deploy uses.

**`setOwner` now mentions subnames.** The comment on `setOwner` warned
that a name sold directly keeps the seller's resolver pointer until the
buyer overwrites it. That is true for the node itself but not for
anything under it: a subname stores its own owner and `isAuthorised`
returns on that before it looks at the registrar, so the seller keeps
write access to every subname they created until the buyer reassigns
each one. Someone acting on the old wording would clean up the node and
think the name was clear. Added to both the implementation and the
interface.

## Type

- [x] Bug fix
- [ ] Feature
- [ ] Breaking change
- [x] Documentation
- [ ] Chore
- [ ] Refactor
- [x] Security

## Scope

- [x] Registration
- [ ] Resolver
- [x] Store
- [ ] Proof of Personhood
- [x] Deployment scripts
- [x] Tests

## Related Issues

Internal security audit, low severity findings.

## Fixes

## Checklist

### Code

- [x] Follows project style
- [ ] `forge build` passes
- [ ] `forge test` passes
- [ ] No new compiler warnings

### Testing

- [x] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [x] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [x] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

## How to test

```bash
forge test --mt test_accepts_a_path_at_the_ceiling
forge test --mt test_rejects_a_path_one_octet_over_the_ceiling
forge test --mt test_subnode_parent_path_over_the_octet_ceiling_is_rejected
```

## Notes
The length cap makes the injection cheaper to live with, it does not
close it. Anyone holding a node can still name someone else as a subnode
owner and push an undeletable row into their store. What changed is that
the row is now bounded at roughly 320 octets instead of being unbounded,
so the cost of reading it back is in the same range as a genuine row.
Closing it properly means one of three things( they are design decisions
though tbh): require the caller to be the subnode's new owner on the
persist branch, give `LabelStore` an owner callable removal, or bound
the scan in `DotnsPopLens` with a resumable cursor.

The `deployment-record` label has to exist in the repo before the new CI
job is useful, otherwise a legitimate deploy PR has no way through.

The audit also flagged that the release workflows hold deployment keys
with no environment gate. That one needs a GitHub environment set up
before the workflow change means anything, so it is not inc in this PR.

---------

Signed-off-by: GHkrishna <krishna@parity.io>
---
 .github/workflows/release-metadata.yml | 43 ++++++++++++++++++++++++++
 CONTRIBUTING.md                        |  4 +--
 DEPLOYMENTS.md                         |  2 +-
 README.md                              |  2 +-
 contracts/registry/DotnsRegistry.sol   |  6 ++++
 contracts/registry/IDotnsRegistry.sol  | 32 ++++++++++++++++---
 contracts/utils/StringUtils.sol        | 35 ++++++++++++++++++---
 test/unit/utils/StringUtils.t.sol      | 28 +++++++++++++++++
 8 files changed, 138 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/release-metadata.yml b/.github/workflows/release-metadata.yml
index d0ff5577d..837cc133a 100644
--- a/.github/workflows/release-metadata.yml
+++ b/.github/workflows/release-metadata.yml
@@ -7,6 +7,13 @@ name: Release Metadata
 # resolved against sources.
 on:
   pull_request:
+    # Includes labeled and unlabeled so adding `deployment-record` re-runs the manifest guard
+    # below. Listing types at all replaces the default set, so the defaults are repeated here.
+    types: [opened, edited, synchronize, reopened, labeled, unlabeled, ready_for_review]
+    # A pull request touching none of the paths below never starts this workflow, so no job in
+    # it reports a conclusion on that pull request. Harmless while these are optional checks,
+    # and the thing to settle before marking any of them required: a required check that never
+    # reports blocks the merge.
     paths:
       - "deployments/**"
       - ".github/abi-contracts.txt"
@@ -29,3 +36,39 @@ jobs:
 
       - name: Validate deployment manifests and the contract list
         run: bun scripts/js/release-metadata.mjs validate
+
+  # Live network manifests record what is deployed on a real chain and ship verbatim into the
+  # deployments.json release asset, so they are written by a deploy and never by a code change
+  # (CONTRIBUTING.md). The CREATE3 parity gates compare deployments/expected.json rather than
+  # these files, so this job is where that rule is enforced. A pull request that records a real
+  # deploy carries the `deployment-record` label and is exempt.
+  # Runs on every pull request rather than being skipped for a labelled one: a skipped job
+  # reports no conclusion, so making this a required check would leave a correctly labelled
+  # deploy pull request unable to merge. The label is read inside the step instead.
+  live-manifests-unchanged:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Reject edits to a live network manifest
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          IS_DEPLOY_RECORD: ${{ contains(github.event.pull_request.labels.*.name, 'deployment-record') }}
+        run: |
+          changed=$(git diff --name-only "$BASE_SHA"...HEAD -- 'deployments/*/*.json')
+          if [ -z "$changed" ]; then
+            echo "No live network manifest was edited."
+            exit 0
+          fi
+          if [ "$IS_DEPLOY_RECORD" = "true" ]; then
+            echo "Live network manifest edited under the 'deployment-record' label:"
+            printf '  %s\n' $changed
+            exit 0
+          fi
+          echo "::error::A code pull request must not edit a live network manifest."
+          printf '  %s\n' $changed
+          echo "Update deployments/expected.json instead; the live file is written by a deploy."
+          echo "If this pull request records a real deploy, add the 'deployment-record' label."
+          exit 1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 150ae8b2d..12c1b6897 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -135,7 +135,7 @@ Any new contract address that other contracts need to read must be looked up thr
 
 If you are adding a new contract category, add a `bytes32` key for it in `DotnsConstants.sol`, wire it up in `WireDeployments.s.sol` (including its entry in `_registryEntries`, so its code identity is declared and verified with the rest), and list the contract and its interface in `.github/abi-contracts.txt` so their ABIs ship in the release artifact. Read it the same way every existing contract does. Give the contract the standard `version()` mirror — a `view` that returns `protocolRegistry.protocolVersion()`, copied from any existing contract — and never a hardcoded version constant: what a network runs is declared once, on the protocol registry, every contract reports that one value, and per-contract identity is the declared codehash the deploy pipeline writes, not a self-report compiled into the bytecode.
 
-A change that moves or adds an address (a new salt, a new contract, a contract restructured behind a proxy) must update `deployments/expected.json` in the same PR — that diff is where review sees the move — and must NOT touch any `deployments/<network>/<chainId>.json`. Those are records of live networks, updated only by a real deploy on that network; editing one from a code PR publishes an address nothing is deployed at. The expected set diverging from a network's manifest is normal and means a redeploy or migration is owed on that network — see "Network manifests and the expected set" in `DEPLOYMENTS.md`.
+A change that moves or adds an address (a new salt, a new contract, a contract restructured behind a proxy) must update `deployments/expected.json` in the same PR — that diff is where review sees the move — and must NOT touch any `deployments/<network>/<chainId>.json`. Those are records of live networks, updated only by a real deploy on that network; editing one from a code PR publishes an address nothing is deployed at. The expected set diverging from a network's manifest is normal and means a redeploy or migration is owed on that network — see "Network manifests and the expected set" in `DEPLOYMENTS.md`. CI enforces this: `release-metadata.yml` fails a pull request that edits a live manifest unless the pull request carries the `deployment-record` label, which is how a real deploy records its addresses.
 
 Bad — the registrar address is frozen at construction, so rotating it needs an upgrade:
 
@@ -277,7 +277,7 @@ forge test --no-match-path 'test/fork/**'
 2. Delete the paired fork test under `test/fork/`.
 3. Delete every `*Old.sol` and `I*Old.sol` referenced only by the upgrade script.
 4. Delete temporary forge artefacts: `broadcast/<Script>.s.sol/` and `cache/<Script>.s.sol/`.
-5. Update `deployments/<network>/<chainid>.json` with any new addresses. It is the only place they are recorded, so nothing else needs editing.
+5. Update `deployments/<network>/<chainid>.json` with any new addresses. It is the only place they are recorded, so nothing else needs editing. That edit is the one case where touching a live manifest is correct, so label the pull request `deployment-record`; without it the `live-manifests-unchanged` check refuses the diff.
 
 ## Code of conduct
 
diff --git a/DEPLOYMENTS.md b/DEPLOYMENTS.md
index 1fd1c98ed..442d86083 100644
--- a/DEPLOYMENTS.md
+++ b/DEPLOYMENTS.md
@@ -283,7 +283,7 @@ If the deployment was intended to update a public environment, update the addres
 
 ### Network manifests and the expected set
 
-`deployments/<network>/<chainId>.json` is a **network record**: what is deployed on that live network right now. It is updated only by a real deploy or migration on that network, never by a code change. Everything that answers for reality reads these files: releases copy their addresses verbatim, and pointing tooling or the wire stage at an address with nothing behind it breaks whatever reads it.
+`deployments/<network>/<chainId>.json` is a **network record**: what is deployed on that live network right now. It is updated only by a real deploy or migration on that network, never by a code change. Everything that answers for reality reads these files: releases copy their addresses verbatim, and pointing tooling or the wire stage at an address with nothing behind it breaks whatever reads it. The CREATE3 parity gates compare `expected.json` rather than these files, so the rule that a code change leaves them alone is enforced in CI instead: `release-metadata.yml` fails a pull request that edits one unless it carries the `deployment-record` label.
 
 `deployments/expected.json` is the **expected set**: the addresses a fresh deploy of the current revision lands through the pinned CREATE3 factory. It is a property of the code, not of any network; the CI deploy job and `scripts/genesis/build-genesis.sh` verify against it, and releases never publish it.
 
diff --git a/README.md b/README.md
index 6628429f5..7ca916994 100644
--- a/README.md
+++ b/README.md
@@ -179,7 +179,7 @@ The registrar owns transferability. A name is marked soulbound at mint when the
 
 Forward registry mapping node to (owner, resolver) and supporting subnode creation. When a base name is minted on the registrar, the matching controller wires the node to the new owner through this registry. Privileged node wiring defers to the same controllers mapping on the registrar, so both controllers can write without the registry tracking controllers of its own.
 
-Subnames are created by the base-name owner. A subname carries its own (owner, resolver) and can in turn carry subnames, so the registry is the place the name hierarchy actually lives.
+Subnames are created by the base-name owner. A subname carries its own (owner, resolver) and can in turn carry subnames, so the registry is the place the name hierarchy actually lives. Nesting is bounded by the whole path rather than by a depth counter: the dotted parent path a caller submits is capped at 255 octets. That is a protocol limit rather than the RFC 1035 figure it resembles, since the RFC bound counts a wire-format name including its length bytes and its TLD. Each level of a subname is stored as its full dotted name in the owner's LabelStore, and that row cannot be deleted, so an uncapped path would let a parent owner write an arbitrarily long permanent row into an address they chose.
 
 The registry exposes isAuthorised(node, account) as the canonical check for whether an address may manage a node: the stored owner for a subname, or the ERC-721 holder, a single-token approvee, or an operator-for-all on the registrar for a tokenised name. Sibling contracts consult this view so a single registrar-level approval delegates management across the protocol rather than each contract maintaining its own approval list.
 
diff --git a/contracts/registry/DotnsRegistry.sol b/contracts/registry/DotnsRegistry.sol
index a22c216ff..1dcbcd84a 100644
--- a/contracts/registry/DotnsRegistry.sol
+++ b/contracts/registry/DotnsRegistry.sol
@@ -141,6 +141,12 @@ contract DotnsRegistry is Initializable, UUPSUpgradeable, OwnableUpgradeable, ID
         // prior owner's resolver cannot follow the name across that recycle. This does not cover a
         // secondary-market ERC-721 `transferFrom`: that path does not call the registry, so a name
         // sold directly carries the seller's resolver pointer until the buyer overwrites it.
+        // Nor does it cover the nodes beneath: a subname carries its own owner in `records`,
+        // and `_isAuthorised` returns on that owner before it ever consults the registrar, so a
+        // seller keeps write authority over every subname whose stored owner is still the
+        // seller, until the buyer reassigns each one through `setSubnodeOwner`. A subname
+        // created for someone else stays with that owner and leaves the seller no write path.
+        // The set is derivable from this contract's `NewOwner` events, which index the parent.
         // Owner remains the zero sentinel so reads delegate to the registrar's ERC-721 holder.
         records[node] = Record({
             owner: address(0),
diff --git a/contracts/registry/IDotnsRegistry.sol b/contracts/registry/IDotnsRegistry.sol
index 082def71d..62bd0dd05 100644
--- a/contracts/registry/IDotnsRegistry.sol
+++ b/contracts/registry/IDotnsRegistry.sol
@@ -11,6 +11,9 @@ interface IDotnsRegistry {
     /// @notice Record describing a subnode creation request.
     /// @param subLabel Human readable subnode label e.g "alice".
     /// @param parentLabel Canonical parent name without the TLD suffix e.g. bob or child.bob.
+    ///        At most `StringUtils.MAX_NAME_PATH_OCTETS` octets. The bound is on the path in
+    ///        octets, so it limits nesting only through how much of that budget each level
+    ///        spends.
     /// @param owner Address to assign as owner of the created subnode.
     /// @param persist Whether to index the subnode into the owner's `LabelStore`, deploying it on
     ///        demand. When false the ownership and resolver record is still written but the store
@@ -65,12 +68,22 @@ interface IDotnsRegistry {
     /// @notice Thrown when a sublabel is not a canonical lowercase ASCII DNS label.
     error InvalidLabel();
 
-    /// @notice Thrown when the supplied parent label does not match the parent node.
+    /// @notice Thrown when the supplied parent label does not match the parent node, or is not a
+    ///         valid name path.
+    /// @dev The two cases share one error because both mean the caller's `parentLabel` cannot be
+    ///      trusted to name `parentNode`: a mismatched namehash, a malformed segment, or a path
+    ///      over `StringUtils.MAX_NAME_PATH_OCTETS`. That last bound is on the path in octets, so
+    ///      it limits nesting only through how much of the budget each level spends. It exists
+    ///      because the composed full name is stored in a `LabelStore` row that has no delete
+    ///      path.
     error ParentLabelMismatch();
 
     /// @notice Record describing a subnode resolver update request.
     /// @param subLabel Human-readable subnode label e.g "alice".
     /// @param parentLabel Canonical parent name without the TLD suffix e.g bob or child.bob.
+    ///        At most `StringUtils.MAX_NAME_PATH_OCTETS` octets. The bound is on the path in
+    ///        octets, so it limits nesting only through how much of that budget each level
+    ///        spends.
     /// @param resolver Resolver contract address (zero clears).
     struct SubnodeResolverRecord {
         bytes32 parentNode;
@@ -84,7 +97,8 @@ interface IDotnsRegistry {
     ///      @custom:reverts NotAuthorised. The new owner address must be non-zero, otherwise
     ///      @custom:reverts NotAllowed. `record.subLabel` must be a single canonical DNS label
     ///      (otherwise @custom:reverts InvalidLabel) and `record.parentLabel` must be a name
-    ///      path whose namehash matches `record.parentNode` (otherwise
+    ///      path of at most `StringUtils.MAX_NAME_PATH_OCTETS` octets whose namehash matches
+    ///      `record.parentNode` (otherwise
     ///      @custom:reverts ParentLabelMismatch). Subnodes are parent-sovereign: the current
     ///      `record.parentNode` owner may reassign or rotate a subnode's resolver at any time
     ///      without the prior subnode owner's consent. On reassignment the resolver pointer is
@@ -110,7 +124,8 @@ interface IDotnsRegistry {
     ///      that surface trust signals to subnode owners should treat any resolver rotation as
     ///      a re-attestation prompt. `record.subLabel` must be a single canonical DNS label
     ///      (otherwise @custom:reverts InvalidLabel) and `record.parentLabel` must be a name
-    ///      path whose namehash matches `record.parentNode` (otherwise
+    ///      path of at most `StringUtils.MAX_NAME_PATH_OCTETS` octets whose namehash matches
+    ///      `record.parentNode` (otherwise
     ///      @custom:reverts ParentLabelMismatch). The resulting subnode must already exist,
     ///      otherwise @custom:reverts NotAuthorised. Emits @custom:emits NewResolver on
     ///      success.
@@ -126,8 +141,15 @@ interface IDotnsRegistry {
     ///      prior owner's resolver pointer (and the records keyed under it) cannot be inherited
     ///      by the next holder across that recycle. A secondary-market ERC-721 `transferFrom` does
     ///      not call the registry, so a name sold directly keeps the seller's resolver pointer
-    ///      until the buyer overwrites it. Stores `owner = address(0)` as a sentinel so reads
-    ///      delegate to `IDotnsRegistrar.ownerOf` and ERC-721 transfers remain authoritative. Emits
+    ///      until the buyer overwrites it. That covers the node itself and not the nodes beneath
+    ///      it: a subname stores its own owner, and @custom:function isAuthorised returns on that
+    ///      owner before consulting the registrar, so after the sale the seller keeps write
+    ///      authority over every subname whose stored owner is still the seller, until the buyer
+    ///      reassigns each one through @custom:function setSubnodeOwner. A subname created for
+    ///      someone else stays with that owner and leaves the seller no write path. The set is
+    ///      derivable from @custom:emits NewOwner, which indexes the parent node. Stores
+    ///      `owner = address(0)` as a sentinel so reads delegate to `IDotnsRegistrar.ownerOf` and
+    ///      ERC-721 transfers remain authoritative. Emits
     ///      @custom:emits NodeTransferred on success.
     function setOwner(bytes32 node, address newOwner) external;
 
diff --git a/contracts/utils/StringUtils.sol b/contracts/utils/StringUtils.sol
index ad1ef02c6..0904a4ec3 100644
--- a/contracts/utils/StringUtils.sol
+++ b/contracts/utils/StringUtils.sol
@@ -26,8 +26,25 @@ library StringUtils {
     ///      it reaches `MAX_DNS_LABEL_OCTETS + LITE_SUFFIX_DIGITS + 1` octets. Its stem is
     ///      bounded here but checked in @custom:function _isLitePersonLabel, which is stricter
     ///      on charset than a DNS label: letters only.
+    ///      This is the per-segment bound only; @custom:function isNamePath additionally bounds
+    ///      the whole path with @custom:constant MAX_NAME_PATH_OCTETS.
     uint256 internal constant MAX_DNS_LABEL_OCTETS = 63;
 
+    /// @notice Cap on the dotted parent path a caller submits, in octets.
+    /// @dev Not an RFC 1035 figure, despite the value. That ceiling is 255 octets of *wire* name,
+    ///      where each label carries a length prefix and the name ends in a zero byte, and it
+    ///      covers the fully qualified name. This bounds the dotted presentation string the caller
+    ///      passes in, which also carries no TLD, so the two are not the same quantity and this
+    ///      one must not be retuned to "match RFC 1035". What reaches a `LabelStore` row is longer
+    ///      again, and depends on the network's TLD: `subLabel` + "." + path + the TLD, so about
+    ///      323 octets at the maximum where the TLD is four octets.
+    /// @dev @custom:constant MAX_DNS_LABEL_OCTETS bounds one segment; this bounds the path. Without
+    ///      it a caller composes an arbitrarily long `parentLabel` out of legal 63-octet segments,
+    ///      and `DotnsRegistry.setSubnodeOwner` stores the full name built from it verbatim in a
+    ///      `LabelStore` row that has no delete path, so the text is a permanent multiplier on
+    ///      every enumeration that reads the row back.
+    uint256 internal constant MAX_NAME_PATH_OCTETS = 255;
+
     /// @notice ASCII full stop separating a lite label's stem from its digit suffix.
     /// @dev A lite label is the only label shape in DotNS that carries a separator;
     ///      @custom:function _isDnsLabel rejects it everywhere else.
@@ -213,18 +230,26 @@ library StringUtils {
         suffix = string(suffixBytes);
     }
 
-    /// @notice Validates that `s` is a dot-separated path of canonical DNS labels.
+    /// @notice Validates that `value` is a dot-separated path of canonical DNS labels, within
+    ///         the whole-path octet ceiling.
     /// @dev Each segment between dots must satisfy @custom:function isSingleLabel. Empty
     ///      segments (leading, trailing, or consecutive dots) fail. Used when
     ///      callers submit multi-label paths (e.g. `alice.dot`) rather than
     ///      bare labels.
+    ///      Two bounds apply and they are not the same one: @custom:constant MAX_DNS_LABEL_OCTETS
+    ///      caps each segment, and @custom:constant MAX_NAME_PATH_OCTETS caps the path. Without
+    ///      the second, a caller composes an unbounded path out of legal segments, so the
+    ///      segment bound alone does not bound what a caller can submit here.
     /// @param value Candidate name path.
-    /// @return isValid True if every dot-separated segment is a canonical DNS label.
+    /// @return isValid True if the path is at most @custom:constant MAX_NAME_PATH_OCTETS octets
+    ///         and every dot-separated segment is a canonical DNS label.
     function isNamePath(string calldata value) internal pure returns (bool isValid) {
-        bytes memory path = bytes(value);
-        uint256 length = path.length;
-        if (length == 0) return false;
+        // Measured on calldata and rejected before the copy: an oversized path is exactly the
+        // input this bound exists for, so it must not be paid for in memory first.
+        uint256 length = bytes(value).length;
+        if (length == 0 || length > MAX_NAME_PATH_OCTETS) return false;
 
+        bytes memory path = bytes(value);
         uint256 start;
         for (uint256 i = 0; i < length; ++i) {
             if (path[i] != bytes1(0x2e)) continue;
diff --git a/test/unit/utils/StringUtils.t.sol b/test/unit/utils/StringUtils.t.sol
index 9d8ee0047..9222a2063 100644
--- a/test/unit/utils/StringUtils.t.sol
+++ b/test/unit/utils/StringUtils.t.sol
@@ -28,6 +28,10 @@ contract StringUtilsHarness {
     function isLitePersonLabelMemory(string calldata value) external pure returns (bool) {
         return StringUtils.isLitePersonLabelMemory(value);
     }
+
+    function isNamePath(string calldata value) external pure returns (bool) {
+        return value.isNamePath();
+    }
 }
 
 /// @title StringUtilsTests
@@ -134,4 +138,28 @@ contract StringUtilsTests is Test {
         _assertLite(longest, true);
         assertFalse(utils.isSingleLabel(longest), "a lite label is not a single DNS label");
     }
+
+    /// @notice A path of exactly @custom:constant StringUtils.MAX_NAME_PATH_OCTETS octets passes.
+    /// @dev The per-segment bound leaves the path itself unbounded, and `setSubnodeOwner` stores
+    ///      the full name composed from a caller's path in a `LabelStore` row that has no delete
+    ///      path. The two cases below are what fix that ceiling: moving the constant without
+    ///      moving them is a failing build.
+    function test_isNamePath_accepts_a_path_at_the_ceiling() public view {
+        string memory segment = _stem(63);
+        string memory path = string.concat(segment, ".", segment, ".", segment, ".", segment);
+        assertEq(bytes(path).length, StringUtils.MAX_NAME_PATH_OCTETS, "fixture is not at the cap");
+        assertTrue(utils.isNamePath(path));
+    }
+
+    /// @notice One octet over the ceiling is refused, with every segment individually legal so
+    ///         the refusal cannot come from the per-segment bound.
+    function test_isNamePath_rejects_a_path_one_octet_over_the_ceiling() public view {
+        string memory segment = _stem(63);
+        string memory path =
+            string.concat(segment, ".", segment, ".", segment, ".", _stem(62), ".", _stem(1));
+        assertEq(
+            bytes(path).length, StringUtils.MAX_NAME_PATH_OCTETS + 1, "fixture is not one over"
+        );
+        assertFalse(utils.isNamePath(path));
+    }
 }

From 408f75eed874f8f043f72c6fa03daf3be567c9a1 Mon Sep 17 00:00:00 2001
From: Giuseppe Re <giuseppe.re@parity.io>
Date: Wed, 23 Sep 2026 08:31:30 +0200
Subject: [PATCH 07/22] ci: gate the release genesis key behind the releases
 environment (#316)

## Description

The genesis owner key `DOTNS_ADMIN_KEY` was a repository-level secret,
readable by any workflow on any branch, with a silent mnemonic fallback
deciding the owner when unset.

- Both publish jobs now run in the `releases` environment: reviewer
approval required, refs limited to `master` and `v[0-9]*` tags, key
stored as an environment secret.
- A pre-build step checks the key derives to the environment's declared
`DOTNS_ADMIN_ADDRESS`, so a mistyped key fails before a genesis is
built.
- The mnemonic fallback is removed from the genesis script: one explicit
key, or a loud failure.

Follow-up once merged: delete the repository-level `DOTNS_ADMIN_KEY` and
`DOTNS_ADMIN_MNEMONIC`, whose last consumers this PR removes.

## Type

- [ ] Bug fix
- [ ] Feature
- [ ] Breaking change
- [ ] Documentation
- [x] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [x] Deployment scripts
- [ ] Tests

## Related Issues

## Fixes

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [x] `forge test` passes
- [x] No new compiler warnings

### Testing

- [x] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [x] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [ ] No breaking changes
- [x] Breaking changes documented below

**Breaking changes:** a release run now requires the `releases`
environment to exist with `DOTNS_ADMIN_KEY` and `DOTNS_ADMIN_ADDRESS`
configured, and pauses for a reviewer approval. Building a genesis
locally with only `DOTNS_ADMIN_MNEMONIC` set no longer works; pass
`DOTNS_ADMIN_KEY`.
`workflow_dispatch` releases can only be started from master; a dispatch
from another branch stops at the environment gate.

## How to test

```bash
bash -n scripts/genesis/build-genesis.sh

# refuses without a key, with a message naming the one accepted credential
unset DOTNS_ADMIN_KEY DOTNS_ADMIN_MNEMONIC; bash scripts/genesis/build-genesis.sh release
```

The full gate is exercised by the next prerelease: the run must pause on
the releases environment, pass the address check, and build with the
fresh key.

## Notes

The environment itself (reviewers, ref patterns, secret, variable) has
already been configured.
---
 .github/workflows/publish-prerelease.yml | 31 +++++++++++++++++++-
 .github/workflows/publish-release.yml    | 37 +++++++++++++++++++++---
 RELEASE_ARTIFACTS.md                     | 14 +++++++++
 scripts/genesis/build-genesis.sh         | 21 +++++---------
 4 files changed, 85 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml
index 67cdf371a..7b42df553 100644
--- a/.github/workflows/publish-prerelease.yml
+++ b/.github/workflows/publish-prerelease.yml
@@ -1,5 +1,8 @@
 name: Publish Beta Package
 
+# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, and the
+# job below pauses on the `releases` environment for a reviewer, so a release takes two
+# distinct human actions: cutting the tag, and approving the run it starts.
 on:
   push:
     tags:
@@ -23,6 +26,9 @@ concurrency:
 jobs:
   beta-release:
     runs-on: ubuntu-latest
+    # Gated: this job reads the genesis owner key, which lives only on the `releases`
+    # environment, so every run waits for a reviewer's approval there.
+    environment: releases
     # Baked into the genesis registry, so it decides which networks the artifact suits.
     # Job-level: five steps name the file derived from it and must not disagree.
     env:
@@ -87,6 +93,30 @@ jobs:
 
       - uses: ./.github/actions/setup-foundry
 
+      # The environment pairs the key (secret) with its address (variable). Deriving one from
+      # the other before the build turns a mistyped key into a failed run instead of a genesis
+      # owned by an address nobody holds. The address is public; the key is never printed.
+      - name: Check the owner key against its declared address
+        env:
+          DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
+          DOTNS_ADMIN_ADDRESS: ${{ vars.DOTNS_ADMIN_ADDRESS }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOTNS_ADMIN_KEY" ]; then
+            echo "::error::DOTNS_ADMIN_KEY is not configured on the releases environment"
+            exit 1
+          fi
+          if [ -z "$DOTNS_ADMIN_ADDRESS" ]; then
+            echo "::error::DOTNS_ADMIN_ADDRESS is not configured on the releases environment"
+            exit 1
+          fi
+          DERIVED="$(cast wallet address --private-key "$DOTNS_ADMIN_KEY")"
+          if [ "$(printf '%s' "$DERIVED" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$DOTNS_ADMIN_ADDRESS" | tr 'A-Z' 'a-z')" ]; then
+            echo "::error::DOTNS_ADMIN_KEY derives to $DERIVED, the environment declares $DOTNS_ADMIN_ADDRESS"
+            exit 1
+          fi
+          echo "Owner key derives to the declared address $DERIVED"
+
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.2.6"
@@ -125,7 +155,6 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
           FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
           DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
-          DOTNS_ADMIN_MNEMONIC: ${{ secrets.DOTNS_ADMIN_MNEMONIC }}
         run: bash scripts/genesis/build-genesis.sh release
 
       - name: Extract ABIs
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 3ae5748f4..9d0a18dd2 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -1,5 +1,8 @@
 name: Publish Release Package
 
+# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, and the
+# job below pauses on the `releases` environment for a reviewer, so a release takes two
+# distinct human actions: cutting the tag, and approving the run it starts.
 on:
   push:
     tags:
@@ -23,6 +26,9 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Gated: this job reads the genesis owner key, which lives only on the `releases`
+    # environment, so every run waits for a reviewer's approval there.
+    environment: releases
     # Baked into the genesis registry, so it decides which networks the artifact suits.
     # Job-level: five steps name the file derived from it and must not disagree.
     env:
@@ -82,6 +88,30 @@ jobs:
 
       - uses: ./.github/actions/setup-foundry
 
+      # The environment pairs the key (secret) with its address (variable). Deriving one from
+      # the other before the build turns a mistyped key into a failed run instead of a genesis
+      # owned by an address nobody holds. The address is public; the key is never printed.
+      - name: Check the owner key against its declared address
+        env:
+          DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
+          DOTNS_ADMIN_ADDRESS: ${{ vars.DOTNS_ADMIN_ADDRESS }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOTNS_ADMIN_KEY" ]; then
+            echo "::error::DOTNS_ADMIN_KEY is not configured on the releases environment"
+            exit 1
+          fi
+          if [ -z "$DOTNS_ADMIN_ADDRESS" ]; then
+            echo "::error::DOTNS_ADMIN_ADDRESS is not configured on the releases environment"
+            exit 1
+          fi
+          DERIVED="$(cast wallet address --private-key "$DOTNS_ADMIN_KEY")"
+          if [ "$(printf '%s' "$DERIVED" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$DOTNS_ADMIN_ADDRESS" | tr 'A-Z' 'a-z')" ]; then
+            echo "::error::DOTNS_ADMIN_KEY derives to $DERIVED, the environment declares $DOTNS_ADMIN_ADDRESS"
+            exit 1
+          fi
+          echo "Owner key derives to the declared address $DERIVED"
+
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.2.6"
@@ -113,15 +143,14 @@ jobs:
       # contracts, the deploy scripts and the CREATE3 factory key that fixes every address,
       # and the artifact then ships from the same commit as the ABIs beside it.
       #
-      # The owner key is taken from DOTNS_ADMIN_KEY if set, otherwise derived from
-      # DOTNS_ADMIN_MNEMONIC. It ends up owning the registry, resolvers, registrar, store factory
-      # and beacons in the genesis storage, so the script refuses to run without one.
+      # The owner key is DOTNS_ADMIN_KEY, checked against its declared address above. It
+      # ends up owning the registry, resolvers, registrar, store factory and beacons in the
+      # genesis storage, so the script refuses to run without it.
       - name: Build pallet-revive genesis
         env:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
           FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
           DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
-          DOTNS_ADMIN_MNEMONIC: ${{ secrets.DOTNS_ADMIN_MNEMONIC }}
         run: bash scripts/genesis/build-genesis.sh release
 
       - name: Extract ABIs
diff --git a/RELEASE_ARTIFACTS.md b/RELEASE_ARTIFACTS.md
index 33fd160e1..584730ad4 100644
--- a/RELEASE_ARTIFACTS.md
+++ b/RELEASE_ARTIFACTS.md
@@ -115,6 +115,20 @@ With `--tag vX.Y.Z` it additionally checks the chain's own declarations: `protoc
 
 ## Publishing
 
+Both publish workflows run in the `releases` environment, because building a genesis reads the
+key that owns every contract in it. The environment holds:
+
+- `DOTNS_ADMIN_KEY` (secret): the genesis owner's private key.
+- `DOTNS_ADMIN_ADDRESS` (variable): the address that key derives to. The workflow checks the
+  pair right after the toolchain is installed and fails the run on a mismatch, so a mistyped
+  key dies before anything is built.
+- Required reviewers: the dotns team. Every release run pauses for one approval.
+- Deployment refs: `master` (for `workflow_dispatch`) and `v[0-9]*` tags. A dispatch started
+  from any other branch stops at the environment gate.
+
+Creating a `v*` tag is itself restricted to the dotns team by the `release tags` ruleset, so a
+release takes two distinct human actions: cutting the tag, and approving the run it starts.
+
 `deployments.json`, `release-manifest.json`, and `codehashes.json` are generated during the release by `scripts/js/release-metadata.mjs build`, from the committed deployment manifests and the build that just ran; `abi-diff.json` comes from `abidiff` against the previous release's published ABIs. Neither is committed: an address stored in two tracked files eventually disagrees with itself, so `deployments/<network>/<chain-id>.json` is the only tracked copy.
 
 That file holds exactly one address per contract, the current one. Each deploy overwrites the entries it produces, so it tracks only the latest deployment for a network and never a history of them; previous address sets exist only in this repository's git history. It also carries no implementation addresses behind the UUPS proxies, and no record of which commit was deployed.
diff --git a/scripts/genesis/build-genesis.sh b/scripts/genesis/build-genesis.sh
index 135236438..4044ac426 100755
--- a/scripts/genesis/build-genesis.sh
+++ b/scripts/genesis/build-genesis.sh
@@ -43,13 +43,14 @@ CANONICAL_MANIFEST="deployments/expected.json"
 # does: this key ends up owning the registry, the resolvers, the registrar, the
 # store factory and the beacons.
 #
-# Accepted, in order of precedence:
-#   DOTNS_ADMIN_KEY       a raw private key — the admin credential this repo already holds
-#   DOTNS_ADMIN_MNEMONIC  the admin mnemonic; index $DOTNS_ADMIN_INDEX (default 0)
+# Accepted:
+#   DOTNS_ADMIN_KEY       a raw private key — in CI it lives on the `releases` environment,
+#                         behind a required reviewer, paired with a DOTNS_ADMIN_ADDRESS
+#                         variable the workflow checks the key against before this runs
 #
-# Deliberately NOT accepted: DOTNS_MNEMONIC. That is an operational credential for driving
-# the `dotns` CLI, not the contract admin, and quietly making it the owner of every
-# contract in a genesis would be a hard mistake to spot.
+# Deliberately NOT accepted: DOTNS_ADMIN_MNEMONIC and DOTNS_MNEMONIC. A second credential
+# accepted here would let a different secret silently decide who owns every contract in a
+# genesis, and a wrong owner is a hard mistake to spot. One explicit key, or a loud failure.
 # Not DEPLOYER_KEY: that name is dotns-releases' own secret, and accepting it here
 # would make which key owns a published genesis depend on which repo the build ran in.
 ADMIN_KEY="${DOTNS_ADMIN_KEY:-}"
@@ -84,15 +85,9 @@ for tool in forge anvil cast node jq curl; do
     command -v "$tool" >/dev/null 2>&1 || { echo "Error: $tool is not on PATH" >&2; exit 1; }
 done
 
-# Needs cast, so it happens after the check above.
-if [ -z "$ADMIN_KEY" ] && [ -n "${DOTNS_ADMIN_MNEMONIC:-}" ]; then
-    ADMIN_KEY="$(cast wallet private-key --mnemonic "$DOTNS_ADMIN_MNEMONIC" "${DOTNS_ADMIN_INDEX:-0}")"
-    echo "Owner key derived from DOTNS_ADMIN_MNEMONIC, index ${DOTNS_ADMIN_INDEX:-0}."
-fi
-
 if [ -z "$ADMIN_KEY" ]; then
     cat >&2 <<'MSG'
-Error: no owner key. Set DOTNS_ADMIN_KEY or DOTNS_ADMIN_MNEMONIC.
+Error: no owner key. Set DOTNS_ADMIN_KEY.
 
 Whichever is given becomes the owner of every DotNS contract in the genesis
 state, so this build refuses to fall back to a public dev key.

From bcfec885ee2c3c45e7035e076c7eb2ede3bce419 Mon Sep 17 00:00:00 2001
From: Giuseppe Re <giuseppe.re@parity.io>
Date: Wed, 23 Sep 2026 08:31:53 +0200
Subject: [PATCH 08/22] chore: add SPDX copyright attribution and a NOTICE file
 (#317)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

Aligns the repository with the legal guidelines for open source
attribution.

- Every Parity-authored contract gains one line under its SPDX
identifier: `SPDX-FileCopyrightText: © 2026 Parity Technologies`. A
contract file travels alone through explorers and vendoring, and carried
a license identifier with no copyright holder to preserve;
`SPDX-FileCopyrightText` is the REUSE-standard field for this, so
coverage stays machine-checkable.
- Vendored third-party code keeps its own notices: `contracts/external/`
(authoritative SPDX headers) and `contracts/utils/Multicall3.sol`
(mds1/multicall3, MIT) carry no Parity line.
- A `NOTICE` file records the project copyright, the MIT license
pointer, and the third-party attributions; the README's license section
now points at it.

Comment-only for the contracts: bytecode, ABIs, and storage layouts are
unchanged.

## Type

- [ ] Bug fix
- [ ] Feature
- [ ] Breaking change
- [ ] Documentation
- [x] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [ ] Deployment scripts
- [ ] Tests

## Related Issues

## Fixes

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [x] `forge test` passes
- [x] No new compiler warnings

### Testing

- [ ] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [x] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**

## How to test

```bash
grep -rL "SPDX-FileCopyrightText" contracts --include='*.sol' | grep -v external
```

Prints only `contracts/utils/Multicall3.sol`, the vendored file that
keeps its original authors' notice.

## Notes

The added lines change each file's compiler metadata hash and nothing
else. Release tooling strips metadata before comparing codehashes, so
codehashes.json and the deployed-bytecode checks are unaffected.
---
 NOTICE                                         | 18 ++++++++++++++++++
 README.md                                      |  2 +-
 contracts/deploy/Create3Factory.sol            |  1 +
 contracts/escrow/DotnsNameEscrow.sol           |  1 +
 contracts/escrow/IDotnsNameEscrow.sol          |  1 +
 contracts/pop/DotnsCostModelRegistry.sol       |  1 +
 contracts/pop/DotnsFlatPricing.sol             |  1 +
 contracts/pop/DotnsScarcityPricing.sol         |  1 +
 contracts/pop/IDotnsCostModelRegistry.sol      |  1 +
 contracts/pop/IDotnsPricing.sol                |  1 +
 contracts/pop/IPopRules.sol                    |  1 +
 contracts/pop/PopRules.sol                     |  1 +
 contracts/registrars/DotnsPopController.sol    |  1 +
 contracts/registrars/DotnsPopLens.sol          |  1 +
 contracts/registrars/DotnsRegistrar.sol        |  1 +
 .../registrars/DotnsRegistrarController.sol    |  1 +
 contracts/registrars/IDotnsController.sol      |  1 +
 contracts/registrars/IDotnsPopController.sol   |  1 +
 contracts/registrars/IDotnsPopLens.sol         |  1 +
 contracts/registrars/IDotnsRegistrar.sol       |  1 +
 .../registrars/IDotnsRegistrarController.sol   |  1 +
 contracts/registry/DotnsProtocolRegistry.sol   |  1 +
 contracts/registry/DotnsRegistry.sol           |  1 +
 contracts/registry/IDotnsProtocolRegistry.sol  |  1 +
 contracts/registry/IDotnsRegistry.sol          |  1 +
 contracts/resolvers/DotnsContentResolver.sol   |  1 +
 contracts/resolvers/DotnsPopResolver.sol       |  1 +
 contracts/resolvers/DotnsResolver.sol          |  1 +
 contracts/resolvers/DotnsReverseResolver.sol   |  1 +
 contracts/resolvers/IDotnsContentResolver.sol  |  1 +
 contracts/resolvers/IDotnsPopResolver.sol      |  1 +
 contracts/resolvers/IDotnsResolver.sol         |  1 +
 contracts/resolvers/IDotnsReverseResolver.sol  |  1 +
 contracts/store/IDotnsStore.sol                |  1 +
 contracts/store/ILabelStore.sol                |  1 +
 contracts/store/IStoreFactory.sol              |  1 +
 contracts/store/IUserStore.sol                 |  1 +
 contracts/store/LabelStore.sol                 |  1 +
 contracts/store/StoreFactory.sol               |  1 +
 contracts/store/UserStore.sol                  |  1 +
 contracts/utils/DotnsConstants.sol             |  1 +
 contracts/utils/LabelUtils.sol                 |  1 +
 contracts/utils/RegistrationUtils.sol          |  1 +
 contracts/utils/StoreAuth.sol                  |  1 +
 contracts/utils/StoreUtils.sol                 |  1 +
 contracts/utils/StringUtils.sol                |  1 +
 contracts/utils/SubnodeUtils.sol               |  1 +
 contracts/utils/SystemUtils.sol                |  1 +
 contracts/whitelist/DotnsNameWhitelist.sol     |  1 +
 contracts/whitelist/IDotnsNameWhitelist.sol    |  1 +
 50 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 NOTICE

diff --git a/NOTICE b/NOTICE
new file mode 100644
index 000000000..79e7cc93f
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,18 @@
+dotNS
+© 2026 Parity Technologies
+
+This product is licensed under the MIT License; see the LICENSE file.
+
+Third-party components retain their own licences, stated in each file's
+SPDX-License-Identifier header, which is authoritative:
+
+- contracts/external/revive/ISystem.sol: pallet-revive system interface,
+  from the polkadot-sdk project (Apache-2.0).
+- contracts/external/personhood/IPersonhood.sol: Proof-of-Personhood
+  interface (GPL-3.0-only).
+- contracts/utils/Multicall3.sol: Multicall3 by its original authors
+  (mds1/multicall3, MIT), vendored with only a pragma update.
+
+Build and test dependencies (OpenZeppelin Contracts, forge-std, and
+others) are fetched at build time under their own licences and stay
+outside this repository and its release artifacts.
diff --git a/README.md b/README.md
index 7ca916994..fda3199c9 100644
--- a/README.md
+++ b/README.md
@@ -312,4 +312,4 @@ The protocol carries a handful of constraints worth knowing before deploying or
 
 ## License
 
-Licensed under the MIT License. See [LICENSE](./LICENSE). External interface definitions under `contracts/external/` retain their upstream licences (the SPDX header in each file is authoritative). Security policy and disclosure: see [SECURITY.md](./SECURITY.md).
+Licensed under the MIT License. See [LICENSE](./LICENSE) and [NOTICE](./NOTICE). External interface definitions under `contracts/external/` retain their upstream licences (the SPDX header in each file is authoritative). Security policy and disclosure: see [SECURITY.md](./SECURITY.md).
diff --git a/contracts/deploy/Create3Factory.sol b/contracts/deploy/Create3Factory.sol
index 3502f78c4..a47195dbe 100644
--- a/contracts/deploy/Create3Factory.sol
+++ b/contracts/deploy/Create3Factory.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {CREATE3} from "solady/utils/CREATE3.sol";
diff --git a/contracts/escrow/DotnsNameEscrow.sol b/contracts/escrow/DotnsNameEscrow.sol
index 518a71b02..2ddb0c8d8 100644
--- a/contracts/escrow/DotnsNameEscrow.sol
+++ b/contracts/escrow/DotnsNameEscrow.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/escrow/IDotnsNameEscrow.sol b/contracts/escrow/IDotnsNameEscrow.sol
index 16d7c6776..e9862c9c5 100644
--- a/contracts/escrow/IDotnsNameEscrow.sol
+++ b/contracts/escrow/IDotnsNameEscrow.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title Dotns Name Escrow Interface
diff --git a/contracts/pop/DotnsCostModelRegistry.sol b/contracts/pop/DotnsCostModelRegistry.sol
index 86842da0d..95d03ad04 100644
--- a/contracts/pop/DotnsCostModelRegistry.sol
+++ b/contracts/pop/DotnsCostModelRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
diff --git a/contracts/pop/DotnsFlatPricing.sol b/contracts/pop/DotnsFlatPricing.sol
index 2be10f974..b2a51fe95 100644
--- a/contracts/pop/DotnsFlatPricing.sol
+++ b/contracts/pop/DotnsFlatPricing.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
diff --git a/contracts/pop/DotnsScarcityPricing.sol b/contracts/pop/DotnsScarcityPricing.sol
index de4b02d08..f0d718697 100644
--- a/contracts/pop/DotnsScarcityPricing.sol
+++ b/contracts/pop/DotnsScarcityPricing.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
diff --git a/contracts/pop/IDotnsCostModelRegistry.sol b/contracts/pop/IDotnsCostModelRegistry.sol
index f2630160d..ef493af12 100644
--- a/contracts/pop/IDotnsCostModelRegistry.sol
+++ b/contracts/pop/IDotnsCostModelRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
diff --git a/contracts/pop/IDotnsPricing.sol b/contracts/pop/IDotnsPricing.sol
index d7b4f1669..f2efd080b 100644
--- a/contracts/pop/IDotnsPricing.sol
+++ b/contracts/pop/IDotnsPricing.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title DotNS Pricing Cost Model
diff --git a/contracts/pop/IPopRules.sol b/contracts/pop/IPopRules.sol
index fc4201702..15ea8680a 100644
--- a/contracts/pop/IPopRules.sol
+++ b/contracts/pop/IPopRules.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title Proof of Personhood Rules for Dotns
diff --git a/contracts/pop/PopRules.sol b/contracts/pop/PopRules.sol
index 5bbebaae3..841440054 100644
--- a/contracts/pop/PopRules.sol
+++ b/contracts/pop/PopRules.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registrars/DotnsPopController.sol b/contracts/registrars/DotnsPopController.sol
index b47b48551..bb2052fab 100644
--- a/contracts/registrars/DotnsPopController.sol
+++ b/contracts/registrars/DotnsPopController.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registrars/DotnsPopLens.sol b/contracts/registrars/DotnsPopLens.sol
index 76ba105cb..c9f28fb41 100644
--- a/contracts/registrars/DotnsPopLens.sol
+++ b/contracts/registrars/DotnsPopLens.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsPopLens} from "./IDotnsPopLens.sol";
diff --git a/contracts/registrars/DotnsRegistrar.sol b/contracts/registrars/DotnsRegistrar.sol
index cea6760ee..719a6ba3b 100644
--- a/contracts/registrars/DotnsRegistrar.sol
+++ b/contracts/registrars/DotnsRegistrar.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registrars/DotnsRegistrarController.sol b/contracts/registrars/DotnsRegistrarController.sol
index ac5672266..b2e36f16a 100644
--- a/contracts/registrars/DotnsRegistrarController.sol
+++ b/contracts/registrars/DotnsRegistrarController.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registrars/IDotnsController.sol b/contracts/registrars/IDotnsController.sol
index f9e4a412e..f0417ed5b 100644
--- a/contracts/registrars/IDotnsController.sol
+++ b/contracts/registrars/IDotnsController.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
diff --git a/contracts/registrars/IDotnsPopController.sol b/contracts/registrars/IDotnsPopController.sol
index cff38f80e..be1995b7c 100644
--- a/contracts/registrars/IDotnsPopController.sol
+++ b/contracts/registrars/IDotnsPopController.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsController} from "./IDotnsController.sol";
diff --git a/contracts/registrars/IDotnsPopLens.sol b/contracts/registrars/IDotnsPopLens.sol
index a30cb0e5d..d31149654 100644
--- a/contracts/registrars/IDotnsPopLens.sol
+++ b/contracts/registrars/IDotnsPopLens.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IPopRules} from "../pop/IPopRules.sol";
diff --git a/contracts/registrars/IDotnsRegistrar.sol b/contracts/registrars/IDotnsRegistrar.sol
index 81fe86763..1a41645b9 100644
--- a/contracts/registrars/IDotnsRegistrar.sol
+++ b/contracts/registrars/IDotnsRegistrar.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IERC721} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
diff --git a/contracts/registrars/IDotnsRegistrarController.sol b/contracts/registrars/IDotnsRegistrarController.sol
index f49fd494f..6475ce13a 100644
--- a/contracts/registrars/IDotnsRegistrarController.sol
+++ b/contracts/registrars/IDotnsRegistrarController.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsController} from "./IDotnsController.sol";
diff --git a/contracts/registry/DotnsProtocolRegistry.sol b/contracts/registry/DotnsProtocolRegistry.sol
index 4af2517c4..3dc33d004 100644
--- a/contracts/registry/DotnsProtocolRegistry.sol
+++ b/contracts/registry/DotnsProtocolRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registry/DotnsRegistry.sol b/contracts/registry/DotnsRegistry.sol
index 1dcbcd84a..ab4f06bf0 100644
--- a/contracts/registry/DotnsRegistry.sol
+++ b/contracts/registry/DotnsRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/registry/IDotnsProtocolRegistry.sol b/contracts/registry/IDotnsProtocolRegistry.sol
index 7b3628c56..8e71c50a5 100644
--- a/contracts/registry/IDotnsProtocolRegistry.sol
+++ b/contracts/registry/IDotnsProtocolRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IDotnsProtocolRegistry
diff --git a/contracts/registry/IDotnsRegistry.sol b/contracts/registry/IDotnsRegistry.sol
index 62bd0dd05..7265b9e63 100644
--- a/contracts/registry/IDotnsRegistry.sol
+++ b/contracts/registry/IDotnsRegistry.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IDotnsRegistry
diff --git a/contracts/resolvers/DotnsContentResolver.sol b/contracts/resolvers/DotnsContentResolver.sol
index 673baa317..fe074ee50 100644
--- a/contracts/resolvers/DotnsContentResolver.sol
+++ b/contracts/resolvers/DotnsContentResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/resolvers/DotnsPopResolver.sol b/contracts/resolvers/DotnsPopResolver.sol
index 2dd3ceae4..6daae5e55 100644
--- a/contracts/resolvers/DotnsPopResolver.sol
+++ b/contracts/resolvers/DotnsPopResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/resolvers/DotnsResolver.sol b/contracts/resolvers/DotnsResolver.sol
index 77e2eb3ab..7f09a232b 100644
--- a/contracts/resolvers/DotnsResolver.sol
+++ b/contracts/resolvers/DotnsResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/resolvers/DotnsReverseResolver.sol b/contracts/resolvers/DotnsReverseResolver.sol
index 9bb53397c..bf8bbb553 100644
--- a/contracts/resolvers/DotnsReverseResolver.sol
+++ b/contracts/resolvers/DotnsReverseResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/resolvers/IDotnsContentResolver.sol b/contracts/resolvers/IDotnsContentResolver.sol
index f2d11d071..4022a792d 100644
--- a/contracts/resolvers/IDotnsContentResolver.sol
+++ b/contracts/resolvers/IDotnsContentResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title Dotns Content Resolver
diff --git a/contracts/resolvers/IDotnsPopResolver.sol b/contracts/resolvers/IDotnsPopResolver.sol
index a513ce890..52c37ec9b 100644
--- a/contracts/resolvers/IDotnsPopResolver.sol
+++ b/contracts/resolvers/IDotnsPopResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IDotnsPopResolver
diff --git a/contracts/resolvers/IDotnsResolver.sol b/contracts/resolvers/IDotnsResolver.sol
index 7baefc4fe..90a29a556 100644
--- a/contracts/resolvers/IDotnsResolver.sol
+++ b/contracts/resolvers/IDotnsResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title Dotns Resolver
diff --git a/contracts/resolvers/IDotnsReverseResolver.sol b/contracts/resolvers/IDotnsReverseResolver.sol
index 453934834..b52362d65 100644
--- a/contracts/resolvers/IDotnsReverseResolver.sol
+++ b/contracts/resolvers/IDotnsReverseResolver.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title Dotns Reverse Resolver
diff --git a/contracts/store/IDotnsStore.sol b/contracts/store/IDotnsStore.sol
index 1562b1b99..93f26debe 100644
--- a/contracts/store/IDotnsStore.sol
+++ b/contracts/store/IDotnsStore.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IDotnsStore
diff --git a/contracts/store/ILabelStore.sol b/contracts/store/ILabelStore.sol
index 385288d6d..2c1e2efeb 100644
--- a/contracts/store/ILabelStore.sol
+++ b/contracts/store/ILabelStore.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsStore} from "./IDotnsStore.sol";
diff --git a/contracts/store/IStoreFactory.sol b/contracts/store/IStoreFactory.sol
index 16e3e1ff6..b799712ed 100644
--- a/contracts/store/IStoreFactory.sol
+++ b/contracts/store/IStoreFactory.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IStoreFactory
diff --git a/contracts/store/IUserStore.sol b/contracts/store/IUserStore.sol
index ad1da2ded..269b56ccb 100644
--- a/contracts/store/IUserStore.sol
+++ b/contracts/store/IUserStore.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsStore} from "./IDotnsStore.sol";
diff --git a/contracts/store/LabelStore.sol b/contracts/store/LabelStore.sol
index 280c83f9b..14a8dacfd 100644
--- a/contracts/store/LabelStore.sol
+++ b/contracts/store/LabelStore.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/store/StoreFactory.sol b/contracts/store/StoreFactory.sol
index a704b2d40..bd9e15ef5 100644
--- a/contracts/store/StoreFactory.sol
+++ b/contracts/store/StoreFactory.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/store/UserStore.sol b/contracts/store/UserStore.sol
index 3a2c30010..2b56cc368 100644
--- a/contracts/store/UserStore.sol
+++ b/contracts/store/UserStore.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/utils/DotnsConstants.sol b/contracts/utils/DotnsConstants.sol
index b00434a8f..b80373ee0 100644
--- a/contracts/utils/DotnsConstants.sol
+++ b/contracts/utils/DotnsConstants.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title DotNS Constants
diff --git a/contracts/utils/LabelUtils.sol b/contracts/utils/LabelUtils.sol
index eca257fa5..dfcf67fb9 100644
--- a/contracts/utils/LabelUtils.sol
+++ b/contracts/utils/LabelUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title DotNS Label Utilities Library
diff --git a/contracts/utils/RegistrationUtils.sol b/contracts/utils/RegistrationUtils.sol
index 85451a794..00533971d 100644
--- a/contracts/utils/RegistrationUtils.sol
+++ b/contracts/utils/RegistrationUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsRegistrar} from "../registrars/IDotnsRegistrar.sol";
diff --git a/contracts/utils/StoreAuth.sol b/contracts/utils/StoreAuth.sol
index 885fdc437..bd6251ceb 100644
--- a/contracts/utils/StoreAuth.sol
+++ b/contracts/utils/StoreAuth.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsController} from "../registrars/IDotnsController.sol";
diff --git a/contracts/utils/StoreUtils.sol b/contracts/utils/StoreUtils.sol
index 957859df4..94a41279a 100644
--- a/contracts/utils/StoreUtils.sol
+++ b/contracts/utils/StoreUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {ILabelStore} from "../store/ILabelStore.sol";
diff --git a/contracts/utils/StringUtils.sol b/contracts/utils/StringUtils.sol
index 0904a4ec3..c22cda2b1 100644
--- a/contracts/utils/StringUtils.sol
+++ b/contracts/utils/StringUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
diff --git a/contracts/utils/SubnodeUtils.sol b/contracts/utils/SubnodeUtils.sol
index a77baebf3..57aed4c74 100644
--- a/contracts/utils/SubnodeUtils.sol
+++ b/contracts/utils/SubnodeUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {IDotnsRegistry} from "../registry/IDotnsRegistry.sol";
diff --git a/contracts/utils/SystemUtils.sol b/contracts/utils/SystemUtils.sol
index e7e191897..423a56bf6 100644
--- a/contracts/utils/SystemUtils.sol
+++ b/contracts/utils/SystemUtils.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {ISystem} from "../external/revive/ISystem.sol";
diff --git a/contracts/whitelist/DotnsNameWhitelist.sol b/contracts/whitelist/DotnsNameWhitelist.sol
index 4c4e10f09..1c318c153 100644
--- a/contracts/whitelist/DotnsNameWhitelist.sol
+++ b/contracts/whitelist/DotnsNameWhitelist.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
diff --git a/contracts/whitelist/IDotnsNameWhitelist.sol b/contracts/whitelist/IDotnsNameWhitelist.sol
index 1923467b0..1c28ba732 100644
--- a/contracts/whitelist/IDotnsNameWhitelist.sol
+++ b/contracts/whitelist/IDotnsNameWhitelist.sol
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
 /// @title IDotnsNameWhitelist

From 9f15b8b3e033dee02e14719662b906400231e74b Mon Sep 17 00:00:00 2001
From: Krishna Waske <krishna@parity.io>
Date: Thu, 24 Sep 2026 17:21:21 +0530
Subject: [PATCH 09/22] chore: ci optimisations (#318)

## Description
This PR fixes three problems with our GitHub Actions setup.
First, when you pushed several commits to an open PR, some checks kept
running for every old commit instead of stopping and only running for
the latest one. This was happening because four workflows (Format and
Lint, PR Title and Labels, Release Metadata, and the Genesis Extractor
Test) were missing a concurrency setting that every other workflow
already had. This PR adds that setting so a new push now cancels the
still running check from the previous commit

Second, our slowest checks (the test suite, the gas report, and the
coverage report) were doing a full cold Foundry build every single time,
even when nothing in the contracts had changed. This PR adds a cache for
Foundry's build output so unchanged code does not need to be recompiled
from scratch on every run.
While setting up that cache, we found a timing bug: the cache key was
being calculated before bun install runs, but bun install is what
actually re-downloads and patches our OpenZeppelin dependencies. So the
cache key was based on the wrong version of those files. This is fixed
by moving the cache step to run after bun install, so the key always
reflects what actually gets built.

Lastly, we noticed the Gas Report workflow was starting and stopping a
Docker container (the local RPC node used for fork tests) on every run,
even though the gas report command explicitly skips fork tests. That
container was never being used, so it has been removed. This saves time
on every single gas report run.

## Type

- [x] Bug fix
- [ ] Feature
- [ ] Breaking change
- [ ] Documentation
- [x] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [ ] Deployment scripts
- [x] Tests

## Related Issues

This came out of a general review of our CI setup.

## Fixes

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [x] `forge test` passes
- [x] No new compiler warnings

### Testing

- [ ] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [x] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**
No

## How to test
This PR changes workflow behavior, so the best way to test it is to run
it.

## Notes

While reviewing this, a couple of smaller ideas came up that are
intentionally not part of this PR, flagging them for later:
- None of our workflows set a timeout-minutes limit on any job, so a
stuck run could sit there for hours (GitHub's default) and hold up its
concurrency group. Worth adding reasonable limits later.
- The Foundry cache key does not account for a future bump of the pinned
Foundry version in .github/actions/setup-foundry/action.yml. Worth
adding that file's hash to the cache key whenever that version is next
bumped.
- Below checks should be marked required in the repo setting:
  - Format & Lint (catches formatting or build issues)
  - PR Title (validates title format)
  - Secret Scan (catches leaked secrets)
  - File Validation (catches bad tracked files)
- Run Solidity Tests / Contract Tests (Unit + Fuzz) (core correctness
check, also fast)
  - Coverage (fails on threshold drops)
- Deploy Contracts and Verify artifacts (catches deploy address
regressions)

- Following not req:
- Run Solidity Tests / Contract Tests (Invariant): slowest check, mostly
re-covers what unit and fuzz already catch
  - Gas Report: informational diff only, never fails the job
- 4naly3er Analysis: always green by design, continue-on-error with no
fail step
  - Slither Analysis: same as 4naly3er, can't actually fail
  - Documentation: doc build health, not a correctness gate
- Release Metadata: path filtered, would get stuck pending on unrelated
PRs
  - Genesis Extractor Test: same path filtered issue as above

---------

Signed-off-by: GHkrishna <krishna@parity.io>
---
 .github/workflows/contract-coverage.yml      | 51 +++++++++++++++++++-
 .github/workflows/format-lint-product.yml    |  6 +++
 .github/workflows/gas-report.yml             | 48 +++++++++++++++---
 .github/workflows/genesis-extractor-test.yml |  7 +++
 .github/workflows/pr-title.yml               |  7 +++
 .github/workflows/push_checking.yml          | 40 +++++++++++++++
 .github/workflows/release-metadata.yml       |  7 +++
 7 files changed, 157 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/contract-coverage.yml b/.github/workflows/contract-coverage.yml
index f1842a6d2..324206d44 100644
--- a/.github/workflows/contract-coverage.yml
+++ b/.github/workflows/contract-coverage.yml
@@ -60,6 +60,40 @@ jobs:
 
       - run: bun install
 
+      # `cache/` and `out/` are forge's own incremental-compile state: it hashes each
+      # source file and only recompiles what changed since the hash it last saw. A
+      # restored cache from an unrelated commit is always safe to build on top of.
+      # Forge just recompiles whatever the content hashes say is dirty, so a partial
+      # match via `restore-keys` still saves most of a cold `via_ir` build. This has
+      # to sit after `bun install`: its postinstall (`setup.bash`) force-reclones
+      # `lib/`'s pinned dependencies and reapplies the OZ patches on top, so hashing
+      # `lib/` any earlier would key the cache off content these steps are about to
+      # replace.
+      #
+      # Forge also drops persisted fuzz/invariant/test failure state under
+      # `cache/fuzz`, `cache/invariant`, and `cache/test-failures`, and replays it
+      # on the next run before exploring anything new (see foundry.toml's
+      # `[profile.ci.invariant]` comment). That state is cleared below, both before
+      # this job's `forge coverage` run and again right before the job ends, so it
+      # never rides along in what gets restored or saved here.
+      #
+      # This job keys its cache under `foundry-build-coverage-`, with `coverage`
+      # ahead of the OS on purpose. `forge coverage --ir-minimum` compiles under
+      # different settings from the test job and leaves different content in
+      # `cache/`/`out/`, so the two must never restore each other's builds. The
+      # test job restores anything starting with `foundry-build-${{ runner.os }}-`
+      # and GitHub picks the newest match, so any key that starts with that
+      # prefix (even `foundry-build-${{ runner.os }}-coverage-...`) would get
+      # picked up by it. Putting `coverage` first keeps it out of that prefix.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            cache
+            out
+          key: foundry-build-coverage-${{ runner.os }}-${{ hashFiles('foundry.toml', 'remappings.txt', 'contracts/**/*.sol', 'test/**/*.sol', 'scripts/**/*.sol', 'lib/**/*.sol') }}
+          restore-keys: |
+            foundry-build-coverage-${{ runner.os }}-
+
       - name: Build contracts
         env:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
@@ -78,10 +112,17 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
         run: |
           set +e
+
+          # A restored cache can carry a fuzz/invariant/test failure persisted by
+          # an earlier, unrelated run. Forge replays those before running anything
+          # new, so a stale one would fail this job even after the real bug behind
+          # it was fixed. Clear it before running coverage.
+          rm -rf cache/fuzz cache/invariant cache/test-failures
+
           forge coverage --ir-minimum --report summary \
             --no-match-coverage "test/|lib/" \
             2>&1 | tee coverage.log
-          CODE=$?
+          CODE=${PIPESTATUS[0]}
 
           python3 scripts/reports/coverage-report.py coverage.log
           exit $CODE
@@ -231,6 +272,14 @@ jobs:
               await github.rest.issues.createComment({ owner, repo, issue_number, body });
             }
 
+      # Last step in the job on purpose: `actions/cache`'s save only runs once
+      # every step above has finished, and it caches whatever is on disk at that
+      # point, not just what "Run coverage" left behind. Clearing here too means
+      # nothing this job did can leave a persisted failure in the saved cache.
+      - name: Clear persisted Foundry failure state before cache save
+        if: always()
+        run: rm -rf cache/fuzz cache/invariant cache/test-failures
+
   cleanup:
     runs-on: ubuntu-latest
     if: github.event.action == 'closed'
diff --git a/.github/workflows/format-lint-product.yml b/.github/workflows/format-lint-product.yml
index 60c8e1ae5..da489ef93 100644
--- a/.github/workflows/format-lint-product.yml
+++ b/.github/workflows/format-lint-product.yml
@@ -9,6 +9,12 @@ permissions:
   pull-requests: write
   issues: write
 
+# Keyed by PR number so a new push cancels this PR's still-running lint job instead of
+# queuing behind it; every other content-triggered workflow in this repo does the same.
+concurrency:
+  group: format-lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/gas-report.yml b/.github/workflows/gas-report.yml
index bf47a9b8d..1d23c298a 100644
--- a/.github/workflows/gas-report.yml
+++ b/.github/workflows/gas-report.yml
@@ -118,10 +118,31 @@ jobs:
 
       - run: bun install
 
-      - name: Start revive-eth-rpc (paseo_local fork target)
-        run: |
-          docker compose up -d --build
-          bash scripts/shell/wait-for-eth-rpc.sh
+      # `cache/` and `out/` are forge's own incremental-compile state: it hashes each
+      # source file and only recompiles what changed since the hash it last saw. A
+      # restored cache from an unrelated commit is always safe to build on top of.
+      # Forge just recompiles whatever the content hashes say is dirty, so a partial
+      # match via `restore-keys` still saves most of a cold `via_ir` build. This has
+      # to sit after `bun install`, not just after the master shard's patch step
+      # above: `bun install`'s postinstall (`setup.bash`) force-reclones `lib/`'s
+      # pinned dependencies for both shards and reapplies the OZ patches on top,
+      # so hashing `lib/` any earlier would key the cache off content that step
+      # is about to replace.
+      #
+      # Forge also drops persisted fuzz/invariant/test failure state under
+      # `cache/fuzz`, `cache/invariant`, and `cache/test-failures`, and replays it
+      # on the next run before exploring anything new (see foundry.toml's
+      # `[profile.ci.invariant]` comment). That state is cleared below, both before
+      # this job's `forge test` run and again right before the job ends, so it
+      # never rides along in what gets restored or saved here.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            cache
+            out
+          key: foundry-build-${{ runner.os }}-${{ matrix.target.id }}-${{ hashFiles('foundry.toml', 'remappings.txt', 'contracts/**/*.sol', 'test/**/*.sol', 'scripts/**/*.sol', 'lib/**/*.sol') }}
+          restore-keys: |
+            foundry-build-${{ runner.os }}-${{ matrix.target.id }}-
 
       - name: Generate gas report
         env:
@@ -136,6 +157,13 @@ jobs:
           # while preserving the solc compilation cache under `cache/`.
           rm -rf out/build-info
           forge build
+
+          # A restored cache can carry a fuzz/invariant/test failure persisted by
+          # an earlier, unrelated run. Forge replays those before running anything
+          # new, so a stale one would show up in this gas report even after the
+          # real bug behind it was fixed. Clear it before testing.
+          rm -rf cache/fuzz cache/invariant cache/test-failures
+
           # Skip invariant tests in the gas report: invariant runs dominate
           # the wall-clock for ~20% of the gas signal (most invariants exercise
           # the same paths the unit/fuzz suites already cost). Keep the
@@ -146,10 +174,6 @@ jobs:
             --no-match-path 'test/fork/**' \
             2>&1 | tee gas-report.txt
 
-      - name: Tear down revive-eth-rpc
-        if: always()
-        run: docker compose down --volumes --remove-orphans
-
       - name: Stage shard output
         if: always()
         run: |
@@ -163,6 +187,14 @@ jobs:
           path: shard
           retention-days: 7
 
+      # Last step in the job on purpose: `actions/cache`'s save only runs once
+      # every step above has finished, and it caches whatever is on disk at that
+      # point, not just what "Generate gas report" left behind. Clearing here too
+      # means nothing this job did can leave a persisted failure in the saved cache.
+      - name: Clear persisted Foundry failure state before cache save
+        if: always()
+        run: rm -rf cache/fuzz cache/invariant cache/test-failures
+
   report:
     name: Gas Report Diff
     needs: generate
diff --git a/.github/workflows/genesis-extractor-test.yml b/.github/workflows/genesis-extractor-test.yml
index d5c795dda..63221e331 100644
--- a/.github/workflows/genesis-extractor-test.yml
+++ b/.github/workflows/genesis-extractor-test.yml
@@ -13,6 +13,13 @@ on:
 permissions:
   contents: read
 
+# Keyed by PR number so a new push cancels this PR's still-running extractor check
+# instead of queuing behind it; every content-triggered workflow in this repo does
+# the same.
+concurrency:
+  group: genesis-extractor-test-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   genesis-extractor-test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 9632d30b2..d6275abd4 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -9,6 +9,13 @@ permissions:
   pull-requests: write
   issues: write
 
+# Keyed by PR number so a new push (or label change) cancels this PR's still-running
+# title/label check instead of queuing behind it; every content-triggered workflow in
+# this repo does the same.
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   title:
     name: PR Title
diff --git a/.github/workflows/push_checking.yml b/.github/workflows/push_checking.yml
index 43b76d1a6..d873a96c3 100644
--- a/.github/workflows/push_checking.yml
+++ b/.github/workflows/push_checking.yml
@@ -78,6 +78,31 @@ jobs:
 
       - run: bun install
 
+      # `cache/` and `out/` are forge's own incremental-compile state: it hashes each
+      # source file and only recompiles what changed since the hash it last saw. A
+      # restored cache from an unrelated commit is always safe to build on top of.
+      # Forge just recompiles whatever the content hashes say is dirty, so a partial
+      # match via `restore-keys` still saves most of a cold `via_ir` build. This has
+      # to sit after `bun install`: its postinstall (`setup.bash`) force-reclones
+      # `lib/`'s pinned dependencies and reapplies the OZ patches on top, so hashing
+      # `lib/` any earlier would key the cache off content these steps are about to
+      # replace.
+      #
+      # Forge also drops persisted fuzz/invariant/test failure state under
+      # `cache/fuzz`, `cache/invariant`, and `cache/test-failures`, and replays it
+      # on the next run before exploring anything new (see foundry.toml's
+      # `[profile.ci.invariant]` comment). That state is cleared below, both before
+      # this job's `forge test` runs and again right before the job ends, so it
+      # never rides along in what gets restored or saved here.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            cache
+            out
+          key: foundry-build-${{ runner.os }}-${{ hashFiles('foundry.toml', 'remappings.txt', 'contracts/**/*.sol', 'test/**/*.sol', 'scripts/**/*.sol', 'lib/**/*.sol') }}
+          restore-keys: |
+            foundry-build-${{ runner.os }}-
+
       # Only the unit-fuzz job needs the fork adapter, and only when fork tests
       # actually exist in the tree. Fork tests are PR-scoped, so `test/fork/` is
       # empty on master and `hashFiles` returns '' (step skipped, no docker build).
@@ -104,6 +129,13 @@ jobs:
           # build-info from another solc invocation would otherwise survive.
           # Preserving `cache/` keeps incremental compile fast.
           rm -rf out/build-info
+
+          # A restored cache can carry a fuzz/invariant/test failure persisted by
+          # an earlier, unrelated run. Forge replays those before running anything
+          # new, so a stale one would fail this job even after the real bug behind
+          # it was fixed. Clear it before building or testing.
+          rm -rf cache/fuzz cache/invariant cache/test-failures
+
           forge build --sizes > build.log 2>&1
           BUILD=$?
 
@@ -163,6 +195,14 @@ jobs:
       - if: steps.run.outputs.result && contains(steps.run.outputs.result, 'Failed')
         run: exit 1
 
+      # Last step in the job on purpose: `actions/cache`'s save only runs once
+      # every step above has finished, and it caches whatever is on disk at that
+      # point, not just what "Run tests" left behind. Clearing here too means
+      # nothing this job did can leave a persisted failure in the saved cache.
+      - name: Clear persisted Foundry failure state before cache save
+        if: always()
+        run: rm -rf cache/fuzz cache/invariant cache/test-failures
+
   report:
     name: Report Test Results
     needs: test
diff --git a/.github/workflows/release-metadata.yml b/.github/workflows/release-metadata.yml
index 837cc133a..22a13fd2f 100644
--- a/.github/workflows/release-metadata.yml
+++ b/.github/workflows/release-metadata.yml
@@ -23,6 +23,13 @@ on:
 permissions:
   contents: read
 
+# Keyed by PR number so a new push cancels this PR's still-running manifest check
+# instead of queuing behind it; every content-triggered workflow in this repo does
+# the same.
+concurrency:
+  group: release-metadata-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest

From 1a6d5b44dd05e6e17c536e9a9c1e6e129fa23ed9 Mon Sep 17 00:00:00 2001
From: Mak <1177472+mordamax@users.noreply.github.com>
Date: Mon, 28 Sep 2026 16:58:36 +0100
Subject: [PATCH 10/22] feat(release): build a Next V2 genesis and publish its
 address set (#320)

## Description
Releases now ship a DotNS genesis for Paseo Asset Hub Next V2 as well as
previewnet, so a wipe can boot with DotNS already deployed

- `dotns-genesis-testnet.json` (previewnet) and
`dotns-genesis-paseo.json` (Next V2), one build per TLD in `DOTNS_TLDS`
- New `dotns-genesis-addresses.json` asset: the address set those
genesis files carry, copied from `deployments/expected.json`
- The genesis builder clears the localhost manifest first, so a second
build in the same job starts clean
- Previewnet README said `.dot`, the chain's registry reports `.testnet`

## Type

- [ ] Bug fix
- [x] Feature
- [ ] Breaking change
- [x] Documentation
- [ ] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [x] Deployment scripts
- [ ] Tests

## Related Issues

#309

## Fixes

Closes #309

## Checklist

### Code

- [x] Follows project style
- [ ] `forge build` passes
- [ ] `forge test` passes
- [x] No new compiler warnings

### Testing

- [ ] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [ ] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**

## How to test

Cut a pre-release: it should carry `dotns-genesis-testnet.json`,
`dotns-genesis-paseo.json` and `dotns-genesis-addresses.json`

## Notes
---
 .github/workflows/publish-prerelease.yml | 27 +++++++++++++++-------
 .github/workflows/publish-release.yml    | 29 ++++++++++++++++--------
 DEPLOYMENTS.md                           |  2 +-
 RELEASE_ARTIFACTS.md                     |  8 ++++---
 deployments/previewnet/README.md         |  2 +-
 scripts/genesis/build-genesis.sh         |  4 ++++
 6 files changed, 50 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml
index 7b42df553..f4f73dad1 100644
--- a/.github/workflows/publish-prerelease.yml
+++ b/.github/workflows/publish-prerelease.yml
@@ -29,10 +29,10 @@ jobs:
     # Gated: this job reads the genesis owner key, which lives only on the `releases`
     # environment, so every run waits for a reviewer's approval there.
     environment: releases
-    # Baked into the genesis registry, so it decides which networks the artifact suits.
-    # Job-level: five steps name the file derived from it and must not disagree.
+    # One genesis per TLD, since the TLD is baked into the registry: `.testnet` for previewnet,
+    # `.paseo` for Paseo Asset Hub Next V2. Job-level: several steps name the files it yields.
     env:
-      DOTNS_TLD: testnet
+      DOTNS_TLDS: testnet paseo
     steps:
       # On workflow_dispatch the tag does not exist yet; the release step creates it
       # from the branch this run was started on. Read through an env var rather than
@@ -155,7 +155,12 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
           FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
           DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
-        run: bash scripts/genesis/build-genesis.sh release
+        run: |
+          for tld in $DOTNS_TLDS; do
+            DOTNS_TLD="$tld" bash scripts/genesis/build-genesis.sh release
+          done
+          # The address set every genesis above carries, which the builder asserted.
+          cp deployments/expected.json release/dotns-genesis-addresses.json
 
       - name: Extract ABIs
         run: |
@@ -194,7 +199,7 @@ jobs:
           TAG="$RELEASE_TAG"
           cd release
           zip -r "../dotns-abis-${TAG}.zip" abis/ release-manifest.json codehashes.json \
-            "dotns-genesis-${DOTNS_TLD}.json"
+            dotns-genesis-*.json
 
       - name: Generate release body
         env:
@@ -251,7 +256,12 @@ jobs:
             echo "not the previous live deployment's."
             echo ""
             echo "- **Release contents:** [release-manifest.json]($ASSET_BASE/release-manifest.json)"
-            echo "- [dotns-genesis-${DOTNS_TLD}.json]($ASSET_BASE/dotns-genesis-${DOTNS_TLD}.json) — pallet-revive genesis, \`.${DOTNS_TLD}\` TLD, for ${DOTNS_TLD} networks only."
+            for tld in $DOTNS_TLDS; do
+              echo "- [dotns-genesis-${tld}.json]($ASSET_BASE/dotns-genesis-${tld}.json) - pallet-revive genesis, \`.${tld}\` TLD, for .${tld} networks only."
+            done
+            echo "- [dotns-genesis-addresses.json]($ASSET_BASE/dotns-genesis-addresses.json) - the addresses those genesis files carry."
+            echo ""
+            echo "Previewnet uses \`.testnet\`, Paseo Asset Hub Next V2 uses \`.paseo\`."
           } >> release-body.md
 
       - name: ABI diff since previous release
@@ -285,7 +295,7 @@ jobs:
             release/release-manifest.json
             release/codehashes.json
             release/abi-diff.json
-            release/dotns-genesis-${{ env.DOTNS_TLD }}.json
+            release/dotns-genesis-*.json
           body_path: release-body.md
           draft: true
           prerelease: true
@@ -304,7 +314,8 @@ jobs:
             echo "release-manifest.json"
             echo "codehashes.json"
             echo "abi-diff.json"
-            echo "dotns-genesis-${DOTNS_TLD}.json"
+            echo "dotns-genesis-addresses.json"
+            for tld in $DOTNS_TLDS; do echo "dotns-genesis-${tld}.json"; done
           } | sort > "$RUNNER_TEMP/wanted-assets.txt"
           if ! diff -u "$RUNNER_TEMP/wanted-assets.txt" "$RUNNER_TEMP/actual-assets.txt"; then
             echo "::error::Draft pre-release $TAG does not match the expected asset set; delete the draft and re-run."
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 9d0a18dd2..88cbbcb43 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -29,10 +29,10 @@ jobs:
     # Gated: this job reads the genesis owner key, which lives only on the `releases`
     # environment, so every run waits for a reviewer's approval there.
     environment: releases
-    # Baked into the genesis registry, so it decides which networks the artifact suits.
-    # Job-level: five steps name the file derived from it and must not disagree.
+    # One genesis per TLD, since the TLD is baked into the registry: `.testnet` for previewnet,
+    # `.paseo` for Paseo Asset Hub Next V2. Job-level: several steps name the files it yields.
     env:
-      DOTNS_TLD: testnet
+      DOTNS_TLDS: testnet paseo
     steps:
       # On workflow_dispatch the tag does not exist yet; the release step creates it
       # from the branch this run was started on. Read through an env var rather than
@@ -151,7 +151,12 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
           FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
           DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
-        run: bash scripts/genesis/build-genesis.sh release
+        run: |
+          for tld in $DOTNS_TLDS; do
+            DOTNS_TLD="$tld" bash scripts/genesis/build-genesis.sh release
+          done
+          # The address set every genesis above carries, which the builder asserted.
+          cp deployments/expected.json release/dotns-genesis-addresses.json
 
       - name: Extract ABIs
         run: |
@@ -188,7 +193,7 @@ jobs:
           TAG="$RELEASE_TAG"
           cd release
           zip -r "../dotns-abis-${TAG}.zip" abis/ deployments.json release-manifest.json \
-            codehashes.json "dotns-genesis-${DOTNS_TLD}.json"
+            codehashes.json dotns-genesis-*.json
 
       - name: Generate release body
         env:
@@ -253,8 +258,13 @@ jobs:
             echo "Pallet-revive genesis state, for a chain that should carry DotNS from block zero"
             echo "rather than deploying it afterwards."
             echo ""
-            echo "- [dotns-genesis-${DOTNS_TLD}.json]($ASSET_BASE/dotns-genesis-${DOTNS_TLD}.json) — registry initialised with the **\`.${DOTNS_TLD}\` TLD**, so it suits **${DOTNS_TLD} networks only** (this is what previewnet uses). Not for a production chain."
-            echo "- A chain booted from this genesis carries the fresh-deploy address set: \`deployments/expected.json\` in the repository at this tag. [deployments.json]($ASSET_BASE/deployments.json) records the live networks instead, and the two can differ where a live network has moved a contract."
+            for tld in $DOTNS_TLDS; do
+              echo "- [dotns-genesis-${tld}.json]($ASSET_BASE/dotns-genesis-${tld}.json) - registry initialised with the **\`.${tld}\` TLD**, so it suits **.${tld} networks only**. Not for a production chain."
+            done
+            echo ""
+            echo "Previewnet uses \`.testnet\`, Paseo Asset Hub Next V2 uses \`.paseo\`."
+            echo ""
+            echo "- [dotns-genesis-addresses.json]($ASSET_BASE/dotns-genesis-addresses.json) - the address set a chain booted from any of these genesis files carries. [deployments.json]($ASSET_BASE/deployments.json) records the live networks instead, and the two can differ where a live network has moved a contract."
           } >> release-body.md
 
           # `gh release view` with no tag resolves through /releases/latest, which skips
@@ -302,7 +312,7 @@ jobs:
             release/release-manifest.json
             release/codehashes.json
             release/abi-diff.json
-            release/dotns-genesis-${{ env.DOTNS_TLD }}.json
+            release/dotns-genesis-*.json
           body_path: release-body.md
           draft: true
           prerelease: false
@@ -322,7 +332,8 @@ jobs:
             echo "release-manifest.json"
             echo "codehashes.json"
             echo "abi-diff.json"
-            echo "dotns-genesis-${DOTNS_TLD}.json"
+            echo "dotns-genesis-addresses.json"
+            for tld in $DOTNS_TLDS; do echo "dotns-genesis-${tld}.json"; done
           } | sort > "$RUNNER_TEMP/wanted-assets.txt"
           if ! diff -u "$RUNNER_TEMP/wanted-assets.txt" "$RUNNER_TEMP/actual-assets.txt"; then
             echo "::error::Draft release $TAG does not match the expected asset set; delete the draft and re-run."
diff --git a/DEPLOYMENTS.md b/DEPLOYMENTS.md
index 442d86083..4c764fc02 100644
--- a/DEPLOYMENTS.md
+++ b/DEPLOYMENTS.md
@@ -285,7 +285,7 @@ If the deployment was intended to update a public environment, update the addres
 
 `deployments/<network>/<chainId>.json` is a **network record**: what is deployed on that live network right now. It is updated only by a real deploy or migration on that network, never by a code change. Everything that answers for reality reads these files: releases copy their addresses verbatim, and pointing tooling or the wire stage at an address with nothing behind it breaks whatever reads it. The CREATE3 parity gates compare `expected.json` rather than these files, so the rule that a code change leaves them alone is enforced in CI instead: `release-metadata.yml` fails a pull request that edits one unless it carries the `deployment-record` label.
 
-`deployments/expected.json` is the **expected set**: the addresses a fresh deploy of the current revision lands through the pinned CREATE3 factory. It is a property of the code, not of any network; the CI deploy job and `scripts/genesis/build-genesis.sh` verify against it, and releases never publish it.
+`deployments/expected.json` is the **expected set**: the addresses a fresh deploy of the current revision lands through the pinned CREATE3 factory. It is a property of the code, not of any network; the CI deploy job and `scripts/genesis/build-genesis.sh` verify against it, and releases publish it only as `dotns-genesis-addresses.json`, the address set of their genesis files.
 
 The expected set can legitimately disagree with a network manifest: after a code change moves an address, the expected set carries the new address while every network manifest keeps the old one until that network actually redeploys. The difference between them is the migration backlog, readable as a diff, and it is resolved per network by the event that relocates the contract: a wipe-and-redeploy on a test network, a deliberate migration on one that never wipes.
 
diff --git a/RELEASE_ARTIFACTS.md b/RELEASE_ARTIFACTS.md
index 584730ad4..1a480c939 100644
--- a/RELEASE_ARTIFACTS.md
+++ b/RELEASE_ARTIFACTS.md
@@ -11,13 +11,15 @@ What each release publishes, what the files guarantee, and how to consume them.
 | `release-manifest.json` | What this release contains, machine readable |
 | `codehashes.json` | Stripped-metadata hash of each contract's built runtime bytecode |
 | `abi-diff.json` | Selector-level ABI changes since the previous release, machine readable |
+| `dotns-genesis-<tld>.json` | pallet-revive genesis with DotNS deployed, one per TLD (`testnet` for previewnet, `paseo` for Paseo Asset Hub Next V2) |
+| `dotns-genesis-addresses.json` | The addresses a chain booted from those genesis files carries, a copy of `deployments/expected.json` |
 | `dotns-abis-<tag>.zip` | The same files in one archive |
 
-Every JSON asset is attached to the release individually, at the top level, with no folder. The zip holds the ABIs under `abis/` plus `deployments.json`, `release-manifest.json`, and `codehashes.json` at its root; `abi-diff.json` is generated together with the release body and attached individually.
+Every JSON asset is attached to the release individually, at the top level, with no folder. The zip holds the ABIs under `abis/` plus `deployments.json`, `release-manifest.json`, `codehashes.json`, and the `dotns-genesis-*.json` files at its root; `abi-diff.json` is generated together with the release body and attached individually.
 
 The release surface is decided in `.github/abi-contracts.txt` so a contract reaches consumers only when it is listed there.
 
-**Pre-releases carry no addresses.** A pre-release is cut in order to be deployed, so at that point the recorded addresses still belong to the previous deployment of different code. Publishing them under that tag would break the one thing `version` is for, namely that a release's addresses and its ABIs came from the same release. A pre-release therefore ships the ABIs, `release-manifest.json`, `codehashes.json`, and `abi-diff.json`, and the addresses arrive with the release that follows the deployment. `codehashes.json` is on the pre-release deliberately: deploys run from pre-release tags, and an upgrade diffs its build against the previous release's copy before touching a live network.
+**Pre-releases carry no live addresses.** A pre-release is cut in order to be deployed, so at that point the recorded addresses still belong to the previous deployment of different code. Publishing them under that tag would break the one thing `version` is for, namely that a release's addresses and its ABIs came from the same release. A pre-release therefore ships the ABIs, `release-manifest.json`, `codehashes.json`, `abi-diff.json`, and the genesis files, whose addresses are this commit's own fresh deploy; the live addresses arrive with the release that follows the deployment. `codehashes.json` is on the pre-release deliberately: deploys run from pre-release tags, and an upgrade diffs its build against the previous release's copy before touching a live network.
 
 `deployments.json` and `release-manifest.json` were also added after this repository had already published releases, so an older release carries only the per-contract ABIs and the zip. That is expected rather than broken, and it cannot be corrected: releases here are immutable, so no asset can be attached after publication. Treat either file being missing as "this release predates it, or is a pre-release" and fall back, or pin a release you have checked.
 
@@ -44,7 +46,7 @@ The release surface is decided in `.github/abi-contracts.txt` so a contract reac
 - One entry can serve more than one live network. `paseo-assethub` is the deployment that both previewnet and Paseo Asset Hub Next V2 run, because every network deployed through the shared CREATE3 factory lands on the same addresses. So expect entries named after deployments, not after every chain you might connect to.
 - The names under `contracts` (`DotnsRegistrar`, `PopRules`) do not change, and a name always means the same contract. Your code can depend on that.
 - Addresses are copied from the manifest verbatim, which the deploy pipeline writes EIP-55 checksummed. Compare them case-insensitively rather than relying on the casing.
-- Only per-network manifests are published. `deployments/expected.json` — the fresh-deploy address set that CI and the genesis builder verify against (see `DEPLOYMENTS.md`) — is not a network and never appears here, so a release cut while an address move is awaiting its network's redeploy still advertises the addresses each live network actually runs.
+- Only per-network manifests are published. `deployments/expected.json` — the fresh-deploy address set that CI and the genesis builder verify against (see `DEPLOYMENTS.md`) — is not a network and never appears here (it ships separately as `dotns-genesis-addresses.json`), so a release cut while an address move is awaiting its network's redeploy still advertises the addresses each live network actually runs.
 - `LabelStoreBeacon` and `UserStoreBeacon` appear when deployed but are not network-stable, because the `StoreFactory` initialiser deploys them. Read them from the factory rather than pinning them.
 
 ## `release-manifest.json`
diff --git a/deployments/previewnet/README.md b/deployments/previewnet/README.md
index 420ca9599..733055514 100644
--- a/deployments/previewnet/README.md
+++ b/deployments/previewnet/README.md
@@ -1,7 +1,7 @@
 # previewnet
 
 The Product Preview Network's Asset Hub (`wss://previewnet.substrate.dev/asset-hub`,
-ETH RPC `https://previewnet.substrate.dev/eth-rpc`), TLD `.dot`. Deployed from a v0.8.0
+ETH RPC `https://previewnet.substrate.dev/eth-rpc`), TLD `.testnet`. Deployed from a v0.8.0
 genesis, so every address matches the fresh-deploy set in `deployments/expected.json`.
 
 The chain id is `420420417`, the same as `paseo-assethub`: pallet-revive testnets share it,
diff --git a/scripts/genesis/build-genesis.sh b/scripts/genesis/build-genesis.sh
index 4044ac426..0ea53a0aa 100755
--- a/scripts/genesis/build-genesis.sh
+++ b/scripts/genesis/build-genesis.sh
@@ -170,6 +170,10 @@ forge clean
 forge build
 echo ""
 
+# The stages extend an existing manifest, and one left by an earlier build (for another TLD)
+# describes a chain this anvil never saw.
+rm -f "$DEPLOYMENT_FILE"
+
 # Deploy the Create3Factory from the single-purpose key at nonce 0 so it lands on
 # the canonical address, then hand it to the stages via CREATE3_FACTORY (read by
 # BaseDeployer._configuredCreate3Factory).

From 75169135af7476545fb9527bd28e93493d038fb8 Mon Sep 17 00:00:00 2001
From: Krishna Waske <krishna@parity.io>
Date: Wed, 30 Sep 2026 15:12:24 +0530
Subject: [PATCH 11/22] fix(release): ignore embedded metadata in changedset,
 list breaking changes first (#323)

## Description

This PR fixes two things in the release tooling
(`scripts/js/release-metadata.mjs`).

**1. `changedset` no longer flags StoreFactory after comment-only
edits**

StoreFactory deploys other contracts with `new`, so its bytecode carries
a copy of their creation code. Each copy ends with that contract's own
metadata hash, and that hash changes whenever a comment or NatSpec line
changes. `changedset` only stripped StoreFactory's own metadata at the
end of its bytecode, so a comment edit in LabelStore made StoreFactory
look changed and asked for an upgrade nobody needed.

Now the hash inside each embedded copy is set to zeros before hashing.
Real code changes still show up. `codehashes.json` gets a new
`hashScheme` field so that files hashed the old way and the new way are
never compared by mistake. `changedset` reads that field and hashes the
current build the same way the previous file was hashed.

**2. Release notes list breaking changes first**

The "ABI changes" section of the release body is now grouped by how much
each change matters:

1. Breaking changes: the ones declared in pull request descriptions,
then changed function signatures, removed functions, contracts that are
no longer published, and changed or removed events.
2. New contracts, new functions and new events.
3. Custom errors.

A new `pulls` command reads the pull requests merged since the previous
release. A pull request counts as breaking if any of these is true: its
"Breaking Changes" section has text, its title has a `!`, it has the
`breaking` label, or one of the breaking boxes is ticked. Its text is
copied into the notes. `abi-diff.json` gets a new `declaredBreaking`
list. Both publish workflows now need `pull-requests: read`.

## Type

- [x] Bug fix
- [x] Feature
- [ ] Breaking change
- [x] Documentation
- [ ] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [ ] Deployment scripts
- [ ] Tests

Release tooling only. No contract code changes.

## Related Issues

Found in #321, whose NatSpec-only edits to LabelStore put StoreFactory
in its changedset.

## Fixes

Fixes #322

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [ ] `forge test` passes
- [x] No new compiler warnings

### Testing

- [ ] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [ ] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [ ] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**

## How to test

**changedset fix**

```bash
forge build
node scripts/js/release-metadata.mjs build --tag base --out /tmp/base --addresses false
# change only a comment in contracts/store/LabelStore.sol
forge build
node scripts/js/release-metadata.mjs changedset --previous /tmp/base/codehashes.json
# nothing is listed

# now make a real code change in LabelStore.sol
forge build
node scripts/js/release-metadata.mjs changedset --previous /tmp/base/codehashes.json
# LabelStore and StoreFactory are listed
```

**Release notes**

```bash
# needs gh logged in with read access to the repo
node scripts/js/release-metadata.mjs pulls --repo paritytech/dotns \
  --base <previous-tag> --head HEAD --out /tmp/pulls.json
node scripts/js/release-metadata.mjs abidiff --current <abis-dir> \
  --previous <previous-abis-dir> --previous-tag <previous-tag> --pulls /tmp/pulls.json
```

## Notes

- The next release still compares against the previous release's
`codehashes.json`, which was hashed the old way. So StoreFactory will
show up once more in that release's changedset if any contract it
deploys changed, even if only a comment changed. After that it is clean.
- If we want that next release to be clean too, we can regenerate the
previous release's metadata with this fix and compare against that
instead. Check out the previous release tag, apply this change, run
`forge build` and `release-metadata.mjs build`, then pass the new
`codehashes.json` to `changedset`. If StoreFactory is not listed, its
code did not change and it does not need an upgrade.
- `pulls` reads every merged pull request, not only the labelled ones,
because missing a breaking change is costly and a label is easy to
forget. It makes one API call per commit, which is fine for our release
size. If releases grow a lot, we can switch to a cheaper approach.
- If reading the pull requests fails, the release step fails. It is
better to re-run the step than to publish notes that miss a breaking
change.
- Any `@mention` in a pull request's breaking changes text will notify
that person when the release is published.

---------

Signed-off-by: GHkrishna <krishna@parity.io>
---
 .github/workflows/publish-prerelease.yml |   8 +-
 .github/workflows/publish-release.yml    |   8 +-
 RELEASE_ARTIFACTS.md                     |   8 +-
 scripts/js/release-metadata.mjs          | 313 ++++++++++++++++++++---
 4 files changed, 302 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml
index f4f73dad1..6e40e24e7 100644
--- a/.github/workflows/publish-prerelease.yml
+++ b/.github/workflows/publish-prerelease.yml
@@ -186,6 +186,11 @@ jobs:
           find release/abis -maxdepth 1 -type f -printf '%f\n' | sort > release/expected-assets.txt
           echo "Extracted $(wc -l < release/expected-assets.txt) ABIs"
 
+          # Record which published ABIs each contract inherits from, read from the same build.
+          # The ABI diff step uses it to list a change once, under the interface that declares
+          # it, even when the names do not match. Kept out of release/, since it is not an asset.
+          bun scripts/js/release-metadata.mjs bases --out "$RUNNER_TEMP/abi-bases.json"
+
       # No addresses: a pre-release is cut to be deployed, so the recorded addresses still
       # belong to the previous deployment of different code. Publishing them under this tag
       # would break the promise that a release's addresses and ABIs come from the same release.
@@ -280,7 +285,8 @@ jobs:
             prev_args=(--previous prev-abis/abis --previous-tag "$PREV")
           fi
           bun scripts/js/release-metadata.mjs abidiff --current release/abis \
-            "${prev_args[@]}" --json release/abi-diff.json >> release-body.md
+            "${prev_args[@]}" --bases "$RUNNER_TEMP/abi-bases.json" \
+            --json release/abi-diff.json >> release-body.md
 
       - name: Create draft pre-release with artifacts
         uses: softprops/action-gh-release@v2
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 88cbbcb43..4f73e3c21 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -182,6 +182,11 @@ jobs:
           find release/abis -maxdepth 1 -type f -printf '%f\n' | sort > release/expected-assets.txt
           echo "Extracted $(wc -l < release/expected-assets.txt) ABIs"
 
+          # Record which published ABIs each contract inherits from, read from the same build.
+          # The ABI diff step uses it to list a change once, under the interface that declares
+          # it, even when the names do not match. Kept out of release/, since it is not an asset.
+          bun scripts/js/release-metadata.mjs bases --out "$RUNNER_TEMP/abi-bases.json"
+
       # Addresses come from the committed deployment manifests, the same files the
       # deployment pipeline in dotns-releases measures a live deploy against. A consumer
       # that only has the release needs them to reach any contract at all.
@@ -296,7 +301,8 @@ jobs:
             prev_args=(--previous prev-abis/abis --previous-tag "$PREV")
           fi
           bun scripts/js/release-metadata.mjs abidiff --current release/abis \
-            "${prev_args[@]}" --json release/abi-diff.json >> release-body.md
+            "${prev_args[@]}" --bases "$RUNNER_TEMP/abi-bases.json" \
+            --json release/abi-diff.json >> release-body.md
 
       - name: Create draft release with artifacts
         uses: softprops/action-gh-release@v2
diff --git a/RELEASE_ARTIFACTS.md b/RELEASE_ARTIFACTS.md
index 1a480c939..d46e3cf80 100644
--- a/RELEASE_ARTIFACTS.md
+++ b/RELEASE_ARTIFACTS.md
@@ -68,18 +68,22 @@ The release surface is decided in `.github/abi-contracts.txt` so a contract reac
 ```json
 {
   "version": "v1.2.3",
+  "hashScheme": 2,
   "build": { "solcVersion": "0.8.34+commit...", "optimizer": {}, "viaIr": true, "evmVersion": "cancun", "foundryLockSha256": "..." },
   "hashes": { "DotnsRegistrar": "0x..." }
 }
 ```
 
-- `hashes` maps each deployable contract to the keccak256 of its built runtime bytecode with the trailing CBOR metadata stripped, so a comment-only edit does not read as a code change. Comparing two releases' files tells you exactly which contracts a release changed; an upgrade must cover that whole set before the release may be declared on a network (see `DEPLOYMENT_CHECKLIST.md`).
+- `hashes` maps each deployable contract to the keccak256 of its built runtime bytecode with the trailing CBOR metadata stripped, so a comment-only edit does not read as a code change. A contract that deploys other contracts with `new` (such as `StoreFactory`) also contains their creation code, and each copy ends with that contract's own metadata. The hash inside those copies is set to zeros before hashing, so a comment-only edit to `LabelStore` does not make `StoreFactory` look changed either. Comparing two releases' files tells you exactly which contracts a release changed; an upgrade must cover that whole set before the release may be declared on a network (see `DEPLOYMENT_CHECKLIST.md`).
+- `hashScheme` says how `hashes` were computed. `2` is the method described above. `1` skips the zeroing of embedded metadata, and files without `hashScheme` (from releases made before it was added) use it. The two only give different hashes for contracts that deploy other contracts with `new`, so only compare two files that use the same scheme. `release-metadata.mjs changedset` does this for you: it hashes the current build with the previous file's scheme.
 - These are artifact-side hashes, for comparing builds with builds. A deployed contract hashes differently on chain (its bytecode carries the metadata and any immutable values), so compare this file against another release's copy of it.
 - `build` records the toolchain inputs. The same source under a different toolchain hashes differently, and that difference is a real code change on chain, so treat the hashes as comparable only alongside their build inputs.
 
 ## `abi-diff.json`
 
-The machine-readable form of the "ABI changes since ..." section of the release body: per contract, the functions, events, and errors added, removed, or changed since the previous release, at selector level. A **changed signature** entry is the one to alert on: the name still exists but the selector moved (a struct parameter gained a field, say), so an un-updated caller gets a bare revert with no data. Contracts new to the release or no longer published are flagged as such. When no earlier release carries ABIs to diff against, the file says so instead of guessing.
+The full, machine-readable ABI diff behind the release body: per contract, the functions, events, and errors added, removed, or changed since the previous release, at selector level. A **changed signature** entry is the one to alert on: the name still exists but the selector moved (a struct parameter gained a field, say), so an un-updated caller gets a bare revert with no data. Contracts new to the release or no longer published are flagged as such. When no earlier release carries ABIs to diff against, the file says so instead of guessing.
+
+The release body is a short summary of this file. Under "Breaking ABI changes since ..." it lists only the changes that break an existing caller or indexer, one line each: changed function signatures, removed functions, contracts no longer published, then changed or removed events. Additions, new contracts, and custom errors are in a collapsed block with a count. A contract and the interfaces it implements usually carry the same change, so the body lists it once, under the interface that declares it, which is what callers bind to. Which published ABIs a contract inherits from is read from the build, not guessed from names, so `DotnsFlatPricing` is matched with `IDotnsPricing` too. A change that only the contract has is still listed. This file always has every contract, both the contract and its interfaces included.
 
 ## Stability
 
diff --git a/scripts/js/release-metadata.mjs b/scripts/js/release-metadata.mjs
index 5fd2975b3..acaf49fb6 100644
--- a/scripts/js/release-metadata.mjs
+++ b/scripts/js/release-metadata.mjs
@@ -5,12 +5,15 @@
 //   changelog  --current <file> [--previous <file>]      release-note lines about address changes
 //              [--previous-tag <name>]
 //   changedset --previous <codehashes.json>              contracts whose built code differs, one per line
+//   bases      --out <file>                              published ABIs each contract inherits from
 //   abidiff    --current <dir> [--previous <dir>]        selector-level ABI diff for the release body
 //              [--previous-tag <name>] [--json <file>]
+//              [--bases <file>]
 //   verify     --network <folder> --rpc <url> [--tag <TAG>]  check a committed manifest against a chain
 //
-// `build` and `changelog` run in both publish workflows; `validate` runs on pull requests, so a
-// broken manifest fails there rather than at release time. `verify` stays out of the release
+// `build`, `bases` and `abidiff` run in both publish workflows, and `changelog` in the release
+// one. `validate` runs on pull requests, so a broken manifest fails there rather than at release
+// time. `verify` stays out of the release
 // path, which must work without reaching a chain; with `--tag` it also checks the chain's
 // declared protocol version and code identity. `changedset` names exactly what a release
 // changed, for upgrade tooling (which lives outside this repository) and for humans. No
@@ -166,15 +169,67 @@ function stripCborMetadata(name, hex) {
   return `0x${code.slice(0, stripped * 2)}`;
 }
 
+// The metadata at the end is not the only metadata in the code. A contract that deploys other
+// contracts (with `new`, for example) carries a copy of their creation code, and each copy ends
+// with that contract's own metadata. StoreFactory is an example: it contains LabelStore's
+// creation code, so a comment-only edit to LabelStore changes a few bytes inside StoreFactory.
+//
+// To ignore that, the hash (digest) inside each embedded metadata block is set to zeros. The
+// code keeps its length, so nothing else moves, and the compiler version bytes are kept. A real
+// change to an embedded contract's code, or to the compiler, still changes the hash.
+//
+// A block is found by its exact shape, not by where it sits: {"ipfs": <34-byte hash>, "solc":
+// <3-byte version>} followed by its length, 0x0033. That is what solc writes with foundry's
+// default `bytecode_hash = "ipfs"`. The older `bzzr1` shape is handled too. With
+// `bytecode_hash = "none"` there is no hash to clear. Normal code does not contain these exact
+// bytes by chance, and a match only counts if it starts on a whole byte.
+const EMBEDDED_METADATA_SHAPES = [
+  { prefix: "a264697066735822", digestHexLength: 68, suffix: "0033" },
+  { prefix: "a265627a7a72315820", digestHexLength: 64, suffix: "0032" },
+];
+
+function zeroEmbeddedMetadataDigests(hex) {
+  let code = hex.toLowerCase();
+  for (const { prefix, digestHexLength, suffix } of EMBEDDED_METADATA_SHAPES) {
+    const shape = new RegExp(
+      `${prefix}[0-9a-f]{${digestHexLength}}64736f6c6343[0-9a-f]{6}${suffix}`,
+      "g",
+    );
+    const zeros = "0".repeat(digestHexLength);
+    let match;
+    while ((match = shape.exec(code)) !== null) {
+      // `code` starts with "0x", so every byte starts at an even index. A match at an odd index
+      // starts in the middle of a byte, so it is not a real block. Keep searching from the next
+      // character.
+      if (match.index % 2 !== 0) {
+        shape.lastIndex = match.index + 1;
+        continue;
+      }
+      const digestStart = match.index + prefix.length;
+      code = code.slice(0, digestStart) + zeros + code.slice(digestStart + digestHexLength);
+    }
+  }
+  return code;
+}
+
 // keccak256 via `cast keccak`, keeping the script dependency-free like the chain reads.
 function keccakHex(hex) {
   return cast(["keccak", hex]);
 }
 
+// Saved in codehashes.json as `hashScheme`, so that `changedset` can hash the current build the
+// same way the previous file was hashed. Comparing hashes made in two different ways would show
+// changes that are not there.
+//   1: the metadata at the end is removed. Files written before `hashScheme` existed use this.
+//   2: the same, and the hashes inside embedded metadata are set to zeros as well.
+// Both give the same result for a contract that does not deploy other contracts.
+const HASH_SCHEME = 2;
+const HASH_SCHEMES = [1, 2];
+
 // Stripped-metadata hash of each deployable contract's built runtime bytecode. These are
 // artifact-side hashes for comparing builds with builds (the changed-set); they are never
 // compared against on-chain hashes, which live in a different domain (see `verify`).
-function builtCodehashes() {
+function builtCodehashes(scheme = HASH_SCHEME) {
   const { contracts } = classifyContracts(readContractNames());
   const hashes = {};
   for (const name of contracts) {
@@ -183,7 +238,8 @@ function builtCodehashes() {
     );
     const runtime = artefact?.deployedBytecode?.object;
     if (!runtime || runtime === "0x") fail(`${name}: no deployed bytecode in the artefact`);
-    hashes[name] = keccakHex(stripCborMetadata(name, runtime));
+    const stripped = stripCborMetadata(name, runtime);
+    hashes[name] = keccakHex(scheme >= 2 ? zeroEmbeddedMetadataDigests(stripped) : stripped);
   }
   return hashes;
 }
@@ -216,7 +272,23 @@ function changedset(args) {
   const previous = JSON.parse(readFileSync(resolve(process.cwd(), args.previous), "utf8"));
   const previousHashes = previous?.hashes;
   if (!previousHashes) fail(`${args.previous} has no 'hashes' map`);
-  const current = builtCodehashes();
+  // Hash the build the same way the previous file was hashed. Otherwise a change in how the
+  // hash is computed would look like a change in the code.
+  const scheme = previous.hashScheme ?? 1;
+  if (!HASH_SCHEMES.includes(scheme)) {
+    fail(
+      `${args.previous} uses hashScheme ${scheme}; this script knows ${HASH_SCHEMES.join(", ")}`,
+    );
+  }
+  if (scheme < HASH_SCHEME) {
+    // Printed to stderr, because stdout is the list that upgrade tooling reads.
+    console.error(
+      `[release-metadata] ${args.previous} uses hashScheme ${scheme}, so this build is hashed ` +
+        `the same way. A contract that deploys other contracts with \`new\` is listed if any ` +
+        `contract it deploys changed at all, even if only a comment changed.`,
+    );
+  }
+  const current = builtCodehashes(scheme);
   // Union, not just the current set: a contract only in the previous release was removed and a
   // contract only in this one is new. Neither is coverable by an in-place upgrade, so both must
   // surface and force the coverage gate to refuse rather than dropping out of the diff.
@@ -315,66 +387,241 @@ function diffAbi(previous, current) {
   return result;
 }
 
-// Markdown fragment for the release body plus a machine-readable JSON asset. Prints "no
-// changes" rather than nothing, so absence is a statement and not a gap; a missing previous
-// release degrades the same way rather than failing the release.
+// For each published ABI, the other published ABIs it inherits from, nearest first. This comes
+// from the build itself, not from names, so a contract is matched with its interface whatever
+// they are called. For example, DotnsFlatPricing implements IDotnsPricing. Bases that are not
+// published ABIs are skipped, because the release body can only point at ABIs that ship in the
+// release.
+//
+// A contract's artifact lists its bases as AST ids. Ids only mean something inside the compiler
+// run that made them, and an incremental `forge build` can leave artifacts from several runs in
+// out/. So each artifact is matched to the build info of its own run (foundry.toml keeps
+// `build_info = true`), and its base ids are turned into names there.
+function publishedBases() {
+  const buildInfoDir = join(ROOT, "out", "build-info");
+  if (!existsSync(buildInfoDir)) {
+    fail(`${buildInfoDir} not found; foundry.toml needs \`build_info = true\`, then forge build`);
+  }
+  // For each compiler run: contract id -> { name, path }.
+  const runs = readdirSync(buildInfoDir)
+    .filter((file) => file.endsWith(".json"))
+    .map((file) => {
+      const info = JSON.parse(readFileSync(join(buildInfoDir, file), "utf8"));
+      const byId = new Map();
+      for (const [path, source] of Object.entries(info?.output?.sources ?? {})) {
+        for (const node of source?.ast?.nodes ?? []) {
+          if (node.nodeType === "ContractDefinition") byId.set(node.id, { name: node.name, path });
+        }
+      }
+      return byId;
+    });
+
+  const published = readContractNames();
+  const publishedSet = new Set(published);
+  const bases = {};
+  for (const name of published) {
+    const path = join(ROOT, "out", `${name}.sol`, `${name}.json`);
+    if (!existsSync(path)) {
+      fail(`${path} not found; run forge build, or check .github/abi-contracts.txt`);
+    }
+    const artefact = JSON.parse(readFileSync(path, "utf8"));
+    const def = artefact?.ast?.nodes?.find(
+      (node) => node.nodeType === "ContractDefinition" && node.name === name,
+    );
+    if (!def) fail(`${path} has no AST for ${name}; foundry.toml needs \`ast = true\``);
+    // The run that built this artifact is the one that has this contract, in this file, under
+    // the same id.
+    const run = runs.find((byId) => {
+      const known = byId.get(def.id);
+      return known?.name === name && known.path === artefact.ast.absolutePath;
+    });
+    if (!run) {
+      fail(`no build info in out/build-info matches ${name}; run forge clean && forge build`);
+    }
+    // The first id is the contract itself.
+    const found = (def.linearizedBaseContracts ?? [])
+      .slice(1)
+      .map((id) => run.get(id)?.name)
+      .filter((base) => base && publishedSet.has(base));
+    if (found.length > 0) bases[name] = found;
+  }
+  return bases;
+}
+
+function writeBases(args) {
+  if (!args.out) fail("bases needs --out <file>");
+  const bases = publishedBases();
+  writeJson(resolve(process.cwd(), args.out), bases);
+  log(`${Object.keys(bases).length} published ABI(s) inherit from another published ABI`);
+}
+
+function readBases(path) {
+  const bases = JSON.parse(readFileSync(resolve(process.cwd(), path), "utf8"));
+  const valid =
+    bases &&
+    typeof bases === "object" &&
+    !Array.isArray(bases) &&
+    Object.values(bases).every((list) => Array.isArray(list));
+  if (!valid) {
+    fail(`${path} does not map contract names to lists of bases; write it with \`bases\``);
+  }
+  return bases;
+}
+
+// Order of the lines in the release body. Breaking changes are the ones that stop an existing
+// caller or indexer from working. The rest are grouped after them.
+const BREAKING_GROUPS = [
+  "functionChanged",
+  "functionRemoved",
+  "contractRemoved",
+  "eventChanged",
+  "eventRemoved",
+];
+const OTHER_GROUPS = [
+  "contractAdded",
+  "functionAdded",
+  "eventAdded",
+  "errorChanged",
+  "errorAdded",
+  "errorRemoved",
+];
+
+// Writes the ABI part of the release body, plus the full diff as JSON.
+//
+// The body is kept short so that people read it. It lists only the breaking changes, one line
+// each: changed function signatures, removed functions, contracts no longer published, then
+// changed or removed events. Everything else (additions, new contracts, custom errors) goes in a
+// collapsed block with a count. The JSON always has the full diff for every contract.
+//
+// A contract and the interfaces it implements usually publish the same functions and events, so
+// one change would be listed several times. `--bases` (written by `bases`) says which published
+// ABIs each contract inherits from. A contract's line is left out when one of those bases has
+// exactly the same line, so the change is listed once, under the interface that declares it,
+// which is what callers bind to. A change that only the contract has is still listed. Without
+// `--bases`, every contract is listed on its own.
+//
+// When there is nothing to report, it says so, so an empty section is never mistaken for a
+// missing one. A previous release without ABIs is reported the same way instead of failing.
 function abidiff(args) {
   if (!args.current) fail("abidiff needs --current <dir>");
   const previousTag = args["previous-tag"] ?? "the previous release";
-  const lines = [];
   const report = { previousTag: args["previous-tag"] ?? null, contracts: {} };
+  const lines = [""];
 
   if (!args.previous) {
-    lines.push("", "No earlier release carries ABIs to diff against.");
+    lines.push("No earlier release carries ABIs to diff against.");
     report.previousUnavailable = true;
   } else {
     const currentAbis = readAbiDir(resolve(process.cwd(), args.current));
     const previousAbis = readAbiDir(resolve(process.cwd(), args.previous));
-    const changedLines = [];
-    const otherLines = [];
-    for (const [name, abi] of currentAbis) {
+    const code = (text) => `\`${text}\``;
+    const signatures = (list) => list.map(code).join(", ");
+    const member = (signature) => signature.slice(0, signature.indexOf("("));
+
+    // One entry per change. `change` describes the change without naming the contract, so a
+    // contract's entry can be matched against its interface's.
+    const entries = [];
+    const add = (contract, group, change, text) => entries.push({ contract, group, change, text });
+
+    for (const name of [...currentAbis.keys()].sort()) {
       const previousAbi = previousAbis.get(name);
       if (!previousAbi) {
-        otherLines.push(`- \`${name}\`: new contract`);
+        add(name, "contractAdded", "added", "new contract");
         report.contracts[name] = { newContract: true };
         continue;
       }
-      const diff = diffAbi(previousAbi, abi);
+      const diff = diffAbi(previousAbi, currentAbis.get(name));
       if (Object.keys(diff).length === 0) continue;
       report.contracts[name] = diff;
       for (const [kind, { changed, added, removed }] of Object.entries(diff)) {
+        // Functions need no label. Events and errors say what they are.
+        const label = kind === "function" ? "" : ` ${kind}`;
         for (const entry of changed) {
-          changedLines.push(
-            `- \`${name}\`: ${kind} \`${entry.name}\` changed signature: ` +
-              `${entry.was.map((s) => `\`${s}\``).join(", ") || "(none)"} is now ` +
-              `${entry.now.map((s) => `\`${s}\``).join(", ") || "(none)"}`,
+          add(
+            name,
+            `${kind}Changed`,
+            `${kind} ${entry.was.join(" ")} > ${entry.now.join(" ")}`,
+            `${code(`${name}.${entry.name}`)}${label}: ` +
+              `${signatures(entry.was)} → ${signatures(entry.now)}`,
           );
         }
-        for (const signature of added) otherLines.push(`- \`${name}\`: ${kind} \`${signature}\` added`);
         for (const signature of removed) {
-          otherLines.push(`- \`${name}\`: ${kind} \`${signature}\` removed`);
+          add(
+            name,
+            `${kind}Removed`,
+            `${kind} removed ${signature}`,
+            `${code(`${name}.${member(signature)}`)}${label}: ${code(signature)} removed`,
+          );
+        }
+        for (const signature of added) {
+          add(
+            name,
+            `${kind}Added`,
+            `${kind} added ${signature}`,
+            `${code(`${name}.${member(signature)}`)}${label}: ${code(signature)} added`,
+          );
         }
       }
     }
-    for (const name of previousAbis.keys()) {
+    for (const name of [...previousAbis.keys()].sort()) {
       if (!currentAbis.has(name)) {
-        otherLines.push(`- \`${name}\`: no longer published`);
+        add(name, "contractRemoved", "removed", "no longer published");
         report.contracts[name] = { removedContract: true };
       }
     }
 
-    lines.push("", `## ABI changes since ${previousTag}`, "");
-    if (changedLines.length + otherLines.length === 0) {
-      lines.push(`No ABI changes since ${previousTag}.`);
+    // Leave out a contract's line when one of its bases has the same one. A contract that is new
+    // together with its bases is named on its base's line instead. That is the furthest base
+    // that is also new, which has no new base of its own, so the whole family ends up on one
+    // line. A removed contract is not in the current build, so its bases are not known and it
+    // keeps its own line.
+    const bases = args.bases ? readBases(args.bases) : {};
+    const byChange = new Map(entries.map((entry) => [`${entry.contract} ${entry.change}`, entry]));
+    const isContractLine = (entry) =>
+      entry.group === "contractAdded" || entry.group === "contractRemoved";
+    const shown = entries.filter((entry) => {
+      const covering = (bases[entry.contract] ?? []).filter((base) =>
+        byChange.has(`${base} ${entry.change}`),
+      );
+      if (covering.length === 0) return true;
+      if (isContractLine(entry)) {
+        const home = byChange.get(`${covering.at(-1)} ${entry.change}`);
+        home.names = [...(home.names ?? [home.contract]), entry.contract];
+      }
+      return false;
+    });
+    const nameList = (names) => {
+      const quoted = names.map(code);
+      return quoted.length > 1
+        ? `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`
+        : quoted[0];
+    };
+    const line = (entry) =>
+      isContractLine(entry)
+        ? `- ${nameList(entry.names ?? [entry.contract])}: ` +
+          (entry.names && entry.group === "contractAdded" ? "new contracts" : entry.text)
+        : `- ${entry.text}`;
+    const inOrder = (groups) =>
+      groups.flatMap((group) => shown.filter((entry) => entry.group === group)).map(line);
+    const breaking = inOrder(BREAKING_GROUPS);
+    const others = inOrder(OTHER_GROUPS);
+
+    if (breaking.length + others.length === 0) {
+      lines.push(`## ABI changes since ${previousTag}`, "", `No ABI changes since ${previousTag}.`);
     } else {
-      if (changedLines.length > 0) {
+      lines.push(`## Breaking ABI changes since ${previousTag}`, "");
+      lines.push(...(breaking.length > 0 ? breaking : ["None."]));
+      if (others.length > 0) {
         lines.push(
-          "**Changed signatures.** Existing callers of these get a bare revert until updated:",
-          ...changedLines,
           "",
+          "<details>",
+          `<summary>Other ABI changes (${others.length})</summary>`,
+          "",
+          ...others,
+          "",
+          "</details>",
         );
       }
-      lines.push(...otherLines);
     }
   }
 
@@ -413,6 +660,7 @@ function build(args) {
   // pre-release tags, and an upgrade diffs its build against the previous release's file.
   writeJson(join(outDir, "codehashes.json"), {
     version: tag,
+    hashScheme: HASH_SCHEME,
     build: buildInputs(),
     hashes: builtCodehashes(),
   });
@@ -712,6 +960,7 @@ if (mode === "build") build(args);
 else if (mode === "validate") validate();
 else if (mode === "changelog") changelog(args);
 else if (mode === "changedset") changedset(args);
+else if (mode === "bases") writeBases(args);
 else if (mode === "abidiff") abidiff(args);
 else if (mode === "verify") verify(args);
 else {
@@ -719,7 +968,9 @@ else {
     "usage: release-metadata.mjs build --tag <TAG> [--out <dir>] | validate | " +
       "changelog --current <file> [--previous <file>] [--previous-tag <name>] | " +
       "changedset --previous <codehashes.json> | " +
-      "abidiff --current <dir> [--previous <dir>] [--previous-tag <name>] [--json <file>] | " +
+      "bases --out <file> | " +
+      "abidiff --current <dir> [--previous <dir>] [--previous-tag <name>] [--json <file>] " +
+      "[--bases <file>] | " +
       "verify --network <folder> --rpc <url> [--tag <TAG>]",
   );
 }

From 9a84fa77fe69f960d8eafb72661c664ff82ff6fb Mon Sep 17 00:00:00 2001
From: Giuseppe Re <giuseppe.re@parity.io>
Date: Wed, 30 Sep 2026 15:40:38 +0200
Subject: [PATCH 12/22] feat: rename lite/full to device and personhood names,
 with legacy gateway entrypoints (#321)

## Description

Renames the Proof of Personhood surface from lite/full to the vocabulary
v1.0.0 launches with: **devicehood** and **personhood** for what an
account has proven or a label requires, **device name** (`stem.NN`) and
**personhood name** for the names the gateway issues. v1.0.0 is the
first mainnet launch, so this is the last moment the rename is cheap.

The gateway pallet runtime shipping with this release is frozen and
keeps calling today's three controller functions and decoding today's
errors. The controller therefore serves both: the new entrypoints, and a
separate `IDotnsPopControllerLegacy` that keeps the old selectors. The
next release (R2) will move the pallet to the new entrypoints and remove
the legacy interface.

### What changes

**`DotnsPopController` / `IDotnsPopController`**

| Master | This PR |
| --- | --- |
| `reserveLiteName` | `issueDeviceName` |
| `reserveBaseName` | `issueDeviceNameWithReservation` |
| `reserveBaseNameOnly` | `reservePersonhoodName` |
| `registerBaseName` | `issuePersonhoodName` |
| `reservedBaseLabelOf` | `reservedLabelOf` |
| `LiteRegistration`, `BaseReservation`, `BaseNameReservation`,
`FullRegistration` | `DeviceNameIssuance`,
`DeviceNameIssuanceWithReservation`, `PersonhoodNameReservation`,
`PersonhoodNameIssuance` |
| `LinkKind.LiteUsername` | `LinkKind.DeviceName` |
| `LiteNameReserved` | `DeviceNameIssued` |
| `StandaloneNameRegistered`, `BaseNameClaimed` | `PersonhoodNameIssued`
on every issuance, plus `ReservationClaimed` on a claim |
| `LiteToFullLinked` | `DeviceNameLinked` |
| `InvalidLiteLabel`, `InvalidBaseLabel` | `InvalidDeviceLabel`,
`InvalidPersonhoodLabel` |
| `LiteNameAlreadyIssued` | `DeviceNameAlreadyIssued` |
| `LiteLabelNotOwnedByUser` | `DeviceNameNotOwned` |
| `BaseNameAlreadyRegistered` | `PersonhoodNameUnavailable` |

"Issue" creates a gateway name; "reserve" is only the personhood-name
queue. `reserveLiteName` issued a name, which is why it is renamed.

**`DotnsPopResolver`**: `setLiteLink` and `LiteLinkUpdated` become
`setDeviceLink` and `DeviceLinkUpdated`. The getters are named by what
they return, because the two directions take and return different
identifiers: `liteLink(personhoodNode)` becomes
`deviceLabelhashOf(personhoodNode)`, returning a device-name labelhash,
and `fullClaim(deviceLabelhash)` becomes
`personhoodNodeOf(deviceLabelhash)`, returning a personhood-name node.

**`DotnsPopLens`**: `liteNamesOf` + `fullNamesOf` and their two counts
merge into `namesOf(user, offset, limit)` and `nameCountOf(user)`: one
listing of every gateway-issued name the user holds, with a single
offset over store entries first and then pending claims.
`NameDetail.tier`, `liteLink`, `fullClaim` become `requiredTier`,
`deviceLabelhash`, `personhoodNode`. `Name` no longer carries a
`deadline`, because pending claims never lapse (#324).

**`PopRules`**: `PopStatus.PopLite` / `PopFull` become `Devicehood` /
`Personhood` (same `uint8` values), and `personhoodOf` becomes
`popStatusOf`, since it also returns devicehood. Revert messages follow
the new vocabulary.

**What keeps its name**

- Lite/Full where dotNS mirrors another team's code: the `IPersonhood`
precompile interface. `PopRules` maps status 1 to `Devicehood` and 2 to
`Personhood` in one place.
- "PoP" in contract names, registry keys and `isPopIssued`.
- The `*BaseName*` identifiers in `PopRules`, which the public
controller and the SDK call. The prose now uses the same word: a label's
**base name** is the label with any device suffix removed, and **stem**
means only the letters of a device name.

### Legacy entrypoints for the frozen pallet

`IDotnsPopControllerLegacy` keeps `reserveLiteName`, `reserveBaseName`
and `registerBaseName` with their current selectors (`0x220015c0`,
`0xd89f1bce`, `0x7c4b376b`), checked against the gateway pallet in
individuality-community (v0.3.3 and `main`). Each forwards to its
replacement's shared body. Called through them, label validation reverts
with `InvalidLiteLabel` / `InvalidBaseLabel` (`0x5c6c2eea`,
`0x39e67d31`), the errors the pallet decodes; every other error is
shared. `supportsInterface` reports both interfaces.

### Behaviour changes

- Every exit from a reservation queue now emits an event.
`ReservationClaimed` and `ReservationEvicted` are new, and
`ReservationRelinquished` is emitted wherever a user's entry is dropped
(standalone issuance and re-reservation included), exactly once, and
only when an entry existed.
- `DotnsPopLens.nameDetail(label)` now returns the label and its
required tier for a personhood name whose claim has not settled. It
returned an empty label and `NoStatus`, because the registrar reads a
tokenised name's label from the holder's `LabelStore`.
`nameDetailByNode` still has no label for an unsettled name, which the
node alone cannot recover.
- `DotnsPopLens.Name` drops `deadline`. It reported `mintedAt +
reservationDuration`, but pending claims never lapse and can be settled
at any time, so the field had no meaning (#324). A claim's `mintedAt` is
still available from `IDotnsPopController.pendingClaims`.

### Upgrade shape

- Code-only swaps of the `DotnsPopController`, `DotnsPopResolver` and
`PopRules` proxies, plus a redeployed `DotnsPopLens`. No storage
migration.
- Storage layout is unchanged against master, apart from two annotated
mapping renames in `DotnsPopResolver`; every `__gap` stays
`uint256[50]`.
- `DotnsPopController` is 23,497 bytes, 1,079 under the limit.

### Docs

- README gains an **Identifiers** section defining label, labelhash,
node and tokenId, including where a device name's labelhash and node
diverge. It corrects the `DotnsRegistrar` description: a tokenId is
`uint256(node)`.
- README, CONTRIBUTING, KNOWN_ISSUES and NatSpec follow the new
vocabulary, and "dotNS" is spelled consistently across contracts, docs,
scripts and workflows.
- Stale statements fixed along the way:
- `baseLength` was described as "digit-stripped", and `classifyName` as
classifying "by the length it leaves"; every label is measured as
written, less a device name's suffix.
- Pending claims were described as expiring, or as settleable by third
parties only after a window; settlement is permissionless at any time
and always writes the label.
- The commit-reveal controller was described as writing reservations; it
only reads the slot, and clears a reclaimed name's stale slot.
- The lens described ownership as read from the registrar; it reads the
registry, which covers device-name subnames.
- The escrow's zero-amount positions come from cross-paid registrations.

### Consumers

Checked [dotns-sdk](https://github.com/paritytech/dotns-sdk),
[bulletin-deploy](https://github.com/paritytech/bulletin-deploy),
[getcash-community](https://github.com/paritytech/getcash-community),
[host-rust-core](https://github.com/paritytech/host-rust-core/),
[polkadot-ios-community](https://github.com/paritytech/polkadot-ios-community),
[polkadot-android-community](https://github.com/paritytech/polkadot-android-community),
[polkadot-desktop-community](https://github.com/paritytech/polkadot-desktop-community),
[dotli-community](https://github.com/paritytech/dotli-community),
[epoca](https://github.com/paritytech/epoca),
[product-sdk](https://github.com/paritytech/product-sdk): none calls a
renamed selector, so nothing is affected in this release.

## Type

- [ ] Bug fix
- [x] Feature
- [x] Breaking change
- [x] Documentation
- [ ] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [x] Resolver
- [ ] Store
- [x] Proof of Personhood
- [ ] Deployment scripts
- [x] Tests

## Related Issues

#319
#324

## Fixes

Closes #319
Closes #324

## Checklist

### Code

- [x] Follows project style
- [x] `forge build` passes
- [x] `forge test` passes
- [ ] No new compiler warnings

### Testing

- [x] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [x] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [x] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [ ] No breaking changes
- [x] Breaking changes documented below

**Breaking changes:**

- **ABI callers and indexers:** renamed functions and errors get new
selectors, and renamed events a new topic0 (see What changes). The three
legacy entrypoints and `InvalidLiteLabel` / `InvalidBaseLabel` keep
theirs.
- **Decoded struct fields:** clients that decode structs by field name
(viem, ethers) must read the new names: `NameDetail.tier`, `liteLink`,
`fullClaim` become `requiredTier`, `deviceLabelhash`, `personhoodNode`,
and the controller's request structs rename their fields too.
- **`PopStatus`:** values stay `uint8` 0 to 3, so nothing on the wire
changes. Member names are not part of the ABI, so the break is limited
to Solidity code importing `IPopRules` and clients that hardcode the old
labels (`PopLite`, `PopFull`); they need `Devicehood`, `Personhood`. The
same applies to `LinkKind.LiteUsername`, now `LinkKind.DeviceName`.
- **`PopRules` revert strings:** the `PopError` messages changed
wording, so anything matching on the text breaks.
- **Lens listings:** `liteNamesOf` / `fullNamesOf` and their counts are
replaced by `namesOf` / `nameCountOf`, with a single offset, and `Name`
drops `deadline`.

## How to test

```bash
forge test
```

## Notes

Once the dotNS gateway pallet will be updated to the new end points, we
can stop supporting the legacy ones.
---
 .env.example                                  |    2 +-
 .github/abi-contracts.txt                     |    1 +
 .github/labels.yml                            |    2 +-
 .github/workflows/deploy-contracts.yml        |    2 +-
 .github/workflows/issue-add-to-project.yml    |    2 +-
 .github/workflows/publish-prerelease.yml      |    2 +-
 .github/workflows/publish-release.yml         |    6 +-
 CONTRIBUTING.md                               |   18 +-
 DEPLOYMENTS.md                                |    4 +-
 DEPLOYMENT_CHECKLIST.md                       |    4 +-
 KNOWN_ISSUES.md                               |    8 +-
 README.md                                     |  105 +-
 RELEASE_ARTIFACTS.md                          |    6 +-
 SECURITY.md                                   |    2 +-
 THIRD_PARTY_NOTICES.md                        |    2 +-
 contracts/deploy/Create3Factory.sol           |    4 +-
 contracts/escrow/DotnsNameEscrow.sol          |   11 +-
 contracts/escrow/IDotnsNameEscrow.sol         |    2 +-
 contracts/pop/DotnsCostModelRegistry.sol      |    2 +-
 contracts/pop/DotnsFlatPricing.sol            |    2 +-
 contracts/pop/DotnsScarcityPricing.sol        |    7 +-
 contracts/pop/IDotnsCostModelRegistry.sol     |    8 +-
 contracts/pop/IDotnsPricing.sol               |    7 +-
 contracts/pop/IPopRules.sol                   |  137 +-
 contracts/pop/PopRules.sol                    |  192 +-
 contracts/registrars/DotnsPopController.sol   |  428 +++--
 contracts/registrars/DotnsPopLens.sol         |  126 +-
 contracts/registrars/DotnsRegistrar.sol       |   16 +-
 .../registrars/DotnsRegistrarController.sol   |   20 +-
 contracts/registrars/IDotnsController.sol     |    2 +-
 contracts/registrars/IDotnsPopController.sol  |  395 ++--
 .../registrars/IDotnsPopControllerLegacy.sol  |   42 +
 contracts/registrars/IDotnsPopLens.sol        |  150 +-
 contracts/registrars/IDotnsRegistrar.sol      |   10 +-
 .../registrars/IDotnsRegistrarController.sol  |   10 +-
 contracts/registry/DotnsProtocolRegistry.sol  |    6 +-
 contracts/registry/DotnsRegistry.sol          |    6 +-
 contracts/registry/IDotnsProtocolRegistry.sol |    2 +-
 contracts/registry/IDotnsRegistry.sol         |    2 +-
 contracts/resolvers/DotnsContentResolver.sol  |    6 +-
 contracts/resolvers/DotnsPopResolver.sol      |   58 +-
 contracts/resolvers/DotnsResolver.sol         |    8 +-
 contracts/resolvers/DotnsReverseResolver.sol  |   14 +-
 contracts/resolvers/IDotnsContentResolver.sol |    8 +-
 contracts/resolvers/IDotnsPopResolver.sol     |   69 +-
 contracts/resolvers/IDotnsResolver.sol        |    4 +-
 contracts/resolvers/IDotnsReverseResolver.sol |    6 +-
 contracts/store/IDotnsStore.sol               |    4 +-
 contracts/store/ILabelStore.sol               |    4 +-
 contracts/store/IStoreFactory.sol             |    2 +-
 contracts/store/LabelStore.sol                |    8 +-
 contracts/store/StoreFactory.sol              |    4 +-
 contracts/store/UserStore.sol                 |    2 +-
 contracts/utils/DotnsConstants.sol            |   17 +-
 contracts/utils/LabelUtils.sol                |    4 +-
 contracts/utils/RegistrationUtils.sol         |    6 +-
 contracts/utils/StoreAuth.sol                 |    2 +-
 contracts/utils/StoreUtils.sol                |    4 +-
 contracts/utils/StringUtils.sol               |   76 +-
 contracts/utils/SubnodeUtils.sol              |   20 +-
 contracts/utils/SystemUtils.sol               |    2 +-
 contracts/whitelist/DotnsNameWhitelist.sol    |    4 +-
 package.json                                  |    2 +-
 scripts/deploy/BaseDeployer.s.sol             |   10 +-
 scripts/deploy/DeployCore.s.sol               |    2 +-
 scripts/deploy/DeployCreate3Factory.s.sol     |    2 +-
 scripts/deploy/DeployPopSystem.s.sol          |    8 +-
 scripts/deploy/DotnsDeployer.s.sol            |    4 +-
 scripts/deploy/deployall.sh                   |    2 +-
 scripts/deploy/factory.sh                     |    2 +-
 scripts/deploy/run.sh                         |    4 +-
 scripts/genesis/build-genesis.sh              |   16 +-
 scripts/genesis/extract-genesis.mjs           |    4 +-
 scripts/genesis/extract-genesis.test.mjs      |    4 +-
 scripts/reports/4naly3er-report.py            |    4 +-
 scripts/reports/coverage-report.py            |    4 +-
 scripts/reports/gas-report.py                 |    4 +-
 scripts/reports/slither-report.py             |    4 +-
 scripts/reports/test-report.py                |    4 +-
 test/base/BaseDotns.t.sol                     |  200 +-
 test/fuzz/pop/PopFuzz.t.sol                   |   24 +-
 .../registrar/DotnsPopControllerFuzz.t.sol    |   81 +-
 .../DotnsRegistrarControllerFuzz.t.sol        |   24 +-
 test/intergration/BasicDotns.reverts.t.sol    |   18 +-
 test/intergration/BasicDotns.t.sol            |   14 +-
 test/intergration/PopLifecycleFlow.t.sol      |  230 +--
 test/intergration/StoreIntegration.t.sol      |    8 +-
 .../escrow/DotnsNameEscrowInvariant.t.sol     |    2 +-
 test/invariant/escrow/EscrowHandler.t.sol     |   20 +-
 .../DotnsPopControllerInvariant.t.sol         |  121 +-
 .../DotnsRegistrarControllerInvariant.t.sol   |    8 +-
 ...DotnsRegistrarReservedGrantInvariant.t.sol |    2 +-
 .../DotnsRegistrarSoulboundInvariant.t.sol    |    2 +-
 .../registrar/PopControllerHandler.t.sol      |  225 +--
 .../RegistrarControllerHandler.t.sol          |    8 +-
 .../registry/DotnsRegistryInvariant.t.sol     |    8 +-
 test/invariant/registry/RegistryHandler.t.sol |    4 +-
 test/unit/escrow/DotnsNameEscrow.t.sol        |   36 +-
 test/unit/escrow/DotnsNameEscrowRedeem.t.sol  |   10 +-
 test/unit/pop/PopRules.t.sol                  |   76 +-
 test/unit/pop/PopRulesClassification.t.sol    |   73 +-
 test/unit/registrar/DotnsPopController.t.sol  | 1661 +++++++++--------
 .../registrar/DotnsPopControllerLegacy.t.sol  |  654 +++++++
 test/unit/registrar/DotnsRegistrar.t.sol      |    8 +-
 .../registrar/DotnsRegistrarController.t.sol  |   41 +-
 .../DotnsRegistrarControllerLifecycle.t.sol   |   20 +-
 .../DotnsProtocolRegistryDeclarations.t.sol   |    2 +-
 test/unit/registry/DotnsRegistry.t.sol        |   10 +-
 test/unit/resolver/DotnsPopResolver.t.sol     |  206 +-
 test/unit/resolver/DotnsReverseResolver.t.sol |   18 +-
 test/unit/utils/StringUtils.t.sol             |  122 +-
 111 files changed, 3551 insertions(+), 2550 deletions(-)
 create mode 100644 contracts/registrars/IDotnsPopControllerLegacy.sol
 create mode 100644 test/unit/registrar/DotnsPopControllerLegacy.t.sol

diff --git a/.env.example b/.env.example
index c9240b3e5..3c8525b06 100644
--- a/.env.example
+++ b/.env.example
@@ -55,7 +55,7 @@ DOTNS_TLD=dot
 DEPLOYMENT_NETWORK=
 
 # Optional. Address of a pre-deployed CREATE3 factory to reuse. When set,
-# DeployCore adopts it instead of minting a new one, so every DotNS address is
+# DeployCore adopts it instead of minting a new one, so every dotNS address is
 # pinned to that factory and stays the same across chain resets. `bun run
 # deploy:all` sets this automatically from the factory step; set it by hand only
 # when running `bun run deploy` (the pipeline on its own).
diff --git a/.github/abi-contracts.txt b/.github/abi-contracts.txt
index c7cc76914..8511dde30 100644
--- a/.github/abi-contracts.txt
+++ b/.github/abi-contracts.txt
@@ -44,6 +44,7 @@ IPopRules
 IDotnsProtocolRegistry
 IDotnsNameEscrow
 IDotnsPopController
+IDotnsPopControllerLegacy
 IDotnsPopResolver
 IDotnsPopLens
 IDotnsController
diff --git a/.github/labels.yml b/.github/labels.yml
index b959e161e..a08724bc0 100644
--- a/.github/labels.yml
+++ b/.github/labels.yml
@@ -120,7 +120,7 @@
 
 - name: "dotns-sdk"
   color: "5319e7"
-  description: "DotNS SDK (UI, CLI, libraries)"
+  description: "dotNS SDK (UI, CLI, libraries)"
 
 - name: "smartcontracts"
   color: "e3a21a"
diff --git a/.github/workflows/deploy-contracts.yml b/.github/workflows/deploy-contracts.yml
index 0165adef7..07588396b 100644
--- a/.github/workflows/deploy-contracts.yml
+++ b/.github/workflows/deploy-contracts.yml
@@ -282,7 +282,7 @@ jobs:
           fi
 
       # This CI deploy reproduces the expected address set. The canonical factory
-      # was deployed above, and every DotNS address is a pure function of that
+      # was deployed above, and every dotNS address is a pure function of that
       # factory plus a fixed salt, so the freshly deployed manifest must equal the
       # committed expected set. Assert that, print the expected-vs-actual table, then
       # rerun the pipeline to prove the deploy is resumable: a rerun adopts every
diff --git a/.github/workflows/issue-add-to-project.yml b/.github/workflows/issue-add-to-project.yml
index dfbac4605..23e3e0833 100644
--- a/.github/workflows/issue-add-to-project.yml
+++ b/.github/workflows/issue-add-to-project.yml
@@ -1,4 +1,4 @@
-name: Add Issues to DotNS Project
+name: Add Issues to dotNS Project
 
 on:
   issues:
diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml
index 6e40e24e7..35d759bad 100644
--- a/.github/workflows/publish-prerelease.yml
+++ b/.github/workflows/publish-prerelease.yml
@@ -214,7 +214,7 @@ jobs:
           ASSET_BASE="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/download/$TAG"
 
           cat > release-body.md << 'ENDOFBODY'
-          ## DotNS ABI Package (Pre-release)
+          ## dotNS ABI Package (Pre-release)
 
           > **This is a pre-release.** ABIs may change before the stable release.
 
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 4f73e3c21..1fb0af90a 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -138,7 +138,7 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
         run: forge test -vv
 
-      # pallet-revive genesis, so a chain can carry DotNS from block zero rather than
+      # pallet-revive genesis, so a chain can carry dotNS from block zero rather than
       # deploying it afterwards. Built here rather than downstream: this repo owns the
       # contracts, the deploy scripts and the CREATE3 factory key that fixes every address,
       # and the artifact then ships from the same commit as the ABIs beside it.
@@ -208,7 +208,7 @@ jobs:
           ASSET_BASE="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/download/$TAG"
 
           cat > release-body.md << 'ENDOFBODY'
-          ## DotNS ABI Package
+          ## dotNS ABI Package
 
           **Contracts**
           | Contract | ABI |
@@ -260,7 +260,7 @@ jobs:
             echo ""
             echo "### Genesis"
             echo ""
-            echo "Pallet-revive genesis state, for a chain that should carry DotNS from block zero"
+            echo "Pallet-revive genesis state, for a chain that should carry dotNS from block zero"
             echo "rather than deploying it afterwards."
             echo ""
             for tld in $DOTNS_TLDS; do
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 12c1b6897..8aafe7900 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
-# Contributing to DotNS
+# Contributing to dotNS
 
-These guidelines apply to the DotNS repository ("dotns"). Contributions are welcome via issues, pull requests, reviews, and testing feedback. Protocol behaviour is documented in [README.md](./README.md) and network addresses in `deployments/<network>/<chain-id>.json`; this file is the contributor mechanics.
+These guidelines apply to the dotNS repository ("dotns"). Contributions are welcome via issues, pull requests, reviews, and testing feedback. Protocol behaviour is documented in [README.md](./README.md) and network addresses in `deployments/<network>/<chain-id>.json`; this file is the contributor mechanics.
 
 ## Types of contributing
 
@@ -74,7 +74,7 @@ Before opening a pull request:
 
 ## Feature design
 
-Treat the chain as the database. Assume no servers and no indexers. If a feature needs an offchain service to be usable, it is not a DotNS feature.
+Treat the chain as the database. Assume no servers and no indexers. If a feature needs an offchain service to be usable, it is not a dotNS feature.
 
 This has a practical implication: every feature must come with an explicit query path. A client should be able to start from a small set of known contracts and find everything it needs with a bounded number of calls. Every getter is `external view`; controllers and resolvers check authorisation on writes, never on reads; governance key rotation does not break existing read paths because consumers re-resolve their siblings through the protocol registry on every call.
 
@@ -118,12 +118,12 @@ Example query paths. Each row starts from a small set of known contracts; every
 
 | Lookup | Path |
 | --- | --- |
-| Lite labelhash => full-person node | Protocol registry => PoP resolver => `fullClaim(liteLabelhash)` |
-| Full-person node => lite labelhash | Protocol registry => PoP resolver => `liteLink(fullNode)` |
+| Device-name labelhash => personhood-name node | Protocol registry => PoP resolver => `personhoodNodeOf(deviceLabelhash)` |
+| Personhood-name node => device-name labelhash | Protocol registry => PoP resolver => `deviceLabelhashOf(personhoodNode)` |
 | Node => chat key | Protocol registry => PoP resolver => `chatKey(node)` |
 | Node or tokenId => registered label | Protocol registry => registrar => `labelOf(uint256(node))` |
-| Base stem => gateway-reservation state | Protocol registry => PoP controller => `isReservedForClaim(baseLabel)` |
-| Base stem => cross-flow reservation state | Protocol registry => PopRules => `isBaseNameReserved(baseLabel)` |
+| Personhood name => gateway-reservation state | Protocol registry => PoP controller => `isReservedForClaim(label)` |
+| Base name => cross-flow reservation state | Protocol registry => PopRules => `isBaseNameReserved(baseName)` |
 | Node => ERC721 owner | Protocol registry => registrar => `ownerOf(uint256(node))` |
 | Subnode => forward-registry owner | Protocol registry => registry => `owner(subnode)` |
 | Node => forward address record | Protocol registry => forward resolver => address record |
@@ -191,7 +191,7 @@ Do not cache the new address in storage on the existing contract during the upgr
 
 ## Static analysis and security tooling
 
-DotNS uses automated checks (including static analysis) on pull requests.
+dotNS uses automated checks (including static analysis) on pull requests.
 
 Important caveats:
 
@@ -284,4 +284,4 @@ forge test --no-match-path 'test/fork/**'
 Be respectful and constructive.
 
 - Harassment, abuse, or aggressive behaviour is not acceptable.
-- Spam issues/PRs, or contributions unrelated to DotNS, may be closed.
+- Spam issues/PRs, or contributions unrelated to dotNS, may be closed.
diff --git a/DEPLOYMENTS.md b/DEPLOYMENTS.md
index 4c764fc02..630e0e9f9 100644
--- a/DEPLOYMENTS.md
+++ b/DEPLOYMENTS.md
@@ -1,10 +1,10 @@
-# DotNS Deployments
+# dotNS Deployments
 
 Current deployment addresses and developer deployment notes for dotNS contracts.
 
 ## What this file is for
 
-This file is the operational companion to the README. It explains how to run the local ETH-RPC adapter, how to deploy DotNS, where deployment manifests are written, and which addresses are currently live on the supported Paseo environments.
+This file is the operational companion to the README. It explains how to run the local ETH-RPC adapter, how to deploy dotNS, where deployment manifests are written, and which addresses are currently live on the supported Paseo environments.
 
 > For a short, do-this-in-order checklist (including how to target **any** Polkadot chain, not just the Paseo environments), see [`DEPLOYMENT_CHECKLIST.md`](./DEPLOYMENT_CHECKLIST.md).
 
diff --git a/DEPLOYMENT_CHECKLIST.md b/DEPLOYMENT_CHECKLIST.md
index 0bb92b668..0cc935183 100644
--- a/DEPLOYMENT_CHECKLIST.md
+++ b/DEPLOYMENT_CHECKLIST.md
@@ -1,6 +1,6 @@
-# DotNS Deployment Checklist
+# dotNS Deployment Checklist
 
-A step-by-step, copy/paste checklist for deploying DotNS to **any** Polkadot
+A step-by-step, copy/paste checklist for deploying dotNS to **any** Polkadot
 chain (any PolkaVM / `revive`-backed Asset Hub-style chain that exposes an
 ETH-RPC adapter).
 
diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index 7980a4d1f..fa67c2a62 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -1,6 +1,6 @@
 # Known issues
 
-DotNS carries a small set of constraints worth knowing before deploying or building against it. Most stem from the current pallet-revive runtime rather than from protocol design, and collapse to a no-op once the runtime gains the corresponding capability. Each is described in full where the relevant contract is documented in the [README](./README.md#contracts); this file is the consolidated index.
+dotNS carries a small set of constraints worth knowing before deploying or building against it. Most stem from the current pallet-revive runtime rather than from protocol design, and collapse to a no-op once the runtime gains the corresponding capability. Each is described in full where the relevant contract is documented in the [README](./README.md#contracts); this file is the consolidated index.
 
 For the security and audit status of the codebase, see [SECURITY.md](./SECURITY.md).
 
@@ -13,9 +13,9 @@ For the security and audit status of the codebase, see [SECURITY.md](./SECURITY.
 
 **Type:** runtime limitation.
 
-Substrate Root cannot deploy a contract on behalf of an account it does not control, so a per-user `LabelStore` cannot be created at the moment a Pop-gateway issuance writes the name. The controller stamps a pending-claim entry instead, and the user settles it later by calling `claimLabelStore` once from their own address. Pending-claim entries carry a bounded TTL and `expirePendingClaim` is permissionless, so the slot frees itself if a user never claims.
+Substrate Root cannot deploy a contract on behalf of an account it does not control, so a per-user `LabelStore` cannot be created at the moment a gateway-path issuance writes the name. The controller stamps a pending-claim entry instead, and the user settles it later by calling `claimLabelStore` from their own address. Settlement is permissionless: `settlePendingClaims` lets anyone settle a given owner's entries and pay the cost, and settlement always writes the label, so a pending name is never stranded.
 
-**Workaround:** `claimLabelStore` (user-signed) settles the whole pending pile and deploys the store.
+**Workaround:** `claimLabelStore` (user-signed) settles a bounded batch of the caller's pending claims, deploying the store on the first write; the caller calls it again while it reports `moreRemaining`.
 
 **Resolution:** when the runtime supports root-origin contract deployment, the deferred path collapses to a no-op and issuance becomes one transaction end-to-end.
 
@@ -25,7 +25,7 @@ See [README → DotnsPopController](./README.md#early-testnet-quirk-labelstore-d
 
 **Type:** current implementation.
 
-The Pop gateway does not write a dedicated user-status mapping. It materialises the PoP flow through gateway-issued labels, PoP resolver records, and reservation queue state; user tier checks for public pricing read status from the personhood precompile and context, not from stored state.
+The gateway path does not write a dedicated user-status mapping. It materialises that path through gateway-issued labels, PoP resolver records, and reservation queue state; user tier checks for public pricing read status from the personhood precompile and context, not from stored state.
 
 **Resolution:** a dedicated status mapping could be added if a use case requires it; the current design is deliberate, not a defect.
 
diff --git a/README.md b/README.md
index fda3199c9..1b30b0452 100644
--- a/README.md
+++ b/README.md
@@ -6,11 +6,11 @@
 > If you experience problems with any product or service that was built on or deployed from this code, you should contact the third party who deployed the code in its amended form, not Parity.
 
 
-# Dotns
+# dotNS
 
 Smart contracts for registering .dot names on Polkadot.
 
-DotNS is a naming system for Polkadot. An account can register a .dot name, receive an ERC721 token that represents ownership of that name, attach records to it (addresses, text, content hashes, chat keys), and create subnames beneath it. Two independent issuance paths coexist on the same underlying registrar: a public commit-reveal path for anyone who wants a name, and a Proof-of-Personhood gateway path that issues lite-person and full-person usernames on behalf of verified users. Every piece of state the protocol surfaces is readable through public view functions on the chain itself, so a client needs only a node and a small set of well-known contract addresses to answer any question about the system.
+dotNS is a naming system for Polkadot. An account can register a .dot name, receive an ERC721 token that represents ownership of that name, attach records to it (addresses, text, content hashes, chat keys), and create subnames beneath it. Two independent issuance paths coexist on the same underlying registrar: a public commit-reveal path for anyone who wants a name, and a gateway path, driven by the [dotNS gateway pallet](#dotnspopcontroller) in the Asset Hub runtime, that issues device names and personhood names on behalf of verified users. Every piece of state the protocol surfaces is readable through public view functions on the chain itself, so a client needs only a node and a small set of well-known contract addresses to answer any question about the system.
 
 ## Diagrams
 
@@ -23,7 +23,7 @@ DotNS is a naming system for Polkadot. An account can register a .dot name, rece
 | Actor | What they may do |
 | --- | --- |
 | **Anyone with an account** | Register an available name on the public paid path, within the bands in [Who can register a name](#who-can-register-a-name). Own it, transfer it, attach records, issue subnames beneath it. |
-| **A personhood-verified person** | Receive a lite-person or full-person username issued through the gateway, at no cost. See [DotnsPopController](#dotnspopcontroller). |
+| **An account with devicehood or personhood** | Receive a device name or a personhood name issued through the dotNS gateway pallet, at no cost. See [DotnsPopController](#dotnspopcontroller). |
 | **Root (governance)** | Gates every name that skips pricing or personhood: issues per-name grants, mints a reserved name directly, drives the gateway, and opens the short-name band. It cannot seize, reassign, or destroy a name anyone already holds — see [What governance controls](#what-governance-controls). |
 | **The contract owner** | Deploys, upgrades, and wires the protocol registry. Not an allocator by design, but `DotnsProtocolRegistry.set` and `DotnsRegistrar.addController` both reach the same outcome, so treat the owner as trusted infrastructure rather than a constrained role. |
 | **Anyone, as upkeep** | Permissionless maintenance: expire a stale reservation, settle another user's deferred label write, submit a granted registration on the beneficiary's behalf. None of these confer any claim on a name. |
@@ -51,7 +51,7 @@ Every name admitted to public sale costs the same refundable deposit: 10 DOT at
 
 ### Base length and the digit rule
 
-Pricing and eligibility read a name's base length. An ordinary name is measured as written, digits included, so `andrew` is six characters and `andrew01` is eight. A lite-person username issued by the PoP gateway carries a separator and two allocated digits (`andrew.01`), and those come off first, so it measures its six-character stem. Base length decides which band a name falls in and who may register it; under the flat model it does not change the amount.
+Pricing and eligibility read a name's base length: the length of its base name, which is the name with any device suffix removed. An ordinary name is its own base name, measured as written, digits included, so `andrew` is six characters and `andrew01` is eight. A device name issued by the gateway pallet carries a separator and two allocated digits (`andrew.01`); its base name is the stem before them, so it measures six. Base length decides which band a name falls in and who may register it; under the flat model it does not change the amount.
 
 ### What a name costs
 
@@ -73,9 +73,9 @@ Three bands share the one deposit.
 | 6 to 8 | a verified person, and only while the short-name switch is on | 10 DOT |
 | 5 or fewer | nobody on the public path | not sold; issued at zero base cost through the reserved path |
 
-Personhood unlocks only the six-to-eight band. A no-digit name there needs full-person verification; a two-digit name needs lite-person verification. It gates who may buy, not the price: the deposit is the same one everyone pays.
+On the public paid path, the six-to-eight band opens only to proof of personhood. Devicehood reaches short names through the gateway pallet instead: it issues a device name such as `andrew.01` and can reserve a personhood name, such as `andrew`, to claim once the user proves personhood. Status decides who may register; the deposit is the same one everyone pays.
 
-Names shorter than nine characters are closed on the public paid path by default. A paid registration below nine reverts until governance opens the short-name market with a single switch. The switch gates the public paid path alone: the personhood gateway issues names of any length without it, and the reserved path does not consult it. It defaults off, so at launch only names of nine characters or more are for sale.
+Names shorter than nine characters are closed on the public paid path by default. A paid registration below nine reverts until governance opens the short-name market with a single switch. The switch is designed for testnets, where turning it on makes short names easier to acquire: a verified person buys a six-to-eight-character name directly on the public path. Polkadot mainnet is meant to keep it off, so the public path there sells only names of nine characters or more. The switch gates the public paid path alone: the gateway pallet issues names of any length without it, and the reserved path does not consult it.
 
 Names of five characters or fewer are never sold on the public path, which rejects a reserved-tier label outright. Such a name enters circulation only through the reserved path, which mints an available label at zero base cost with no deposit and no personhood check. That path is gated on a grant: the label must be bound to the intended owner on `DotnsNameWhitelist`, or the dispatch must be substrate Root. There is no treasury: no value moves when a reserved name is issued.
 
@@ -88,9 +88,9 @@ The path decides whether the amount is a refundable deposit, a non-refundable fe
 | `gavinwood` | 9 | public, own key | 10 DOT | refundable deposit |
 | `gavinwood` | 9 | public, someone else pays | 10 DOT | protocol fee |
 | `andrewsays` | 10 | public, own key | 10 DOT | refundable deposit |
-| `andrew` | 6 | public, own key (switch on, full person) | 10 DOT | refundable deposit |
-| `alicebob42` | 8 | public, own key (switch on, lite person) | 10 DOT | refundable deposit |
-| any six-to-eight name | 6 to 8 | personhood gateway grant | none | no deposit, no fee |
+| `andrew` | 6 | public, own key (switch on, proof of personhood) | 10 DOT | refundable deposit |
+| `alicebob42` | 10 | public, own key | 10 DOT | refundable deposit |
+| any six-to-eight name | 6 to 8 | gateway path | none | no deposit, no fee |
 | `andrew`, moved to a wallet that cannot clear its band | 6 | transfer | 10 DOT | protocol fee |
 
 ### Deposits and protocol fees
@@ -103,7 +103,7 @@ A name someone else pays for, and a transfer, pay a non-refundable fee instead.
 
 Publicly registered names transfer freely and charge the name's own price, but only in two cases: the recipient cannot clear the name's band, or the move is a personhood downgrade, where the recipient's tier is lower than the sender's. Passing a six-character name to a wallet that could never have registered it costs the name's own price, so there is no cheap way to hand a band-gated name to a party who could not have earned it. A move between two wallets that both clear the band, and a move to the same address, cost nothing. The fee, when one is owed, settles into the protocol fee pot. The deposit, when present, rides with the name: the escrow position rebinds to the new holder rather than refunding, and only releasing the name back to escrow unlocks the locked deposit.
 
-Names minted through the PoP gateway are soulbound: they stay bound to the person who earned them and cannot be transferred at all. Any transfer of a gateway-issued name reverts, and quoting a transfer fee for one reverts rather than returning a price. Everything else about the name works normally, so its owner still sets records, issues subnames, and manages the name.
+Names minted through the gateway pallet are soulbound: they stay bound to the person who earned them and cannot be transferred at all. Any transfer of a gateway-issued name reverts, and quoting a transfer fee for one reverts rather than returning a price. Everything else about the name works normally, so its owner still sets records, issues subnames, and manages the name.
 
 A bare transfer does not reset the name's records. Registration and reclaim from escrow both point the registry record back at the default reverse resolver, but a direct ERC-721 `transferFrom` never calls the registry, so a name sold privately arrives still pointing at the seller's resolver. A buyer should overwrite the records they care about rather than assume they start clean.
 
@@ -131,11 +131,11 @@ Gateway-issued (soulbound) names never enter this lifecycle. Releasing a name tr
 
 ### Cost-model versioning
 
-D and F are fixed for the life of a pricing model. Changing either means deploying a fresh model with the new values and registering it, at which point it becomes the current version; there is no live setter that edits the numbers in place. Governance can also point the current version back at an earlier registered model to roll a change back. An in-flight registration prices at the version it committed to, so a model change between commit and reveal leaves its cost unchanged.
+A pricing model's values are fixed for its life: the flat model's deposit, or the scarcity candidate's base fee D and floor F. Changing them means deploying a fresh model with the new values and registering it, at which point it becomes the current version; there is no live setter that edits the numbers in place. Governance can also point the current version back at an earlier registered model to roll a change back. An in-flight registration prices at the version it committed to, so a model change between commit and reveal leaves its cost unchanged.
 
 ### What governance controls
 
-Governance sets D and F to whatever values it chooses. The contracts hold them coherent and nothing more: D above zero, F above zero and no greater than D, and D within a ceiling that keeps the six-character multiplication from overflowing. There is no cap on how high or low D goes and no limit on how fast it moves, so any rate limit or advance notice comes from the governance process rather than from these contracts. Governance also opens or closes the short-name market with the switch, tunes the release cooldown within its one-hour bound, sets the redeem window between 1 and 30 days, and sets the gateway's reservation duration. None of these controls lets governance seize, reassign, or destroy a name anyone already holds.
+Governance chooses a model's values when it deploys one, and the contracts hold them coherent and nothing more: a flat deposit above zero; for the scarcity candidate, D and F above zero, F no greater than D, and D within a ceiling that keeps the multiplication below nine characters from overflowing. Beyond these checks there is no cap on how high or low the amounts go and no limit on how fast they move, so any rate limit or advance notice comes from the governance process rather than from these contracts. Governance also opens or closes the short-name market with the switch, tunes the release cooldown within its one-hour bound, sets the redeem window between 1 and 30 days, and sets the gateway's reservation duration. None of these controls lets governance seize, reassign, or destroy a name anyone already holds.
 
 ### Refund ledgers
 
@@ -147,47 +147,62 @@ Clients that need the exact moment a released name becomes registrable should re
 
 Two controllers sit on top of a single registrar and a single protocol registry. The registrar holds the ERC721 token per name; the registry holds the forward node => (owner, resolver) mapping and subname hierarchy; the resolvers hold per-name records; the protocol registry is the indirection layer through which every contract resolves its siblings at runtime, an address book read on each call rather than a set of sibling addresses fixed in every caller. Controllers are the entry points: they mint names and drive the side effects. Neither controller imports the other. The layers underneath arbitrate collision handling: ERC721 uniqueness on the registrar, and a single reservation table on PopRules that both flows read through.
 
+### Identifiers
+
+Past the entry points, contracts identify a name by hashes of its text. Four identifiers recur, and the second and third are easy to confuse.
+
+- **Label**: the text of a name without the TLD, as submitted: `victoria`, or `michael.01` for a device name.
+- **Labelhash**: `keccak256(label)`, a hash of the text alone with no position in the name tree. The controllers' events, the reservation queue and `isPopIssued` identify names by label or labelhash.
+- **Node**: the namehash, `keccak256(parentNode ++ labelhash)`, applied one segment at a time from the TLD's node (`tldNode` on the protocol registry) down. It fixes where a name sits in the tree and keys the registry and every resolver record. The node of `victoria` is `namehash(tldNode, keccak256("victoria"))`.
+- **TokenId**: `uint256(node)`, for a second-level name tokenised on the registrar. A subname, device names included, has no token and lives in the registry alone.
+
+A device name is where the labelhash and the node diverge. `michael.01` is registered as the subname `michael` beneath the numeric container `01`, so its node is `namehash(namehash(tldNode, keccak256("01")), keccak256("michael"))`. Its labelhash, as the PoP controller and the PoP resolver use it, is `keccak256("michael.01")` over the whole text. That value is no step of the device name's node, and neither can be computed from the other without the label.
+
+Hashing is one-way: the text of a name cannot be recovered from its node or its labelhash, which is why `LabelStore` keeps it (see [StoreFactory, LabelStore, and UserStore](#storefactory-labelstore-and-userstore)). Base name and base length are defined under [Base length and the digit rule](#base-length-and-the-digit-rule); a device name's stem is the letters before its `.NN` suffix.
+
 ### DotnsRegistrarController
 
-Commit-reveal controller for the public registration path. A caller first submits a commitment hash, waits out the minimum commitment age, then reveals the registration parameters alongside the payment. The controller validates the commitment, routes price and eligibility through PopRules, and orchestrates every side effect of a successful registration: the mint on the registrar, the forward wire-up on the registry, the reverse record on the reverse resolver, the immutable Store write, and any refund owed on overpayment. Acceptable input is a single DNS label of at least the minimum-length policy; shorter labels revert with `LabelTooShort`. Labels classified as governance-reserved revert with `GovernanceReserved`; a base stem held by another user reverts with `NameReserved`. On the cross-payer path the owner's recorded PoP tier must meet the label's required tier, so verified-payer-for-unverified-owner sponsorship is rejected with `OwnerStatusInsufficient` and the direct-path personhood guarantee carries over to sponsored registrations.
+Commit-reveal controller for the public registration path. A caller first submits a commitment hash, waits out the minimum commitment age, then reveals the registration parameters alongside the payment. The controller validates the commitment, routes price and eligibility through PopRules, and orchestrates every side effect of a successful registration: the mint on the registrar, the forward wire-up on the registry, the reverse record on the reverse resolver, the immutable Store write, and any refund owed on overpayment. Acceptable input is a single DNS label of at least the minimum-length policy; shorter labels revert with `LabelTooShort`. On the cross-payer path, a governance-reserved label reverts with `GovernanceReserved` and a label whose base name another user holds with `NameReserved`; the direct path rejects both through PopRules' price check with a `PopError`. On the cross-payer path the owner's recorded PoP tier must meet the label's required tier, so verified-payer-for-unverified-owner sponsorship is rejected with `OwnerStatusInsufficient` and the direct-path personhood guarantee carries over to sponsored registrations.
 
 ### DotnsPopController
 
-Dedicated controller for the Proof-of-Personhood gateway flow. Lives behind its own UUPS proxy with its own storage and is registered on the registrar via addController alongside the commit-reveal controller. Its gated entry points are callable only under a substrate Root origin, which the controller verifies itself by reading `originIsRoot` from the revive System precompile.
+Dedicated controller for the gateway path. Its caller is the dotNS gateway pallet (`DotnsGateway`), a pallet in the Asset Hub runtime maintained in the [individuality-community](https://github.com/paritytech/individuality-community/tree/main/pallets/dotns-gateway) repository. The pallet verifies a user's devicehood (an attester reservation) or personhood (a ring-membership proof), then calls this controller through a dispatcher contract. The controller lives behind its own UUPS proxy with its own storage and is registered on the registrar via addController alongside the commit-reveal controller. Its gated entry points are callable only under a substrate Root origin, which the controller verifies itself by reading `originIsRoot` from the revive System precompile.
+
+Today the gateway path does not write a standalone user-status mapping. It materialises that path through gateway-issued labels, PoP resolver records, and reservation queue state; user tier checks for public pricing still come from the personhood precompile/context read.
 
-Today the Pop gateway does not write a standalone user-status mapping. It materialises the PoP flow through gateway-issued labels, PoP resolver records, and reservation queue state; user tier checks for public pricing still come from the personhood precompile/context read.
+The first, issueDeviceName, issues a device name to a user. The gateway-facing input is a stem.suffix shape: a stem of lowercase ASCII letters, exactly one dot, then exactly two digits (for example michael.03). The stem is stricter than a DNS label, because it is the name a person chose and People Chain restricts that to letters: no digits, no hyphens, no uppercase. The same rule applies to a personhood name, which is the other name a person chooses, so `alice-bob` and `michae3l` are ordinary public names but cannot be issued as identities. How short a stem may be is not part of the shape; that is the governance-reserved band, applied by classification. The label is stored, minted and shown in that form, which is the form People Chain holds and the gateway pallet sends, so nothing is normalised at this boundary. Inputs with more than one dot, no dot, a non-digit suffix, or a suffix length other than two digits are rejected. The name is registered as the stem beneath its numeric container (`michael` under `03`), so it resolves like any other subname. The stem is not limited to the 6 to 8 of the Devicehood tier: a longer one is accepted, and a device name whose stem is nine letters or more classifies as NoStatus for public pricing, so devicehood is an issuance property here rather than an economic tier. A stem of five letters or fewer classifies as Reserved and is rejected on this path, which is the same governance gate that applies to short flat names. The call also persists the user's chat key on the PoP resolver. issueDeviceNameWithReservation does the same and also enqueues a reservation for a personhood name the user intends to claim later; reservePersonhoodName enqueues only the reservation.
 
-The first, reserveBaseName, mints a lite-person username to a user. The gateway-facing input is a stem.suffix shape: a stem of lowercase ASCII letters, exactly one dot, then exactly two digits (for example michal.03). The stem is stricter than a DNS label, because it is the name a person chose and People Chain restricts that to letters: no digits, no hyphens, no uppercase. The same rule applies to a full-person name, which is the other name a person chooses, so `alice-bob` and `micha3l` are ordinary public names but cannot be issued as identities. How short a stem may be is not part of the shape; that is the governance-reserved band, applied by classification. The label is stored, minted and shown in that form, which is the form People Chain holds and the gateway pallet sends, so nothing is normalised at this boundary. Inputs with more than one dot, no dot, a non-digit suffix, or a suffix length other than two digits are rejected. The node is the hash of the whole string, so it can never collide with a subname built from the same characters. The stem is not limited to the 6 to 8 of the PopLite tier: a longer one is accepted, and a lite username whose stem is nine letters or more classifies as NoStatus for public pricing, so its lite status is an issuance property rather than an economic tier. A stem of five letters or fewer classifies as Reserved and is rejected on this path, which is the same governance gate that applies to short flat names. The call also persists the user's chat key on the PoP resolver and optionally enqueues a reservation for a full-person base name the user intends to claim later.
+The second, issuePersonhoodName, issues a personhood name. The label is lowercase ASCII letters only, the same rule the device-name stem follows, so a hyphen or an interior digit is rejected even though both are valid in a public name. Whether the call is a claim against a prior reservation or a fresh standalone issuance is derived from on-chain reservation state; the caller does not choose. The link argument selects the chat-key source: inherit from a prior device name, or accept a fresh one in the payload. When inheriting, the call also writes the device link (personhood => device) and personhood link (device => personhood) records on the PoP resolver in the same transaction so downstream consumers can resolve either direction without scanning events.
 
-The second, registerBaseName, mints a full-person username. The label is lowercase ASCII letters only, the same rule the lite stem follows, so a hyphen or an interior digit is rejected even though both are valid in a public name. Whether the call is a claim against a prior lite reservation or a fresh standalone registration is derived from on-chain reservation state; the caller does not choose. The link argument selects the chat-key source: inherit from a prior lite label, or accept a fresh one in the payload. When inheriting, the call also writes the liteLink (full => lite) and fullClaim (lite => full) records on the PoP resolver in the same transaction so downstream consumers can resolve either direction without scanning events.
+Each personhood name carries a head/tail-indexed reservation queue with a capacity of MAX_RESERVATION_QUEUE and a governance-configurable reservationDuration. The queue head is mirrored into PopRules on every head transition (enqueue-from-empty, expiry-driven promotion, non-expiry head removal, claim-wipes-queue), so the public commit-reveal flow sees the same cross-flow lock through its existing PopRules price check. The gateway path is symmetric: issuePersonhoodName consults the live PopRules slot before mint and rejects with `NotHolder` when another user holds the base name, so PopRules is the single cross-flow authority in both directions. issuePersonhoodName additionally rejects device-name-classified and governance-reserved labels with `InvalidPersonhoodLabel`. Every exit from a queue emits an event (`ReservationClaimed`, `ReservationEvicted`, `ReservationRelinquished`, `ReservationExpired`), so an indexer can rebuild the queues from events alone. Expiry advancement is permissionless: anyone can call expireReservation to garbage-collect a stale head, which is what the pallet does on its own cadence.
 
-Each base label carries a head/tail-indexed reservation queue with a capacity of MAX_RESERVATION_QUEUE and a governance-configurable reservationDuration. The queue head is mirrored into PopRules on every head transition (enqueue-from-empty, expiry-driven promotion, non-expiry head removal, claim-wipes-queue), so the public commit-reveal flow sees the same cross-flow lock through its existing PopRules price check. The gateway path is symmetric: registerBaseName consults the live PopRules slot before mint and rejects with `NotHolder` when another user holds the stem, so PopRules is the single cross-flow authority in both directions. registerBaseName additionally rejects lite-classified labels (those belong on reserveBaseName) and governance-reserved labels with `InvalidBaseLabel`. Expiry advancement is permissionless: anyone can call expireReservation to garbage-collect a stale head, which is what the pallet does on its own cadence.
+The gateway pallet binds three deprecated entrypoints, reserveLiteName, reserveBaseName and registerBaseName, through `IDotnsPopControllerLegacy`. Each forwards to issueDeviceName, issueDeviceNameWithReservation and issuePersonhoodName respectively with the same selector it always had, and its label errors are `InvalidLiteLabel` and `InvalidBaseLabel`, the ones the pallet decodes. New integrations use the current entrypoints.
 
 #### Early testnet quirk: LabelStore deployment
 
-Pop-gateway issuances mint the name and persist its label, but LabelStore deployment is deferred for users who have not yet interacted with the protocol from their own address. The current pallet-revive runtime does not let substrate Root deploy contracts on behalf of an account it does not control, so the per-user LabelStore cannot be created at the moment the gateway writes. The controller stamps a pending-claim entry instead, and settlement writes the label into the owner's store, deploying the store on the first write. Settlement is permissionless via settlePendingClaims: the owner settles their own store, or after the claim window anyone settles a given owner's entry and pays the cost. Settlement always writes the label rather than dropping the entry, so a pending name is never stranded. When the runtime supports root-origin contract deployment, the deferred path collapses to a no-op and the issuance flow becomes one transaction end-to-end. This is a runtime limitation, not a protocol design choice.
+Pop-gateway issuances mint the name and persist its label, but LabelStore deployment is deferred for users who have not yet interacted with the protocol from their own address. The current pallet-revive runtime does not let substrate Root deploy contracts on behalf of an account it does not control, so the per-user LabelStore cannot be created at the moment the gateway writes. The controller stamps a pending-claim entry instead, and settlement writes the label into the owner's store, deploying the store on the first write. Settlement is permissionless via settlePendingClaims: the owner settles their own store, or anyone settles a given owner's entries at any time and pays the cost. Settlement always writes the label rather than dropping the entry, so a pending name is never stranded. When the runtime supports root-origin contract deployment, the deferred path collapses to a no-op and the issuance flow becomes one transaction end-to-end. This is a runtime limitation, not a protocol design choice.
 
 Deferred settlement has no transfer-pricing consequence, because gateway-issued names are soulbound and cannot be transferred at all. The transfer-floor price is derived by reading the label from the sender's LabelStore, so a name held before its label is settled would have no readable label to price against; making gateway names non-transferable removes that path entirely rather than relying on settlement to close it.
 
 ### DotnsRegistrar
 
-ERC721-backed registrar that mints ownership of label IDs (labelhashes). Minting is restricted to every address in the controllers mapping; the mapping is owner-gated through addController and removeController. Every other contract in the system that needs to check "is this address authorised to drive name state?" consults this mapping rather than keeping a parallel list, which is what lets multiple controllers coexist on the same registrar without per-contract configuration changes.
+ERC721-backed registrar that tokenises second-level names: a name's tokenId is `uint256(node)` (see [Identifiers](#identifiers)). Minting is restricted to every address in the controllers mapping; the mapping is owner-gated through addController and removeController. Every other contract in the system that needs to check "is this address authorised to drive name state?" consults this mapping rather than keeping a parallel list, which is what lets multiple controllers coexist on the same registrar without per-contract configuration changes.
 
-The registrar owns transferability. A name is marked soulbound at mint when the caller is the address registered under POP_CONTROLLER, so only the PoP gateway can issue a soulbound name and no other controller can lock a public one. The marker is set once and never cleared, and isSoulbound reports it. The transfer hook rejects every transfer of a soulbound name, including a move to the holder's own address and a release into escrow, so a gateway-issued name can never leave its holder's wallet. Only the mint is exempt, because the marker is set just after it.
+The registrar owns transferability. A name is marked soulbound at mint when the caller is the address registered under POP_CONTROLLER, so only the gateway path can issue a soulbound name and no other controller can lock a public one. The marker is set once and never cleared, and isSoulbound reports it. The transfer hook rejects every transfer of a soulbound name, including a move to the holder's own address and a release into escrow, so a gateway-issued name can never leave its holder's wallet. Only the mint is exempt, because the marker is set just after it.
 
 ### DotnsRegistry
 
-Forward registry mapping node to (owner, resolver) and supporting subnode creation. When a base name is minted on the registrar, the matching controller wires the node to the new owner through this registry. Privileged node wiring defers to the same controllers mapping on the registrar, so both controllers can write without the registry tracking controllers of its own.
+Forward registry mapping node to (owner, resolver) and supporting subnode creation. When a second-level name is minted on the registrar, the matching controller wires the node to the new owner through this registry. Privileged node wiring defers to the same controllers mapping on the registrar, so both controllers can write without the registry tracking controllers of its own.
 
-Subnames are created by the base-name owner. A subname carries its own (owner, resolver) and can in turn carry subnames, so the registry is the place the name hierarchy actually lives. Nesting is bounded by the whole path rather than by a depth counter: the dotted parent path a caller submits is capped at 255 octets. That is a protocol limit rather than the RFC 1035 figure it resembles, since the RFC bound counts a wire-format name including its length bytes and its TLD. Each level of a subname is stored as its full dotted name in the owner's LabelStore, and that row cannot be deleted, so an uncapped path would let a parent owner write an arbitrarily long permanent row into an address they chose.
+Subnames are created by the parent name's owner. A subname carries its own (owner, resolver) and can in turn carry subnames, so the registry is the place the name hierarchy actually lives. Nesting is bounded by the whole path rather than by a depth counter: the dotted parent path a caller submits is capped at 255 octets. That is a protocol limit rather than the RFC 1035 figure it resembles, since the RFC bound counts a wire-format name including its length bytes and its TLD. Each level of a subname is stored as its full dotted name in the owner's LabelStore, and that row cannot be deleted, so an uncapped path would let a parent owner write an arbitrarily long permanent row into an address they chose.
 
 The registry exposes isAuthorised(node, account) as the canonical check for whether an address may manage a node: the stored owner for a subname, or the ERC-721 holder, a single-token approvee, or an operator-for-all on the registrar for a tokenised name. Sibling contracts consult this view so a single registrar-level approval delegates management across the protocol rather than each contract maintaining its own approval list.
 
 ### PopRules
 
-PoP-aware name classification and pricing. Classification reads the label's **base length** and whether the label carries the gateway's separator, then maps to one of four tiers: NoStatus (base length 9 or more, open to anyone at the cost-model price), PopFull (base length 6-8, requires full-person verification), PopLite (a separated `stem.NN` label whose stem is 6-8 characters, gateway-issued to lite-verified users), and Reserved (base length 5 or fewer, governed by the protocol).
+PoP-aware name classification and pricing. Classification reads the label's **base length** and whether the label carries the gateway's separator, then maps to one of four tiers: NoStatus (base length 9 or more, open to anyone at the cost-model price), Personhood (base length 6-8, requires proof of personhood), Devicehood (a separated `stem.NN` device name whose stem is 6-8 characters, issued by the gateway to accounts with devicehood), and Reserved (base length 5 or fewer, governed by the protocol).
 
-A lite-person label is a stem of lowercase letters, one separator, then exactly two digits (`joseph.42`), mirroring what People Chain issues; the stem's length is bounded by the bands below rather than by the shape. Base length is the label measured as written, except for a lite label, whose separator and two allocated digits are removed first. The gateway allocates those digits to distinguish people who chose the same stem, so removing them recovers what the candidate picked; no such allocation stands behind the digits in an ordinary name, so `web3` is a four-character word rather than `web` with a counter. Digits carry no protocol meaning outside the separated form: any count is accepted on an ordinary label, and none makes it PopLite. The classification determines the price and the eligibility gate the commit-reveal controller enforces.
+A device name is a stem of lowercase letters, one separator, then exactly two digits (`joseph.42`), mirroring what People Chain issues; the stem's length is bounded by the bands below rather than by the shape. Base length is the label measured as written, except for a device name, whose separator and two allocated digits are removed first. The gateway allocates those digits to distinguish people who chose the same stem, so removing them recovers what the candidate picked; no such allocation stands behind the digits in an ordinary name, so `web3` is a four-character word rather than `web` with a counter. Digits carry no protocol meaning outside the separated form: any count is accepted on an ordinary label, and none makes it Devicehood. A label's base name is the label with any device suffix removed: a device name's stem, or any other label as written. PopRules keys reservations by it. The classification determines the price and the eligibility gate the commit-reveal controller enforces.
 
 #### Classification examples and failure modes
 
@@ -196,29 +211,29 @@ An ordinary label is measured as written; only a separated `stem.NN` label is sh
 | Label | Base length | Classification | Eligible public path | Price | Notes |
 | --- | ---: | --- | --- | ---: | --- |
 | alice | 5 | Reserved | Grant or Root only | Not sold; issued at 0 | Five characters or fewer is governance-reserved. |
-| andrew.01 | 6 | PopLite | Pop gateway only | Gateway grant is free | The separated form. Its stem is six characters, and the separator with its two digits is the suffix. |
-| alicebob.42 | 8 | PopLite | Pop gateway only | Gateway grant is free | Eight-character stem; the whole label is eleven characters. |
-| andrewsays.01 | 10 | NoStatus | Pop gateway only | Gateway grant is free | A lite name with a long stem classifies NoStatus, so its lite status is an issuance property rather than an economic tier. |
-| andrew | 6 | PopFull | PopFull user | 10 DOT | Canonical full-person base name; priced only while the short-name switch is on. |
-| andrew01 | 8 | PopFull | PopFull user | 10 DOT | Measured whole. The digits are part of the name and do not make it lite. |
-| andrew1 | 7 | PopFull | PopFull user | 10 DOT | Any digit count is accepted on an ordinary label. |
+| andrew.01 | 6 | Devicehood | Gateway path only | Gateway grant is free | The separated form. Its stem is six characters, and the separator with its two digits is the suffix. |
+| alicebob.42 | 8 | Devicehood | Gateway path only | Gateway grant is free | Eight-character stem; the whole label is eleven characters. |
+| andrewsays.01 | 10 | NoStatus | Gateway path only | Gateway grant is free | A device name with a long stem classifies NoStatus, so devicehood is an issuance property here rather than an economic tier. |
+| andrew | 6 | Personhood | Personhood account | 10 DOT | Canonical personhood-name shape; priced only while the short-name switch is on. |
+| andrew01 | 8 | Personhood | Personhood account | 10 DOT | Measured whole. The digits are part of the name and do not make it a device name. |
+| andrew1 | 7 | Personhood | Personhood account | 10 DOT | Any digit count is accepted on an ordinary label. |
 | web3 | 4 | Reserved | Grant or Root only | Not sold; issued at 0 | A four-character word, not `web` with a counter. |
 | andrewsays | 10 | NoStatus | Anyone | 10 DOT | The amount is the flat refundable deposit. |
 | andrewsays01 | 12 | NoStatus | Anyone | 10 DOT | Measured whole and still NoStatus, at the same flat deposit. |
 | Andrew01 | n/a | Rejected by canonical label validator | None | n/a | Labels must be lowercase ASCII DNS labels. |
-| andrew.4 | n/a | Rejected | None | n/a | A separator is legal only on a lite label, which carries exactly two digits. |
-| andrew.123 | n/a | Rejected | None | n/a | Three digits is not the lite suffix. |
-| alice.42 | 5 | Reserved | Pop gateway only | Not sold; not issued | A well-formed lite label whose five-letter stem is governance-reserved, so the gateway does not issue it. |
-| andr3w.01 | n/a | Rejected | None | n/a | The stem is letters only, so a digit in it is not a lite label. |
-| andrew-x.01 | n/a | Rejected | None | n/a | Hyphens are valid in a DNS label but not in a lite stem. |
+| andrew.4 | n/a | Rejected | None | n/a | A separator is legal only on a device name, which carries exactly two digits. |
+| andrew.123 | n/a | Rejected | None | n/a | Three digits is not the device-name suffix. |
+| alice.42 | 5 | Reserved | Gateway path only | Not sold; not issued | A well-formed device name whose five-letter stem is governance-reserved, so the gateway path does not issue it. |
+| andr3w.01 | n/a | Rejected | None | n/a | The stem is letters only, so a digit in it is not a device name. |
+| andrew-x.01 | n/a | Rejected | None | n/a | Hyphens are valid in a DNS label but not in a device-name stem. |
 
-A separated label reaches the chain only through the PoP gateway: the public path requires a single DNS label, which admits no separator. That is what reserves the dotted space to the gateway, and it is why a reader cannot take the separator alone as proof of personhood for an arbitrary string. The controller publishes `isPopIssued(label)` for that.
+A separated label reaches the chain only through the gateway path: the public path requires a single DNS label, which admits no separator. That is what reserves the dotted space to the gateway path, and it is why a reader cannot take the separator alone as proof of personhood for an arbitrary string. The controller publishes `isPopIssued(label)` for that.
 
-Tier assignment is read on every pricing call, not stored: PopRules queries the alias-accounts personhood precompile at DotnsConstants.PERSONHOOD with the dotns context (bytes32("dotns")), and translates the returned status byte into a PopStatus (0=NoStatus, 1=PopLite, 2=PopFull). Unknown tier bytes collapse to NoStatus, so a future precompile addition fails closed rather than silently being treated as a higher tier. There is no on-chain self-attestation; users obtain personhood off-chain through the People-chain ring proof and the alias-accounts pallet propagates the result via XCM.
+Tier assignment is read on every pricing call, not stored: PopRules queries the alias-accounts personhood precompile at DotnsConstants.PERSONHOOD with the dotns context (bytes32("dotns")), and translates the returned status byte into a PopStatus (0=NoStatus, 1=Devicehood, 2=Personhood; the precompile itself names them None, Lite and Full). Unknown tier bytes collapse to NoStatus, so a future precompile addition fails closed rather than silently being treated as a higher tier. There is no on-chain self-attestation; users obtain personhood off-chain through the People-chain ring proof and the alias-accounts pallet propagates the result via XCM.
 
-Classification is not the same thing as effective holder context. A long label such as andrewsays is always a NoStatus-tier label by shape, but it may be held by a PopFull, PopLite, or NoStatus account. Consumers that need to know what rules apply to that live name should combine three reads: classify the label, query the registrar owner, then query the owner's dotns-context PoP status through the precompile or gateway-written state. The escrow position is the economic qualifier: if the token has an active release position with a non-zero amount, it came through the refundable NoStatus deposit path; if no such deposit exists, a verified holder can own the same long label without it being deposit-backed. In other words, andrewsays does not become a PopFull-tier label when a PopFull user owns it, but the owner can still be PopFull for transfer pricing, reverse resolution, and UI display.
+Classification is not the same thing as effective holder context. A long label such as andrewsays is always a NoStatus-tier label by shape, but it may be held by a Personhood, Devicehood, or NoStatus account. Consumers that need to know what rules apply to that live name should combine three reads: classify the label, query the registrar owner, then query the owner's dotns-context PoP status through the precompile (`PopRules.popStatusOf`). The escrow position is the economic qualifier: if the token has an active release position with a non-zero amount, it came through the refundable NoStatus deposit path; if no such deposit exists, a verified holder can own the same long label without it being deposit-backed. In other words, andrewsays does not become a Personhood-tier label when a Personhood account owns it, but the owner can still hold personhood for transfer pricing, reverse resolution, and UI display.
 
-Name grants are the exception path for users or organisations that need to register without satisfying the live PoP tier check. DotNS still does not accept self-attestation: the contracts only consume PoP status from the personhood precompile, and a user cannot set or prove their own status inside DotNS. Instead, `DotnsNameWhitelist` binds a specific label to a specific beneficiary, and registerReserved mints it at zero base cost, bypassing the PoP pricing gate while still using the normal commit-reveal and availability checks. Only governance issues a grant: every admin action on the whitelist requires a substrate Root dispatch, so no key can grant a name, the contract owner included. A Root dispatch can also mint a reserved name directly, without a grant. That covers the whitelist path; the registrar's controller set and the protocol registry's keys are still owner-managed, so an owner retains other routes to the same outcome.
+Name grants are the exception path for users or organisations that need to register without satisfying the live PoP tier check. dotNS still does not accept self-attestation: the contracts only consume PoP status from the personhood precompile, and a user cannot set or prove their own status inside dotNS. Instead, `DotnsNameWhitelist` binds a specific label to a specific beneficiary, and registerReserved mints it at zero base cost, bypassing the PoP pricing gate while still using the normal commit-reveal and availability checks. Only governance issues a grant: every admin action on the whitelist requires a substrate Root dispatch, so no key can grant a name, the contract owner included. A Root dispatch can also mint a reserved name directly, without a grant. That covers the whitelist path; the registrar's controller set and the protocol registry's keys are still owner-managed, so an owner retains other routes to the same outcome.
 
 A grant is deliberately narrow. It names one label rather than permitting any available name, it names the address the name must mint to, and it is spent by that mint, so it cannot seed a second registration. The gate reads the intended owner rather than the caller, so a relayer may submit the registration on the beneficiary's behalf; the name still lands on the beneficiary. The reserved path writes no reverse record, because the submitter is not necessarily the beneficiary and setReverseName overwrites unconditionally; the owner claims their own primary afterwards through claimReverseRecord.
 
@@ -226,9 +241,9 @@ A grant is a governance action. `grantName` is Root-only, so on a production net
 
 A grant does not register a name or bypass ownership rules; it only permits the named address to register that one label without a PoP status.
 
-PopRules also holds the cross-flow reservation table for base names, keyed by the bare stem. The PoP controller writes it on every reservation-queue head transition: it takes a bare stem directly and rejects the update when the slot is held by a different user, so the caller's local queue bookkeeping never silently diverges from the PopRules state. The commit-reveal controller has a second write path, gated on a PopLite price; since PopLite is the separated form and the public path cannot submit one, that path never fires.
+PopRules also holds the cross-flow reservation table, keyed by base name. The PoP controller writes it on every reservation-queue head transition: it takes a base name directly and rejects the update when the slot is held by a different user, so the caller's local queue bookkeeping never silently diverges from the PopRules state. The commit-reveal controller writes no reservation: it reads the slot when it prices a name, and clears a reclaimed name's stale slot. `reserveBaseName` is the write path for any other authorised controller, bounded to base lengths 6 to 8.
 
-Two read paths, priceWithCheck and priceWithoutCheck, are what the public flow consults. Both look the reservation up by stem, and only a separated label is shortened to reach one. So a live entry on `andrew` blocks `andrew` and `andrew.01`, while `andrew01` is a different name and is unaffected. Reservations run for 12 weeks by default.
+Two read paths, priceWithCheck and priceWithoutCheck, are what the public flow consults. Both look the reservation up by base name, and only a separated label is shortened to reach one. So a live entry on `andrew` blocks `andrew` and `andrew.01`, while `andrew01` is a different name and is unaffected. Reservations run for 12 weeks by default.
 
 ### DotnsReverseResolver
 
@@ -256,13 +271,13 @@ Stores forward-resolution address records per node. This is the conventional "na
 
 ### DotnsPopResolver
 
-Per-node resolver for records produced by the Proof-of-Personhood flow. Three record kinds. The chat key is ECDH public-key bytes keyed by node; it is written by the PoP controller during a lite reservation and during any claim path that inherits from a prior lite entry, and is what gives verified users an on-chain discovery channel for end-to-end encrypted messaging. The lite link answers "which lite username did this full name claim from?" and is keyed by the full-person node. The full claim is the reverse direction: it answers "which full name did this lite user claim?" and is keyed by the lite labelhash. The forward and reverse links are written by the same call, so they stay in lockstep; downstream consumers that look up by lite username (Nova's pallet, for one) resolve the full name without scanning events.
+Per-node resolver for records produced by the gateway path. Three record kinds. The chat key is ECDH public-key bytes keyed by node; it is written by the PoP controller when it issues a device name and during any personhood issuance, either inherited from a prior device name or supplied fresh in the payload, and is what gives verified users an on-chain discovery channel for end-to-end encrypted messaging. The two link directions take and return different identifiers. `deviceLabelhashOf(personhoodNode)` answers "which device name is this personhood name linked to?": it takes a personhood-name node and returns a device-name labelhash. `personhoodNodeOf(deviceLabelhash)` is the reverse direction, "which personhood name is this device name linked to?": it takes a device-name labelhash, the hash of the full `stem.NN` text (see [Identifiers](#identifiers)), and returns a personhood-name node. The forward and reverse links are written by the same call, so they stay in lockstep; downstream consumers that look up by device name (Nova's pallet, for one) resolve the personhood name without scanning events.
 
 Writer authorisation is dynamic: the PoP controller address is fetched from the protocol registry on every write. Rotating the PoP controller is a single set call on the protocol registry with no resolver upgrade required.
 
 ### DotnsProtocolRegistry
 
-On-chain lookup table mapping well-known bytes32 keys (declared in DotnsConstants) to contract addresses. Every DotNS contract resolves its siblings through this registry at runtime.
+On-chain lookup table mapping well-known bytes32 keys (declared in DotnsConstants) to contract addresses. Every dotNS contract resolves its siblings through this registry at runtime.
 
 Without it, each contract would store direct addresses to every contract it calls. An upgrade that changes one address would require a separate owner transaction for every contract that references it. The protocol registry reduces this to one: update the key in the registry, and every caller picks up the new address on its next call. The indirection also means a governance-driven rotation of, say, the PoP controller does not break any consumer that has already been deployed.
 
@@ -278,7 +293,7 @@ For read batching, Multicall3 lets clients collect several results from the same
 
 Stores are the per-user storage layer. They exist because two query paths the rest of the system needs are not answerable from anywhere else: "what names has this address ever held?" cannot be served by resolvers (keyed per-node) or the registry (live ownership only, no history), and "what user-controlled records does this address publish?" has nowhere on a resolver to live since the data is not bound to any one name. Each address gets at most one of each store, forever, and the factory is the single source of truth for which store belongs to which user.
 
-LabelStore is the protocol-managed half. The registrar and the controller set write a label entry once and the slot is permanently locked. The invariant is labels only: every per-name record category (reverse, content, forward address, chat key, lite link) goes to a dedicated resolver, and the Store stays the durable per-owner registration ledger. Because entries are append-only, transferring a name writes a fresh entry on the recipient and leaves the sender's locked entry in place, so LabelStore doubles as the address's lifetime-of-ownership ledger while the registry continues to answer for live ownership.
+LabelStore is the protocol-managed half. The registrar and the controller set write a label entry once and the slot is permanently locked. The invariant is labels only: every per-name record category (reverse, content, forward address, chat key, device link) goes to a dedicated resolver, and the Store stays the durable per-owner registration ledger. Because entries are append-only, transferring a name writes a fresh entry on the recipient and leaves the sender's locked entry in place, so LabelStore doubles as the address's lifetime-of-ownership ledger while the registry continues to answer for live ownership.
 
 The reason a label needs storing at all is that the chain never sees it. A name is hashed into a node before it reaches any contract, and hashing is one-way: from `joseph.dot` you can always compute the node, but from the node you can never recover the text. Since pricing, classification, and the transfer floor all read the label's length and shape, the string has to be kept deliberately. `LabelStore` is that record, and the only route back from a node to the name it came from.
 
diff --git a/RELEASE_ARTIFACTS.md b/RELEASE_ARTIFACTS.md
index d46e3cf80..dd544d13a 100644
--- a/RELEASE_ARTIFACTS.md
+++ b/RELEASE_ARTIFACTS.md
@@ -1,4 +1,4 @@
-# DotNS Release Artifacts
+# dotNS Release Artifacts
 
 What each release publishes, what the files guarantee, and how to consume them.
 
@@ -11,7 +11,7 @@ What each release publishes, what the files guarantee, and how to consume them.
 | `release-manifest.json` | What this release contains, machine readable |
 | `codehashes.json` | Stripped-metadata hash of each contract's built runtime bytecode |
 | `abi-diff.json` | Selector-level ABI changes since the previous release, machine readable |
-| `dotns-genesis-<tld>.json` | pallet-revive genesis with DotNS deployed, one per TLD (`testnet` for previewnet, `paseo` for Paseo Asset Hub Next V2) |
+| `dotns-genesis-<tld>.json` | pallet-revive genesis with dotNS deployed, one per TLD (`testnet` for previewnet, `paseo` for Paseo Asset Hub Next V2) |
 | `dotns-genesis-addresses.json` | The addresses a chain booted from those genesis files carries, a copy of `deployments/expected.json` |
 | `dotns-abis-<tag>.zip` | The same files in one archive |
 
@@ -101,7 +101,7 @@ Two ways to protect yourself. Resolve addresses through the protocol registry at
 
 ## Consuming it
 
-Prefer resolving addresses at runtime. Every DotNS contract exposes `protocolRegistry`, and `DotnsProtocolRegistry.get(key)` resolves each well-known key in `DotnsConstants`, so one address from the artifact is enough to reach the rest and the chain remains the authority. Pin the whole set only when a runtime lookup is not possible.
+Prefer resolving addresses at runtime. Every dotNS contract exposes `protocolRegistry`, and `DotnsProtocolRegistry.get(key)` resolves each well-known key in `DotnsConstants`, so one address from the artifact is enough to reach the rest and the chain remains the authority. Pin the whole set only when a runtime lookup is not possible.
 
 Note that a `deployments.json` entry states where a contract was deployed, not that it is currently the live one for a role. The registry is the only answer to that question.
 
diff --git a/SECURITY.md b/SECURITY.md
index b93c8ebbf..f53bcb370 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,7 +2,7 @@
 
 ## Security status
 
-This repository contains the DotNS smart-contract suite: reference and proof-of-concept code and
+This repository contains the dotNS smart-contract suite: reference and proof-of-concept code and
 patterns for a Polkadot naming system. It is intended for reference and experimentation, not as a
 production-ready artefact.
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 7281886a1..de8f20f86 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -6,7 +6,7 @@ summary; the licence text shipped with each dependency is authoritative.
 
 ## Code derived from ENS
 
-Parts of the DotNS contract suite are adapted from the Ethereum Name Service (ENS) contracts
+Parts of the dotNS contract suite are adapted from the Ethereum Name Service (ENS) contracts
 (registry / registrar / resolver / reverse-resolver structure, namehash and labelhash, and the
 commit-reveal registration flow). The ENS contracts are MIT-licensed and copyright True Names
 Limited. The MIT licence requires the original copyright and permission notice to be retained; it is
diff --git a/contracts/deploy/Create3Factory.sol b/contracts/deploy/Create3Factory.sol
index a47195dbe..3f22fa0c7 100644
--- a/contracts/deploy/Create3Factory.sol
+++ b/contracts/deploy/Create3Factory.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 
 import {CREATE3} from "solady/utils/CREATE3.sol";
 
-/// @title Dotns CREATE3 Factory
+/// @title dotNS CREATE3 Factory
 /// @notice Permissionless wrapper around Solady's audited CREATE3 library.
 /// @dev Anyone may call @custom:function deploy. CREATE3 addresses are a pure function of
 /// `(factory_address, salt)` — the caller never enters the derivation — so caller-gating
@@ -14,7 +14,7 @@ import {CREATE3} from "solady/utils/CREATE3.sol";
 ///
 /// An occupied salt is handled by the caller. `BaseDeployer._deployCreate3` adopts an occupied
 /// address only when the occupant's runtime code is the artefact that run would have deployed,
-/// and `DOTNS_SALT_VERSION` moves the DotNS address set to fresh addresses when it is not.
+/// and `DOTNS_SALT_VERSION` moves the dotNS address set to fresh addresses when it is not.
 /// @custom:security-contact admin@parity.io
 contract Create3Factory {
     /// @notice Emitted on every successful CREATE3 deployment through this factory.
diff --git a/contracts/escrow/DotnsNameEscrow.sol b/contracts/escrow/DotnsNameEscrow.sol
index 2ddb0c8d8..99507e3e0 100644
--- a/contracts/escrow/DotnsNameEscrow.sol
+++ b/contracts/escrow/DotnsNameEscrow.sol
@@ -17,7 +17,7 @@ import {IDotnsRegistrar} from "../registrars/IDotnsRegistrar.sol";
 import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
-/// @title Dotns Name Escrow
+/// @title dotNS Name Escrow
 /// @notice Holds refundable deposits for registered names and manages the release/reclaim
 /// lifecycle. @custom:security-contact admin@parity.io
 contract DotnsNameEscrow is
@@ -460,10 +460,9 @@ contract DotnsNameEscrow is
         // Nothing to settle: return before touching `claimed`. That flag is what `redeem` reads to
         // decide whether the holder has already been paid for the name, so setting it here would
         // make a zero-amount `withdraw`, which pays nothing and emits nothing, silently forfeit
-        // the holder's right to recover their own name for no consideration at all. Free PopFull
-        // and PopLite registrations seed exactly these positions, and `withdraw` is the step the
-        // old contract required before a name could be recycled, so that is a path holders will
-        // take.
+        // the holder's right to recover their own name for no consideration at all. Cross-paid
+        // registrations seed exactly these positions, as does any name whose curve price is zero,
+        // and `withdraw` is a path holders will take.
         if (owed == 0) return;
 
         // Effects: from here the deposit really is being handed over, so the flag is set.
@@ -786,7 +785,7 @@ contract DotnsNameEscrow is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/escrow/IDotnsNameEscrow.sol b/contracts/escrow/IDotnsNameEscrow.sol
index e9862c9c5..cd49a758d 100644
--- a/contracts/escrow/IDotnsNameEscrow.sol
+++ b/contracts/escrow/IDotnsNameEscrow.sol
@@ -2,7 +2,7 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title Dotns Name Escrow Interface
+/// @title dotNS Name Escrow Interface
 /// @notice Escrows refundable deposits for registered names and manages the release lifecycle.
 /// @custom:security-contact admin@parity.io
 interface IDotnsNameEscrow {
diff --git a/contracts/pop/DotnsCostModelRegistry.sol b/contracts/pop/DotnsCostModelRegistry.sol
index 95d03ad04..668451f83 100644
--- a/contracts/pop/DotnsCostModelRegistry.sol
+++ b/contracts/pop/DotnsCostModelRegistry.sol
@@ -7,7 +7,7 @@ import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 import {IDotnsCostModelRegistry} from "./IDotnsCostModelRegistry.sol";
 import {IDotnsPricing} from "./IDotnsPricing.sol";
 
-/// @title DotNS Cost Model Registry
+/// @title dotNS Cost Model Registry
 /// @notice Keeps every registered cost model addressable by version and tracks the current one.
 /// @dev Holds only pointers, so it stays a plain owner-gated contract. `PopRules` resolves it once
 ///      through `DotnsConstants.COST_MODEL` and prices the current version for fresh reads and a
diff --git a/contracts/pop/DotnsFlatPricing.sol b/contracts/pop/DotnsFlatPricing.sol
index b2a51fe95..bb8c0007a 100644
--- a/contracts/pop/DotnsFlatPricing.sol
+++ b/contracts/pop/DotnsFlatPricing.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
 
-/// @title DotNS Flat Pricing
+/// @title dotNS Flat Pricing
 /// @notice Prices every registration at a single deposit, whatever the base length.
 /// @dev The launch cost model: one constant amount for any name the bands admit, so a nine-plus
 ///      character name costs the same flat deposit and shorter names stay gated by `PopRules`. The
diff --git a/contracts/pop/DotnsScarcityPricing.sol b/contracts/pop/DotnsScarcityPricing.sol
index f0d718697..7ed44cb06 100644
--- a/contracts/pop/DotnsScarcityPricing.sol
+++ b/contracts/pop/DotnsScarcityPricing.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
 
-/// @title DotNS Scarcity Pricing
+/// @title dotNS Scarcity Pricing
 /// @notice Prices a registration on a geometric scarcity curve driven by base length.
 /// @dev The curve doubles the base fee for each character below nine and halves it for each
 ///      character from nine upward, never below the floor. The base fee is the curve's value at
@@ -29,8 +29,9 @@ contract DotnsScarcityPricing is IDotnsPricing {
     /// @dev Carries the curve invariants: the base fee and floor are both strictly positive, the
     ///      floor does not exceed the base fee, and the base fee stays within
     ///      `type(uint256).max / 512` so the multiplication below nine characters cannot overflow.
-    ///      An all-digit label such as "42" strips to base length 0 and reaches the 2**9
-    /// multiplier, which sets the /512 ceiling. Any breach triggers @custom:reverts PricingError.
+    ///      A base length of 0 reaches the 2**9 multiplier, which sets the /512 ceiling: no label
+    ///      measures zero, but the pricing function accepts any length. Any breach triggers
+    ///      @custom:reverts PricingError.
     /// @param baseFeeValue Base fee D in wei.
     /// @param minPriceValue Price floor F in wei.
     constructor(uint256 baseFeeValue, uint256 minPriceValue) {
diff --git a/contracts/pop/IDotnsCostModelRegistry.sol b/contracts/pop/IDotnsCostModelRegistry.sol
index ef493af12..3986f2f2f 100644
--- a/contracts/pop/IDotnsCostModelRegistry.sol
+++ b/contracts/pop/IDotnsCostModelRegistry.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 
 import {IDotnsPricing} from "./IDotnsPricing.sol";
 
-/// @title DotNS Cost Model Registry
+/// @title dotNS Cost Model Registry
 /// @notice Holds every cost model the protocol has run and names the current one.
 /// @dev The address registered under `DotnsConstants.COST_MODEL` points here, set once and never
 ///      repointed. Changing the live curve registers a new model, which adds its version and moves
@@ -69,14 +69,16 @@ interface IDotnsCostModelRegistry {
     function current() external view returns (IDotnsPricing model);
 
     /// @notice Prices a base length at the current version.
-    /// @param baseLength Digit-stripped length of the label being priced.
+    /// @param baseLength Base length of the label being priced: its length as written, less a
+    ///        device name's suffix.
     /// @return weiPrice Registration cost in wei at the current version.
     function priceForBaseLength(uint256 baseLength) external view returns (uint256 weiPrice);
 
     /// @notice Prices a base length at a specific version.
     /// @dev @custom:reverts UnknownVersion when no model is registered for `version`.
     /// @param version The version to price against.
-    /// @param baseLength Digit-stripped length of the label being priced.
+    /// @param baseLength Base length of the label being priced: its length as written, less a
+    ///        device name's suffix.
     /// @return weiPrice Registration cost in wei at that version.
     function priceForBaseLengthAtVersion(
         uint256 version,
diff --git a/contracts/pop/IDotnsPricing.sol b/contracts/pop/IDotnsPricing.sol
index f2efd080b..8b950389d 100644
--- a/contracts/pop/IDotnsPricing.sol
+++ b/contracts/pop/IDotnsPricing.sol
@@ -2,7 +2,7 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title DotNS Pricing Cost Model
+/// @title dotNS Pricing Cost Model
 /// @notice Prices a registration from the base length of its label alone.
 /// @dev The seam between name policy and the wei amount a registration costs. `PopRules` and the
 ///      public commit-reveal controller keep the classification, reservation, and tier rules; the
@@ -18,10 +18,11 @@ interface IDotnsPricing {
     error PricingError(string reason);
 
     /// @notice Returns the registration cost in wei for a label of the given base length.
-    /// @dev Pure amount lookup: the caller supplies the digit-stripped base length and the model
+    /// @dev Pure amount lookup: the caller supplies the base length and the model
     ///      returns the curve value for it. Runs on the ERC721 transfer floor read, so it stays a
     ///      view with no state writes.
-    /// @param baseLength Digit-stripped length of the label being priced.
+    /// @param baseLength Base length of the label being priced: its length as written, less a
+    ///        device name's suffix.
     /// @return weiPrice Registration cost in wei for that base length.
     function priceForBaseLength(uint256 baseLength) external view returns (uint256 weiPrice);
 
diff --git a/contracts/pop/IPopRules.sol b/contracts/pop/IPopRules.sol
index 15ea8680a..b5a5dc160 100644
--- a/contracts/pop/IPopRules.sol
+++ b/contracts/pop/IPopRules.sol
@@ -2,16 +2,20 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title Proof of Personhood Rules for Dotns
-/// @notice Proof of personhood interface defining Dotns price calculation, PoP-tier requirements,
+/// @title Proof of Personhood Rules for dotNS
+/// @notice Proof of personhood interface defining dotNS price calculation, PoP-tier requirements,
 ///         and base-name reservation rules.
-/// @dev Classifies labels into the PoP tier required for registration and exposes reservation
-///      metadata. Every label is measured as written, except a gateway lite label, whose
-///      separator and allocated digits are removed first. Base length <= 5 is reserved for
-///      governance; 6-8 requires PopFull; >= 9 is open to every caller as NoStatus. PopLite is
-///      the separated form alone, so digits in an ordinary label carry no personhood meaning.
-///      Reservations are keyed by that same stem, so `joseph` and `joseph.42` share a slot while
-///      `joseph42` is an unrelated name.
+/// @dev A label's base name is the label with any device suffix removed: the stem of a device
+///      name, or any other label as written. `joseph` is the base name of both `joseph` and
+///      `joseph.42`, and a label's base length is the length of its base name.
+///
+///      Classifies labels into the PoP tier required for registration and exposes reservation
+///      metadata. Every label is measured as written, except a device name, whose separator and
+///      allocated digits are removed first. Base length <= 5 is reserved for governance; 6-8
+///      requires personhood; >= 9 is open to every caller as NoStatus. Devicehood applies to the
+///      separated form alone, so digits in an ordinary label carry no meaning. Reservations are
+///      keyed by that same base name, so `joseph` and `joseph.42` share a slot while `joseph42` is
+///      an unrelated name.
 ///
 ///      Amounts come from the cost model registered under `DotnsConstants.COST_MODEL`, which owns
 ///      the curve; only the base length crosses that seam. Every caller pays the same amount for a
@@ -19,18 +23,18 @@ pragma solidity ^0.8.34;
 /// @custom:security-contact admin@parity.io
 interface IPopRules {
     /// @notice Proof-of-Personhood eligibility tier.
-    /// @dev `NoStatus` is the default for unverified users; `PopLite` and `PopFull` are the two
-    ///      personhood tiers; `Reserved` covers both governance-held names and base stems held by
-    ///      another user through the reservation table.
+    /// @dev `NoStatus` is the default for unverified users; `Devicehood` and `Personhood` are the
+    ///      two proofs; `Reserved` covers both governance-held names and base names held by another
+    ///      user through the reservation table.
     enum PopStatus {
         NoStatus,
-        PopLite,
-        PopFull,
+        Devicehood,
+        Personhood,
         Reserved
     }
 
     /// @notice Emitted when a base name receives a reservation.
-    /// @param baseName The digit-stripped label receiving the reservation.
+    /// @param baseName The base name receiving the reservation.
     /// @param owner Address obtaining the reservation right.
     /// @param expires UNIX timestamp when the reservation expires.
     event BaseNameReserved(string indexed baseName, address indexed owner, uint64 expires);
@@ -54,9 +58,9 @@ interface IPopRules {
     /// @notice Thrown when a caller is not an authorised controller on the registrar.
     error NotRegistry();
 
-    /// @notice Thrown when registering a name whose base stem is held as a live reservation by
+    /// @notice Thrown when registering a name whose base name is held as a live reservation by
     /// another user.
-    /// @param label Caller-supplied label whose stem is reserved.
+    /// @param label Caller-supplied label whose base name is reserved.
     error NameReserved(string label);
 
     /// @notice Thrown when registering a label that classifies as governance-reserved at the
@@ -86,7 +90,7 @@ interface IPopRules {
         string message;
     }
 
-    /// @notice Reservation metadata for a base name (digits removed).
+    /// @notice Reservation metadata for a base name.
     /// @param owner Address holding exclusive claim rights during the reservation window.
     /// @param expires UNIX timestamp when the reservation expires.
     /// @param controller Address that wrote the reservation; the only address permitted to release
@@ -97,11 +101,12 @@ interface IPopRules {
         address controller;
     }
 
-    /// @notice Classifies a name into a required PoP tier per DotNS naming rules.
+    /// @notice Classifies a name into a required PoP tier per dotNS naming rules.
     /// @dev Pure; inputs are the label bytes only. Callers use the returned tier to decide which
     ///      pricing and verification branch applies. A label that is neither a single lowercase
-    ///      ASCII DNS label nor a lite label triggers @custom:reverts PopError; a trailing-digit
-    ///      suffix of any length is accepted and classified by the length it leaves.
+    ///      ASCII DNS label nor a device name triggers @custom:reverts PopError. Trailing digits in
+    ///      an ordinary label count towards its length; only a device name's separator and suffix
+    ///      are removed before it is classified.
     /// @param name The name label being evaluated.
     /// @return requirement Required tier for registration.
     /// @return message Explanation of the classification result.
@@ -112,8 +117,8 @@ interface IPopRules {
 
     /// @notice Opens or closes the public market for names shorter than nine characters.
     /// @dev Restricted to a substrate Root origin; any other caller triggers @custom:reverts
-    ///      NotRoot. Short names are otherwise issued through the PoP gateway, so this flag is the
-    ///      Root-only lever that additionally admits them on the public paid path.
+    ///      NotRoot. Short names are otherwise issued through the dotNS gateway pallet, so this
+    ///      flag is the Root-only lever that additionally admits them on the public paid path.
     ///      While closed, which is the deploy default, @custom:function priceWithCheck and
     ///      @custom:function priceWithoutCheck trigger @custom:reverts PopError for a base length
     ///      below nine, so no public caller buys a short name. The gateway free grant and the
@@ -126,55 +131,55 @@ interface IPopRules {
     /// @dev Reads the account's dotns-scoped tier from the personhood precompile and maps it to a
     ///      `PopStatus`. This is the direct account-tier read; the same tier otherwise surfaces
     ///      only as the `userStatus` field of a pricing query. Never returns `Reserved`, so the
-    ///      result is one of `NoStatus`, `PopLite`, or `PopFull`.
+    ///      result is one of `NoStatus`, `Devicehood`, or `Personhood`.
     /// @param account Address whose tier is read.
     /// @return tier The account's personhood tier.
-    function personhoodOf(address account) external view returns (PopStatus tier);
+    function popStatusOf(address account) external view returns (PopStatus tier);
 
-    /// @notice Creates or refreshes a reservation entry for a stem in the 6 to 8 band.
+    /// @notice Creates or refreshes a reservation entry for a base name in the 6 to 8 band.
     /// @dev Authorised-controller entry point: only a controller in the registrar's `controllers`
     ///      set may call this, otherwise @custom:reverts NotRegistry. The gateway queue writes
     ///      through @custom:function reserveBaseNameForPop and the public commit-reveal flow
     ///      reads the slot rather than writing one, so this is the entry point for a sibling
-    ///      controller. Its length window bounds the stem and does not name a tier: PopLite is
-    ///      decided by the separated label shape. The caller passes the already-stripped stem; a
+    ///      controller. Its length window bounds the base name and does not name a tier:
+    ///      Devicehood is decided by the separated label shape. The caller passes the base name; a
     ///      non-canonical label, a trailing digit, or a length outside `[6, 8]` triggers
     ///      @custom:reverts PopError. Cross-user collision on a live slot triggers @custom:reverts
     ///      PopError so the caller cannot silently overwrite another user's reservation; same-user
     ///      refresh and writes into an empty or expired slot emit @custom:emits BaseNameReserved.
-    /// @param stem The base label with no trailing digits.
+    /// @param baseName The base name, with no trailing digits.
     /// @param user The address receiving reservation rights.
-    function reserveBaseName(string calldata stem, address user) external;
+    function reserveBaseName(string calldata baseName, address user) external;
 
     /// @notice Emitted when a base-name reservation is cleared.
-    /// @param baseName The base label whose reservation was released.
+    /// @param baseName The base name whose reservation was released.
     event BaseNameReleased(string indexed baseName);
 
-    /// @notice Writes or refreshes a reservation for a bare base-name stem.
+    /// @notice Writes or refreshes a reservation for a base name.
     /// @dev Gateway-driven reservation path used by the PoP controller. Only a controller in the
     ///      registrar's `controllers` set may call this, otherwise @custom:reverts NotRegistry.
-    ///      Does not apply the lite-format length window that @custom:function reserveBaseName
-    ///      enforces, but does require the input to be canonical and stem-shaped (no trailing
-    ///      digits); a non-canonical or non-stem label triggers @custom:reverts PopError. If the
-    ///      slot is already live and held by a different user, @custom:reverts PopError so the
+    ///      Does not apply the 6-8 base-length window that @custom:function reserveBaseName
+    ///      enforces, but does require the input to be canonical with no trailing digits; a
+    ///      non-canonical label or one with trailing digits triggers @custom:reverts PopError. If
+    ///      the slot is already live and held by a different user, @custom:reverts PopError so the
     ///      caller's local bookkeeping and PopRules state stay in lockstep; if it is live for the
     ///      same user, expiry is refreshed to `block.timestamp + MAX_RESERVATION_TIME`. Emits
     ///      @custom:emits BaseNameReserved on every successful write.
-    /// @param stem The base label with no trailing digits.
+    /// @param baseName The base name, with no trailing digits.
     /// @param user The address receiving reservation rights.
-    function reserveBaseNameForPop(string calldata stem, address user) external;
+    function reserveBaseNameForPop(string calldata baseName, address user) external;
 
-    /// @notice Clears a reservation for a base-name stem.
+    /// @notice Clears a reservation for a base name.
     /// @dev Only a controller in the registrar's `controllers` set may call this, otherwise
-    ///      @custom:reverts NotRegistry. Non-canonical or non-stem labels trigger
-    ///      @custom:reverts PopError. Live reservations may only be cleared by the same controller
-    ///      that wrote them; another authorised controller attempting to clear a live slot triggers
-    ///      @custom:reverts PopError. Expired reservations may be cleared by any authorised
-    ///      controller as garbage collection. Used by the PoP controller when a reservation is
-    ///      claimed, relinquished, or a queue head promotion leaves the slot empty. Emits
-    ///      @custom:emits BaseNameReleased once the slot is cleared.
-    /// @param stem The base label whose reservation should be cleared (no trailing digits).
-    function releaseBaseName(string calldata stem) external;
+    ///      @custom:reverts NotRegistry. Non-canonical labels and labels with trailing digits
+    ///      trigger @custom:reverts PopError. Live reservations may only be cleared by the same
+    ///      controller that wrote them; another authorised controller attempting to clear a live
+    ///      slot triggers @custom:reverts PopError. Expired reservations may be cleared by any
+    ///      authorised controller as garbage collection. Used by the PoP controller when a
+    ///      reservation is claimed, relinquished, or a queue head promotion leaves the slot empty.
+    ///      Emits @custom:emits BaseNameReleased once the slot is cleared.
+    /// @param baseName The base name whose reservation should be cleared (no trailing digits).
+    function releaseBaseName(string calldata baseName) external;
 
     /// @notice Clears a reservation when the slot owner matches `expectedOwner`, allowing any
     ///         registrar-authorised controller (not only the stamping one) to release the slot.
@@ -184,19 +189,20 @@ interface IPopRules {
     ///      a prior occupant has handed the name back to escrow and the new registrant needs
     ///      the cross-flow guard cleared regardless of which controller originally stamped it.
     ///      Only a registrar-authorised controller may call this (@custom:reverts NotRegistry).
-    ///      Non-canonical or non-stem labels trigger @custom:reverts PopError. A live reservation
+    ///      Non-canonical labels and labels with trailing digits trigger @custom:reverts PopError.
+    ///      A live reservation
     ///      whose owner does not match `expectedOwner` triggers @custom:reverts PopError; expired
     ///      reservations are cleared regardless. Emits @custom:emits BaseNameReleased.
-    /// @param stem The base label whose reservation should be cleared (no trailing digits).
+    /// @param baseName The base name whose reservation should be cleared (no trailing digits).
     /// @param expectedOwner The address the caller expects to be the current reservation owner.
-    function releaseReservationForReclaim(string calldata stem, address expectedOwner) external;
+    function releaseReservationForReclaim(string calldata baseName, address expectedOwner) external;
 
     /// @notice Retrieves reservation information for a base name.
     /// @dev Raw accessor: returns the stored slot regardless of expiry. Use
     ///      @custom:function isBaseNameReserved
     ///      when live-window semantics are needed. Non-canonical labels trigger
     ///      @custom:reverts PopError.
-    /// @param baseName The base label without trailing digits.
+    /// @param baseName The base name, without trailing digits.
     /// @return owner The address assigned to the reservation.
     /// @return expires UNIX timestamp when the reservation expires.
     function getBaseNameReservation(string calldata baseName)
@@ -204,21 +210,21 @@ interface IPopRules {
         view
         returns (address owner, uint64 expires);
 
-    /// @notice Returns the reservation stem of a label: a lite label without its allocated
-    ///         suffix, or any other label unchanged.
+    /// @notice Returns the base name of a label, its reservation key: a device name without its
+    ///         allocated suffix, or any other label unchanged.
     /// @dev Mirrors the normalisation applied before a reservation is written, so callers can
-    ///      look up or release one by passing the full label. Only a lite label is shortened,
+    ///      look up or release one by passing the whole label. Only a device name is shortened,
     ///      because only the gateway allocates the digits it carries: `joseph.42` yields
     ///      `joseph` while `joseph42` is an unrelated name and yields itself. Non-canonical
     ///      labels trigger @custom:reverts PopError.
-    /// @param name Full label, lite or otherwise.
-    /// @return stem The reservation stem of `name`.
-    function stripDigits(string calldata name) external pure returns (string memory stem);
+    /// @param name Whole label, device name or otherwise.
+    /// @return baseName The base name of `name`.
+    function stripDigits(string calldata name) external pure returns (string memory baseName);
 
     /// @notice Indicates whether a base name is currently reserved.
     /// @dev Applies the live-window predicate to the stored slot so an expired reservation reads
     ///      as free. Non-canonical labels trigger @custom:reverts PopError.
-    /// @param baseName The base label without trailing digits.
+    /// @param baseName The base name, without trailing digits.
     /// @return reservedStatus True if a live reservation is active.
     /// @return owner The reservation holder (zero when not reserved).
     /// @return expires UNIX timestamp when the reservation expires.
@@ -231,7 +237,7 @@ interface IPopRules {
     /// @dev Reverting pricing path used by the commit-reveal controller. Price is the scarcity
     ///      curve for the label's base length and is charged to every caller, verified or not;
     ///      personhood only unlocks the premium band. Non-canonical
-    ///      labels, a base stem held live by another user, a governance-reserved label, or a
+    ///      labels, a base name held live by another user, a governance-reserved label, or a
     ///      `userAddress` whose personhood tier does not meet the label's required tier each
     ///      trigger @custom:reverts PopError.
     /// @param name Domain label.
@@ -269,7 +275,7 @@ interface IPopRules {
     /// @notice Calculates price with PoP classification and reservation metadata, without
     /// reverting on conflicts.
     /// @dev Non-reverting counterpart to `priceWithCheck`: surfaces the same fields, but reports
-    ///      a `Reserved` status through `metadata` instead of reverting when the base stem is
+    ///      a `Reserved` status through `metadata` instead of reverting when the base name is
     ///      held by another user. Used by front-ends that need to present a price and eligibility
     ///      preview without forcing a transaction attempt. Governance-reserved names are not
     ///      rejected here either; the caller decides what to do. Non-canonical labels still
@@ -314,7 +320,7 @@ interface IPopRules {
     ///      the name's own curve price. The two components overlap on pure
     ///      tier mismatches, so the function takes their maximum rather than their sum to avoid
     ///      double-charging. Consumed by @custom:function DotnsRegistrar.quoteTransferFee.
-    ///      A label that is neither a single lowercase ASCII DNS label nor a lite label triggers
+    ///      A label that is neither a single lowercase ASCII DNS label nor a device name triggers
     ///      @custom:reverts PopError.
     /// @param name Domain label being transferred.
     /// @param from Current holder of the name.
@@ -329,9 +335,8 @@ interface IPopRules {
         view
         returns (uint256 floor);
 
-    /// @notice Returns whether `name` is a base name under PoP rules.
-    /// @dev A base name has no trailing digits, so it is what a reservation may be keyed by. A
-    ///      lite label always ends in two, so it is never a base name. Non-canonical labels
+    /// @notice Returns whether `name` can key a reservation: a base name with no trailing digits.
+    /// @dev A device name always ends in two digits, so it never qualifies. Non-canonical labels
     ///      trigger @custom:reverts PopError.
     /// @param name The label to check.
     /// @return isBase True when the label has no trailing digits.
@@ -341,7 +346,7 @@ interface IPopRules {
     /// @dev Prices the label by its base length through the cost model registered under
     ///      `DotnsConstants.COST_MODEL`. Ignores the caller's personhood status and reservation
     ///      state. A non-canonical label triggers @custom:reverts PopError. An ordinary label is
-    ///      priced as written; only a lite label's allocated suffix is removed first.
+    ///      priced as written; only a device name's allocated suffix is removed first.
     /// @param name Domain label to price.
     /// @return cost Registration cost in wei.
     function price(string calldata name) external view returns (uint256 cost);
diff --git a/contracts/pop/PopRules.sol b/contracts/pop/PopRules.sol
index 841440054..e31e8c05c 100644
--- a/contracts/pop/PopRules.sol
+++ b/contracts/pop/PopRules.sol
@@ -21,13 +21,14 @@ import {DotnsConstants} from "../utils/DotnsConstants.sol";
 import {IPersonhood} from "../external/personhood/IPersonhood.sol";
 
 /// @title PopRules
-/// @notice Implements DotNS classification, cost-model-driven pricing, and base-name reservations.
-/// @dev Tiers are set by base length. Every label is measured as written, except a lite label,
-///      whose separator and allocated digits are not part of the name the candidate chose, so
+/// @notice Implements dotNS classification, cost-model-driven pricing, and base-name reservations.
+/// @dev Tiers are set by base length, the length of a label's base name: the label with any
+///      device suffix removed. Every label is measured as written, except a device name, whose
+///      separator and allocated digits are not part of the name the candidate chose, so
 ///      `joseph.42` measures six and `joseph42` measures eight.
-///      Base lengths <= 5 are governance-reserved, base lengths 6-8 require PopFull, and base
-///      lengths >= 9 are open to any caller as NoStatus. PopLite is the separated form alone: a
-///      digit suffix on an ordinary label says nothing about personhood.
+///      Base lengths <= 5 are governance-reserved, base lengths 6-8 require personhood, and base
+///      lengths >= 9 are open to any caller as NoStatus. Devicehood applies to the separated form
+///      alone: a digit suffix on an ordinary label says nothing about a proof.
 ///      Every caller pays the same amount for a given base length. The amount comes from the cost
 ///      model registered under `DotnsConstants.COST_MODEL`, which owns the curve; this contract
 ///      passes it only the base length and keeps the classification, reservation, and tier rules.
@@ -44,13 +45,13 @@ contract PopRules is
 {
     using StringUtils for *;
 
-    /// @notice Active reservations keyed by stem.
+    /// @notice Active reservations keyed by base name.
     mapping(string baseName => Reservation reservation) public reservations;
 
     /// @notice Maximum time a base name can be reserved.
     uint256 public constant MAX_RESERVATION_TIME = 12 weeks;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Whether the public paid path may register names shorter than nine characters.
@@ -106,20 +107,20 @@ contract PopRules is
 
     /// @inheritdoc IPopRules
     function reserveBaseName(
-        string calldata stem,
+        string calldata baseName,
         address userAddress
     )
         external
         override
         onlyRegistry
     {
-        _requireStem(stem);
-        uint256 stemLength = bytes(stem).length;
+        _requireBaseName(baseName);
+        uint256 baseLength = bytes(baseName).length;
         require(
-            stemLength >= 6 && stemLength <= 8 && _countTrailingDigits(stem) == 0,
-            PopError("Reservation stem must be 6-8 chars with no trailing digits")
+            baseLength >= 6 && baseLength <= 8 && _countTrailingDigits(baseName) == 0,
+            PopError("Reservation base name must be 6-8 chars with no trailing digits")
         );
-        _writeReservation(stem, userAddress);
+        _writeReservation(baseName, userAddress);
     }
 
     /// @inheritdoc IPopRules
@@ -136,7 +137,7 @@ contract PopRules is
         override
         returns (address reservationOwner, uint64 expiryTimestamp)
     {
-        _requireStem(baseName);
+        _requireBaseName(baseName);
         Reservation memory reserved = reservations[baseName];
         return (reserved.owner, reserved.expires);
     }
@@ -148,7 +149,7 @@ contract PopRules is
         override
         returns (bool isReserved, address reservationOwner, uint64 expiryTimestamp)
     {
-        _requireStem(baseName);
+        _requireBaseName(baseName);
         Reservation memory reservation = reservations[baseName];
         return (_isLive(reservation), reservation.owner, reservation.expires);
     }
@@ -274,7 +275,7 @@ contract PopRules is
         Reservation memory reservation = reservations[baseName];
 
         if (_isLive(reservation) && reservation.owner != userAddress) {
-            metadata.message = "Base name reserved for original Lite registrant";
+            metadata.message = "Reserved for a device-name holder's personhood claim";
             metadata.status = IPopRules.PopStatus.Reserved;
         }
 
@@ -312,41 +313,41 @@ contract PopRules is
         uint256 reachComponent = _meetsReach(required, toTier) ? 0 : ownPrice;
 
         PopStatus fromTier = _personhoodTier(from);
-        // `_personhoodTier` never returns Reserved, so users are in {NoStatus, PopLite, PopFull}
-        // and enum comparison reflects tier ordering directly.
+        // `_personhoodTier` never returns Reserved, so users are in {NoStatus, Devicehood,
+        // Personhood} and enum comparison reflects tier ordering directly.
         uint256 downgradeComponent = toTier < fromTier ? ownPrice : 0;
 
         return reachComponent > downgradeComponent ? reachComponent : downgradeComponent;
     }
 
     /// @inheritdoc IPopRules
-    function personhoodOf(address account) external view override returns (PopStatus tier) {
+    function popStatusOf(address account) external view override returns (PopStatus tier) {
         return _personhoodTier(account);
     }
 
     /// @notice Reads `account`'s dotns-scoped personhood tier from the alias-accounts
     ///         precompile and translates it into a `PopStatus`.
     /// @dev Single source of truth so callers cannot read the precompile directly and
-    ///      drift on the status mapping. Tiers are defined incrementally on the
-    ///      precompile side: 0=None, 1=Lite, 2=Full. Anything outside that range
-    ///      collapses to `NoStatus` so a future tier addition fails closed instead of
-    ///      silently being treated as a higher level than it actually is.
+    ///      drift on the status mapping. The precompile defines its statuses incrementally and
+    ///      names them 0=None, 1=Lite, 2=Full; this maps 1 to `Devicehood` and 2 to `Personhood`.
+    ///      Anything outside that range collapses to `NoStatus` so a future tier addition fails
+    ///      closed instead of silently being treated as a higher level than it actually is.
     function _personhoodTier(address account) private view returns (PopStatus) {
         IPersonhood.PersonhoodInfo memory info = IPersonhood(DotnsConstants.PERSONHOOD)
             .personhoodStatus(account, DotnsConstants.PERSONHOOD_CONTEXT);
-        if (info.status == 2) return PopStatus.PopFull;
-        if (info.status == 1) return PopStatus.PopLite;
+        if (info.status == 2) return PopStatus.Personhood;
+        if (info.status == 1) return PopStatus.Devicehood;
         return PopStatus.NoStatus;
     }
 
     /// @notice Single canonical "is `userStatus` at reach for `required`?" predicate.
     /// @dev Both `priceWithCheck` and `transferFloor` build on this so the tier-eligibility rule
     /// lives in exactly one place and the callers cannot disagree about who clears a given label.
-    /// `_personhoodTier` never returns `Reserved`, so `userStatus` is in `{NoStatus, PopLite,
-    /// PopFull}` and the enum comparison reflects tier ordering directly. A `Reserved` `required`
-    /// (governance label) is unreachable by any verified user, so the comparison returns false and
-    /// the caller charges the friction fee, providing defence-in-depth if a Reserved label ever
-    /// enters circulation.
+    /// `_personhoodTier` never returns `Reserved`, so `userStatus` is in `{NoStatus, Devicehood,
+    /// Personhood}` and the enum comparison reflects tier ordering directly. A `Reserved`
+    /// `required` (governance label) is unreachable by any verified user, so the comparison returns
+    /// false and the caller charges the friction fee, providing defence-in-depth if a Reserved
+    /// label ever enters circulation.
     function _meetsReach(PopStatus required, PopStatus userStatus) private pure returns (bool) {
         return userStatus >= required;
     }
@@ -393,26 +394,26 @@ contract PopRules is
         require(shortNamesEnabled || baseLength >= 9, PopError("Short names are not for sale"));
     }
 
-    /// @notice Index one past `name`'s stem: a lite label without its suffix, or the whole of
-    ///         any other label.
-    /// @dev Only a lite label has a suffix to remove. The gateway allocates those two digits to
+    /// @notice Index one past `name`'s base name: a device name without its suffix, or the whole
+    ///         of any other label.
+    /// @dev Only a device name has a suffix to remove. The gateway allocates those two digits to
     ///      tell apart people who chose the same stem, so removing them recovers what the
     ///      candidate actually picked. No such allocation stands behind the digits in an
     ///      ordinary label, where they are part of the name: `web3` is a four-character word,
     ///      not `web` with a counter.
-    function _stemEnd(string calldata name) private pure returns (uint256 stemEnd) {
-        stemEnd = bytes(name).length;
-        if (!name.isLitePersonLabel()) return stemEnd;
-        return stemEnd - StringUtils.LITE_SUFFIX_DIGITS - 1;
+    function _baseNameEnd(string calldata name) private pure returns (uint256 end) {
+        end = bytes(name).length;
+        if (!name.isDeviceLabel()) return end;
+        return end - StringUtils.DEVICE_SUFFIX_DIGITS - 1;
     }
 
     /// @notice The base length that pricing and classification both use to place a name in its
-    ///         band, which is the length of the name's stem.
-    /// @dev Every label is measured as written, except a lite label, whose allocated suffix is
+    ///         band, which is the length of the name's base name.
+    /// @dev Every label is measured as written, except a device name, whose allocated suffix is
     ///      not part of the name the candidate chose. So `web3` and `blink182` are measured
     ///      whole and no digit count is privileged or rejected.
     function _validatedBaseLength(string calldata name) internal pure returns (uint256 baseLength) {
-        return _stemEnd(name);
+        return _baseNameEnd(name);
     }
 
     /// @notice Enforces base-name reservation rules.
@@ -425,7 +426,7 @@ contract PopRules is
         if (_isLive(reservation)) {
             require(
                 reservation.owner == userAddress,
-                PopError("Base name reserved for original Lite registrant")
+                PopError("Reserved for a device-name holder's personhood claim")
             );
         }
     }
@@ -453,14 +454,14 @@ contract PopRules is
         }
     }
 
-    /// @notice Returns `name`'s stem: a lite label without its allocated suffix, or any other
-    ///         label verbatim.
-    /// @dev The reservation key. Because only a lite label is shortened, `joseph.42` contends
+    /// @notice Returns `name`'s base name: a device name without its allocated suffix, or any
+    ///         other label verbatim.
+    /// @dev The reservation key. Because only a device name is shortened, `joseph.42` contends
     ///      with `joseph` while `joseph42` is an unrelated name and contends with nothing.
     /// @param name Domain label.
     function _stripDigits(string calldata name) internal pure returns (string memory baseName) {
         bytes calldata bytesName = bytes(name);
-        uint256 endPosition = _stemEnd(name);
+        uint256 endPosition = _baseNameEnd(name);
 
         // No suffix to strip: return the input verbatim and skip the manual copy.
         if (endPosition == bytesName.length) return name;
@@ -485,37 +486,37 @@ contract PopRules is
         }
 
         if (baseLength >= 6 && baseLength <= 8) {
-            // PopLite is the gateway's separated form. Digits in an ordinary label say nothing
+            // Devicehood is the gateway's separated form. Digits in an ordinary label say nothing
             // about personhood, so such a label sits in the band its length earns.
-            if (name.isLitePersonLabel()) {
-                return (PopStatus.PopLite, "Requires Lite personhood verification", baseLength);
+            if (name.isDeviceLabel()) {
+                return (PopStatus.Devicehood, "Requires devicehood", baseLength);
             }
-            return (PopStatus.PopFull, "Requires Full personhood verification", baseLength);
+            return (PopStatus.Personhood, "Requires personhood", baseLength);
         }
 
-        // Base length >= 9 is open to any caller, and is reached by a lite label whose stem is
+        // Base length >= 9 is open to any caller, and is reached by a device name whose stem is
         // nine or more through the gateway.
         return (PopStatus.NoStatus, "Available to all", baseLength);
     }
 
-    /// @notice Requires `stem` to be a canonical DNS label, carrying no separator.
-    /// @dev Reservation keys are stems, so a separator here is a caller error rather than a lite
-    ///      name. A digit suffix passes this check, because a DNS label admits digits; the entry
-    ///      points that write a reservation reject one themselves.
-    ///      @custom:function _requireLabel is the guard for full labels.
-    function _requireStem(string calldata stem) internal pure {
-        require(stem.isSingleLabel(), PopError("Name must be lowercase ASCII DNS label"));
+    /// @notice Requires `baseName` to be a canonical DNS label, carrying no separator.
+    /// @dev Reservation keys are base names, and a base name carries no separator, so a separator
+    ///      here is a caller error. A digit suffix passes this check, because a DNS label admits
+    ///      digits; the entry points that write a reservation reject one themselves.
+    ///      @custom:function _requireLabel is the guard for whole labels.
+    function _requireBaseName(string calldata baseName) internal pure {
+        require(baseName.isSingleLabel(), PopError("Name must be lowercase ASCII DNS label"));
     }
 
-    /// @notice Requires `name` to be a label DotNS can issue: a canonical DNS label, or a lite
-    ///         label carrying its separator.
+    /// @notice Requires `name` to be a label dotNS can issue: a canonical DNS label, or a device
+    ///         name carrying its separator.
     /// @dev The union is the full set of issuable labels, so a near miss such as `alice.4` or
-    ///      `a.b.42` still reverts. @custom:function _requireStem is the stricter guard for
+    ///      `a.b.42` still reverts. @custom:function _requireBaseName is the stricter guard for
     ///      reservation keys, which never carry a separator.
     function _requireLabel(string calldata name) internal pure {
         require(
-            name.isSingleLabel() || name.isLitePersonLabel(),
-            PopError("Name must be a lowercase ASCII DNS label or a lite label")
+            name.isSingleLabel() || name.isDeviceLabel(),
+            PopError("Name must be a lowercase ASCII DNS label or a device name")
         );
     }
 
@@ -534,7 +535,7 @@ contract PopRules is
     function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
@@ -552,35 +553,40 @@ contract PopRules is
 
     /// @inheritdoc IPopRules
     function reserveBaseNameForPop(
-        string calldata stem,
+        string calldata baseName,
         address userAddress
     )
         external
         override
         onlyRegistry
     {
-        _requireStem(stem);
+        _requireBaseName(baseName);
         require(
-            _countTrailingDigits(stem) == 0,
-            PopError("Reservation stem must have no trailing digits")
+            _countTrailingDigits(baseName) == 0,
+            PopError("Reservation base name must have no trailing digits")
         );
-        _writeReservation(stem, userAddress);
+        _writeReservation(baseName, userAddress);
     }
 
     /// @inheritdoc IPopRules
-    function stripDigits(string calldata name) external pure override returns (string memory stem) {
+    function stripDigits(string calldata name)
+        external
+        pure
+        override
+        returns (string memory baseName)
+    {
         _requireLabel(name);
         return _stripDigits(name);
     }
 
     /// @inheritdoc IPopRules
-    function releaseBaseName(string calldata stem) external override onlyRegistry {
-        _requireStem(stem);
+    function releaseBaseName(string calldata baseName) external override onlyRegistry {
+        _requireBaseName(baseName);
         require(
-            _countTrailingDigits(stem) == 0,
-            PopError("Reservation stem must have no trailing digits")
+            _countTrailingDigits(baseName) == 0,
+            PopError("Reservation base name must have no trailing digits")
         );
-        Reservation memory reservation = reservations[stem];
+        Reservation memory reservation = reservations[baseName];
         // Live reservations can only be cleared by the controller that wrote
         // them, so one registrar-authorised controller cannot wipe another's
         // active slot. Expired reservations are dead weight and may be cleared
@@ -591,45 +597,45 @@ contract PopRules is
                 PopError("Only reserving controller can release")
             );
         }
-        delete reservations[stem];
-        emit BaseNameReleased(stem);
+        delete reservations[baseName];
+        emit BaseNameReleased(baseName);
     }
 
     /// @inheritdoc IPopRules
     function releaseReservationForReclaim(
-        string calldata stem,
+        string calldata baseName,
         address expectedOwner
     )
         external
         override
         onlyRegistry
     {
-        _requireStem(stem);
+        _requireBaseName(baseName);
         require(
-            _countTrailingDigits(stem) == 0,
-            PopError("Reservation stem must have no trailing digits")
+            _countTrailingDigits(baseName) == 0,
+            PopError("Reservation base name must have no trailing digits")
         );
-        Reservation memory reservation = reservations[stem];
+        Reservation memory reservation = reservations[baseName];
         // Cross-controller release is gated on owner match rather than controller match,
         // so the public registrar controller can clear a PoP-stamped slot during reclaim
         // when the prior occupant is the reservation owner.
         if (_isLive(reservation)) {
             require(reservation.owner == expectedOwner, PopError("Reservation owner mismatch"));
         }
-        delete reservations[stem];
-        emit BaseNameReleased(stem);
+        delete reservations[baseName];
+        emit BaseNameReleased(baseName);
     }
 
-    /// @notice Internal single-source-of-truth writer for stem reservations.
+    /// @notice Internal single-source-of-truth writer for base-name reservations.
     /// @dev Routes both @custom:function reserveBaseName and @custom:function reserveBaseNameForPop
     ///      through one path so the cross-user collision semantics stay identical: a live slot held
     ///      by a different user @custom:reverts PopError, and any other case writes a fresh expiry
     ///      and emits @custom:emits BaseNameReserved. Same-owner re-reservations refresh the expiry
     ///      to `block.timestamp + MAX_RESERVATION_TIME`. Callers are responsible for validating
-    ///      `stem` is canonical and stem-shaped (no trailing digits); this helper does no input
+    ///      `baseName` is canonical and carries no trailing digits; this helper does no input
     ///      validation of its own so each public entry can layer additional eligibility checks.
-    function _writeReservation(string calldata stem, address userAddress) internal {
-        Reservation memory existing = reservations[stem];
+    function _writeReservation(string calldata baseName, address userAddress) internal {
+        Reservation memory existing = reservations[baseName];
         bool liveSlot = _isLive(existing);
         if (liveSlot) {
             require(existing.owner == userAddress, PopError("Base name held by another user"));
@@ -641,12 +647,12 @@ contract PopRules is
         // forge-lint: disable-next-line(unsafe-typecast)
         uint64 expiryTime = uint64(block.timestamp + MAX_RESERVATION_TIME);
         // Preserve the original stamping `controller` on same-owner refresh so a sibling controller
-        // tracking the same stem (e.g. the PoP queue head) retains the right to release. Without
-        // this, a same-user re-reservation through a different controller silently steals the slot
-        // and bricks the original controller's release/advance/claim paths.
+        // tracking the same base name (e.g. the PoP queue head) retains the right to release.
+        // Without this, a same-user re-reservation through a different controller silently steals
+        // the slot and bricks the original controller's release/advance/claim paths.
         address stampingController = liveSlot ? existing.controller : msg.sender;
-        reservations[stem] =
+        reservations[baseName] =
             Reservation({owner: userAddress, expires: expiryTime, controller: stampingController});
-        emit BaseNameReserved(stem, userAddress, expiryTime);
+        emit BaseNameReserved(baseName, userAddress, expiryTime);
     }
 }
diff --git a/contracts/registrars/DotnsPopController.sol b/contracts/registrars/DotnsPopController.sol
index bb2052fab..d0b01853a 100644
--- a/contracts/registrars/DotnsPopController.sol
+++ b/contracts/registrars/DotnsPopController.sol
@@ -15,6 +15,7 @@ import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 
 import {IDotnsPopController} from "./IDotnsPopController.sol";
+import {IDotnsPopControllerLegacy} from "./IDotnsPopControllerLegacy.sol";
 import {IDotnsRegistrar} from "./IDotnsRegistrar.sol";
 import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {IDotnsPopResolver} from "../resolvers/IDotnsPopResolver.sol";
@@ -30,45 +31,45 @@ import {DotnsConstants} from "../utils/DotnsConstants.sol";
 import {SystemUtils} from "../utils/SystemUtils.sol";
 
 /// @title DotnsPopController
-/// @notice Dedicated PoP controller orchestrating lite-person and full-person username
-/// issuance on behalf of the PoP gateway.
+/// @notice Dedicated PoP controller that issues device names and personhood names on behalf of
+/// the dotNS gateway pallet.
 /// @dev Lives behind its own UUPS proxy with its own storage. Registered on `DotnsRegistrar`
 /// via `addController`, which is how multiple controllers coexist on the same registrar
 /// without interfering with each other.
 ///
 /// Enforcement:
-/// Personhood is attested off-chain by the gateway before the call reaches this
+/// Devicehood and personhood are attested off-chain by the gateway before the call reaches this
 /// contract, so the on-chain personhood precompile is not re-queried on the gateway path.
-/// Every base-label mint path still calls @custom:function IPopRules.classifyName to reject
-/// governance-reserved labels (@custom:reverts InvalidBaseLabel on the base path,
-/// @custom:reverts InvalidLiteLabel on the lite path). The lite leg accepts any two-digit lite
-/// label whose stem is not governance-reserved, regardless of stem length. Native-token pricing
-/// is bypassed entirely; the gateway pays no rent.
+/// Every issuance path still calls @custom:function IPopRules.classifyName to reject
+/// governance-reserved labels (@custom:reverts InvalidPersonhoodLabel for personhood names,
+/// @custom:reverts InvalidDeviceLabel for device names). A device name is accepted with any
+/// two-digit suffix whose stem is not governance-reserved, regardless of stem length. Native-token
+/// pricing is bypassed entirely; the gateway pays no rent.
 ///
 /// Decoupling:
 /// This contract does not import or call `IDotnsRegistrarController`. The public
 /// commit-reveal controller is equally unaware of this one. Cross-flow collision handling
 /// relies on two distinct properties, neither of which requires the two controllers to know
 /// about each other:
-/// (1) Lite-person labels (`stem.NN`) occupy a namespace the public path cannot reach: the
-/// separator is legal only on a lite label, and the public path rejects it, so no public
+/// (1) Device names (`stem.NN`) occupy a namespace the public path cannot reach: the
+/// separator is legal only on a device name, and the public path rejects it, so no public
 /// registration can spell one. A digit suffix is not exclusive, but an ordinary label carrying
 /// one is measured as written and so is simply a different name. The two flows therefore cannot
 /// contend for the same label. This holds of labels the contracts minted, not of an arbitrary
 /// string: a subname stored under a digit-only parent reads the same way, which is why
 /// provenance is published through @custom:function isPopIssued rather than inferred.
-/// (2) Base-name reservations are synchronised into `IPopRules`. The head of this
-/// controller's reservation queue is written through `IPopRules.reserveBaseNameForPop` on
+/// (2) Personhood-name reservations are synchronised into `IPopRules` by base name. The head of
+/// this controller's reservation queue is written through `IPopRules.reserveBaseNameForPop` on
 /// every head transition; the slot is cleared through `IPopRules.releaseBaseName` when the
 /// queue empties (claim, final relinquish, final expiry). The public commit-reveal
 /// controller routes through `IPopRules.priceWithCheck`, which rejects any registration
-/// targeting a base-name stem reserved for another user, so the public flow respects
+/// targeting a base name reserved for another user, so the public flow respects
 /// gateway reservations without ever importing this contract. PopRules is the single
 /// cross-flow authority; the queue here is the intra-PoP ordering layer on top of it.
 ///
 /// Shared primitives: labelhash / namehash via @custom:contract LabelUtils; the mint +
 /// forward-registry + store-write triad via @custom:contract RegistrationUtils; chat-key and
-/// lite-to-full link persistence via
+/// device-link persistence via
 /// @custom:contract IDotnsPopResolver. Keeping per-name records on the resolver preserves the
 /// "Store = labels only" invariant.
 /// @custom:security-contact admin@parity.io
@@ -77,7 +78,8 @@ contract DotnsPopController is
     UUPSUpgradeable,
     OwnableUpgradeable,
     ERC165Upgradeable,
-    IDotnsPopController
+    IDotnsPopController,
+    IDotnsPopControllerLegacy
 {
     using StringUtils for *;
     using EnumerableSet for EnumerableSet.AddressSet;
@@ -97,7 +99,7 @@ contract DotnsPopController is
     /// state has been committed.
     uint256 private constant CHAT_KEY_LENGTH = 65;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Per-label queue metadata (head/tail pointers).
@@ -112,13 +114,13 @@ contract DotnsPopController is
     /// read both fields in one call instead of two.
     mapping(address user => UserReservation reservation) internal _userReservations;
 
-    /// @notice Remembers the base-label string for each reserved labelhash so the PopRules
+    /// @notice Remembers the personhood name for each reserved labelhash so the PopRules
     /// sync path can address the reservation by its original string form (PopRules keys its
     /// `reservations` mapping by string).
     /// @dev Populated on first enqueue for a label, cleared when the queue empties. Exists
     /// only to bridge the queue's `bytes32` key space to PopRules' `string` key space;
     /// nothing else reads it.
-    mapping(bytes32 labelhash => string baseLabel) internal _reservedBaseLabel;
+    mapping(bytes32 labelhash => string reservedLabel) internal _reservedBaseLabel;
 
     /// @notice Duration (in seconds) after which a reservation entry is considered expired.
     /// @dev Sets the reservation duration, configurable by
@@ -132,9 +134,8 @@ contract DotnsPopController is
 
     /// @notice Per-user pile of deferred names awaiting a `LabelStore`.
     /// @dev The mint origin cannot deploy a `LabelStore`, so deferred names accumulate here until a
-    /// signed-origin
-    /// @custom:function settlePendingClaims deploys the store and writes the stashed labels. Each
-    /// entry's deadline is measured from its own `mintedAt` against `reservationDuration`.
+    /// signed-origin @custom:function settlePendingClaims deploys the store and writes the stashed
+    /// labels. Entries never lapse and can be settled at any time.
     mapping(address user => PendingClaim[] queue) internal _pendingClaimQueue;
 
     /// @notice Labels this controller minted, keyed by the bare label without the TLD.
@@ -191,79 +192,136 @@ contract DotnsPopController is
     }
 
     /// @inheritdoc IDotnsPopController
-    function reserveLiteName(LiteRegistration calldata params) external override onlyRoot {
-        _reserveLite(_popRules(), params);
+    function issueDeviceName(DeviceNameIssuance calldata params) external override onlyRoot {
+        _issueDeviceName(_popRules(), params, false);
+    }
+
+    /// @inheritdoc IDotnsPopControllerLegacy
+    function reserveLiteName(DeviceNameIssuance calldata params) external override onlyRoot {
+        _issueDeviceName(_popRules(), params, true);
+    }
+
+    /// @inheritdoc IDotnsPopController
+    function issueDeviceNameWithReservation(DeviceNameIssuanceWithReservation calldata params)
+        external
+        override
+        onlyRoot
+    {
+        _issueDeviceNameWithReservation(params, false);
+    }
+
+    /// @inheritdoc IDotnsPopControllerLegacy
+    function reserveBaseName(DeviceNameIssuanceWithReservation calldata params)
+        external
+        override
+        onlyRoot
+    {
+        _issueDeviceNameWithReservation(params, true);
+    }
+
+    /// @inheritdoc IDotnsPopController
+    function reservePersonhoodName(PersonhoodNameReservation calldata params)
+        external
+        override
+        onlyRoot
+    {
+        IPopRules rules = _popRules();
+        (bytes32 reservedHash,) = _validateReservablePersonhoodLabel(rules, params.label, false);
+        _advanceExpiredHead(reservedHash);
+        _dropUserReservation(params.user);
+        _enqueueReservation(rules, reservedHash, params.label, params.user);
     }
 
     /// @inheritdoc IDotnsPopController
-    function reserveBaseName(BaseReservation calldata params) external override onlyRoot {
+    function issuePersonhoodName(PersonhoodNameIssuance calldata params)
+        external
+        override
+        onlyRoot
+    {
+        _issuePersonhoodName(params, false);
+    }
+
+    /// @inheritdoc IDotnsPopControllerLegacy
+    function registerBaseName(PersonhoodNameIssuance calldata params) external override onlyRoot {
+        _issuePersonhoodName(params, true);
+    }
+
+    /// @notice Body shared by @custom:function issueDeviceNameWithReservation and its legacy
+    /// entrypoint.
+    /// @dev The reservation is validated before the issuance so an unreservable label aborts the
+    /// whole call. `legacy` selects the label errors, as in @custom:function _issueDeviceName.
+    function _issueDeviceNameWithReservation(
+        DeviceNameIssuanceWithReservation calldata params,
+        bool legacy
+    )
+        internal
+    {
         IPopRules rules = _popRules();
         bytes32 reservedHash;
-        bool hasReservation = bytes(params.reservedBaseLabel).length != 0;
+        bool hasReservation = bytes(params.reservedLabel).length != 0;
         if (hasReservation) {
-            (reservedHash,) = _validateReservableBaseLabel(rules, params.reservedBaseLabel);
+            (reservedHash,) =
+                _validateReservablePersonhoodLabel(rules, params.reservedLabel, legacy);
         }
 
-        _reserveLite(rules, params.lite);
+        _issueDeviceName(rules, params.issuance, legacy);
 
         if (hasReservation) {
             _advanceExpiredHead(reservedHash);
-            _removeUserFromQueue(params.lite.user);
-            _enqueueReservation(rules, reservedHash, params.reservedBaseLabel, params.lite.user);
+            _dropUserReservation(params.issuance.user);
+            _enqueueReservation(rules, reservedHash, params.reservedLabel, params.issuance.user);
         }
     }
 
-    /// @inheritdoc IDotnsPopController
-    function reserveBaseNameOnly(BaseNameReservation calldata params) external override onlyRoot {
-        IPopRules rules = _popRules();
-        (bytes32 reservedHash,) = _validateReservableBaseLabel(rules, params.reservedBaseLabel);
-        _advanceExpiredHead(reservedHash);
-        _removeUserFromQueue(params.user);
-        _enqueueReservation(rules, reservedHash, params.reservedBaseLabel, params.user);
-    }
-
-    /// @notice Lite-only mint shared by @custom:function reserveLiteName and the lite leg
-    /// of @custom:function reserveBaseName.
-    /// @dev Gateway attestation is the authority for personhood on this path; the on-chain
+    /// @notice Device-name issuance shared by @custom:function issueDeviceName, the issuance of
+    /// @custom:function issueDeviceNameWithReservation, and their legacy entrypoints.
+    /// @dev Gateway attestation is the authority for devicehood on this path; the on-chain
     /// precompile is not consulted. The label is stored in the `stem.NN` form the gateway sends,
     /// which is the canonical form of the name, so no normalisation happens here. The shape check
-    /// runs before classification so a malformed label reverts
-    /// @custom:reverts InvalidLiteLabel, which the gateway decodes by selector; letting
-    /// `classifyName` catch it instead would surface an undecodable PopRules string.
-    /// Takes the @custom:struct LiteRegistration struct directly so both call sites pass the same
-    /// payload shape: the typed entrypoint forwards its own `params`, the `reserveBaseName`
-    /// entrypoint forwards `params.lite`.
-    function _reserveLite(IPopRules rules, LiteRegistration calldata params) internal {
-        require(params.liteLabel.isLitePersonLabel(), InvalidLiteLabel());
+    /// runs before classification so a malformed label reverts with a controller error, which the
+    /// gateway decodes by selector; letting `classifyName` catch it instead would surface an
+    /// undecodable PopRules string. `legacy` selects @custom:reverts InvalidLiteLabel over
+    /// @custom:reverts InvalidDeviceLabel for the callers that decode the legacy error.
+    function _issueDeviceName(
+        IPopRules rules,
+        DeviceNameIssuance calldata params,
+        bool legacy
+    )
+        internal
+    {
+        _requireDeviceLabel(params.label.isDeviceLabel(), legacy);
         _requireValidChatKey(params.chatKey);
 
-        (IPopRules.PopStatus required,) = rules.classifyName(params.liteLabel);
-        // The shape check fixes the suffix, so classification lands on PopLite (stem 6-8),
+        (IPopRules.PopStatus required,) = rules.classifyName(params.label);
+        // The shape check fixes the suffix, so classification lands on Devicehood (stem 6-8),
         // NoStatus (stem 9 or more), or Reserved (stem 5 or fewer). Accept the first two; a
         // stem short enough to be governance-reserved is not issued from this path.
-        require(required != IPopRules.PopStatus.Reserved, InvalidLiteLabel());
-        (bytes32 labelhash, bytes32 node) = _validateLiteLabel(params.liteLabel);
+        _requireDeviceLabel(required != IPopRules.PopStatus.Reserved, legacy);
+        (bytes32 labelhash, bytes32 node) = _validateDeviceLabel(params.label, legacy);
 
         _completeGatewayRegistration(
-            params.user, params.liteLabel, labelhash, node, params.chatKey, bytes32(0)
+            params.user, params.label, labelhash, node, params.chatKey, bytes32(0)
         );
 
-        emit LiteNameReserved(labelhash, params.user, params.liteLabel);
+        emit DeviceNameIssued(labelhash, params.user, params.label);
     }
 
-    /// @inheritdoc IDotnsPopController
-    function registerBaseName(FullRegistration calldata params) external override onlyRoot {
+    /// @notice Personhood-name issuance shared by @custom:function issuePersonhoodName and its
+    /// legacy entrypoint.
+    /// @dev `legacy` selects @custom:reverts InvalidLiteLabel / @custom:reverts InvalidBaseLabel
+    /// over the new label errors for the callers that decode the legacy ones.
+    function _issuePersonhoodName(PersonhoodNameIssuance calldata params, bool legacy) internal {
         Link calldata link = params.link;
         address user = params.user;
         string calldata label = params.label;
 
-        (bytes32 labelhash, bytes32 node) = _validateBaseLabel(label);
+        (bytes32 labelhash, bytes32 node) = _validatePersonhoodLabel(label, legacy);
 
         IPopRules rules = _popRules();
         (IPopRules.PopStatus required,) = rules.classifyName(label);
-        require(
-            required != IPopRules.PopStatus.Reserved && required != IPopRules.PopStatus.PopLite,
-            InvalidBaseLabel()
+        _requirePersonhoodLabel(
+            required != IPopRules.PopStatus.Reserved && required != IPopRules.PopStatus.Devicehood,
+            legacy
         );
 
         _advanceExpiredHead(labelhash);
@@ -293,52 +351,53 @@ contract DotnsPopController is
         }
 
         if (isClaim) {
-            _clearQueue(labelhash);
+            _clearQueue(labelhash, user);
         } else {
-            _removeUserFromQueue(user);
+            _dropUserReservation(user);
         }
 
-        bytes32 liteLabelhash;
-        bytes32 liteNode;
+        bytes32 deviceLabelhash;
+        bytes32 deviceNode;
         bytes memory chatKeyToPersist;
-        if (link.kind == LinkKind.LiteUsername) {
-            require(link.liteLabel.isLitePersonLabel(), InvalidLiteLabel());
-            (liteLabelhash, liteNode) = _validateLiteLabel(link.liteLabel);
-            // A lite username is a subnode, so its owner lives in the registry record rather than
+        if (link.kind == LinkKind.DeviceName) {
+            _requireDeviceLabel(link.deviceLabel.isDeviceLabel(), legacy);
+            (deviceLabelhash, deviceNode) = _validateDeviceLabel(link.deviceLabel, legacy);
+            // A device name is a subnode, so its owner lives in the registry record rather than
             // the registrar's ERC-721 ledger.
             require(
-                _registry().owner(liteNode) == user, LiteLabelNotOwnedByUser(user, liteLabelhash)
+                _registry().owner(deviceNode) == user, DeviceNameNotOwned(user, deviceLabelhash)
             );
-            chatKeyToPersist = _popResolver().chatKey(liteNode);
+            chatKeyToPersist = _popResolver().chatKey(deviceNode);
         } else {
             _requireValidChatKey(link.chatKey);
             chatKeyToPersist = link.chatKey;
         }
 
-        _completeGatewayRegistration(user, label, labelhash, node, chatKeyToPersist, liteLabelhash);
+        _completeGatewayRegistration(
+            user, label, labelhash, node, chatKeyToPersist, deviceLabelhash
+        );
 
+        emit PersonhoodNameIssued(labelhash, user, label);
         if (isClaim) {
-            emit BaseNameClaimed(labelhash, user, label);
-        } else {
-            emit StandaloneNameRegistered(labelhash, user, label);
+            emit ReservationClaimed(labelhash, user);
         }
-        if (link.kind == LinkKind.LiteUsername) {
-            emit LiteToFullLinked(labelhash, liteLabelhash);
+        if (link.kind == LinkKind.DeviceName) {
+            emit DeviceNameLinked(labelhash, deviceLabelhash);
         }
     }
 
     /// @inheritdoc IDotnsPopController
-    function expireReservation(string calldata reservedBaseLabel) external override {
-        (bytes32 labelhash,) = _validateBaseLabel(reservedBaseLabel);
+    function expireReservation(string calldata label) external override {
+        (bytes32 labelhash,) = _validatePersonhoodLabel(label, false);
         _advanceExpiredHead(labelhash);
     }
 
     /// @inheritdoc IDotnsPopController
     function relinquishReservation() external override {
-        UserReservation memory userRes = _userReservations[msg.sender];
-        require(userRes.labelhash != bytes32(0), NoActiveReservation(msg.sender));
-        _removeUserFromQueue(msg.sender);
-        emit ReservationRelinquished(userRes.labelhash, msg.sender);
+        require(
+            _userReservations[msg.sender].labelhash != bytes32(0), NoActiveReservation(msg.sender)
+        );
+        _dropUserReservation(msg.sender);
     }
 
     /// @inheritdoc IDotnsPopController
@@ -407,10 +466,10 @@ contract DotnsPopController is
         returns (address)
     {
         bytes32 labelhash = LabelUtils.labelhashMemory(label);
-        // A lite label settled its ownership as a subnode, so its store entry keys the same
-        // hierarchical node; a full label keys the second-level node under the TLD.
-        bytes32 node = label.isLitePersonLabelMemory()
-            ? _liteSubnode(label)
+        // A device name settled its ownership as a subnode, so its store entry keys the same
+        // hierarchical node; a personhood name keys the second-level node under the TLD.
+        bytes32 node = label.isDeviceLabelMemory()
+            ? _deviceSubnode(label)
             : LabelUtils.namehashUnder(protocolRegistry.tldNode(), labelhash);
         if (store == address(0)) {
             store = factory.deployLabelStoreFor(user);
@@ -422,13 +481,13 @@ contract DotnsPopController is
     }
 
     /// @inheritdoc IDotnsPopController
-    function isReservedForClaim(string calldata reservedBaseLabel)
+    function isReservedForClaim(string calldata label)
         external
         view
         override
         returns (bool reserved, address holder)
     {
-        (bytes32 labelhash,) = _validateBaseLabel(reservedBaseLabel);
+        (bytes32 labelhash,) = _validatePersonhoodLabel(label, false);
         ReservationQueueMeta memory meta = _reservationMeta[labelhash];
         if (meta.head >= meta.tail) return (false, address(0));
 
@@ -540,11 +599,11 @@ contract DotnsPopController is
     }
 
     /// @inheritdoc IDotnsPopController
-    function reservedBaseLabelOf(bytes32 labelhash)
+    function reservedLabelOf(bytes32 labelhash)
         external
         view
         override
-        returns (string memory baseLabel)
+        returns (string memory label)
     {
         return _reservedBaseLabel[labelhash];
     }
@@ -557,11 +616,12 @@ contract DotnsPopController is
         returns (bool)
     {
         return interfaceId == type(IDotnsPopController).interfaceId
+            || interfaceId == type(IDotnsPopControllerLegacy).interfaceId
             || super.supportsInterface(interfaceId);
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
@@ -572,14 +632,14 @@ contract DotnsPopController is
     }
 
     /// @notice Mints a name, wires forward registry, persists PoP-flow records (chat key,
-    /// lite link) on the PoP resolver, and either writes the label into the owner's
+    /// device link) on the PoP resolver, and either writes the label into the owner's
     /// existing `LabelStore` or stashes a pending claim when the owner has none yet.
     /// @dev The mint + forward-registry pair is delegated to
     /// @custom:function RegistrationUtils.registerAndStore so this flow and the public
     /// commit-reveal flow share exactly one implementation of that sequence. The label is
     /// passed empty so the registrar does not deploy a `LabelStore`; the mint origin cannot
     /// run the `LabelStore` constructor. PoP-flow per-name records
-    /// (chat key, lite link) are persisted eagerly on @custom:contract IDotnsPopResolver
+    /// (chat key, device link) are persisted eagerly on @custom:contract IDotnsPopResolver
     /// here, before the label is written, so the resolver carries the full identity record
     /// from mint time regardless of whether the owner already has a `LabelStore`. The Store
     /// stays labels-only. Warm path emits @custom:emits NameRegistered immediately; the
@@ -592,21 +652,22 @@ contract DotnsPopController is
         bytes32 labelhash,
         bytes32 node,
         bytes memory chatKeyBytes,
-        bytes32 liteLabelhash
+        bytes32 deviceLabelhash
     )
         internal
     {
         _popIssued[label] = true;
 
-        // A lite username is a subname under its numeric container, so it takes the subnode path
-        // and never mints a token. A full-person name is a tokenised second-level registration and
+        // A device name is a subname under its numeric container, so it takes the subnode path
+        // and never mints a token. A personhood name is a tokenised second-level registration and
         // keeps the shared token triad untouched. `persist` is false because the store write is
         // deferred to the pending-claim queue below and the user syncs it later.
-        if (label.isLitePersonLabelMemory()) {
-            // A lite name is issued once. Its subnode already existing means a duplicate issuance,
-            // which would rehome the identity and overwrite its records, so it is rejected.
-            require(!_registry().recordExists(node), LiteNameAlreadyIssued());
-            (string memory stem, string memory suffix) = label.splitLiteLabel();
+        if (label.isDeviceLabelMemory()) {
+            // A device name is issued once. Its subnode already existing means a duplicate
+            // issuance, which would rehome the identity and overwrite its records, so it is
+            // rejected.
+            require(!_registry().recordExists(node), DeviceNameAlreadyIssued());
+            (string memory stem, string memory suffix) = label.splitDeviceLabel();
             // Take the node from the registry write itself, so the chat-key and store writes below
             // land on exactly the node the record was created at rather than a separately derived
             // one that could drift from it.
@@ -631,13 +692,13 @@ contract DotnsPopController is
             );
         }
 
-        if (chatKeyBytes.length != 0 || liteLabelhash != bytes32(0)) {
+        if (chatKeyBytes.length != 0 || deviceLabelhash != bytes32(0)) {
             IDotnsPopResolver resolver = _popResolver();
             if (chatKeyBytes.length != 0) {
                 resolver.setChatKey(node, chatKeyBytes);
             }
-            if (liteLabelhash != bytes32(0)) {
-                resolver.setLiteLink(node, liteLabelhash);
+            if (deviceLabelhash != bytes32(0)) {
+                resolver.setDeviceLink(node, deviceLabelhash);
             }
         }
 
@@ -657,9 +718,9 @@ contract DotnsPopController is
     /// user whose store was pre-populated under the same `node` (e.g. by a sibling protocol
     /// flow) can still settle their pending claim without bricking on `LabelAlreadyExists`.
     /// @param store Owner's `LabelStore` proxy.
-    /// @param node The name's node. A lite label resolves to its stem beneath its numeric
+    /// @param node The name's node. A device name resolves to its stem beneath its numeric
     /// container, so this is not always `namehash(tldNode, keccak(label))` for the whole label.
-    /// @param label Bare label without the TLD, which is appended on write. A lite label
+    /// @param label Bare label without the TLD, which is appended on write. A device name
     /// carries its separator, so this is not always a single DNS label.
     function _writeRecord(address store, bytes32 node, string memory label) internal {
         if (ILabelStore(store).isLocked(node)) return;
@@ -694,7 +755,7 @@ contract DotnsPopController is
     function _enqueueReservation(
         IPopRules rules,
         bytes32 labelhash,
-        string memory baseLabel,
+        string memory reservedLabel,
         address user
     )
         internal
@@ -714,8 +775,8 @@ contract DotnsPopController is
         _userReservations[user] = UserReservation({labelhash: labelhash, index: index});
 
         if (becomesHead) {
-            _reservedBaseLabel[labelhash] = baseLabel;
-            rules.reserveBaseNameForPop(baseLabel, user);
+            _reservedBaseLabel[labelhash] = reservedLabel;
+            rules.reserveBaseNameForPop(reservedLabel, user);
         }
 
         emit ReservationQueued(labelhash, user, index - meta.head);
@@ -723,16 +784,19 @@ contract DotnsPopController is
 
     /// @notice Wipes the entire reservation queue for `labelhash` and releases the
     /// corresponding PopRules reservation.
-    /// @dev Used when a holder claims their reservation: every waiter is evicted and their
-    /// per-user tracking state is cleared, and PopRules is told the slot is free so future
-    /// public registrations are unblocked (the claim itself just minted the name, so there
-    /// is nothing left to reserve).
-    function _clearQueue(bytes32 labelhash) internal {
+    /// @dev Used when `claimant` claims their reservation: every other waiter is evicted
+    /// (@custom:emits ReservationEvicted for each one) and their per-user tracking state is
+    /// cleared, and PopRules is told the slot is free so future public registrations are unblocked
+    /// (the claim itself just minted the name, so there is nothing left to reserve).
+    function _clearQueue(bytes32 labelhash, address claimant) internal {
         ReservationQueueMeta memory meta = _reservationMeta[labelhash];
         for (uint64 i = meta.head; i < meta.tail; i++) {
             ReservationEntry memory entry = _reservationEntries[labelhash][i];
             if (entry.owner != address(0)) {
                 delete _userReservations[entry.owner];
+                if (entry.owner != claimant) {
+                    emit ReservationEvicted(labelhash, entry.owner);
+                }
             }
             delete _reservationEntries[labelhash][i];
         }
@@ -777,12 +841,25 @@ contract DotnsPopController is
         }
     }
 
+    /// @notice Drops `user`'s own reservation entry, if any, and records that it happened.
+    /// @dev The single path by which a user's entry leaves a queue other than by expiry or by a
+    /// claim: an explicit relinquish, a standalone personhood-name issuance, and a re-reservation
+    /// that moves the user to another queue. @custom:emits ReservationRelinquished only when the
+    /// user held an entry, so an indexer can rebuild every queue from events alone.
+    function _dropUserReservation(address user) internal {
+        bytes32 labelhash = _userReservations[user].labelhash;
+        if (labelhash == bytes32(0)) return;
+        _removeUserFromQueue(user);
+        emit ReservationRelinquished(labelhash, user);
+    }
+
     /// @notice Removes `user` from whichever reservation queue they currently occupy.
     /// @dev For a head removal, we delete the entry without bumping `meta.head` and delegate
     /// the advance to `_advanceExpiredHead`. Its existing zero-owner skip walks past the
     /// freshly-deleted slot, and its `head != meta.head` branch fires the PopRules resync
     /// in the one place head promotion is actually handled. Non-head removals leave the
-    /// queue shape intact, so no advance or resync is needed.
+    /// queue shape intact, so no advance or resync is needed. Emits nothing itself; callers go
+    /// through @custom:function _dropUserReservation.
     function _removeUserFromQueue(address user) internal {
         UserReservation memory userRes = _userReservations[user];
         bytes32 labelhash = userRes.labelhash;
@@ -799,74 +876,103 @@ contract DotnsPopController is
         }
     }
 
-    /// @notice Validates a lite-person `stem.NN` label and derives `(labelhash, node)`.
+    /// @notice Validates a device name `stem.NN` and derives `(labelhash, node)`.
     /// @dev The stem is lowercase letters only, so this rejects a stem carrying a digit or a
     /// hyphen before any node is derived. `node` is the hierarchical subnode `stem` under the
     /// numeric container `NN`, the node a resolver reaches by walking the dotted name, and
     /// `labelhash` stays the keccak of the whole label so it is a stable text identifier for events
-    /// and the reservation queue.
-    function _validateLiteLabel(string memory liteLabel)
+    /// and the reservation queue. `legacy` selects the label error, as in
+    /// @custom:function _requireDeviceLabel.
+    function _validateDeviceLabel(
+        string memory deviceLabel,
+        bool legacy
+    )
         internal
         view
         returns (bytes32 labelhash, bytes32 node)
     {
-        require(liteLabel.isLitePersonLabelMemory(), InvalidLiteLabel());
-        labelhash = LabelUtils.labelhashMemory(liteLabel);
-        node = _liteSubnode(liteLabel);
+        _requireDeviceLabel(deviceLabel.isDeviceLabelMemory(), legacy);
+        labelhash = LabelUtils.labelhashMemory(deviceLabel);
+        node = _deviceSubnode(deviceLabel);
     }
 
-    /// @notice Derives the hierarchical subnode for a lite label `<stem>.<suffix>`.
-    /// @dev Splits at the separator and walks `suffix.tld` then `stem` under it, so a lite name
+    /// @notice Derives the hierarchical subnode for a device name `<stem>.<suffix>`.
+    /// @dev Splits at the separator and walks `suffix.tld` then `stem` under it, so a device name
     /// resolves as `stem` beneath its numeric container rather than as a hash of the whole label.
-    /// Shared by @custom:function _validateLiteLabel and pending-claim settlement so every lite
+    /// Shared by @custom:function _validateDeviceLabel and pending-claim settlement so every
     /// consumer agrees on one node.
-    /// @param liteLabel Lite label held in memory, e.g. `alice.01`.
+    /// @param deviceLabel Device name held in memory, e.g. `alice.01`.
     /// @return subnode Namehash of `stem` under `suffix.tld`.
-    function _liteSubnode(string memory liteLabel) internal view returns (bytes32 subnode) {
-        subnode = SubnodeUtils.liteSubnodeOf(protocolRegistry.tldNode(), liteLabel);
+    function _deviceSubnode(string memory deviceLabel) internal view returns (bytes32 subnode) {
+        subnode = SubnodeUtils.deviceSubnodeOf(protocolRegistry.tldNode(), deviceLabel);
     }
 
-    /// @notice Validates a base (full-person) label and derives `(labelhash, node)`.
+    /// @notice Validates a personhood name and derives `(labelhash, node)`.
     /// @dev Letters only, so this is stricter than a DNS label: a hyphen or an interior digit
     /// is rejected here even though @custom:function StringUtils.isSingleLabel would admit it.
-    function _validateBaseLabel(string calldata baseLabel)
+    /// `legacy` selects the label error, as in @custom:function _requirePersonhoodLabel.
+    function _validatePersonhoodLabel(
+        string calldata label,
+        bool legacy
+    )
         internal
         view
         returns (bytes32 labelhash, bytes32 node)
     {
-        // Letters only, matching the gateway's full-person label rule: a
-        // full-person label is a name a person chose, so it admits no digits and no hyphens.
-        // Classification does not cover this on its own, since a suffixed label with nine or
-        // more characters lands on NoStatus and would otherwise pass.
-        require(baseLabel.isPersonLabel(), InvalidBaseLabel());
-        (labelhash, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), baseLabel);
-    }
-
-    /// @notice Validates a base label as reservable and returns its hashes.
-    /// @dev Shared by both reservation entrypoints so the guard cannot drift between them. Runs
-    /// three checks and reverts on the first failure, before any reservation state is mutated: the
-    /// label must classify outside the governance-reserved tier and be a base name, be a
-    /// letters-only person label, and have no owner on the registrar. The last check is the fix for
-    /// a reservation queued over an already-registered name: the queue keys by stem, so such a
-    /// reservation could never be redeemed yet would hold the stem, and so every lite name built
-    /// on it, for the full reservation window. `exists` (owner set) mirrors exactly what makes the
-    /// eventual claim's mint revert, so a label that passes here is one a claim can still register.
-    function _validateReservableBaseLabel(
+        // Letters only, matching the gateway's personhood-name rule: a personhood name is a name
+        // a person chose, so it admits no digits and no hyphens. Classification does not cover
+        // this on its own: a label carrying a digit or a hyphen is measured as written, so one of
+        // six or more characters classifies as Personhood or NoStatus and would otherwise pass.
+        _requirePersonhoodLabel(label.isPersonhoodLabel(), legacy);
+        (labelhash, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), label);
+    }
+
+    /// @notice Validates a personhood name as reservable and returns its hashes.
+    /// @dev Shared by both reservation paths so the guard cannot drift between them. Runs three
+    /// checks and reverts on the first failure, before any reservation state is mutated: the label
+    /// must be a letters-only personhood label, which makes it its own base name, classify outside
+    /// the governance-reserved tier, and have no owner on the registrar. The last check is the fix
+    /// for a reservation queued over an already-registered name: the queue keys by base name, so
+    /// such a reservation could never be redeemed yet would hold the base name, and so every device
+    /// name with that stem, for the full reservation window. `exists` (owner set) mirrors exactly
+    /// what makes the eventual claim's mint revert, so a label that passes here is one a claim can
+    /// still register.
+    function _validateReservablePersonhoodLabel(
         IPopRules rules,
-        string calldata baseLabel
+        string calldata label,
+        bool legacy
     )
         internal
         view
         returns (bytes32 labelhash, bytes32 node)
     {
-        (labelhash, node) = _validateBaseLabel(baseLabel);
+        (labelhash, node) = _validatePersonhoodLabel(label, legacy);
 
-        (IPopRules.PopStatus required,) = rules.classifyName(baseLabel);
-        require(
-            required != IPopRules.PopStatus.Reserved && rules.isBaseName(baseLabel),
-            InvalidBaseLabel()
+        (IPopRules.PopStatus required,) = rules.classifyName(label);
+        _requirePersonhoodLabel(
+            required != IPopRules.PopStatus.Reserved && rules.isBaseName(label), legacy
         );
-        require(!_registrar().exists(uint256(node)), BaseNameAlreadyRegistered());
+        require(!_registrar().exists(uint256(node)), PersonhoodNameUnavailable());
+    }
+
+    /// @notice Reverts with the device-label error the caller decodes when `ok` is false.
+    /// @dev `legacy` is set only on the @custom:contract IDotnsPopControllerLegacy entrypoints,
+    /// whose callers decode @custom:reverts InvalidLiteLabel; every other path reverts
+    /// @custom:reverts InvalidDeviceLabel.
+    function _requireDeviceLabel(bool ok, bool legacy) internal pure {
+        if (ok) return;
+        if (legacy) revert InvalidLiteLabel();
+        revert InvalidDeviceLabel();
+    }
+
+    /// @notice Reverts with the personhood-label error the caller decodes when `ok` is false.
+    /// @dev `legacy` is set only on the @custom:contract IDotnsPopControllerLegacy entrypoints,
+    /// whose callers decode @custom:reverts InvalidBaseLabel; every other path reverts
+    /// @custom:reverts InvalidPersonhoodLabel.
+    function _requirePersonhoodLabel(bool ok, bool legacy) internal pure {
+        if (ok) return;
+        if (legacy) revert InvalidBaseLabel();
+        revert InvalidPersonhoodLabel();
     }
 
     /// @notice Reverts when a non-empty chat key is not exactly `CHAT_KEY_LENGTH` bytes.
@@ -910,19 +1016,19 @@ contract DotnsPopController is
     /// write the slot). The release-then-reserve pair satisfies PopRules' ownership gate on
     /// `reserveBaseNameForPop`.
     function _syncPopRulesToHead(bytes32 labelhash, address newHead) internal {
-        string memory baseLabel = _reservedBaseLabel[labelhash];
+        string memory reservedLabel = _reservedBaseLabel[labelhash];
         IPopRules rules = _popRules();
-        rules.releaseBaseName(baseLabel);
-        rules.reserveBaseNameForPop(baseLabel, newHead);
+        rules.releaseBaseName(reservedLabel);
+        rules.reserveBaseNameForPop(reservedLabel, newHead);
         emit ReservationHeadAdvanced(labelhash, newHead);
     }
 
     /// @notice Clears the PopRules slot and the local label bookkeeping when the queue empties
     /// (claim, last-relinquish, last-expire).
     function _releasePopRulesSlot(bytes32 labelhash) internal {
-        string memory baseLabel = _reservedBaseLabel[labelhash];
-        if (bytes(baseLabel).length == 0) return;
-        _popRules().releaseBaseName(baseLabel);
+        string memory reservedLabel = _reservedBaseLabel[labelhash];
+        if (bytes(reservedLabel).length == 0) return;
+        _popRules().releaseBaseName(reservedLabel);
         delete _reservedBaseLabel[labelhash];
     }
 
diff --git a/contracts/registrars/DotnsPopLens.sol b/contracts/registrars/DotnsPopLens.sol
index c9f28fb41..506976e6a 100644
--- a/contracts/registrars/DotnsPopLens.sol
+++ b/contracts/registrars/DotnsPopLens.sol
@@ -23,7 +23,7 @@ import {DotnsConstants} from "../utils/DotnsConstants.sol";
 /// controller's pending queue, ownership from the registry, chat keys and links from the PoP
 /// resolver, and label classification from PopRules. The registry is the single ownership
 /// authority: it delegates a tokenised name to the registrar and owns a subname directly, so a
-/// lite username, which is a subname, resolves the same way as a full-person name. Living outside
+/// device name, which is a subname, resolves the same way as a personhood name. Living outside
 /// the controller keeps the controller within the contract-size limit. Deployed as a plain
 /// contract through the CREATE3 factory, so its address is deterministic and it can be redeployed
 /// on a read change without touching stored state.
@@ -47,7 +47,7 @@ contract DotnsPopLens is IDotnsPopLens {
     }
 
     /// @inheritdoc IDotnsPopLens
-    function liteNamesOf(
+    function namesOf(
         address user,
         uint256 offset,
         uint256 limit
@@ -57,31 +57,12 @@ contract DotnsPopLens is IDotnsPopLens {
         override
         returns (Name[] memory names)
     {
-        return _pageNames(user, offset, limit, true);
+        return _pageNames(user, offset, limit);
     }
 
     /// @inheritdoc IDotnsPopLens
-    function fullNamesOf(
-        address user,
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (Name[] memory names)
-    {
-        return _pageNames(user, offset, limit, false);
-    }
-
-    /// @inheritdoc IDotnsPopLens
-    function liteNameCountOf(address user) external view override returns (uint256 count) {
-        return _countNames(user, true);
-    }
-
-    /// @inheritdoc IDotnsPopLens
-    function fullNameCountOf(address user) external view override returns (uint256 count) {
-        return _countNames(user, false);
+    function nameCountOf(address user) external view override returns (uint256 count) {
+        return _countNames(user);
     }
 
     /// @inheritdoc IDotnsPopLens
@@ -90,8 +71,8 @@ contract DotnsPopLens is IDotnsPopLens {
         // label from the node alone, and classification must see the label before the detail is
         // returned.
         NameDetail memory detail = _detail(_nodeOf(name), name);
-        // Holding the label means holding its labelhash, so the lite-to-full link resolves here.
-        detail.fullClaim = _popResolver().fullClaim(LabelUtils.labelhash(name));
+        // Holding the label means holding its labelhash, so the personhood link resolves here.
+        detail.personhoodNode = _popResolver().personhoodNodeOf(LabelUtils.labelhash(name));
         return detail;
     }
 
@@ -100,10 +81,11 @@ contract DotnsPopLens is IDotnsPopLens {
         // No label is supplied: the node cannot recover a pending subname's label, so it stays
         // empty.
         NameDetail memory detail = _detail(node, "");
-        // The node cannot be inverted to a labelhash, so `fullClaim` resolves only when the label
-        // is independently recoverable (a settled name whose label the registrar returns).
+        // The node cannot be inverted to a labelhash, so `personhoodNode` resolves only when the
+        // label is independently recoverable (a settled name whose label the registrar returns).
         if (bytes(detail.label).length != 0) {
-            detail.fullClaim = _popResolver().fullClaim(LabelUtils.labelhashMemory(detail.label));
+            detail.personhoodNode =
+                _popResolver().personhoodNodeOf(LabelUtils.labelhashMemory(detail.label));
         }
         return detail;
     }
@@ -116,29 +98,27 @@ contract DotnsPopLens is IDotnsPopLens {
         profile.reservationLabelhash = controller.userReservation(user).labelhash;
     }
 
-    /// @notice Whether `label` belongs in the lite listing (`wantLite`) or the full listing.
-    /// @dev Two questions and one guard the caller already applied. Whether a name is an identity
-    /// at all is provenance, so each listing is gated on
+    /// @notice Whether `label` belongs in the listing: a name the gateway issued.
+    /// @dev Whether a name is an identity at all is provenance, so the listing is gated on
     /// @custom:function IDotnsPopController.isPopIssued: characters alone would admit a public
-    /// registration spelled `joseph42`, which reads as a full-person name and is not one. Which
-    /// kind of identity it is, lite or full, is spelling: a lite name carries its separator and a
-    /// full-person name does not, and provenance covers both. A lite name is a subname and a
-    /// full-person name is a tokenised second-level name, and the callers resolve ownership through
-    /// the registry, which covers both, so both listings reach their names. Provenance is keyed by
-    /// text, so a subname a `user` created under a name they own does not enter a listing unless
-    /// the controller issued it. The two listings together cover the names the gateway issued and
-    /// `user` holds, one kind each, rather than everything the account holds.
-    function _belongsToListing(string memory label, bool wantLite) internal view returns (bool) {
+    /// registration spelled `joseph42`, which passes the single-label shape check yet was never
+    /// issued by the gateway. The label shape then confirms it is one of the two kinds the gateway
+    /// issues, a device name with its separator or a personhood name without one. A device name is
+    /// a subname and a personhood name is a tokenised second-level name, and the callers resolve
+    /// ownership through the registry, which covers both. Provenance is keyed by text, so a
+    /// subname a `user` created under a name they own does not enter the listing unless the
+    /// controller issued it.
+    function _belongsToListing(string memory label) internal view returns (bool) {
         if (!_controller().isPopIssued(label)) return false;
-        return wantLite ? label.isLitePersonLabelMemory() : label.isSingleLabelMemory();
+        return label.isDeviceLabelMemory() || label.isSingleLabelMemory();
     }
 
-    /// @notice Counts the names currently owned by `user` that belong to the requested listing.
+    /// @notice Counts the gateway-issued names currently owned by `user`.
     /// @dev Walks the user's `LabelStore` (settled names) then their pending claims, keeping only
-    /// entries that belong to the listing and are still owned by `user` on the registrar. A pending
+    /// entries that belong to the listing and are still owned by `user` in the registry. A pending
     /// entry already written into the store by a sibling flow is skipped so it is not counted
     /// twice.
-    function _countNames(address user, bool wantLite) internal view returns (uint256 count) {
+    function _countNames(address user) internal view returns (uint256 count) {
         string memory tld = _protocolRegistry.tld();
         address store = _storeFactory().getLabelStore(user);
 
@@ -152,7 +132,7 @@ contract DotnsPopLens is IDotnsPopLens {
                 // The store keys ownership by node and provenance by text separately; bind them so
                 // a row whose key is not its own text's node is neither counted nor listed.
                 if (node != _nodeOf(label)) continue;
-                if (_belongsToListing(label, wantLite)) ++count;
+                if (_belongsToListing(label)) ++count;
             }
         }
 
@@ -160,14 +140,14 @@ contract DotnsPopLens is IDotnsPopLens {
         uint256 pending = queue.length;
         for (uint256 j; j < pending; ++j) {
             string memory label = queue[j].label;
-            if (!_belongsToListing(label, wantLite)) continue;
+            if (!_belongsToListing(label)) continue;
             bytes32 node = _nodeOf(label);
             if (store != address(0) && ILabelStore(store).isLocked(node)) continue;
             if (_ownedBy(node, user)) ++count;
         }
     }
 
-    /// @notice Returns a page of `user`'s owned names belonging to the requested listing.
+    /// @notice Returns a page of `user`'s owned gateway-issued names.
     /// @dev Same ownership-verified walk as @custom:function _countNames, in the same order
     /// (store then pending), skipping the first `offset` matches and returning up to `limit`
     /// entries. `limit` is clamped to `DotnsConstants.MAX_PAGE_SIZE` to bound the memory and the
@@ -175,8 +155,7 @@ contract DotnsPopLens is IDotnsPopLens {
     function _pageNames(
         address user,
         uint256 offset,
-        uint256 limit,
-        bool wantLite
+        uint256 limit
     )
         internal
         view
@@ -202,25 +181,22 @@ contract DotnsPopLens is IDotnsPopLens {
                 // Bind the row's node key to its own text, so a row whose key is not its text's
                 // node is neither counted nor listed.
                 if (node != _nodeOf(label)) continue;
-                if (!_belongsToListing(label, wantLite)) continue;
+                if (!_belongsToListing(label)) continue;
                 if (seen++ < offset) continue;
-                page[filled++] = Name({node: node, label: label, settled: true, deadline: 0});
+                page[filled++] = Name({node: node, label: label, settled: true});
             }
         }
 
         IDotnsPopController.PendingClaim[] memory queue = _pendingClaims(user);
         uint256 pending = queue.length;
-        uint64 duration = _controller().reservationDuration();
         for (uint256 j; j < pending && filled < limit; ++j) {
             string memory label = queue[j].label;
-            if (!_belongsToListing(label, wantLite)) continue;
+            if (!_belongsToListing(label)) continue;
             bytes32 node = _nodeOf(label);
             if (store != address(0) && ILabelStore(store).isLocked(node)) continue;
             if (!_ownedBy(node, user)) continue;
             if (seen++ < offset) continue;
-            page[filled++] = Name({
-                node: node, label: label, settled: false, deadline: queue[j].mintedAt + duration
-            });
+            page[filled++] = Name({node: node, label: label, settled: false});
         }
 
         if (filled == limit) return page;
@@ -238,13 +214,14 @@ contract DotnsPopLens is IDotnsPopLens {
         return _registry().owner(node) == user;
     }
 
-    /// @notice Gathers a name's record from the registrar, PoP resolver, and PopRules.
+    /// @notice Gathers a name's record from the registry, registrar, PoP resolver, and PopRules.
     /// @dev Reads defensively so an unminted or unsettled name yields zeroed fields instead of
-    /// reverting. `fullClaim` is left for the caller because it needs the labelhash, which is
-    /// recoverable from the label string but not from the node alone. `tier` classifies the label
-    /// shape, so `knownLabel` supplies the label for a pending subname the node cannot recover,
-    /// letting classification run before the detail is returned; it is ignored when the label is
-    /// otherwise recoverable, and an empty `knownLabel` leaves an unrecoverable label unclassified.
+    /// reverting. `personhoodNode` is left for the caller because it needs the labelhash, which is
+    /// recoverable from the label string but not from the node alone. `requiredTier` classifies the
+    /// label shape, so `knownLabel` supplies the label for an unsettled name the node cannot
+    /// recover, letting classification run before the detail is returned; it is ignored when the
+    /// label is otherwise recoverable, and an empty `knownLabel` leaves an unrecoverable label
+    /// unclassified.
     /// @param node The name's node.
     /// @param knownLabel Label the caller already holds, used only when the node cannot recover it.
     function _detail(
@@ -263,16 +240,17 @@ contract DotnsPopLens is IDotnsPopLens {
             address store = _storeFactory().getLabelStore(owner);
             bool settled = store != address(0) && ILabelStore(store).isLocked(node);
             detail.settled = settled;
-            // A tokenised name carries its label on the registrar; a subname does not, so its
-            // label is read back from the owner's store once settled. A pending subname has no
-            // recoverable label from the node alone, so it is taken from `knownLabel` when the
-            // caller supplied one.
+            // The registrar reads a tokenised name's label from the holder's store, and a subname's
+            // label is read from the owner's store directly, so either is recoverable from the node
+            // only once settled. Until then it is taken from `knownLabel` when the caller supplied
+            // one.
             if (_registrar().exists(uint256(node))) {
                 detail.label = _registrar().labelOf(uint256(node));
             } else if (settled) {
                 detail.label =
                     LabelUtils.stripTld(_protocolRegistry.tld(), ILabelStore(store).getLabel(node));
-            } else if (bytes(knownLabel).length != 0) {
+            }
+            if (bytes(detail.label).length == 0 && bytes(knownLabel).length != 0) {
                 detail.label = knownLabel;
             }
         }
@@ -282,12 +260,12 @@ contract DotnsPopLens is IDotnsPopLens {
             try _popRules().classifyName(detail.label) returns (
                 IPopRules.PopStatus tier, string memory
             ) {
-                detail.tier = tier;
+                detail.requiredTier = tier;
             } catch {}
         }
         IDotnsPopResolver resolver = _popResolver();
         detail.chatKey = resolver.chatKey(node);
-        detail.liteLink = resolver.liteLink(node);
+        detail.deviceLabelhash = resolver.deviceLabelhashOf(node);
     }
 
     /// @notice Reads a bounded page of `user`'s pending claims from the controller.
@@ -316,15 +294,15 @@ contract DotnsPopLens is IDotnsPopLens {
         return IDotnsRegistry(_protocolRegistry.get(DotnsConstants.REGISTRY));
     }
 
-    /// @notice Derives the node a name resolves to, whether tokenised or a lite subname.
-    /// @dev A lite name is `stem` beneath its numeric container, so it hashes as a subnode; any
+    /// @notice Derives the node a name resolves to, whether tokenised or a device-name subname.
+    /// @dev A device name is `stem` beneath its numeric container, so it hashes as a subnode; any
     /// other name hashes as a second-level label under the TLD.
     /// @param label Bare label without the TLD, e.g. `alice` or `alice.01`.
     /// @return node The node the name resolves to.
     function _nodeOf(string memory label) internal view returns (bytes32 node) {
         bytes32 tldNode = _protocolRegistry.tldNode();
-        if (label.isLitePersonLabelMemory()) {
-            return SubnodeUtils.liteSubnodeOf(tldNode, label);
+        if (label.isDeviceLabelMemory()) {
+            return SubnodeUtils.deviceSubnodeOf(tldNode, label);
         }
         node = LabelUtils.namehashUnder(tldNode, LabelUtils.labelhashMemory(label));
     }
diff --git a/contracts/registrars/DotnsRegistrar.sol b/contracts/registrars/DotnsRegistrar.sol
index 719a6ba3b..a1106534e 100644
--- a/contracts/registrars/DotnsRegistrar.sol
+++ b/contracts/registrars/DotnsRegistrar.sol
@@ -24,13 +24,13 @@ import {IDotnsNameEscrow} from "../escrow/IDotnsNameEscrow.sol";
 import {IPopRules} from "../pop/IPopRules.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
-/// @title Dotns Registrar
+/// @title dotNS Registrar
 /// @notice ERC721-backed registrar implementing permanent name ownership.
 /// @dev Deliberately policy-free on pricing, reservations, and PoP gating; those live in the
 /// controllers and @custom:contract IPopRules. The registrar owns transferability itself: publicly
-/// registered names transfer freely, while names minted through the PoP gateway are soulbound and
-/// revert on transfer. The `_update` hook enforces both the soulbound gate and the fee-on-transfer
-/// settlement that consults the escrow.
+/// registered names transfer freely, while names minted through the dotNS gateway pallet are
+/// soulbound and revert on transfer. The `_update` hook enforces both the soulbound gate and the
+/// fee-on-transfer settlement that consults the escrow.
 /// @custom:security-contact admin@parity.io
 contract DotnsRegistrar is
     Initializable,
@@ -50,12 +50,12 @@ contract DotnsRegistrar is
     /// @custom:oz-retyped-from mapping(IDotnsRegistrarController => bool)
     mapping(IDotnsController controller => bool exists) public controllers;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     /// @dev Used to resolve sibling contract addresses (store factory, controller, registry)
     /// without storing individual references.
     IDotnsProtocolRegistry public protocolRegistry;
 
-    /// @notice Marks a token as soulbound: minted through the PoP gateway and non-transferable.
+    /// @notice Marks a token as soulbound: minted through the gateway pallet and non-transferable.
     /// @dev Set at mint by @custom:function register when the caller is the address registered
     /// under `DotnsConstants.POP_CONTROLLER`. Write-once and never cleared: a name's soulbound
     /// state is fixed at registration. Read by the `_update` transfer gate and by
@@ -144,7 +144,7 @@ contract DotnsRegistrar is
         // `LabelStore` under `pallet-revive`, so the controller stashes a pending claim and the
         // user settles via @custom:function IDotnsPopController.claimLabelStore later). Non-empty
         // labels must still be canonical so the transfer-floor lookup in `_quoteTransferFee`
-        // cannot brick the token by reverting on a malformed stem.
+        // cannot brick the token by reverting on a malformed label.
         require(bytes(label).length == 0 || label.isSingleLabel(), InvalidLabel());
         _mint(owner, id);
         // Provenance is verified here rather than trusted from a caller-supplied flag: only the
@@ -225,7 +225,7 @@ contract DotnsRegistrar is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/registrars/DotnsRegistrarController.sol b/contracts/registrars/DotnsRegistrarController.sol
index b2e36f16a..c91d4001f 100644
--- a/contracts/registrars/DotnsRegistrarController.sol
+++ b/contracts/registrars/DotnsRegistrarController.sol
@@ -30,7 +30,7 @@ import {RegistrationUtils} from "../utils/RegistrationUtils.sol";
 import {StoreUtils} from "../utils/StoreUtils.sol";
 import {SystemUtils} from "../utils/SystemUtils.sol";
 
-/// @title Dotns Registrar Controller
+/// @title dotNS Registrar Controller
 /// @notice Allocates top-level labels using a commit reveal scheme.
 /// @dev Orchestrates allocation, PoP validation, pricing enforcement, forward registry
 /// wiring, default reverse resolution, and immutable store writing.
@@ -70,7 +70,7 @@ contract DotnsRegistrarController is
     ///      from this stamp.
     mapping(bytes32 hash => uint256 version) public committedPricingVersion;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @dev Reserved storage space to allow for layout changes in the future.
@@ -175,19 +175,19 @@ contract DotnsRegistrarController is
         uint256 tokenId = uint256(node);
         bool isReclaim = registrar.exists(tokenId);
 
-        string memory stem = rules.stripDigits(registration.label);
-        bool stemCanonical = stem.isSingleLabelMemory();
+        string memory baseName = rules.stripDigits(registration.label);
+        bool baseNameCanonical = baseName.isSingleLabelMemory();
         // Reclaim hands the name back from a prior occupant who may hold a sibling-controller's
-        // stem reservation, which is garbage once the name moves on, so clear it. Non-reclaim
+        // base-name reservation, which is garbage once the name moves on, so clear it. Non-reclaim
         // paths intentionally leave an existing reservation in place: the slot belongs to the
         // sibling controller that wrote it (e.g. the PoP queue head stamp), and clearing it from
         // here would brick that controller's release and advance paths.
-        if (stemCanonical && isReclaim) {
-            (address reservationOwner,) = rules.getBaseNameReservation(stem);
+        if (baseNameCanonical && isReclaim) {
+            (address reservationOwner,) = rules.getBaseNameReservation(baseName);
             address expectedOwner =
                 IDotnsNameEscrow(payable(escrow)).getReleasePosition(tokenId).recipient;
             if (reservationOwner != address(0) && reservationOwner == expectedOwner) {
-                rules.releaseReservationForReclaim(stem, expectedOwner);
+                rules.releaseReservationForReclaim(baseName, expectedOwner);
             }
         }
 
@@ -393,7 +393,7 @@ contract DotnsRegistrarController is
     /// Store.
     /// @dev On a fresh mint the triad of mint + forward-registry + store-write is delegated
     /// to @custom:function RegistrationUtils.registerAndStore, the single canonical implementation
-    /// shared across every DotNS registration flow. On a reclaim the mint step is skipped (the
+    /// shared across every dotNS registration flow. On a reclaim the mint step is skipped (the
     /// escrow has already moved custody) and only the registry wiring and store write run.
     /// Reverse-record setting and the priced-registration event stay here because they are
     /// commit-reveal-specific policy.
@@ -444,7 +444,7 @@ contract DotnsRegistrarController is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/registrars/IDotnsController.sol b/contracts/registrars/IDotnsController.sol
index f0417ed5b..0258ca7c4 100644
--- a/contracts/registrars/IDotnsController.sol
+++ b/contracts/registrars/IDotnsController.sol
@@ -7,7 +7,7 @@ import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 /// @title IDotnsController
 /// @notice Baseline interface implemented by every controller authorised on `DotnsRegistrar`.
 /// @dev Marker interface that types `DotnsRegistrar.controllers` so every authorised caller
-/// (public commit-reveal, PoP gateway, any future privileged flow) fits the same mapping and
+/// (public commit-reveal, gateway path, any future privileged flow) fits the same mapping and
 /// the same `addController` / `removeController` signatures without forcing a common call
 /// surface. Extending @custom:contract IERC165 lets the registrar (or any observer) runtime-check
 /// which concrete controller interface a given address implements.
diff --git a/contracts/registrars/IDotnsPopController.sol b/contracts/registrars/IDotnsPopController.sol
index be1995b7c..efdaeeb87 100644
--- a/contracts/registrars/IDotnsPopController.sol
+++ b/contracts/registrars/IDotnsPopController.sol
@@ -5,54 +5,53 @@ pragma solidity ^0.8.34;
 import {IDotnsController} from "./IDotnsController.sol";
 
 /// @title IDotnsPopController
-/// @notice Interface for the dedicated PoP controller orchestrating lite-person and full-person
-/// username issuance on behalf of the PoP gateway.
+/// @notice Interface for the dedicated PoP controller that issues device names and personhood
+/// names on behalf of the dotNS gateway pallet.
 /// @dev Deliberately disjoint from @custom:contract IDotnsRegistrarController. The two
 /// controllers coexist on @custom:contract DotnsRegistrar via its multi-controller affordance
-/// and neither imports the other. A full-person username collides through the registrar's ERC721
-/// availability check (first-to-mint wins); a lite username is not a token, so it collides through
+/// and neither imports the other. A personhood name collides through the registrar's ERC721
+/// availability check (first-to-mint wins); a device name is not a token, so it collides through
 /// @custom:function IDotnsRegistry.recordExists at its stem-under-container node
-/// (@custom:reverts LiteNameAlreadyIssued). Reservation queuing for `reservedBaseLabel`
-/// mirrors its live head into PopRules, so a queued stem also blocks the public
+/// (@custom:reverts DeviceNameAlreadyIssued). Reservation queuing for `reservedLabel`
+/// mirrors its live head into PopRules, so a queued base name also blocks the public
 /// commit-reveal flow, which reads that slot when it prices a name.
 ///
 /// Label formats:
-/// Lite-person usernames (first argument to @custom:function reserveBaseName and the
-/// `liteLabel` of a `LinkKind.LiteUsername` link) are a stem of lowercase ASCII letters, a
-/// separator, then exactly two digits (e.g. `joseph.42`) per
-/// @custom:function StringUtils.isLitePersonLabel. The stem is stricter than a DNS label
-/// because the name a person chooses is restricted to letters; a stem short enough to
-/// be governance-reserved is rejected by classification, not by the shape. The label is stored in
-/// the form the gateway sends, which is the canonical form of the name, so nothing here
-/// normalises it.
-/// Full-person usernames (the `label` of @custom:function registerBaseName and the
-/// optional `reservedBaseLabel` of @custom:function reserveBaseName) are lowercase ASCII
-/// letters only, per @custom:function StringUtils.isPersonLabel (e.g. `alice`). That is the
-/// same rule a lite stem follows and is stricter than a DNS label: no hyphens and no interior
-/// digits, because a full-person name is also a name a person chose. A separator marks a lite
-/// label and is rejected everywhere else, so only the gateway can create a dotted name; a
+/// Device names (the `label` of @custom:function issueDeviceName and the `deviceLabel` of a
+/// `LinkKind.DeviceName` link) are a stem of lowercase ASCII letters, a separator, then exactly
+/// two digits (e.g. `joseph.42`) per @custom:function StringUtils.isDeviceLabel. The stem is
+/// stricter than a DNS label because the name a person chooses is restricted to letters; a stem
+/// short enough to be governance-reserved is rejected by classification, not by the shape. The
+/// label is stored in the form the gateway sends, which is the canonical form of the name, so
+/// nothing here normalises it.
+/// Personhood names (the `label` of @custom:function issuePersonhoodName and the optional
+/// `reservedLabel` of @custom:function issueDeviceNameWithReservation) are lowercase ASCII
+/// letters only, per @custom:function StringUtils.isPersonhoodLabel (e.g. `alice`). That is the
+/// same rule a device-name stem follows and is stricter than a DNS label: no hyphens and no
+/// interior digits, because a personhood name is also a name a person chose. A separator marks a
+/// device name and is rejected everywhere else, so only the gateway can create a dotted name; a
 /// digit suffix on its own is not exclusive, since a public label may carry one directly.
-/// Cross-flow priority on the base stem is arbitrated by
+/// Cross-flow priority on the base name is arbitrated by
 /// @custom:function IPopRules.reserveBaseNameForPop.
 /// @custom:security-contact admin@parity.io
 interface IDotnsPopController is IDotnsController {
-    /// @notice Discriminant for the `Link` union supplied to `registerBaseName`.
-    /// @dev Selects the chat-key source for the full-person username. Orthogonal to whether
-    /// the registration is a claim or standalone; that is derived from on-chain reservation
-    /// state. `None` means the caller supplies a fresh chat key in `link.chatKey`.
-    /// `LiteUsername` means the full-person username is linked to a prior lite-person
-    /// username (`link.liteLabel`) and inherits its chat key.
+    /// @notice Discriminant for the `Link` union supplied to `issuePersonhoodName`.
+    /// @dev Selects the chat-key source for the personhood name. Orthogonal to whether the
+    /// issuance is a claim or standalone; that is derived from on-chain reservation state. `None`
+    /// means the caller supplies a fresh chat key in `link.chatKey`. `DeviceName` means the
+    /// personhood name is linked to a prior device name (`link.deviceLabel`) and inherits its chat
+    /// key. The member order is part of the ABI: the gateway pallet encodes `DeviceName` as `1`.
     enum LinkKind {
         None,
-        LiteUsername
+        DeviceName
     }
 
-    /// @notice Tagged union selecting the chat-key source for a full-person registration.
-    /// @param liteLabel Lite-person `stem.NN` label (only read when `kind == LiteUsername`).
+    /// @notice Tagged union selecting the chat-key source for a personhood-name issuance.
+    /// @param deviceLabel Device name `stem.NN` (only read when `kind == DeviceName`).
     /// @param chatKey Chat key bytes (only read when `kind == None`).
     struct Link {
         LinkKind kind;
-        string liteLabel;
+        string deviceLabel;
         bytes chatKey;
     }
 
@@ -83,79 +82,76 @@ interface IDotnsPopController is IDotnsController {
     /// @notice Deferred per-user binding of a freshly minted name to its `LabelStore`.
     /// @dev Recorded by the gateway path when the user has no `LabelStore`. The binding later
     /// settles via @custom:function settlePendingClaims, which deploys the store from a signed
-    /// origin and writes the stashed label. PoP-resolver records (chat key, lite link) are
+    /// origin and writes the stashed label. PoP-resolver records (chat key, device link) are
     /// persisted eagerly at mint time on @custom:contract IDotnsPopResolver, not at settlement,
     /// so the resolver carries the full identity record regardless of whether the user has
     /// settled their Store. A user accumulates one entry per deferred name: the Root gateway path
     /// cannot deploy a `LabelStore` (contract creation is forbidden from the Root origin), so it
     /// keeps stashing entries until a signed-origin @custom:function settlePendingClaims deploys
-    /// the store and settles the entries. Each entry's deadline is measured from its own
-    /// `mintedAt` against `reservationDuration`.
-    /// @param label Bare label without the TLD, which is appended at settlement time. A lite
-    /// claim carries its separator, so this is not always a single DNS label.
+    /// the store and settles the entries. Entries never lapse and can be settled at any time.
+    /// @param label Bare label without the TLD, which is appended at settlement time. A device
+    /// name carries its separator, so this is not always a single DNS label.
     /// @param mintedAt Timestamp of the originating mint.
     struct PendingClaim {
         string label;
         uint64 mintedAt;
     }
 
-    /// @notice Lite-person registration payload.
+    /// @notice Device-name issuance payload.
     /// @dev Single struct so the gateway can ABI-encode one tuple as the cross-chain payload
     /// and the contract decodes it directly out of `msg.data`. All fields are required;
     /// `chatKey` may be empty bytes to skip the resolver write.
-    /// @param liteLabel Lite-person `stem.NN` label being minted.
+    /// @param label Device name `stem.NN` being issued.
     /// @param user Beneficiary account on this chain.
     /// @param chatKey Chat-key bytes persisted on the PoP resolver. Empty leaves the slot unset.
-    struct LiteRegistration {
-        string liteLabel;
+    struct DeviceNameIssuance {
+        string label;
         address user;
         bytes chatKey;
     }
 
-    /// @notice Lite-person registration combined with an optional base-name reservation.
-    /// @dev `BaseReservation` is a @custom:struct LiteRegistration plus a base-label reservation
-    /// slot, expressed as composition rather than duplicated fields so internal helpers can
-    /// consume the lite leg via `params.lite` without unpacking. The lite leg always runs;
-    /// the reservation leg only runs when `reservedBaseLabel` is non-empty.
-    /// @param lite Lite-person registration request; see LiteRegistration.
-    /// @param reservedBaseLabel Base label to enqueue for a later full-person claim. Empty
-    /// string skips the reservation leg.
-    struct BaseReservation {
-        LiteRegistration lite;
-        string reservedBaseLabel;
+    /// @notice Device-name issuance combined with an optional personhood-name reservation.
+    /// @dev Composition of a @custom:struct DeviceNameIssuance and a reservation slot, so
+    /// internal helpers consume the issuance via `params.issuance` without unpacking. The issuance
+    /// always runs; the reservation only runs when `reservedLabel` is non-empty.
+    /// @param issuance Device-name issuance request; see DeviceNameIssuance.
+    /// @param reservedLabel Personhood name to enqueue for a later claim. Empty string skips the
+    /// reservation.
+    struct DeviceNameIssuanceWithReservation {
+        DeviceNameIssuance issuance;
+        string reservedLabel;
     }
 
-    /// @notice Base-name reservation payload for the split gateway flow.
-    /// @dev This is the reservation-only primitive. The lite username mint is handled by
-    /// @custom:function reserveLiteName, and LabelStore settlement is handled by
+    /// @notice Personhood-name reservation payload.
+    /// @dev The reservation-only primitive. Device-name issuance is handled by
+    /// @custom:function issueDeviceName, and LabelStore settlement by
     /// @custom:function settlePendingClaims.
     /// @param user Beneficiary account that will hold the reservation.
-    /// @param reservedBaseLabel Base label to enqueue for a later full-person claim.
-    struct BaseNameReservation {
+    /// @param label Personhood name to enqueue for a later claim.
+    struct PersonhoodNameReservation {
         address user;
-        string reservedBaseLabel;
+        string label;
     }
 
-    /// @notice Full-person registration payload.
-    /// @param label Base DNS label being minted.
+    /// @notice Personhood-name issuance payload.
+    /// @param label Personhood name being issued.
     /// @param user Beneficiary account on this chain.
     /// @param link Chat-key source for the new entry; see @custom:struct Link.
-    struct FullRegistration {
+    struct PersonhoodNameIssuance {
         string label;
         address user;
         Link link;
     }
 
-    /// @notice Emitted when a lite-person username is registered via the PoP gateway.
-    event LiteNameReserved(bytes32 indexed labelhash, address indexed user, string label);
+    /// @notice Emitted when the gateway pallet issues a device name.
+    event DeviceNameIssued(bytes32 indexed labelhash, address indexed user, string label);
 
-    /// @notice Emitted when a full-person username is claimed out of an existing reservation.
-    event BaseNameClaimed(bytes32 indexed labelhash, address indexed user, string label);
+    /// @notice Emitted when the gateway pallet issues a personhood name.
+    /// @dev Fires whether or not the user held a reservation for it; a claim of the live
+    /// reservation also @custom:emits ReservationClaimed.
+    event PersonhoodNameIssued(bytes32 indexed labelhash, address indexed user, string label);
 
-    /// @notice Emitted when a standalone full-person username is registered via the PoP gateway.
-    event StandaloneNameRegistered(bytes32 indexed labelhash, address indexed user, string label);
-
-    /// @notice Emitted when a reservation entry is added to the queue for a base name.
+    /// @notice Emitted when a reservation entry is added to the queue for a personhood name.
     /// @param position Position in the queue at the time of joining (0 = active holder).
     event ReservationQueued(
         bytes32 indexed reservedLabelhash, address indexed user, uint64 position
@@ -164,11 +160,19 @@ interface IDotnsPopController is IDotnsController {
     /// @notice Emitted when a reservation entry is removed due to expiry.
     event ReservationExpired(bytes32 indexed reservedLabelhash, address indexed user);
 
-    /// @notice Emitted when a user voluntarily relinquishes their reservation.
+    /// @notice Emitted when a user's own reservation entry is dropped: an explicit relinquish, a
+    /// standalone personhood-name issuance, or a re-reservation that moves the user to another
+    /// queue.
     event ReservationRelinquished(bytes32 indexed reservedLabelhash, address indexed user);
 
-    /// @notice Emitted when a full-person username is linked to a lite-person username.
-    event LiteToFullLinked(bytes32 indexed fullLabelhash, bytes32 indexed liteLabelhash);
+    /// @notice Emitted when the holder of a queue's live head claims the reserved name.
+    event ReservationClaimed(bytes32 indexed reservedLabelhash, address indexed user);
+
+    /// @notice Emitted for each waiter removed from a queue when its head is claimed.
+    event ReservationEvicted(bytes32 indexed reservedLabelhash, address indexed user);
+
+    /// @notice Emitted when a personhood name is linked to a device name.
+    event DeviceNameLinked(bytes32 indexed personhoodLabelhash, bytes32 indexed deviceLabelhash);
 
     /// @notice Emitted when the reservation duration is updated.
     event ReservationDurationSet(uint64 duration);
@@ -197,7 +201,7 @@ interface IDotnsPopController is IDotnsController {
 
     /// @notice Emitted when a reservation queue's head transitions to a new user, either via
     /// expiry of the prior head or via the explicit relinquish path.
-    /// @param labelhash Base-label hash whose queue head changed.
+    /// @param labelhash Personhood-name hash whose queue head changed.
     /// @param newHead Address now holding the head slot.
     event ReservationHeadAdvanced(bytes32 indexed labelhash, address indexed newHead);
 
@@ -206,20 +210,22 @@ interface IDotnsPopController is IDotnsController {
     ///      and reading `msg.sender` under one traps.
     error NotRoot();
 
-    /// @notice Thrown when a supplied lite-person label does not match `stem.NN`.
-    error InvalidLiteLabel();
+    /// @notice Thrown when a supplied device name does not match `stem.NN`, or its stem is
+    /// governance-reserved.
+    error InvalidDeviceLabel();
 
-    /// @notice Thrown when a supplied base label is not a canonical DNS label.
-    error InvalidBaseLabel();
+    /// @notice Thrown when a supplied personhood name is not lowercase ASCII letters only, or
+    /// classifies outside what the gateway may issue or reserve.
+    error InvalidPersonhoodLabel();
 
-    /// @notice Thrown when a reserved base label already has an owner on the registrar, so the
-    /// queued reservation could never be redeemed at mint time.
-    error BaseNameAlreadyRegistered();
+    /// @notice Thrown when a personhood name to reserve already has an owner on the registrar, so
+    /// the queued reservation could never be claimed.
+    error PersonhoodNameUnavailable();
 
-    /// @notice Thrown when a lite username is issued again while its subname already exists.
-    /// @dev A lite name is issued once; re-issuing it would rehome the identity to a new owner and
-    ///      overwrite its records, so an existing subname is rejected rather than reassigned.
-    error LiteNameAlreadyIssued();
+    /// @notice Thrown when a device name is issued again while its subname already exists.
+    /// @dev A device name is issued once; re-issuing it would rehome the identity to a new owner
+    ///      and overwrite its records, so an existing subname is rejected rather than reassigned.
+    error DeviceNameAlreadyIssued();
 
     /// @notice Thrown when a supplied chat key is non-empty and not exactly 65 bytes long.
     /// @dev Mirrors the resolver's `InvalidChatKeyLength` so the controller surfaces a
@@ -236,87 +242,84 @@ interface IDotnsPopController is IDotnsController {
     /// @notice Thrown when attempting to enqueue a user who already has an active reservation.
     error AlreadyReserved(address user, bytes32 labelhash);
 
-    /// @notice Thrown when someone tries to mint a base label in standalone mode while another user
-    /// holds the live head-of-queue reservation.
+    /// @notice Thrown when someone tries to issue a personhood name standalone while another user
+    /// holds the live head-of-queue reservation for it.
     error NotHolder(address user, bytes32 labelhash);
 
-    /// @notice Thrown when a lite-link inheritance does not match the registrar-side owner
-    /// of the lite label.
-    /// @dev Prevents identity hijack by ensuring the registrant on the full-name leg actually
-    /// holds the prior lite identity whose chat key is being inherited.
+    /// @notice Thrown when a device link names a device name the registrant does not own.
+    /// @dev Prevents identity hijack by ensuring the registrant of the personhood name actually
+    /// holds the device name whose chat key is being inherited.
     /// @param user Registrant supplied by the gateway.
-    /// @param liteLabelhash Lite label whose ownership did not match.
-    error LiteLabelNotOwnedByUser(address user, bytes32 liteLabelhash);
+    /// @param deviceLabelhash Device name whose ownership did not match.
+    error DeviceNameNotOwned(address user, bytes32 deviceLabelhash);
 
     /// @notice Thrown when @custom:function setReservationDuration is called with a value below
     /// the protocol minimum.
     /// @param duration Caller-supplied duration, in seconds.
     error ReservationDurationTooLow(uint64 duration);
 
-    /// @notice Registers a lite-person username on behalf of the supplied user
-    /// and optionally enqueues a reservation for a base name they intend to
-    /// claim as a full person later.
-    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
-    /// lite leg validates the `stem.NN` shape and requires the label to classify outside the
-    /// governance-reserved tier (otherwise @custom:reverts InvalidLiteLabel), and rejects a
+    /// @notice Issues a device name to the supplied user and optionally enqueues a reservation
+    /// for a personhood name they intend to claim later.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The issuance
+    /// validates the `stem.NN` shape and requires the label to classify outside the
+    /// governance-reserved tier (otherwise @custom:reverts InvalidDeviceLabel), and rejects a
     /// supplied chat key whose length is neither zero nor `CHAT_KEY_LENGTH`
     /// (otherwise @custom:reverts InvalidChatKey). On a warm-path mint (user already has a
-    /// `LabelStore`) it @custom:emits LiteNameReserved and @custom:emits NameRegistered;
-    /// on a cold-path mint it @custom:emits LiteNameReserved and
+    /// `LabelStore`) it @custom:emits DeviceNameIssued and @custom:emits NameRegistered;
+    /// on a cold-path mint it @custom:emits DeviceNameIssued and
     /// @custom:emits PendingClaimStashed, with @custom:emits NameRegistered deferred to
-    /// @custom:function settlePendingClaims when the claim settles. The base-name leg only runs
-    /// when `reservedBaseLabel` is non-empty: it requires a letters-only person label, which is
-    /// therefore also a true base label (otherwise @custom:reverts InvalidBaseLabel), and
-    /// with no owner on the registrar (otherwise @custom:reverts BaseNameAlreadyRegistered),
-    /// since a name that already has an owner could never be claimed. This validation runs
-    /// before both the lite mint and any queue mutation, so an already-registered
-    /// `reservedBaseLabel` aborts the whole call and the candidate receives no lite username
-    /// either; callers should validate the reserved label before attesting rather than relying
-    /// on this revert. It then advances the
-    /// head past expired entries (@custom:emits ReservationExpired for each one),
-    /// removes the user from any prior queue position so a single user holds at most one live
-    /// reservation across all labels, and enqueues a fresh entry
+    /// @custom:function settlePendingClaims when the claim settles. The reservation only runs
+    /// when `reservedLabel` is non-empty: it requires a letters-only personhood label
+    /// (otherwise @custom:reverts InvalidPersonhoodLabel) with no owner on the registrar
+    /// (otherwise @custom:reverts PersonhoodNameUnavailable), since a name that already has an
+    /// owner could never be claimed. This validation runs before both the issuance and any queue
+    /// mutation, so an already-registered `reservedLabel` aborts the whole call and the candidate
+    /// receives no device name either; callers should validate the reserved label before
+    /// attesting rather than relying on this revert. It then advances the head past expired
+    /// entries (@custom:emits ReservationExpired for each one), removes the user from any prior
+    /// queue position (@custom:emits ReservationRelinquished) so a single user holds at most one
+    /// live reservation across all labels, and enqueues a fresh entry
     /// (@custom:emits ReservationQueued). The enqueue rejects with @custom:reverts
     /// AlreadyReserved when the user already holds a reservation that was not cleared by the
     /// prior removal and with @custom:reverts QueueFull when the per-label queue has reached
-    /// `MAX_RESERVATION_QUEUE`. Cross-chain callers pass the ABI-encoded reservation tuple as
-    /// the call's payload, which Solidity decodes directly.
-    /// @param params Reservation request; see @custom:struct BaseReservation.
-    function reserveBaseName(BaseReservation calldata params) external;
-
-    /// @notice Enqueues only the full/base-name reservation for a user.
-    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot).
-    /// This is the second step of the split
-    /// gateway flow: @custom:function reserveLiteName mints the lite username first, then this
-    /// function reserves the full/base label in a separate transaction so proof-size stays below
-    /// per-call limits. Reverts with @custom:reverts InvalidBaseLabel when the label is empty,
-    /// is not lowercase ASCII letters (so a hyphen or any digit rejects it), or is
-    /// governance-reserved, and with
-    /// @custom:reverts BaseNameAlreadyRegistered when the label already has an owner on the
-    /// registrar and so could never be claimed. The caller remains agnostic about
-    /// backend batching; it simply exposes a small retryable primitive.
-    /// @param params Reservation request; see @custom:struct BaseNameReservation.
-    function reserveBaseNameOnly(BaseNameReservation calldata params) external;
-
-    /// @notice Registers a lite-person username on behalf of the supplied
-    /// user without touching the base-name reservation queue.
+    /// `MAX_RESERVATION_QUEUE`. Cross-chain callers pass the ABI-encoded tuple as the call's
+    /// payload, which Solidity decodes directly.
+    /// @param params Issuance and reservation request; see
+    /// @custom:struct DeviceNameIssuanceWithReservation.
+    function issueDeviceNameWithReservation(DeviceNameIssuanceWithReservation calldata params)
+        external;
+
+    /// @notice Enqueues only a personhood-name reservation for a user.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). This is the
+    /// second step of the split gateway flow: @custom:function issueDeviceName issues the device
+    /// name first, then this function reserves the personhood name in a separate transaction so
+    /// proof-size stays below per-call limits. Reverts with @custom:reverts InvalidPersonhoodLabel
+    /// when the label is empty, is not lowercase ASCII letters (so a hyphen or any digit rejects
+    /// it), or is governance-reserved, and with @custom:reverts PersonhoodNameUnavailable when the
+    /// label already has an owner on the registrar and so could never be claimed. Moving the user
+    /// out of a prior queue @custom:emits ReservationRelinquished. The caller remains agnostic
+    /// about backend batching; it simply exposes a small retryable primitive.
+    /// @param params Reservation request; see @custom:struct PersonhoodNameReservation.
+    function reservePersonhoodName(PersonhoodNameReservation calldata params) external;
+
+    /// @notice Issues a device name to the supplied user without touching the reservation queue.
     /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
     /// supplied label must satisfy the `stem.NN` shape and must classify outside the
-    /// governance-reserved tier (otherwise @custom:reverts InvalidLiteLabel); a supplied chat
+    /// governance-reserved tier (otherwise @custom:reverts InvalidDeviceLabel); a supplied chat
     /// key whose length is neither zero nor `CHAT_KEY_LENGTH` reverts
-    /// @custom:reverts InvalidChatKey before mint and resolver writes run. A username that has
-    /// already been issued reverts @custom:reverts LiteNameAlreadyIssued. On a warm-path mint
-    /// @custom:emits LiteNameReserved and @custom:emits NameRegistered. On a cold-path
-    /// mint @custom:emits LiteNameReserved and @custom:emits PendingClaimStashed, with
+    /// @custom:reverts InvalidChatKey before mint and resolver writes run. A device name that has
+    /// already been issued reverts @custom:reverts DeviceNameAlreadyIssued. On a warm-path mint
+    /// @custom:emits DeviceNameIssued and @custom:emits NameRegistered. On a cold-path
+    /// mint @custom:emits DeviceNameIssued and @custom:emits PendingClaimStashed, with
     /// @custom:emits NameRegistered deferred to @custom:function settlePendingClaims when the
-    /// claim settles. Cross-chain callers pass the ABI-encoded lite-registration tuple as the
-    /// call's payload, which Solidity decodes directly.
-    /// @param params Registration request; see @custom:struct LiteRegistration.
-    function reserveLiteName(LiteRegistration calldata params) external;
+    /// claim settles. Cross-chain callers pass the ABI-encoded issuance tuple as the call's
+    /// payload, which Solidity decodes directly.
+    /// @param params Issuance request; see @custom:struct DeviceNameIssuance.
+    function issueDeviceName(DeviceNameIssuance calldata params) external;
 
     /// @notice Whether this controller issued `label` as a PoP identity.
-    /// @dev Keyed by text, so it answers about a name rather than about a node. A lite label is
-    /// issued as a subname (`joseph` beneath its numeric container `42`) and a full-person label as
+    /// @dev Keyed by text, so it answers about a name rather than about a node. A device name is
+    /// issued as a subname (`joseph` beneath its numeric container `42`) and a personhood name as
     /// a second-level name, so a caller holding a node must check that the node is the one `label`
     /// resolves to under those rules before reading this answer as being about what it holds; node
     /// identity is what names the object. Set at mint and never cleared, so it is unaffected by a
@@ -326,51 +329,50 @@ interface IDotnsPopController is IDotnsController {
     /// @return issued True when this controller issued `label`.
     function isPopIssued(string calldata label) external view returns (bool issued);
 
-    /// @notice Registers a full-person username on behalf of the supplied user.
-    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
-    /// base label must be a letters-only person label, and therefore a true base label,
-    /// (otherwise @custom:reverts InvalidBaseLabel), and the label must not
-    /// classify as governance-reserved (otherwise @custom:reverts InvalidBaseLabel). The
-    /// gateway also defers to PopRules as the single cross-flow authority: when PopRules
-    /// carries a live base-name slot held by another user (this controller's prior queue head,
-    /// or a sibling controller's write), the call reverts @custom:reverts NotHolder before any
-    /// queue mutation. Two orthogonal axes drive the state machine. The reservation
-    /// axis treats the user as claiming if and only if they hold the live head-of-queue
-    /// reservation on the base label: a claim wipes the entire queue, releases the PopRules
-    /// slot, and @custom:emits BaseNameClaimed; a non-claim silently relinquishes any
-    /// pending entry the user holds and @custom:emits StandaloneNameRegistered. Advancing
-    /// the queue head past expired entries @custom:emits ReservationExpired for each
-    /// one. The chat-key axis selects whether a fresh key is persisted on the resolver or the
-    /// new entry inherits its key from a prior lite-person username. The fresh-key branch
-    /// rejects a chat key whose length is neither zero nor `CHAT_KEY_LENGTH` (otherwise
-    /// @custom:reverts InvalidChatKey). The `LiteUsername` branch validates the lite label's
-    /// `stem.NN` shape (otherwise @custom:reverts InvalidLiteLabel), requires the registrant to
-    /// own the lite token (otherwise @custom:reverts LiteLabelNotOwnedByUser), reads the lite
-    /// node's chat key from the resolver and copies it across; if the lite node carries no chat
-    /// key the inherited value is empty and the full node's chat-key write is silently skipped
-    /// (the `LiteToFullLinked` event still fires). @custom:emits LiteToFullLinked
-    /// alongside the registration event. On a warm-path mint the event order is
-    /// @custom:emits NameRegistered first (from the inner mint), then
-    /// @custom:emits BaseNameClaimed or @custom:emits StandaloneNameRegistered, then
-    /// @custom:emits LiteToFullLinked when applicable. On a cold-path mint
-    /// @custom:emits PendingClaimStashed replaces the initial @custom:emits NameRegistered;
-    /// the deferred @custom:emits NameRegistered fires later from @custom:function
-    /// settlePendingClaims. Cross-chain callers pass the ABI-encoded full-registration tuple as
-    /// the call's payload, which Solidity decodes directly.
-    /// @param params Registration request; see @custom:struct FullRegistration.
-    function registerBaseName(FullRegistration calldata params) external;
+    /// @notice Issues a personhood name to the supplied user.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The label must
+    /// be a letters-only personhood label (otherwise @custom:reverts InvalidPersonhoodLabel), and
+    /// must not classify as governance-reserved or as a device-name shape (otherwise
+    /// @custom:reverts InvalidPersonhoodLabel). The gateway also defers to PopRules as the single
+    /// cross-flow authority: when PopRules carries a live base-name slot held by another user (this
+    /// controller's prior queue head, or a sibling controller's write), the call reverts
+    /// @custom:reverts NotHolder before any queue mutation. Two orthogonal axes drive the state
+    /// machine. The reservation axis treats the user as claiming if and only if they hold the live
+    /// head-of-queue reservation on the label: a claim wipes the entire queue
+    /// (@custom:emits ReservationEvicted for every other waiter), releases the PopRules slot, and
+    /// @custom:emits ReservationClaimed; a non-claim drops any pending entry the user holds
+    /// (@custom:emits ReservationRelinquished). Either way the issuance
+    /// @custom:emits PersonhoodNameIssued. Advancing the queue head past expired entries
+    /// @custom:emits ReservationExpired for each one. The chat-key axis selects whether a fresh key
+    /// is persisted on the resolver or the new entry inherits its key from a prior device name.
+    /// The fresh-key branch rejects a chat key whose length is neither zero nor `CHAT_KEY_LENGTH`
+    /// (otherwise @custom:reverts InvalidChatKey). The `DeviceName` branch validates the device
+    /// name's `stem.NN` shape (otherwise @custom:reverts InvalidDeviceLabel), requires the
+    /// registrant to own the device name in the registry (otherwise
+    /// @custom:reverts DeviceNameNotOwned), reads its chat key from the resolver and copies it
+    /// across; if the device name carries no chat key the inherited value is empty and the
+    /// personhood name's chat-key write is silently skipped (the `DeviceNameLinked` event still
+    /// fires). @custom:emits DeviceNameLinked alongside the issuance event. On a warm-path mint
+    /// the event order is @custom:emits NameRegistered first (from the inner mint), then
+    /// @custom:emits PersonhoodNameIssued, then @custom:emits DeviceNameLinked when applicable. On
+    /// a cold-path mint @custom:emits PendingClaimStashed replaces the initial
+    /// @custom:emits NameRegistered; the deferred @custom:emits NameRegistered fires later from
+    /// @custom:function settlePendingClaims. Cross-chain callers pass the ABI-encoded issuance
+    /// tuple as the call's payload, which Solidity decodes directly.
+    /// @param params Issuance request; see @custom:struct PersonhoodNameIssuance.
+    function issuePersonhoodName(PersonhoodNameIssuance calldata params) external;
 
     /// @notice Permissionlessly removes expired entries from the head of a reservation queue.
     /// @dev Permissionless on purpose: anyone (typically a UI or a bot) can poke a stale queue
     /// so the next live head takes over without waiting for the next gateway call. Validates
-    /// `reservedBaseLabel` as a letters-only person label (otherwise
-    /// @custom:reverts InvalidBaseLabel)
-    /// and @custom:emits ReservationExpired for every expired entry reaped from the
-    /// head. A label carrying a digit or a hyphen is not a person label and
-    /// @custom:reverts InvalidBaseLabel, as does a lite label, since a separator is not one
+    /// `label` as a letters-only personhood label (otherwise @custom:reverts
+    /// InvalidPersonhoodLabel) and @custom:emits ReservationExpired for every expired entry reaped
+    /// from the head. A label carrying a digit or a hyphen is not a personhood label and
+    /// @custom:reverts InvalidPersonhoodLabel, as does a device name, since a separator is not one
     /// either. Only a letters-only label reaches the queue, and one that was never reserved
     /// resolves to an empty queue so the call is a no-op.
-    function expireReservation(string calldata reservedBaseLabel) external;
+    /// @param label Personhood name whose queue is reaped.
+    function expireReservation(string calldata label) external;
 
     /// @notice Lets the caller voluntarily drop their own active reservation.
     /// @dev Reverts with @custom:reverts NoActiveReservation when the caller holds no live
@@ -381,9 +383,10 @@ interface IDotnsPopController is IDotnsController {
     function relinquishReservation() external;
 
     /// @notice Returns whether a label currently has a live reservation at the queue head.
-    /// @dev Validates `reservedBaseLabel` as a letters-only person label (otherwise
-    /// @custom:reverts InvalidBaseLabel) before inspecting the queue.
-    function isReservedForClaim(string calldata reservedBaseLabel)
+    /// @dev Validates `label` as a letters-only personhood label (otherwise
+    /// @custom:reverts InvalidPersonhoodLabel) before inspecting the queue.
+    /// @param label Personhood name whose queue is inspected.
+    function isReservedForClaim(string calldata label)
         external
         view
         returns (bool reserved, address holder);
@@ -398,7 +401,7 @@ interface IDotnsPopController is IDotnsController {
     /// the queue is empty; active entries occupy `[head, tail)`. Exposed on the interface
     /// because invariant tests and off-chain consumers use it to enumerate
     /// live queue state without scanning storage.
-    /// @param labelhash Keccak-256 of the base label whose queue is being read.
+    /// @param labelhash Keccak-256 of the personhood name whose queue is being read.
     /// @return head Index of the live queue head.
     /// @return tail Index one past the last queued entry.
     function reservationMeta(bytes32 labelhash) external view returns (uint64 head, uint64 tail);
@@ -407,7 +410,7 @@ interface IDotnsPopController is IDotnsController {
     /// @dev Sparse storage: a zero `entryOwner` means the slot was relinquished, expired and
     /// reaped, or never written. Callers pair this with @custom:function reservationMeta to walk
     /// the live window `[head, tail)`.
-    /// @param labelhash Keccak-256 of the base label whose queue is being read.
+    /// @param labelhash Keccak-256 of the personhood name whose queue is being read.
     /// @param index Queue index to look up.
     /// @return entryOwner Owner of the slot (zero if empty/relinquished).
     /// @return joinedAt Timestamp the entry was enqueued (only meaningful when
@@ -430,18 +433,18 @@ interface IDotnsPopController is IDotnsController {
         view
         returns (UserReservation memory reservation);
 
-    /// @notice Returns the base label a reservation queue is keyed under.
+    /// @notice Returns the personhood name a reservation queue is keyed under.
     /// @dev Reverse lookup from the `bytes32` queue key to its label string, so a consumer that
     /// observed a queue by labelhash (for example from a reservation event) can recover the
     /// human-readable label without holding its preimage. Returns an empty string when no
     /// reservation was ever enqueued under `labelhash`.
-    /// @param labelhash Keccak-256 of the base label.
-    /// @return baseLabel The base label string, or empty when unknown.
-    function reservedBaseLabelOf(bytes32 labelhash) external view returns (string memory baseLabel);
+    /// @param labelhash Keccak-256 of the personhood name.
+    /// @return label The personhood name, or empty when unknown.
+    function reservedLabelOf(bytes32 labelhash) external view returns (string memory label);
 
-    /// @notice Returns the window, in seconds, after which a queue or pending-claim entry lapses.
-    /// @dev Governance-configurable via @custom:function setReservationDuration. Read by the lens
-    /// to compute each pending claim's settlement deadline.
+    /// @notice Returns the window, in seconds, after which a reservation-queue entry lapses.
+    /// @dev Governance-configurable via @custom:function setReservationDuration. Pending claims do
+    /// not lapse.
     /// @return duration Reservation duration in seconds.
     function reservationDuration() external view returns (uint64 duration);
 
@@ -483,8 +486,8 @@ interface IDotnsPopController is IDotnsController {
 
     /// @notice Returns a paginated slice of a user's pending claims in queue order.
     /// @dev An empty array means the user has no pending claims at `offset`. Each entry carries
-    /// its `mintedAt`; the settlement deadline is `mintedAt + reservationDuration`. An `offset`
-    /// past the end returns an empty array rather than reverting, and a page holds at most
+    /// its `mintedAt`, and every entry stays settleable whatever its age. An `offset` past the end
+    /// returns an empty array rather than reverting, and a page holds at most
     /// `DotnsConstants.MAX_PAGE_SIZE` entries.
     /// @param user Account whose pending claims are read.
     /// @param offset Start index into the queue.
diff --git a/contracts/registrars/IDotnsPopControllerLegacy.sol b/contracts/registrars/IDotnsPopControllerLegacy.sol
new file mode 100644
index 000000000..727ed563f
--- /dev/null
+++ b/contracts/registrars/IDotnsPopControllerLegacy.sol
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 Parity Technologies
+pragma solidity ^0.8.34;
+
+import {IDotnsPopController} from "./IDotnsPopController.sol";
+
+/// @title IDotnsPopControllerLegacy
+/// @notice Deprecated PoP controller entrypoints, kept with their original selectors for callers
+/// bound to them.
+/// @dev Each function forwards to its replacement on @custom:contract IDotnsPopController and has
+/// the same effect. They take the replacement's struct types: a selector hashes only the function
+/// name and the tuple shape, so the selectors are unchanged. Label validation reached through these
+/// entrypoints reverts with @custom:reverts InvalidLiteLabel and @custom:reverts InvalidBaseLabel,
+/// the errors their callers decode; every other error is shared with the replacements.
+/// @custom:security-contact admin@parity.io
+interface IDotnsPopControllerLegacy {
+    /// @notice Thrown on the legacy entrypoints where the replacements throw
+    /// @custom:reverts InvalidDeviceLabel.
+    error InvalidLiteLabel();
+
+    /// @notice Thrown on the legacy entrypoints where the replacements throw
+    /// @custom:reverts InvalidPersonhoodLabel.
+    error InvalidBaseLabel();
+
+    /// @notice Deprecated: use @custom:function IDotnsPopController.issueDeviceName.
+    /// @dev Selector `reserveLiteName((string,address,bytes))`.
+    /// @param params Issuance request; see @custom:struct IDotnsPopController.DeviceNameIssuance.
+    function reserveLiteName(IDotnsPopController.DeviceNameIssuance calldata params) external;
+
+    /// @notice Deprecated: use @custom:function IDotnsPopController.issueDeviceNameWithReservation.
+    /// @dev Selector `reserveBaseName(((string,address,bytes),string))`.
+    /// @param params Issuance and reservation request; see
+    /// @custom:struct IDotnsPopController.DeviceNameIssuanceWithReservation.
+    function reserveBaseName(IDotnsPopController.DeviceNameIssuanceWithReservation calldata params)
+        external;
+
+    /// @notice Deprecated: use @custom:function IDotnsPopController.issuePersonhoodName.
+    /// @dev Selector `registerBaseName((string,address,(uint8,string,bytes)))`.
+    /// @param params Issuance request; see
+    /// @custom:struct IDotnsPopController.PersonhoodNameIssuance.
+    function registerBaseName(IDotnsPopController.PersonhoodNameIssuance calldata params) external;
+}
diff --git a/contracts/registrars/IDotnsPopLens.sol b/contracts/registrars/IDotnsPopLens.sol
index d31149654..a231efbdb 100644
--- a/contracts/registrars/IDotnsPopLens.sol
+++ b/contracts/registrars/IDotnsPopLens.sol
@@ -9,65 +9,66 @@ import {IPopRules} from "../pop/IPopRules.sol";
 /// the store factory, the PoP resolver, and PopRules.
 /// @dev Holds no state of its own beyond the protocol registry it resolves siblings through, and
 /// takes no part in issuance. It exists so the query surface lives outside the controller, which
-/// keeps the controller within the contract-size limit and keeps ownership on the registrar.
+/// keeps the controller within the contract-size limit. Ownership is read from the registry, which
+/// covers device-name subnames and tokenised names alike.
 /// @custom:security-contact admin@parity.io
 interface IDotnsPopLens {
     /// @notice One row in a per-account name listing: the name and the node used to look it up.
     /// @dev Computed on read; not stored. `settled` is false while the name still sits in the
     /// temporary pending-claim queue and true once its label is written into a `LabelStore`.
-    /// `deadline` is the pending settlement deadline (`mintedAt + reservationDuration`) and is
-    /// zero for a settled name.
     /// @param node namehash of the name; the key for chat-key, link, and detail lookups.
-    /// @param label Full name string.
+    /// @param label Bare label without the TLD; a device name carries its separator.
     /// @param settled Whether the label is written into a `LabelStore`.
-    /// @param deadline Pending settlement deadline, or zero when settled.
     struct Name {
         bytes32 node;
         string label;
         bool settled;
-        uint64 deadline;
     }
 
-    /// @notice The full on-chain record for a single name, gathered from the registrar, the PoP
-    /// resolver, and PopRules in one read.
+    /// @notice The full on-chain record for a single name, gathered from the registry, the
+    /// registrar, the PoP resolver, and PopRules in one read.
     /// @dev Computed on read; not stored. Never reverts on an unminted or unsettled name: absent
-    /// fields read as zero or empty. `tier` classifies the label shape (the tier the name
-    /// requires), not the owner's personhood. `fullClaim` is keyed by the lite labelhash, which
-    /// cannot be recovered from a node alone, so it is populated by @custom:function nameDetail
-    /// and left zero by @custom:function nameDetailByNode unless the label is independently
-    /// resolvable.
+    /// fields read as zero or empty. `requiredTier` classifies the label shape (the tier the name
+    /// requires), not the owner's proof. `personhoodNode` is looked up by the device-name
+    /// labelhash, which cannot be recovered from a node alone, so it is populated by
+    /// @custom:function nameDetail and left zero by @custom:function nameDetailByNode unless the
+    /// label is independently resolvable.
     /// @param node namehash of the name.
-    /// @param label Full name string, or empty when the name is unminted or its claim is unsettled.
-    /// @param owner Current registrar owner, or the zero address when the name does not exist.
-    /// @param exists Whether the name is minted.
+    /// @param label Bare label without the TLD. Empty when the name has no owner, or when
+    /// @custom:function nameDetailByNode reads a name whose claim is unsettled.
+    /// @param owner Current owner in the registry, or the zero address when the name has none.
+    /// @param exists Whether the name has an owner in the registry.
     /// @param settled Whether the label is written into the current owner's `LabelStore`.
-    /// @param tier PopRules classification of the label.
+    /// @param requiredTier PopRules classification of the label. Classification needs the label, so
+    /// this reads `NoStatus` whenever `label` is empty: for a name with no owner, and for an
+    /// unsettled claim read through @custom:function nameDetailByNode.
     /// @param chatKey Chat-key bytes recorded on the PoP resolver for the node.
-    /// @param liteLink For a full name, the linked lite labelhash; zero otherwise.
-    /// @param fullClaim For a lite name, the promoted full node; zero otherwise or when
-    /// unresolvable from a node.
+    /// @param deviceLabelhash For a personhood name, the linked device-name labelhash; zero
+    /// otherwise.
+    /// @param personhoodNode For a device name, the linked personhood-name node; zero otherwise or
+    /// when unresolvable from a node.
     struct NameDetail {
         bytes32 node;
         string label;
         address owner;
         bool exists;
         bool settled;
-        IPopRules.PopStatus tier;
+        IPopRules.PopStatus requiredTier;
         bytes chatKey;
-        bytes32 liteLink;
-        bytes32 fullClaim;
+        bytes32 deviceLabelhash;
+        bytes32 personhoodNode;
     }
 
     /// @notice An account-level summary of PoP state, gathered in one read.
-    /// @dev Computed on read; not stored, and never reverts. Name counts are excluded because
-    /// counting scans the account's holdings; read them with @custom:function liteNameCountOf and
-    /// @custom:function fullNameCountOf when required. The account's personhood tier is read
-    /// separately via @custom:function IPopRules.personhoodOf, which consults the personhood
-    /// precompile and so does not belong in this precompile-free summary.
+    /// @dev Computed on read; not stored, and never reverts. The name count is excluded because
+    /// counting scans the account's holdings; read it with @custom:function nameCountOf when
+    /// required. The account's proof is read separately via @custom:function
+    /// IPopRules.popStatusOf, which consults the personhood precompile and so does not belong in
+    /// this precompile-free summary.
     /// @param hasLabelStore Whether the account has a deployed `LabelStore`.
     /// @param pendingClaimCount Number of claims still staged in the pending queue.
-    /// @param reservationLabelhash The base label the account holds a live reservation on, or
-    /// zero when none.
+    /// @param reservationLabelhash The personhood name the account holds a live reservation on,
+    /// or zero when none.
     struct PopProfile {
         bool hasLabelStore;
         uint256 pendingClaimCount;
@@ -78,28 +79,28 @@ interface IDotnsPopLens {
     /// @return registry The protocol registry address.
     function protocolRegistry() external view returns (address registry);
 
-    /// @notice Lists the lite-person names currently owned by `user`.
-    /// @dev Reads the user's `LabelStore` labels and pending claims, keeps the gateway-issued
-    /// ones carrying a separator, and re-checks each against `registrar.ownerOf` so a name
-    /// transferred away
-    /// drops out and a name transferred in shows under its current owner. Ordering follows the
-    /// store then the pending queue. An `offset` past the end returns an empty array rather than
-    /// reverting, and a short return means the slice ended. A gateway name transferred before it
-    /// settles has its label in no store, so it cannot appear here and is reachable only by node
-    /// via @custom:function nameDetailByNode. Gas grows with the account's holdings, so call it
+    /// @notice Lists the gateway-issued names currently owned by `user`: device names and
+    /// personhood names together.
+    /// @dev Reads the user's `LabelStore` labels and pending claims, keeps the ones the gateway
+    /// issued, and re-checks each against the registry owner so a name transferred away drops out
+    /// and a name transferred in shows under its current owner. Ordering follows the store then
+    /// the pending queue. An `offset` past the end returns an empty array rather than reverting,
+    /// and a short return means the slice ended. A gateway name transferred before it settles has
+    /// its label in no store, so it cannot appear here and is reachable only by node via
+    /// @custom:function nameDetailByNode. Gas grows with the account's holdings, so call it
     /// off-chain. A page holds at most `DotnsConstants.MAX_PAGE_SIZE` entries, and the pending
     /// portion covers up to that many staged claims.
     /// A name is listed only when @custom:function IDotnsPopController.isPopIssued confirms the
-    /// gateway minted it, so a name that merely resembles a lite label is not listed: neither a
-    /// public registration spelled `joseph42` nor a subname stored as `joseph.42`. Among issued
-    /// names the separator is what marks a lite one, since provenance covers full-person names
-    /// too. Identities minted before provenance was recorded have none to confirm, so they are
-    /// not listed and are re-issued through the gateway.
-    /// @param user Account whose lite names are listed.
+    /// gateway minted it, so a public registration is never listed, even one spelled `joseph42`,
+    /// and neither is a subname stored as `joseph.42` outside the gateway. Among issued names the
+    /// label shape tells the kinds apart: a device name carries its separator and a personhood
+    /// name doesn't. Identities minted before provenance was recorded have none to confirm, so
+    /// they are not listed and are re-issued through the gateway.
+    /// @param user Account whose names are listed.
     /// @param offset Start index into the filtered sequence.
     /// @param limit Maximum entries to return.
-    /// @return names Page of the account's lite names; see @custom:struct Name.
-    function liteNamesOf(
+    /// @return names Page of the account's gateway-issued names; see @custom:struct Name.
+    function namesOf(
         address user,
         uint256 offset,
         uint256 limit
@@ -108,60 +109,33 @@ interface IDotnsPopLens {
         view
         returns (Name[] memory names);
 
-    /// @notice Lists the full-person names currently owned by `user`.
-    /// @dev Same ownership-verified read as @custom:function liteNamesOf, and the same
-    /// provenance requirement: a name is listed only when the gateway minted it. It keeps the
-    /// labels without a separator, which is the form the gateway issues a full-person name in.
-    /// A public registration is not an identity and appears in neither listing, so the two
-    /// together cover what the gateway issued rather than everything the account holds.
-    /// @param user Account whose full names are listed.
-    /// @param offset Start index into the filtered sequence.
-    /// @param limit Maximum entries to return.
-    /// @return names Page of the account's full names; see @custom:struct Name.
-    function fullNamesOf(
-        address user,
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        returns (Name[] memory names);
-
-    /// @notice Counts the lite-person names currently owned by `user`.
-    /// @dev Uses the same ownership-verified read as @custom:function liteNamesOf; counting scans
-    /// the account's holdings, so gas grows with them. Call it off-chain.
-    /// @param user Account whose lite names are counted.
-    /// @return count Number of lite names currently owned.
-    function liteNameCountOf(address user) external view returns (uint256 count);
-
-    /// @notice Counts the full-person names currently owned by `user`.
-    /// @dev Uses the same ownership-verified read as @custom:function fullNamesOf; counting scans
-    /// the account's holdings, so gas grows with them. Call it off-chain.
-    /// @param user Account whose full names are counted.
-    /// @return count Number of full names currently owned.
-    function fullNameCountOf(address user) external view returns (uint256 count);
+    /// @notice Counts the gateway-issued names currently owned by `user`.
+    /// @dev Uses the same ownership-verified read as @custom:function namesOf; counting scans the
+    /// account's holdings, so gas grows with them. Call it off-chain.
+    /// @param user Account whose names are counted.
+    /// @return count Number of gateway-issued names currently owned.
+    function nameCountOf(address user) external view returns (uint256 count);
 
     /// @notice Returns the full on-chain record for a name given its label string.
     /// @dev Resolves the node internally, so a caller holding only the string needs no namehash
     /// implementation. Never reverts on an unknown name: absent fields read as zero or empty.
-    /// This overload can populate `fullClaim` because it holds the label and so its labelhash.
-    /// @param name Bare label without the TLD. A lite label carries its separator and resolves
-    /// here too, since the node is the hash of the whole string.
+    /// This overload can populate `personhoodNode` because it holds the label and so its labelhash.
+    /// @param name Bare label without the TLD. A device name carries its separator and resolves
+    /// here too, to its stem beneath its numeric container.
     /// @return detail The name's record; see @custom:struct NameDetail.
     function nameDetail(string calldata name) external view returns (NameDetail memory detail);
 
     /// @notice Returns the full on-chain record for a name given its node.
-    /// @dev The node cannot be inverted to its labelhash, so `fullClaim` is populated only when
-    /// the label is independently resolvable from the node and reads zero otherwise; every other
-    /// field is resolved directly. Never reverts on an unknown node.
+    /// @dev The node cannot be inverted to its labelhash, so `personhoodNode` is populated only
+    /// when the label is independently resolvable from the node and reads zero otherwise; every
+    /// other field is resolved directly. Never reverts on an unknown node.
     /// @param node namehash of the name.
     /// @return detail The name's record; see @custom:struct NameDetail.
     function nameDetailByNode(bytes32 node) external view returns (NameDetail memory detail);
 
     /// @notice Returns an account-level summary of a user's PoP state.
-    /// @dev O(1) facts only; lite and full name counts are read separately via
-    /// @custom:function liteNameCountOf and @custom:function fullNameCountOf because those scan
-    /// the account's holdings. Never reverts.
+    /// @dev O(1) facts only; the name count is read separately via @custom:function nameCountOf
+    /// because it scans the account's holdings. Never reverts.
     /// @param user Account being summarised.
     /// @return profile The account summary; see @custom:struct PopProfile.
     function profileOf(address user) external view returns (PopProfile memory profile);
diff --git a/contracts/registrars/IDotnsRegistrar.sol b/contracts/registrars/IDotnsRegistrar.sol
index 1a41645b9..97b337aa0 100644
--- a/contracts/registrars/IDotnsRegistrar.sol
+++ b/contracts/registrars/IDotnsRegistrar.sol
@@ -5,8 +5,8 @@ pragma solidity ^0.8.34;
 import {IERC721} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
 import {IDotnsController} from "./IDotnsController.sol";
 
-/// @title Dotns Registrar
-/// @notice ERC721-backed ownership for DotNS names with controller-gated registration.
+/// @title dotNS Registrar
+/// @notice ERC721-backed ownership for dotNS names with controller-gated registration.
 /// @dev Intentionally minimal and policy-free. Provides ERC721 ownership for registered name
 /// token IDs and controller-gated registration; pricing, PoP enforcement, and flow-specific
 /// policy live in the controllers.
@@ -43,7 +43,7 @@ interface IDotnsRegistrar is IERC721 {
     error InvalidLabel();
 
     /// @notice Thrown when a transfer or a transfer-fee quote targets a soulbound name.
-    /// @dev Soulbound names are minted through the PoP gateway and are permanently
+    /// @dev Soulbound names are minted through the dotNS gateway pallet and are permanently
     /// non-transferable. Raised by the `_update` transfer gate and by
     /// @custom:function quoteTransferFee.
     error NameSoulbound(uint256 tokenId);
@@ -109,7 +109,7 @@ interface IDotnsRegistrar is IERC721 {
     /// cleared. A `true` result means every transfer overload reverts with
     /// @custom:reverts NameSoulbound and @custom:function quoteTransferFee reverts likewise.
     /// @param tokenId The name's token id.
-    /// @return soulbound True when the name was minted through the PoP gateway.
+    /// @return soulbound True when the name was minted through the gateway pallet.
     function isSoulbound(uint256 tokenId) external view returns (bool soulbound);
 
     /// @notice Returns whether a given token id has been minted.
@@ -117,7 +117,7 @@ interface IDotnsRegistrar is IERC721 {
 
     /// @notice Adds an authorised controller.
     /// @dev Typed against the baseline `IDotnsController` (not a concrete subtype) so a single
-    /// authorisation surface accepts every controller flavour (commit-reveal, PoP gateway,
+    /// authorisation surface accepts every controller flavour (commit-reveal, gateway path,
     /// future variants) without per-flavour setters. Owner-gated (otherwise
     /// @custom:reverts OwnableUnauthorizedAccount); emits @custom:emits ControllerAdded on
     /// success.
diff --git a/contracts/registrars/IDotnsRegistrarController.sol b/contracts/registrars/IDotnsRegistrarController.sol
index 6475ce13a..254d4913f 100644
--- a/contracts/registrars/IDotnsRegistrarController.sol
+++ b/contracts/registrars/IDotnsRegistrarController.sol
@@ -5,7 +5,7 @@ pragma solidity ^0.8.34;
 import {IDotnsController} from "./IDotnsController.sol";
 import {IPopRules} from "../pop/IPopRules.sol";
 
-/// @title Dotns Registrar Controller
+/// @title dotNS Registrar Controller
 /// @notice Interface for registering top-level labels using a commit reveal scheme.
 /// @dev Defines allocation only; forward resolution, reverse lookup, pricing mechanics, PoP
 /// validation, and store writing are handled by external contracts. Users commit a hash of
@@ -151,14 +151,14 @@ interface IDotnsRegistrarController is IDotnsController {
     /// @custom:reverts CommitmentTooOld past `maxCommitmentAge`, and finally resolves the
     /// configured escrow address from the protocol registry (otherwise
     /// @custom:reverts EscrowNotConfigured). Splits on direct vs cross-payer at
-    /// `msg.sender == registration.owner`. The direct path runs `priceWithCheck` (personhood
+    /// `msg.sender == registration.owner`. The direct path runs `priceWithCheck` (PoP-status
     /// + reservation gate) and routes the charge to a refundable escrow deposit owned by
-    /// `registration.owner`. The cross-payer path skips the personhood revert in
+    /// `registration.owner`. The cross-payer path skips the PoP-status revert in
     /// `priceWithCheck` but applies it directly via @custom:reverts OwnerStatusInsufficient
     /// when the owner's recorded tier does not meet the label's required tier, and still
     /// rejects governance-reserved labels with @custom:reverts GovernanceReserved and live
-    /// cross-user stem reservations with @custom:reverts NameReserved. The cross-payer charge is
-    /// the owner-side registration price; the path applies no separate transfer friction. The
+    /// cross-user base-name reservations with @custom:reverts NameReserved. The cross-payer charge
+    /// is the owner-side registration price; the path applies no separate transfer friction. The
     /// charge routes to the escrow protocol fee pot while seeding a zero-amount deposit slot so
     /// the release lifecycle stays reachable. The reveal prices the name at the committed
     /// `pricingVersion`, so a model change between commit and reveal leaves the amount unchanged,
diff --git a/contracts/registry/DotnsProtocolRegistry.sol b/contracts/registry/DotnsProtocolRegistry.sol
index 3dc33d004..248754e36 100644
--- a/contracts/registry/DotnsProtocolRegistry.sol
+++ b/contracts/registry/DotnsProtocolRegistry.sol
@@ -12,9 +12,9 @@ import {IDotnsProtocolRegistry} from "./IDotnsProtocolRegistry.sol";
 import {LabelUtils} from "../utils/LabelUtils.sol";
 import {StringUtils} from "../utils/StringUtils.sol";
 
-/// @title Dotns Protocol Registry
+/// @title dotNS Protocol Registry
 /// @author Parity
-/// @notice Upgradeable address registry for all DotNS protocol contracts, and the authority for
+/// @notice Upgradeable address registry for all dotNS protocol contracts, and the authority for
 ///         the network's top-level domain.
 /// @dev Single source of truth for sibling-contract lookups. All siblings resolve each other via
 ///      well-known `bytes32` constants in `DotnsConstants` rather than holding direct addresses,
@@ -144,7 +144,7 @@ contract DotnsProtocolRegistry is
     }
 
     /// @notice Returns the declared release, mirroring `protocolVersion` under the historical
-    ///         `version()` selector every DotNS contract exposes.
+    ///         `version()` selector every dotNS contract exposes.
     /// @dev Sibling contracts mirror the same stored value by reading it from here, so
     ///      `version()` answers identically network-wide; this contract is where the value
     ///      lives, so it reads its own storage.
diff --git a/contracts/registry/DotnsRegistry.sol b/contracts/registry/DotnsRegistry.sol
index ab4f06bf0..092b9fdb6 100644
--- a/contracts/registry/DotnsRegistry.sol
+++ b/contracts/registry/DotnsRegistry.sol
@@ -17,7 +17,7 @@ import {IDotnsProtocolRegistry} from "./IDotnsProtocolRegistry.sol";
 import {StringUtils} from "../utils/StringUtils.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
-/// @title Dotns Registry
+/// @title dotNS Registry
 /// @author Parity
 /// @notice Upgradeable on-chain registry for hierarchical name ownership and resolution.
 /// @dev Tokenised second-level nodes store `owner == address(0)` as a sentinel and defer to
@@ -30,7 +30,7 @@ contract DotnsRegistry is Initializable, UUPSUpgradeable, OwnableUpgradeable, ID
     /// @notice Mapping of node identifiers to records.
     mapping(bytes32 node => Record record) private records;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     uint256[50] private __gap;
@@ -316,7 +316,7 @@ contract DotnsRegistry is Initializable, UUPSUpgradeable, OwnableUpgradeable, ID
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/registry/IDotnsProtocolRegistry.sol b/contracts/registry/IDotnsProtocolRegistry.sol
index 8e71c50a5..60c3f6641 100644
--- a/contracts/registry/IDotnsProtocolRegistry.sol
+++ b/contracts/registry/IDotnsProtocolRegistry.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 
 /// @title IDotnsProtocolRegistry
 /// @author Parity
-/// @notice Interface for the DotNS protocol-level address registry.
+/// @notice Interface for the dotNS protocol-level address registry.
 /// @dev Single source of truth for sibling lookups. Contracts resolve each other via well-known
 ///      `bytes32` constants in `DotnsConstants` so an upgrade or rewire only mutates the
 ///      registry, never the consumers. The registry also holds the network's top-level domain,
diff --git a/contracts/registry/IDotnsRegistry.sol b/contracts/registry/IDotnsRegistry.sol
index 7265b9e63..27029b735 100644
--- a/contracts/registry/IDotnsRegistry.sol
+++ b/contracts/registry/IDotnsRegistry.sol
@@ -132,7 +132,7 @@ interface IDotnsRegistry {
     ///      success.
     function setSubnodeResolver(SubnodeResolverRecord calldata record) external;
 
-    /// @notice Creates or resets a node record for a tokenised base registration.
+    /// @notice Creates or resets a node record for a tokenised second-level registration.
     /// @dev Restricted to the registrar's controllers, otherwise @custom:reverts NotAuthorised.
     ///      `newOwner` must be non-zero (otherwise @custom:reverts NotAllowed) and must match
     ///      the ERC-721 owner reported by the registrar (otherwise
diff --git a/contracts/resolvers/DotnsContentResolver.sol b/contracts/resolvers/DotnsContentResolver.sol
index fe074ee50..00894f81a 100644
--- a/contracts/resolvers/DotnsContentResolver.sol
+++ b/contracts/resolvers/DotnsContentResolver.sol
@@ -16,7 +16,7 @@ import {IDotnsContentResolver} from "./IDotnsContentResolver.sol";
 import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
-/// @title Dotns Content Resolver
+/// @title dotNS Content Resolver
 /// @notice Implements `IDotnsContentResolver` interface with content hash, text records, and
 /// operator approvals.
 /// @dev Writes are gated on the registry's authorisation for the node (owner or registrar-level
@@ -41,7 +41,7 @@ contract DotnsContentResolver is
     /// @notice Store all approval mapping
     mapping(address owner => mapping(address operator => bool approved)) private operators;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @dev Reserved storage space to allow for layout changes in the future.
@@ -143,7 +143,7 @@ contract DotnsContentResolver is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/resolvers/DotnsPopResolver.sol b/contracts/resolvers/DotnsPopResolver.sol
index 6daae5e55..00bd03a65 100644
--- a/contracts/resolvers/DotnsPopResolver.sol
+++ b/contracts/resolvers/DotnsPopResolver.sol
@@ -35,17 +35,19 @@ contract DotnsPopResolver is
     /// @notice Stored chat-key bytes keyed by node.
     mapping(bytes32 node => bytes chatKey) private _chatKeys;
 
-    /// @notice Stored lite-person labelhash keyed by full-person node.
-    /// @dev Forward direction (full => lite): maps a full-person node to the
-    ///      labelhash of the lite username it was claimed from.
-    mapping(bytes32 fullNode => bytes32 liteLabelhash) private _liteLinks;
-
-    /// @notice Reverse index mapping a lite labelhash to the full-person node
-    ///         it was promoted to.
-    /// @dev Written alongside `_liteLinks` on every claim so consumers that look
-    ///      up by lite username resolve the full name without scanning events.
-    ///      Zero when the lite label has never been linked to a full claim.
-    mapping(bytes32 liteLabelhash => bytes32 fullNode) private _fullClaims;
+    /// @notice Stored device-name labelhash keyed by personhood-name node.
+    /// @dev Forward direction: maps a personhood-name node to the labelhash of the device name it
+    ///      is linked to.
+    /// @custom:oz-renamed-from _liteLinks
+    mapping(bytes32 personhoodNode => bytes32 deviceLabelhash) private _deviceLinks;
+
+    /// @notice Reverse index mapping a device-name labelhash to the personhood-name node it is
+    ///         linked to.
+    /// @dev Written alongside `_deviceLinks` on every link so consumers that look up by device
+    ///      name resolve the personhood name without scanning events. Zero when the device name
+    ///      has never been linked.
+    /// @custom:oz-renamed-from _fullClaims
+    mapping(bytes32 deviceLabelhash => bytes32 personhoodNode) private _personhoodNodes;
 
     /// @dev Reserved storage space to allow for layout changes in the future.
     uint256[50] private __gap;
@@ -97,25 +99,25 @@ contract DotnsPopResolver is
     }
 
     /// @inheritdoc IDotnsPopResolver
-    function setLiteLink(
-        bytes32 fullNode,
-        bytes32 liteLabelhash
+    function setDeviceLink(
+        bytes32 personhoodNode,
+        bytes32 deviceLabelhash
     )
         external
         override
         onlyPopController
     {
-        bytes32 oldLite = _liteLinks[fullNode];
-        bytes32 oldFull = _fullClaims[liteLabelhash];
-        if (oldLite != bytes32(0) && oldLite != liteLabelhash) {
-            delete _fullClaims[oldLite];
+        bytes32 oldDevice = _deviceLinks[personhoodNode];
+        bytes32 oldPersonhood = _personhoodNodes[deviceLabelhash];
+        if (oldDevice != bytes32(0) && oldDevice != deviceLabelhash) {
+            delete _personhoodNodes[oldDevice];
         }
-        if (oldFull != bytes32(0) && oldFull != fullNode) {
-            delete _liteLinks[oldFull];
+        if (oldPersonhood != bytes32(0) && oldPersonhood != personhoodNode) {
+            delete _deviceLinks[oldPersonhood];
         }
-        _liteLinks[fullNode] = liteLabelhash;
-        _fullClaims[liteLabelhash] = fullNode;
-        emit LiteLinkUpdated(fullNode, liteLabelhash);
+        _deviceLinks[personhoodNode] = deviceLabelhash;
+        _personhoodNodes[deviceLabelhash] = personhoodNode;
+        emit DeviceLinkUpdated(personhoodNode, deviceLabelhash);
     }
 
     /// @inheritdoc IDotnsPopResolver
@@ -124,17 +126,17 @@ contract DotnsPopResolver is
     }
 
     /// @inheritdoc IDotnsPopResolver
-    function liteLink(bytes32 fullNode) external view override returns (bytes32) {
-        return _liteLinks[fullNode];
+    function deviceLabelhashOf(bytes32 personhoodNode) external view override returns (bytes32) {
+        return _deviceLinks[personhoodNode];
     }
 
     /// @inheritdoc IDotnsPopResolver
-    function fullClaim(bytes32 liteLabelhash) external view override returns (bytes32) {
-        return _fullClaims[liteLabelhash];
+    function personhoodNodeOf(bytes32 deviceLabelhash) external view override returns (bytes32) {
+        return _personhoodNodes[deviceLabelhash];
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/resolvers/DotnsResolver.sol b/contracts/resolvers/DotnsResolver.sol
index 7f09a232b..b6dfb6839 100644
--- a/contracts/resolvers/DotnsResolver.sol
+++ b/contracts/resolvers/DotnsResolver.sol
@@ -16,8 +16,8 @@ import {IDotnsRegistry} from "../registry/IDotnsRegistry.sol";
 import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
-/// @title Dotns Resolver
-/// @notice Stores forward-resolution address records for DotNS nodes
+/// @title dotNS Resolver
+/// @notice Stores forward-resolution address records for dotNS nodes
 /// @dev Writes are gated on node ownership in the forward registry, not on a
 ///      privileged writer address. Address records describe where a name points
 ///      and only the current node owner has the authority to set that target.
@@ -29,7 +29,7 @@ contract DotnsResolver is
     ERC165Upgradeable,
     IDotnsResolver
 {
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @dev Reserved storage space to allow for layout changes in the future.
@@ -97,7 +97,7 @@ contract DotnsResolver is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/resolvers/DotnsReverseResolver.sol b/contracts/resolvers/DotnsReverseResolver.sol
index bf8bbb553..b197edd83 100644
--- a/contracts/resolvers/DotnsReverseResolver.sol
+++ b/contracts/resolvers/DotnsReverseResolver.sol
@@ -18,7 +18,7 @@ import {LabelUtils} from "../utils/LabelUtils.sol";
 import {SubnodeUtils} from "../utils/SubnodeUtils.sol";
 import {StringUtils} from "../utils/StringUtils.sol";
 
-/// @title Dotns Reverse Resolver
+/// @title dotNS Reverse Resolver
 /// @notice Resolves an address to its associated name under the network TLD.
 /// @dev Writes are gated on a fixed writer address resolved from the protocol
 ///      registry (the registrar or its controller), not on node ownership.
@@ -36,7 +36,7 @@ contract DotnsReverseResolver is
     ///      that no reverse name is set.
     mapping(address owner => string name) private reverseNames;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @dev Reserved storage space to allow for layout changes in the future.
@@ -103,8 +103,8 @@ contract DotnsReverseResolver is
         return stored;
     }
 
-    /// @notice Resolves the node a name maps to, whether tokenised or a lite subname.
-    /// @dev A lite name is `stem` beneath its numeric container, so it hashes as a subnode; any
+    /// @notice Resolves the node a name maps to, whether tokenised or a device-name subname.
+    /// @dev A device name is `stem` beneath its numeric container, so it hashes as a subnode; any
     ///      other name hashes as a second-level label under the TLD. Ownership of either is read
     ///      through the registry, which delegates a tokenised name to the registrar and holds a
     ///      subname directly.
@@ -112,8 +112,8 @@ contract DotnsReverseResolver is
     /// @return node The node the name resolves to.
     function _nodeOf(string memory label) internal view returns (bytes32 node) {
         bytes32 tldNode = protocolRegistry.tldNode();
-        if (StringUtils.isLitePersonLabelMemory(label)) {
-            return SubnodeUtils.liteSubnodeOf(tldNode, label);
+        if (StringUtils.isDeviceLabelMemory(label)) {
+            return SubnodeUtils.deviceSubnodeOf(tldNode, label);
         }
         node = LabelUtils.namehashUnder(tldNode, LabelUtils.labelhashMemory(label));
     }
@@ -144,7 +144,7 @@ contract DotnsReverseResolver is
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/resolvers/IDotnsContentResolver.sol b/contracts/resolvers/IDotnsContentResolver.sol
index 4022a792d..54c9cc5ce 100644
--- a/contracts/resolvers/IDotnsContentResolver.sol
+++ b/contracts/resolvers/IDotnsContentResolver.sol
@@ -2,9 +2,9 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title Dotns Content Resolver
+/// @title dotNS Content Resolver
 /// @notice Defines storage and retrieval for content hash, text records, and operator approvals for
-/// DotNS nodes. @dev Content hash and text records point to off-chain content such as IPFS CIDs or
+/// dotNS nodes. @dev Content hash and text records point to off-chain content such as IPFS CIDs or
 ///      future schemes; interpretation is handled off-chain. Operator approvals allow
 ///      third parties to manage records on behalf of the owner.
 /// @custom:security-contact admin@parity.io
@@ -32,7 +32,7 @@ interface IDotnsContentResolver {
     error NotAuthorised(bytes32 node, address caller);
 
     /// @notice Sets the content hash for a node.
-    /// @dev The caller must own the node in the DotNS registry or be an approved operator,
+    /// @dev The caller must own the node in the dotNS registry or be an approved operator,
     ///      otherwise @custom:reverts NotAuthorised. Content hashes are opaque bytes (e.g. an
     ///      IPFS CID); the resolver stores them as-is and never interprets the payload. Emits
     ///      @custom:emits ContentHashUpdated on every successful write.
@@ -46,7 +46,7 @@ interface IDotnsContentResolver {
     function contenthash(bytes32 node) external view returns (bytes memory hash);
 
     /// @notice Sets a text record for a node.
-    /// @dev The caller must own the node in the DotNS registry or be an approved operator,
+    /// @dev The caller must own the node in the dotNS registry or be an approved operator,
     ///      otherwise @custom:reverts NotAuthorised. Text records are arbitrary key/value strings
     ///      (e.g. `avatar`, `url`, `description`). Emits @custom:emits TextUpdated on every
     ///      successful write.
diff --git a/contracts/resolvers/IDotnsPopResolver.sol b/contracts/resolvers/IDotnsPopResolver.sol
index 52c37ec9b..5843223c2 100644
--- a/contracts/resolvers/IDotnsPopResolver.sol
+++ b/contracts/resolvers/IDotnsPopResolver.sol
@@ -3,14 +3,14 @@
 pragma solidity ^0.8.34;
 
 /// @title IDotnsPopResolver
-/// @notice Resolver for per-name records produced by the PoP username flow.
+/// @notice Resolver for per-name records produced by the dotNS gateway pallet.
 /// @dev Holds three record kinds:
 ///      - Chat key: ECDH public-key bytes used for end-to-end encrypted messaging.
-///      - Lite link: for a full-person node, the labelhash of the lite-person
-///        username it was minted from (when the link was made).
-///      - Full claim: reverse index mapping a lite labelhash to the full-person
-///        node it was promoted to. Mirrors `liteLink` on every write so a
-///        caller that holds a lite labelhash can resolve the full-person node
+///      - Device link (`deviceLabelhashOf`): for a personhood-name node, the labelhash of the
+///        device name it was linked to when it was issued.
+///      - Personhood link (`personhoodNodeOf`): reverse index mapping a device-name labelhash to
+///        the personhood-name node it is linked to. Mirrors `deviceLabelhashOf` on every write so a
+///        caller that holds a device-name labelhash can resolve the personhood name
 ///        without scanning events.
 ///
 ///      Lives separately from the per-user `LabelStore` so that the store can remain
@@ -29,10 +29,10 @@ interface IDotnsPopResolver {
     /// @param chatKey The new chat key bytes.
     event ChatKeyUpdated(bytes32 indexed node, bytes chatKey);
 
-    /// @notice Emitted when a full-person node's lite link is set or updated.
-    /// @param fullNode The full-person node carrying the link.
-    /// @param liteLabelhash The labelhash of the linked lite-person username.
-    event LiteLinkUpdated(bytes32 indexed fullNode, bytes32 indexed liteLabelhash);
+    /// @notice Emitted when a personhood name's device link is set or updated.
+    /// @param personhoodNode The personhood-name node carrying the link.
+    /// @param deviceLabelhash The labelhash of the linked device name.
+    event DeviceLinkUpdated(bytes32 indexed personhoodNode, bytes32 indexed deviceLabelhash);
 
     /// @notice Thrown when the caller is not the authorised PoP controller.
     /// @param caller The address that attempted the write.
@@ -53,35 +53,40 @@ interface IDotnsPopResolver {
     /// @param chatKey ECDH public key bytes (pallet-side type is `[u8; 65]`).
     function setChatKey(bytes32 node, bytes calldata chatKey) external;
 
-    /// @notice Sets the lite-person link for a full-person `node`.
+    /// @notice Sets the device link for a personhood-name node.
     /// @dev Callable only by the authorised PoP controller, otherwise
     ///      @custom:reverts NotPopController. Overwrites any previous link. When overwriting, the
-    ///      stale inverse entry is nulled so both the forward (`liteLink`) and reverse
-    ///      (`fullClaim`) indices remain consistent: re-linking the same `fullNode` to a new
-    ///      `liteLabelhash` clears `fullClaim(oldLite)`, and re-linking the same `liteLabelhash`
-    ///      to a new `fullNode` clears `liteLink(oldFull)`. The invariant
-    ///      `fullClaim(liteLink(node)) == node` always holds after the call. Emits
-    ///      @custom:emits LiteLinkUpdated on every successful write.
-    /// @param fullNode The full-person node carrying the link.
-    /// @param liteLabelhash The labelhash of the linked lite-person username.
-    function setLiteLink(bytes32 fullNode, bytes32 liteLabelhash) external;
+    ///      stale inverse entry is nulled so both the forward (`deviceLabelhashOf`) and reverse
+    ///      (`personhoodNodeOf`) indices remain consistent: re-linking the same `personhoodNode` to
+    ///      a new `deviceLabelhash` clears `personhoodNodeOf(oldDevice)`, and re-linking the same
+    ///      `deviceLabelhash` to a new `personhoodNode` clears `deviceLabelhashOf(oldPersonhood)`.
+    ///      The invariant `personhoodNodeOf(deviceLabelhashOf(node)) == node` always holds after
+    ///      the call. Emits @custom:emits DeviceLinkUpdated on every successful write.
+    /// @param personhoodNode The personhood-name node carrying the link.
+    /// @param deviceLabelhash The labelhash of the linked device name.
+    function setDeviceLink(bytes32 personhoodNode, bytes32 deviceLabelhash) external;
 
     /// @notice Returns the chat key associated with a node.
     /// @param node The node to query.
     /// @return chatKey The stored chat key bytes, or empty if unset.
     function chatKey(bytes32 node) external view returns (bytes memory chatKey);
 
-    /// @notice Returns the lite-person labelhash linked to a full-person node.
-    /// @param fullNode The full-person node to query.
-    /// @return liteLabelhash The linked lite-person labelhash, or zero if unset.
-    function liteLink(bytes32 fullNode) external view returns (bytes32 liteLabelhash);
+    /// @notice Returns the device-name labelhash linked to a personhood-name node.
+    /// @param personhoodNode The personhood-name node to query.
+    /// @return deviceLabelhash The linked device-name labelhash, or zero if unset.
+    function deviceLabelhashOf(bytes32 personhoodNode)
+        external
+        view
+        returns (bytes32 deviceLabelhash);
 
-    /// @notice Returns the full-person node a given lite label has claimed.
-    /// @dev Reverse of @custom:function liteLink. Written by the same `setLiteLink` call so the
-    ///      two directions stay in lockstep. Returns zero when the lite label
-    ///      has never been linked to a full claim.
-    /// @param liteLabelhash The labelhash of the lite-person username to query.
-    /// @return fullNode The full-person node claimed from this lite label, or
-    ///         zero if unset.
-    function fullClaim(bytes32 liteLabelhash) external view returns (bytes32 fullNode);
+    /// @notice Returns the personhood-name node a device name is linked to.
+    /// @dev Reverse of @custom:function deviceLabelhashOf. Written by the same `setDeviceLink` call
+    ///      so the two directions stay in lockstep. Returns zero when the device name has never
+    ///      been linked to a personhood name.
+    /// @param deviceLabelhash The labelhash of the device name to query.
+    /// @return personhoodNode The linked personhood-name node, or zero if unset.
+    function personhoodNodeOf(bytes32 deviceLabelhash)
+        external
+        view
+        returns (bytes32 personhoodNode);
 }
diff --git a/contracts/resolvers/IDotnsResolver.sol b/contracts/resolvers/IDotnsResolver.sol
index 90a29a556..ccde119c9 100644
--- a/contracts/resolvers/IDotnsResolver.sol
+++ b/contracts/resolvers/IDotnsResolver.sol
@@ -2,8 +2,8 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title Dotns Resolver
-/// @notice Defines forward-resolution address records for DotNS nodes.
+/// @title dotNS Resolver
+/// @notice Defines forward-resolution address records for dotNS nodes.
 /// @dev Forward-address records describe where a name points. Authority therefore
 ///      follows node ownership in the forward registry, not a privileged writer.
 /// @custom:security-contact admin@parity.io
diff --git a/contracts/resolvers/IDotnsReverseResolver.sol b/contracts/resolvers/IDotnsReverseResolver.sol
index b52362d65..99bded638 100644
--- a/contracts/resolvers/IDotnsReverseResolver.sol
+++ b/contracts/resolvers/IDotnsReverseResolver.sol
@@ -2,7 +2,7 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title Dotns Reverse Resolver
+/// @title dotNS Reverse Resolver
 /// @notice Interface for writing and reading reverse name records for addresses.
 /// @dev Reverse records bind to an EOA rather than a registry node. Two write paths exist:
 ///      a registrar-only setter used by the controller during reserved registration, and a
@@ -18,7 +18,7 @@ interface IDotnsReverseResolver {
     /// @notice Thrown when a caller attempts to claim a reverse record for a name they do not own.
     /// @param caller The address attempting the claim.
     /// @param node The claimed name's node: a token id for a tokenised name, and the
-    ///        stem-under-container subnode for a lite name.
+    ///        stem-under-container subnode for a device name.
     error NotNameOwner(address caller, uint256 node);
 
     /// @notice Emitted when a name is associated with an address.
@@ -36,7 +36,7 @@ interface IDotnsReverseResolver {
 
     /// @notice Self-service claim: associates `msg.sender` with `<label>` under the network TLD.
     /// @dev The caller must currently own `label`, read through the registry, which delegates a
-    ///      tokenised name to the registrar and holds a lite subname directly, otherwise
+    ///      tokenised name to the registrar and holds a device-name subname directly, otherwise
     ///      @custom:reverts NotNameOwner. Overwrites any existing record for the caller
     ///      and emits @custom:emits ReverseNameSet on every successful write. Transferring the
     ///      name away does not eagerly clear the record; @custom:function nameOf fails closed at
diff --git a/contracts/store/IDotnsStore.sol b/contracts/store/IDotnsStore.sol
index 93f26debe..daba3dc2c 100644
--- a/contracts/store/IDotnsStore.sol
+++ b/contracts/store/IDotnsStore.sol
@@ -3,9 +3,9 @@
 pragma solidity ^0.8.34;
 
 /// @title IDotnsStore
-/// @notice Baseline interface implemented by every per-user DotNS store.
+/// @notice Baseline interface implemented by every per-user dotNS store.
 /// @dev Marker interface shared by `ILabelStore` (protocol-written, labels-only) and
-///      `IUserStore` (user-written, generic key/value). Every DotNS store type binds
+///      `IUserStore` (user-written, generic key/value). Every dotNS store type binds
 ///      to exactly one user forever, so `owner()` is the single shared surface.
 ///      Identity of a store is proven by its position in the `StoreFactory` mapping,
 ///      not by interface probing; the factory is the canonical source of truth.
diff --git a/contracts/store/ILabelStore.sol b/contracts/store/ILabelStore.sol
index 2c1e2efeb..79ecc5e7f 100644
--- a/contracts/store/ILabelStore.sol
+++ b/contracts/store/ILabelStore.sol
@@ -5,12 +5,12 @@ pragma solidity ^0.8.34;
 import {IDotnsStore} from "./IDotnsStore.sol";
 
 /// @title ILabelStore
-/// @notice Interface for the per-user DotNS label store.
+/// @notice Interface for the per-user dotNS label store.
 /// @dev The `LabelStore` is the protocol-managed half of the per-user storage pair:
 ///      write-only by the registrar, an authorised controller or the registry, read-only by
 ///      everyone else, and permanently locked per `labelhash` on first write. It
 ///      holds registration records only; every other per-name category (reverse,
-///      content, forward address, chat key, lite link) lives on a dedicated
+///      content, forward address, chat key, device link) lives on a dedicated
 ///      resolver, not here.
 /// @custom:security-contact admin@parity.io
 interface ILabelStore is IDotnsStore {
diff --git a/contracts/store/IStoreFactory.sol b/contracts/store/IStoreFactory.sol
index b799712ed..78590fa65 100644
--- a/contracts/store/IStoreFactory.sol
+++ b/contracts/store/IStoreFactory.sol
@@ -3,7 +3,7 @@
 pragma solidity ^0.8.34;
 
 /// @title IStoreFactory
-/// @notice Interface for the DotNS per-user store factory.
+/// @notice Interface for the dotNS per-user store factory.
 /// @dev Owns two `UpgradeableBeacon` instances; one for `LabelStore` (protocol-managed),
 ///      one for `UserStore` (user-claimed). Each user may acquire at most one of each,
 ///      forever. There is no transfer, no redeploy, no additional store type.
diff --git a/contracts/store/LabelStore.sol b/contracts/store/LabelStore.sol
index 14a8dacfd..ae81b6e25 100644
--- a/contracts/store/LabelStore.sol
+++ b/contracts/store/LabelStore.sol
@@ -10,7 +10,7 @@ import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {StoreAuth} from "../utils/StoreAuth.sol";
 
 /// @title LabelStore
-/// @notice Permanent per-user DotNS label store.
+/// @notice Permanent per-user dotNS label store.
 /// @dev One instance per user, deployed as a `BeaconProxy` by `StoreFactory` during registration.
 ///      Bound to its user forever: `_owner` and `_protocolRegistry` are set once at `initialize`
 ///      and never mutate. Writes are gated to the registrar, an authorised controller or the
@@ -18,7 +18,7 @@ import {StoreAuth} from "../utils/StoreAuth.sol";
 ///      (@custom:function StoreAuth.isStoreWriter); every labelhash is single-write and
 ///      permanently locked on first use.
 /// @dev Labels-only by invariant: this store holds registration records only. Every other
-///      per-name category (reverse, content, forward address, chat key, lite link) lives on a
+///      per-name category (reverse, content, forward address, chat key, device link) lives on a
 ///      dedicated resolver, never here.
 /// @dev Storage collision: the `BeaconProxy` stores the beacon address at EIP-1967 slot
 ///      `keccak256("eip1967.proxy.beacon") - 1`, which is non-sequential and cannot collide
@@ -28,7 +28,7 @@ contract LabelStore is Initializable, ILabelStore {
     /// @dev Permanent user this store belongs to. Set in `initialize`.
     address private _owner;
 
-    /// @dev Canonical DotNS protocol registry. Set in `initialize`.
+    /// @dev Canonical dotNS protocol registry. Set in `initialize`.
     address private _protocolRegistry;
 
     /// @dev labelhash => stored label string.
@@ -173,7 +173,7 @@ contract LabelStore is Initializable, ILabelStore {
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/store/StoreFactory.sol b/contracts/store/StoreFactory.sol
index bd9e15ef5..9069f969c 100644
--- a/contracts/store/StoreFactory.sol
+++ b/contracts/store/StoreFactory.sol
@@ -20,7 +20,7 @@ import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {StoreAuth} from "../utils/StoreAuth.sol";
 
 /// @title StoreFactory
-/// @notice Factory for the two per-user DotNS store types, sharing one factory contract and two
+/// @notice Factory for the two per-user dotNS store types, sharing one factory contract and two
 /// beacons. @dev Each user may acquire AT MOST two stores, ever:
 ///      - a `LabelStore`, deployed via `deployLabelStoreFor` by the owner or a store writer
 ///        during registration; and
@@ -204,7 +204,7 @@ contract StoreFactory is Initializable, UUPSUpgradeable, OwnableUpgradeable, ISt
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/store/UserStore.sol b/contracts/store/UserStore.sol
index 2b56cc368..987ee689e 100644
--- a/contracts/store/UserStore.sol
+++ b/contracts/store/UserStore.sol
@@ -183,7 +183,7 @@ contract UserStore is Initializable, IUserStore {
     }
 
     /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
+    ///         registry so every dotNS contract reports one synchronised value.
     /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
     ///      `version()` selector for ABI compatibility. It reports the network's declaration,
     ///      not this contract's build; per-contract identity is the codehash declared on the
diff --git a/contracts/utils/DotnsConstants.sol b/contracts/utils/DotnsConstants.sol
index b80373ee0..0ebccf589 100644
--- a/contracts/utils/DotnsConstants.sol
+++ b/contracts/utils/DotnsConstants.sol
@@ -2,8 +2,8 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title DotNS Constants
-/// @notice Protocol-level invariants shared across DotNS contracts.
+/// @title dotNS Constants
+/// @notice Protocol-level invariants shared across dotNS contracts.
 /// @dev Centralises the well-known protocol-registry keys that every contract uses to discover
 ///      its siblings (registrar, controller, registry, resolvers, etc.). Each key is a
 ///      role address resolved at call time, so rotating an implementation is a
@@ -21,8 +21,9 @@ library DotnsConstants {
 
     /// @notice Address of the Proof-of-Personhood precompile backed by the
     ///         alias-accounts pallet on Asset Hub.
-    /// @dev Consumed by `PopRules` to read each account's personhood tier
-    ///      (`None` / `Lite` / `Full`) and the dotns-scoped `contextAlias`.
+    /// @dev Consumed by `PopRules` to read each account's proof status, which the precompile
+    ///      names `None` / `Lite` / `Full` (PopRules maps them to `NoStatus` / `Devicehood` /
+    ///      `Personhood`), and the dotns-scoped `contextAlias`.
     address internal constant PERSONHOOD = address(0x000000000000000000000000000000000a010000);
 
     /// @notice Application identifier passed to @custom:function IPersonhood.personhoodStatus.
@@ -146,16 +147,16 @@ library DotnsConstants {
     /// forge-lint: disable-next-line(unsafe-typecast)
     bytes32 internal constant CONTENT_RESOLVER = bytes32("contentResolver");
 
-    /// @notice Well-known key for the dedicated PoP controller orchestrating lite/full-person
-    ///         username issuance on behalf of the PoP gateway.
+    /// @notice Well-known key for the dedicated PoP controller that issues device names and
+    ///         personhood names on behalf of the dotNS gateway pallet.
     /// @dev Kept distinct from `CONTROLLER` (commit-reveal public controller) so the
     ///      two can coexist per `DotnsRegistrar`'s multi-controller affordance.
     /// forge-lint: disable-next-line(unsafe-typecast)
     bytes32 internal constant POP_CONTROLLER = bytes32("popController");
 
     /// @notice Well-known key for the PoP resolver holding per-name records produced
-    ///         by the PoP username flow (chat keys, lite => full links).
-    /// @dev Role: `node => chatKey` and bidirectional `lite <=> full` link index.
+    ///         by the gateway pallet (chat keys, device links).
+    /// @dev Role: `node => chatKey` and bidirectional device-link index.
     ///      Writer is the `POP_CONTROLLER`, not the node owner.
     /// forge-lint: disable-next-line(unsafe-typecast)
     bytes32 internal constant POP_RESOLVER = bytes32("popResolver");
diff --git a/contracts/utils/LabelUtils.sol b/contracts/utils/LabelUtils.sol
index dfcf67fb9..871211091 100644
--- a/contracts/utils/LabelUtils.sol
+++ b/contracts/utils/LabelUtils.sol
@@ -2,8 +2,8 @@
 // SPDX-FileCopyrightText: © 2026 Parity Technologies
 pragma solidity ^0.8.34;
 
-/// @title DotNS Label Utilities Library
-/// @notice Canonical keccak labelhash and namehash helpers shared by every DotNS contract that
+/// @title dotNS Label Utilities Library
+/// @notice Canonical keccak labelhash and namehash helpers shared by every dotNS contract that
 ///         derives node identifiers from user-supplied labels.
 /// @dev Exists so that the identical inline-assembly keccak sequences don't need to
 ///      live in every controller, registrar, or resolver. Every caller that maps a
diff --git a/contracts/utils/RegistrationUtils.sol b/contracts/utils/RegistrationUtils.sol
index 00533971d..6cc4cffa5 100644
--- a/contracts/utils/RegistrationUtils.sol
+++ b/contracts/utils/RegistrationUtils.sol
@@ -9,10 +9,10 @@ import {IStoreFactory} from "../store/IStoreFactory.sol";
 import {StoreUtils} from "./StoreUtils.sol";
 import {DotnsConstants} from "./DotnsConstants.sol";
 
-/// @title DotNS Registration Utilities Library
+/// @title dotNS Registration Utilities Library
 /// @notice Single canonical implementation of the "mint + forward-registry + store-write"
-///         triad used by every DotNS registration flow.
-/// @dev Exists so that every controller (public commit-reveal, PoP gateway, future
+///         triad used by every dotNS registration flow.
+/// @dev Exists so that every controller (public commit-reveal, gateway path, future
 ///      privileged flows) calls the same sequence. Without this library each controller
 ///      re-implements the sequence, and the implementations drift.
 /// @dev Scope: this library is deliberately minimal. It only performs the steps
diff --git a/contracts/utils/StoreAuth.sol b/contracts/utils/StoreAuth.sol
index bd6251ceb..378160d44 100644
--- a/contracts/utils/StoreAuth.sol
+++ b/contracts/utils/StoreAuth.sol
@@ -30,7 +30,7 @@ library StoreAuth {
     /// @notice Whether `caller` is a protocol component allowed to act on a user's store.
     /// @dev Ordered by how often each one writes: the registrar on every mint and transfer, a
     ///      controller on a registration or a gateway name, and the registry on a subname.
-    /// @param protocolRegistry The canonical DotNS protocol registry.
+    /// @param protocolRegistry The canonical dotNS protocol registry.
     /// @param caller The address being checked, normally `msg.sender`.
     /// @return authorised True if `caller` is the registrar, an authorised controller, or the
     ///         registry.
diff --git a/contracts/utils/StoreUtils.sol b/contracts/utils/StoreUtils.sol
index 94a41279a..80c13eaa2 100644
--- a/contracts/utils/StoreUtils.sol
+++ b/contracts/utils/StoreUtils.sol
@@ -5,9 +5,9 @@ pragma solidity ^0.8.34;
 import {ILabelStore} from "../store/ILabelStore.sol";
 import {IStoreFactory} from "../store/IStoreFactory.sol";
 
-/// @title DotNS Store Utilities Library
+/// @title dotNS Store Utilities Library
 /// @notice Canonical helpers for protocol writes into per-user `LabelStore` instances.
-/// @dev One auth rule, one write path. Every DotNS consumer (controller, registrar,
+/// @dev One auth rule, one write path. Every dotNS consumer (controller, registrar,
 ///      registry, PoP controller) funnels label writes through `writeNewLabel` so
 ///      authorisation, deploy-on-first-use and conflict handling are identical across flows.
 /// @custom:security-contact admin@parity.io
diff --git a/contracts/utils/StringUtils.sol b/contracts/utils/StringUtils.sol
index c22cda2b1..1a9db4d3a 100644
--- a/contracts/utils/StringUtils.sol
+++ b/contracts/utils/StringUtils.sol
@@ -5,7 +5,7 @@ pragma solidity ^0.8.34;
 import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
 
 /// @title String Utilities Library
-/// @notice Provides string manipulation utilities for DotNS contracts.
+/// @notice Provides string manipulation utilities for dotNS contracts.
 /// @dev Extends OpenZeppelin's Strings library with additional UTF-8 and conversion helpers.
 /// @custom:security-contact admin@parity.io
 library StringUtils {
@@ -13,19 +13,19 @@ library StringUtils {
     using Strings for int256;
     using Strings for address;
 
-    /// @notice Number of digits in a lite-person PoP label's suffix.
+    /// @notice Number of digits in a device name's suffix.
     /// @dev The count the gateway emits, and an exact requirement here: the separator sits at a
     ///      fixed offset from the end, so a one or three digit suffix is rejected. The gateway
     /// reads its own minimum, so widening it there does not widen this.
-    uint256 internal constant LITE_SUFFIX_DIGITS = 2;
+    uint256 internal constant DEVICE_SUFFIX_DIGITS = 2;
 
     /// @notice Maximum number of octets in a single DNS label.
     /// @dev RFC 1035 caps each label at 63 octets. Enforced inside @custom:function _isDnsLabel so
     ///      every public validator (@custom:function isSingleLabel, @custom:function isNamePath,
-    ///      @custom:function isLitePersonLabel) inherits the bound and oversized labels never
-    ///      reach the registrar. A lite label bounds its stem rather than the whole string, so
-    ///      it reaches `MAX_DNS_LABEL_OCTETS + LITE_SUFFIX_DIGITS + 1` octets. Its stem is
-    ///      bounded here but checked in @custom:function _isLitePersonLabel, which is stricter
+    ///      @custom:function isDeviceLabel) inherits the bound and oversized labels never
+    ///      reach the registrar. A device name bounds its stem rather than the whole string, so
+    ///      it reaches `MAX_DNS_LABEL_OCTETS + DEVICE_SUFFIX_DIGITS + 1` octets. Its stem is
+    ///      bounded here but checked in @custom:function _isDeviceLabel, which is stricter
     ///      on charset than a DNS label: letters only.
     ///      This is the per-segment bound only; @custom:function isNamePath additionally bounds
     ///      the whole path with @custom:constant MAX_NAME_PATH_OCTETS.
@@ -46,8 +46,8 @@ library StringUtils {
     ///      every enumeration that reads the row back.
     uint256 internal constant MAX_NAME_PATH_OCTETS = 255;
 
-    /// @notice ASCII full stop separating a lite label's stem from its digit suffix.
-    /// @dev A lite label is the only label shape in DotNS that carries a separator;
+    /// @notice ASCII full stop separating a device name's stem from its digit suffix.
+    /// @dev A device name is the only label shape in dotNS that carries a separator;
     ///      @custom:function _isDnsLabel rejects it everywhere else.
     bytes1 internal constant LABEL_SEPARATOR = 0x2e;
 
@@ -97,58 +97,58 @@ library StringUtils {
         return _isDnsLabel(label, 0, label.length);
     }
 
-    /// @notice Validates the lite-person PoP label format: `<stem>.<digits>`.
-    /// @dev A lite-person label is a stem of lowercase ASCII letters, one
+    /// @notice Validates the device-name format: `<stem>.<digits>`.
+    /// @dev A device name is a stem of lowercase ASCII letters, one
     ///      @custom:constant LABEL_SEPARATOR, then exactly
-    ///      @custom:constant LITE_SUFFIX_DIGITS digits (e.g. `joseph.42`). Letters only,
+    ///      @custom:constant DEVICE_SUFFIX_DIGITS digits (e.g. `joseph.42`). Letters only,
     ///      because the stem is the name a person chose, which is restricted to letters. How short
     /// a stem may be is policy rather than format, so it is left to the governance-reserved band in
     /// @custom:function IPopRules.classifyName.
-    ///      It is the only label shape in DotNS permitted to carry a separator, which is what
+    ///      It is the only label shape in dotNS permitted to carry a separator, which is what
     ///      reserves the dotted space to the gateway. A digit suffix is not exclusive: an
     ///      ordinary label may end in digits, but it is measured as written and so classifies by
     ///      its full length.
-    ///      Cross-flow priority is arbitrated on the stem, not on the whole label: a lite
-    ///      label's stem is reserved as a base name through
+    ///      Cross-flow priority is arbitrated on the base name: a device name's stem is its base
+    ///      name, reserved through
     ///      @custom:function IPopRules.reserveBaseNameForPop, so `joseph.42` contends with
-    ///      `joseph`. There is no flat spelling of a lite label for it to contend with.
+    ///      `joseph`. There is no flat spelling of a device name for it to contend with.
     /// @param value Candidate label.
     /// @return isValid True if `value` is a stem of lowercase ASCII letters followed by a
-    ///         separator and exactly @custom:constant LITE_SUFFIX_DIGITS digits.
-    function isLitePersonLabel(string calldata value) internal pure returns (bool isValid) {
-        return _isLitePersonLabel(bytes(value));
+    ///         separator and exactly @custom:constant DEVICE_SUFFIX_DIGITS digits.
+    function isDeviceLabel(string calldata value) internal pure returns (bool isValid) {
+        return _isDeviceLabel(bytes(value));
     }
 
-    /// @notice Memory-location helper for @custom:function isLitePersonLabel.
+    /// @notice Memory-location helper for @custom:function isDeviceLabel.
     /// @dev For callers holding the label in memory rather than calldata: the controller reads
     ///      it back from a struct before deriving the node, and the lens reads it out of a
     ///      store. Same predicate, different data location.
     /// @param value Candidate label held in memory.
     /// @return isValid True if `value` is a stem of lowercase ASCII letters followed by a
-    ///         separator and exactly @custom:constant LITE_SUFFIX_DIGITS digits.
-    function isLitePersonLabelMemory(string memory value) internal pure returns (bool isValid) {
-        return _isLitePersonLabel(bytes(value));
+    ///         separator and exactly @custom:constant DEVICE_SUFFIX_DIGITS digits.
+    function isDeviceLabelMemory(string memory value) internal pure returns (bool isValid) {
+        return _isDeviceLabel(bytes(value));
     }
 
-    function _isLitePersonLabel(bytes memory raw) private pure returns (bool isValid) {
+    function _isDeviceLabel(bytes memory raw) private pure returns (bool isValid) {
         uint256 length = raw.length;
         // One stem letter, the separator, then the digits is the shortest accepted shape. The
         // stem is not bounded below here: how short a name may be is policy, and PopRules
         // already holds it as the governance-reserved band. Enforcing a minimum here would
         // duplicate the governance-reserved band and drift from it.
-        if (length < LITE_SUFFIX_DIGITS + 2) return false;
+        if (length < DEVICE_SUFFIX_DIGITS + 2) return false;
 
         // Fixing the separator's position is what enforces the exact digit count: a third
         // digit, a missing separator and a trailing separator all land a non-separator byte
         // here. The letters-only stem then admits no second separator, so exactly one is
         // possible without scanning for it.
-        uint256 separator = length - LITE_SUFFIX_DIGITS - 1;
+        uint256 separator = length - DEVICE_SUFFIX_DIGITS - 1;
         if (raw[separator] != LABEL_SEPARATOR) return false;
 
         // The stem is a name a person chose, so it follows the same letters-only rule as a
-        // full-person label. Uppercase is excluded for the reason it is everywhere else here:
+        // personhood name. Uppercase is excluded for the reason it is everywhere else here:
         // a single name must have a single spelling, and so a single node.
-        if (!_isPersonLabel(raw, 0, separator)) return false;
+        if (!_isPersonhoodLabel(raw, 0, separator)) return false;
 
         for (uint256 i = separator + 1; i < length; ++i) {
             bytes1 char = raw[i];
@@ -159,19 +159,19 @@ library StringUtils {
     }
 
     /// @notice Validates that `value` is a name a person chose: lowercase ASCII letters only.
-    /// @dev Matches the gateway's full-person label rule, which admits no digits
+    /// @dev Matches the gateway's personhood-name rule, which admits no digits
     ///      and no hyphens, so a label outside this shape cannot have been issued. Stricter
     ///      than @custom:function isSingleLabel, and it is the same rule
-    ///      @custom:function isLitePersonLabel applies to a lite stem. How short a name may be
+    ///      @custom:function isDeviceLabel applies to a device-name stem. How short a name may be
     ///      is policy rather than format, so no floor is applied here.
     /// @param value Candidate label.
     /// @return isValid True if every octet of `value` is a lowercase ASCII letter.
-    function isPersonLabel(string calldata value) internal pure returns (bool isValid) {
+    function isPersonhoodLabel(string calldata value) internal pure returns (bool isValid) {
         bytes memory raw = bytes(value);
-        return _isPersonLabel(raw, 0, raw.length);
+        return _isPersonhoodLabel(raw, 0, raw.length);
     }
 
-    function _isPersonLabel(
+    function _isPersonhoodLabel(
         bytes memory raw,
         uint256 start,
         uint256 end
@@ -191,16 +191,16 @@ library StringUtils {
         return true;
     }
 
-    /// @notice Splits a lite-person label `<stem>.<digits>` into its stem and digit suffix.
-    /// @dev Splits at the first @custom:constant LABEL_SEPARATOR. A lite label carries exactly one
+    /// @notice Splits a device name `<stem>.<digits>` into its stem and digit suffix.
+    /// @dev Splits at the first @custom:constant LABEL_SEPARATOR. A device name carries exactly one
     ///      separator, so the caller is expected to have run @custom:function
-    /// isLitePersonLabelMemory first; a label with no separator returns the whole input as the stem
+    /// isDeviceLabelMemory first; a label with no separator returns the whole input as the stem
     /// and an empty
     ///      suffix, which the caller's later label checks reject.
-    /// @param value Lite label held in memory, for example `alice.01`.
+    /// @param value Device name held in memory, for example `alice.01`.
     /// @return stem The label before the separator, for example `alice`.
     /// @return suffix The digit suffix after the separator, for example `01`.
-    function splitLiteLabel(string memory value)
+    function splitDeviceLabel(string memory value)
         internal
         pure
         returns (string memory stem, string memory suffix)
diff --git a/contracts/utils/SubnodeUtils.sol b/contracts/utils/SubnodeUtils.sol
index 57aed4c74..f232ed302 100644
--- a/contracts/utils/SubnodeUtils.sol
+++ b/contracts/utils/SubnodeUtils.sol
@@ -9,7 +9,7 @@ import {LabelUtils} from "./LabelUtils.sol";
 import {StringUtils} from "./StringUtils.sol";
 import {DotnsConstants} from "./DotnsConstants.sol";
 
-/// @title DotNS Subnode Utilities Library
+/// @title dotNS Subnode Utilities Library
 /// @notice General-purpose helpers for registering names that live as subnodes of another name,
 ///         rather than as tokenised second-level registrations.
 /// @dev A subname has no token: its ownership lives in the registry record, not in the registrar's
@@ -56,24 +56,24 @@ library SubnodeUtils {
         subnode = LabelUtils.namehashUnder(parentNode, LabelUtils.labelhashMemory(subLabel));
     }
 
-    /// @notice Derives the subnode for a lite label `<stem>.<suffix>`, splitting it on the
+    /// @notice Derives the subnode for a device name `<stem>.<suffix>`, splitting it on the
     /// separator first.
-    /// @dev The single place a lite label is turned into a node, shared by the write path and every
-    ///      reader of a lite name so the issuer and its readers agree on where a lite name lives.
-    ///      Callers gate on @custom:function StringUtils.isLitePersonLabelMemory beforehand, so the
-    ///      label is known to carry the separator this splits on.
+    /// @dev The single place a device name is turned into a node, shared by the write path and
+    ///      every reader of a device name so the issuer and its readers agree on where a device
+    ///      name lives. Callers gate on @custom:function StringUtils.isDeviceLabelMemory
+    ///      beforehand, so the label is known to carry the separator this splits on.
     /// @param tldNode The TLD node.
-    /// @param liteLabel Lite label, e.g. `alice.01`.
+    /// @param deviceLabel Device name, e.g. `alice.01`.
     /// @return subnode Namehash of the stem beneath its numeric container beneath the TLD.
-    function liteSubnodeOf(
+    function deviceSubnodeOf(
         bytes32 tldNode,
-        string memory liteLabel
+        string memory deviceLabel
     )
         internal
         pure
         returns (bytes32 subnode)
     {
-        (string memory stem, string memory suffix) = StringUtils.splitLiteLabel(liteLabel);
+        (string memory stem, string memory suffix) = StringUtils.splitDeviceLabel(deviceLabel);
         subnode = subnodeOf(tldNode, suffix, stem);
     }
 
diff --git a/contracts/utils/SystemUtils.sol b/contracts/utils/SystemUtils.sol
index 423a56bf6..7338a9701 100644
--- a/contracts/utils/SystemUtils.sol
+++ b/contracts/utils/SystemUtils.sol
@@ -6,7 +6,7 @@ import {ISystem} from "../external/revive/ISystem.sol";
 import {DotnsConstants} from "./DotnsConstants.sol";
 
 /// @title SystemUtils
-/// @notice Shared access to revive's System precompile for DotNS contracts.
+/// @notice Shared access to revive's System precompile for dotNS contracts.
 /// @dev Canonical wrapper around `ISystem` at `DotnsConstants.REVIVE_SYSTEM`, so the precompile
 ///      address and interface are wired in one place rather than duplicated per consumer.
 /// @custom:security-contact admin@parity.io
diff --git a/contracts/whitelist/DotnsNameWhitelist.sol b/contracts/whitelist/DotnsNameWhitelist.sol
index 1c318c153..096ed7073 100644
--- a/contracts/whitelist/DotnsNameWhitelist.sol
+++ b/contracts/whitelist/DotnsNameWhitelist.sol
@@ -49,7 +49,7 @@ contract DotnsNameWhitelist is
     using EnumerableSet for EnumerableSet.AddressSet;
     using EnumerableSet for EnumerableSet.Bytes32Set;
 
-    /// @notice Protocol-level address registry for all DotNS contracts.
+    /// @notice Protocol-level address registry for all dotNS contracts.
     IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Live-claim cap per name, tunable by governance within
@@ -120,7 +120,7 @@ contract DotnsNameWhitelist is
     ///      @custom:reverts InvalidInitialization. Sets `initialOwner` as owner and wires the
     ///      protocol registry the node derivation reads the TLD from.
     /// @param initialOwner Address that owns the contract once initialised.
-    /// @param registry Protocol registry all DotNS contracts resolve through.
+    /// @param registry Protocol registry all dotNS contracts resolve through.
     function initialize(
         address initialOwner,
         IDotnsProtocolRegistry registry
diff --git a/package.json b/package.json
index eccc3d23b..569a11aab 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@dotns/dotns-contracts",
   "version": "2.0.0",
-  "description": "Dotns contracts",
+  "description": "dotNS contracts",
   "type": "module",
   "scripts": {
     "test": "forge test -vvvvv",
diff --git a/scripts/deploy/BaseDeployer.s.sol b/scripts/deploy/BaseDeployer.s.sol
index 6ec16afba..1919dd1d0 100644
--- a/scripts/deploy/BaseDeployer.s.sol
+++ b/scripts/deploy/BaseDeployer.s.sol
@@ -13,7 +13,7 @@ import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
 import {DeploymentNetwork} from "./DeploymentNetwork.sol";
 
 /// @title BaseDeployer
-/// @notice Shared base for the DotNS deploy pipeline. Each concrete stage
+/// @notice Shared base for the dotNS deploy pipeline. Each concrete stage
 ///         script reads the manifest from disk (populated by prior stages),
 ///         deploys its own proxies in its own forge-script process, and writes
 ///         the updated manifest back.
@@ -30,7 +30,7 @@ abstract contract BaseDeployer is Script {
     ///         successive calls within the same run.
     string internal constant MANIFEST_OBJECT_KEY = "dotns.manifest";
 
-    /// @notice Namespace for all DotNS CREATE3 salts.
+    /// @notice Namespace for all dotNS CREATE3 salts.
     /// @dev Do not include the chain ID: the deployment goal is identical
     ///      addresses for identical bytecode and constructor data on every
     ///      chain. Bump this value only when intentionally moving the whole
@@ -250,7 +250,7 @@ abstract contract BaseDeployer is Script {
     /// @dev Full OZ upgrade-safety validation runs on every call. The helper
     ///      exists so every stage script shares one canonical deploy shape
     ///      rather than repeating the validation, broadcast, label, and log
-    ///      sequence. Salts are derived from a stable DotNS namespace plus the
+    ///      sequence. Salts are derived from a stable dotNS namespace plus the
     ///      manifest label, so addresses stay the same across chains as long as
     ///      the deployer, bytecode, constructor args, and label remain stable.
     /// @param owner Broadcasting account; becomes the proxy owner.
@@ -347,7 +347,7 @@ abstract contract BaseDeployer is Script {
     /// @notice Ensures the CREATE3 factory exists and primes it as the in-memory
     ///         override for the remainder of this process, reusing a pre-deployed
     ///         factory when one is configured.
-    /// @dev Every DotNS address is a pure function of the factory address and a
+    /// @dev Every dotNS address is a pure function of the factory address and a
     ///      stable salt, and the factory address is `keccak(deployer, nonce)`. A
     ///      fresh `new Create3Factory()` from a key whose nonce is not fixed
     ///      therefore lands at a new address and shifts every downstream CREATE3
@@ -399,7 +399,7 @@ abstract contract BaseDeployer is Script {
             "  Its address depends on the deployer nonce and is NOT reproducible across chain"
         );
         console.log(
-            "  resets. To pin every DotNS address, set CREATE3_FACTORY (or run deploy:all)."
+            "  resets. To pin every dotNS address, set CREATE3_FACTORY (or run deploy:all)."
         );
         _adoptCreate3Factory(factory);
     }
diff --git a/scripts/deploy/DeployCore.s.sol b/scripts/deploy/DeployCore.s.sol
index d2508b0b1..e6a09c523 100644
--- a/scripts/deploy/DeployCore.s.sol
+++ b/scripts/deploy/DeployCore.s.sol
@@ -13,7 +13,7 @@ import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolReg
 import {Multicall3} from "../../contracts/utils/Multicall3.sol";
 
 /// @title DeployCore
-/// @notice First stage of the DotNS fresh-deploy pipeline. Bootstraps the
+/// @notice First stage of the dotNS fresh-deploy pipeline. Bootstraps the
 ///         CREATE3 factory, deploys the protocol registry through it, records
 ///         the factory on the registry, then deploys the foundational
 ///         name-ownership layer: four UUPS proxies (store factory, registrar,
diff --git a/scripts/deploy/DeployCreate3Factory.s.sol b/scripts/deploy/DeployCreate3Factory.s.sol
index d2d171894..4dbe62dd8 100644
--- a/scripts/deploy/DeployCreate3Factory.s.sol
+++ b/scripts/deploy/DeployCreate3Factory.s.sol
@@ -7,7 +7,7 @@ import {Create3Factory} from "../../contracts/deploy/Create3Factory.sol";
 
 /// @title DeployCreate3Factory
 /// @notice Deploys the CREATE3 factory on its own, from a single-purpose key.
-/// @dev Every DotNS address is a pure function of the CREATE3 factory address
+/// @dev Every dotNS address is a pure function of the CREATE3 factory address
 ///      and a stable salt, and the factory address is `keccak(deployer, nonce)`.
 ///      A key that also runs the pipeline or upgrades cannot guarantee its
 ///      nonce, so a factory it mints drifts to a new address on every chain
diff --git a/scripts/deploy/DeployPopSystem.s.sol b/scripts/deploy/DeployPopSystem.s.sol
index 0c9a0a095..71f8dd7f2 100644
--- a/scripts/deploy/DeployPopSystem.s.sol
+++ b/scripts/deploy/DeployPopSystem.s.sol
@@ -9,10 +9,10 @@ import {DotnsPopController} from "../../contracts/registrars/DotnsPopController.
 import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
 
 /// @title DeployPopSystem
-/// @notice Fourth stage. Deploys the PoP-specific proxies: the resolver that
-///         holds chat keys and lite/full links, and the controller that drives
-///         lite-person and full-person issuance. Both bind to the protocol
-///         registry `DeployPolicy` deployed.
+/// @notice Fourth stage. Deploys the PoP-specific contracts: the resolver that
+///         holds chat keys and device links, the controller that issues
+///         device names and personhood names, and the read-only lens. All three
+///         bind to the protocol registry `DeployPolicy` deployed.
 /// @custom:security-contact admin@parity.io
 contract DeployPopSystem is BaseDeployer {
     /// @notice Default reservation duration for the PoP controller.
diff --git a/scripts/deploy/DotnsDeployer.s.sol b/scripts/deploy/DotnsDeployer.s.sol
index 79825363b..e0b88252b 100644
--- a/scripts/deploy/DotnsDeployer.s.sol
+++ b/scripts/deploy/DotnsDeployer.s.sol
@@ -28,7 +28,7 @@ import {
 import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
 
 /// @title DotnsDeployer
-/// @notice Fresh-deploy script for the full DotNS contract set behind UUPS proxies.
+/// @notice Fresh-deploy script for the full dotNS contract set behind UUPS proxies.
 /// @dev Deploys every proxy in its own broadcast scope to cap forge's per-tx
 ///      memory accounting; every proxy still runs OZ upgrade-safety validation.
 ///      The protocol registry is deployed first so every downstream proxy can
@@ -92,7 +92,7 @@ contract DotnsDeployer is BaseDeployer {
         address nameWhitelist;
     }
 
-    /// @notice Deploys the full DotNS contract set, wires the protocol registry,
+    /// @notice Deploys the full dotNS contract set, wires the protocol registry,
     ///         and writes the resulting manifest under `deployments/`.
     /// @dev Network-specific output folder comes from `networkFolder`, honouring
     ///      the `DEPLOYMENT_NETWORK` override and otherwise the `block.chainid`
diff --git a/scripts/deploy/deployall.sh b/scripts/deploy/deployall.sh
index 42f70f001..4b4f77ece 100755
--- a/scripts/deploy/deployall.sh
+++ b/scripts/deploy/deployall.sh
@@ -2,7 +2,7 @@
 #
 # One-command deploy. Ensures the CREATE3 factory exists (deployed once from the
 # factory key at nonce 0, a deterministic address), then runs the full pipeline
-# reusing that factory. Because every DotNS address derives from the factory
+# reusing that factory. Because every dotNS address derives from the factory
 # address, and the factory address is the same on every fresh chain, this
 # reproduces the same address set across resets and networks.
 #
diff --git a/scripts/deploy/factory.sh b/scripts/deploy/factory.sh
index 742c2be86..71d27c405 100755
--- a/scripts/deploy/factory.sh
+++ b/scripts/deploy/factory.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 #
 # Deploys the CREATE3 factory on its own, from a dedicated single-purpose key,
-# so its address stays reproducible across chain resets. Every other DotNS
+# so its address stays reproducible across chain resets. Every other dotNS
 # address derives from the factory address, and the factory's own address is
 # nonce-derived, so a key that also runs the pipeline or upgrades cannot keep it
 # stable. Deploy it here from a key that does nothing else, then pass the printed
diff --git a/scripts/deploy/run.sh b/scripts/deploy/run.sh
index 0c19e55d3..9aa24becf 100755
--- a/scripts/deploy/run.sh
+++ b/scripts/deploy/run.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Runs the multi-stage DotNS deploy pipeline against a Foundry keystore
+# Runs the multi-stage dotNS deploy pipeline against a Foundry keystore
 # wallet. `.env` is a one-off bootstrap file: it carries PRIVATE_KEY and
 # ACCOUNT_PASSWORD only long enough to import the wallet into the
 # Foundry keystore on the first run, after which the file is deleted so
@@ -122,7 +122,7 @@ else
   esac
 fi
 
-# Reuse a pre-deployed CREATE3 factory when its address is supplied. Every DotNS
+# Reuse a pre-deployed CREATE3 factory when its address is supplied. Every dotNS
 # address derives from the factory address, and the factory's own address is
 # nonce-derived, so a key that also runs upgrades cannot keep it stable across
 # chain resets. Deploy the factory once from a single-purpose key at nonce 0
diff --git a/scripts/genesis/build-genesis.sh b/scripts/genesis/build-genesis.sh
index 0ea53a0aa..9f67c459e 100755
--- a/scripts/genesis/build-genesis.sh
+++ b/scripts/genesis/build-genesis.sh
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# DotNS pallet-revive genesis builder
+# dotNS pallet-revive genesis builder
 #
-# Deploys the full DotNS contract set to a local anvil, then extracts the
+# Deploys the full dotNS contract set to a local anvil, then extracts the
 # resulting EVM state (bytecodes + storage) as a pallet-revive GenesisConfig
-# artifact. A chain can then carry DotNS from genesis instead of deploying it
+# artifact. A chain can then carry dotNS from genesis instead of deploying it
 # after the fact.
 #
 # Output, into $1 (default ./release):
@@ -37,7 +37,7 @@ CANONICAL_MANIFEST="deployments/expected.json"
 
 # Who OWNS the contracts in the genesis state (REQUIRED, one of the three below).
 #
-# No DotNS *address* depends on this key — with CREATE3 the addresses are a pure
+# No dotNS *address* depends on this key — with CREATE3 the addresses are a pure
 # function of the factory (see FACTORY_DEPLOYER_KEY below, which owns only the
 # factory) — but every ownership and role assignment written into genesis storage
 # does: this key ends up owning the registry, the resolvers, the registrar, the
@@ -55,7 +55,7 @@ CANONICAL_MANIFEST="deployments/expected.json"
 # would make which key owns a published genesis depend on which repo the build ran in.
 ADMIN_KEY="${DOTNS_ADMIN_KEY:-}"
 
-# Single-purpose CREATE3 factory deployer key (REQUIRED). Every DotNS address is
+# Single-purpose CREATE3 factory deployer key (REQUIRED). Every dotNS address is
 # a pure function of the Create3Factory address, and the factory address is
 # keccak(deployer, nonce 0) — see "Deterministic addresses (CREATE3)" in
 # DEPLOYMENTS.md. Deploying the factory from this key as its first transaction is
@@ -76,7 +76,7 @@ fi
 
 GENESIS_OUT="$OUT/dotns-genesis-$DOTNS_TLD.json"
 
-echo "=== DotNS genesis builder ==="
+echo "=== dotNS genesis builder ==="
 echo "Building a genesis for TLD .$DOTNS_TLD -> $(basename "$GENESIS_OUT")"
 echo ""
 
@@ -89,7 +89,7 @@ if [ -z "$ADMIN_KEY" ]; then
     cat >&2 <<'MSG'
 Error: no owner key. Set DOTNS_ADMIN_KEY.
 
-Whichever is given becomes the owner of every DotNS contract in the genesis
+Whichever is given becomes the owner of every dotNS contract in the genesis
 state, so this build refuses to fall back to a public dev key.
 MSG
     exit 1
@@ -286,7 +286,7 @@ if ! diff -u -L "expected ($CANONICAL_MANIFEST)" -L "actual (this build)" \
         echo ""
         echo "       Two things cause this:"
         echo "         * FACTORY_DEPLOYER_KEY is not the key the live factory came from."
-        echo "           Every DotNS address derives from the factory address, which is"
+        echo "           Every dotNS address derives from the factory address, which is"
         echo "           keccak(deployer, nonce 0), so a different key moves all of them."
         echo "         * A salt or a label moved for one contract. Only that contract's"
         echo "           line differs; update $CANONICAL_MANIFEST, or restore the label."
diff --git a/scripts/genesis/extract-genesis.mjs b/scripts/genesis/extract-genesis.mjs
index e883624d5..295a63c30 100644
--- a/scripts/genesis/extract-genesis.mjs
+++ b/scripts/genesis/extract-genesis.mjs
@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 /**
- * DotNS Genesis State Extractor
+ * dotNS Genesis State Extractor
  *
- * Reads an anvil state dump and a DotNS deployments file, extracts all
+ * Reads an anvil state dump and a dotNS deployments file, extracts all
  * contract bytecodes and storage, and outputs a JSON file compatible with
  * pallet-revive's GenesisConfig format.
  *
diff --git a/scripts/genesis/extract-genesis.test.mjs b/scripts/genesis/extract-genesis.test.mjs
index b324926c6..f9cc08fb4 100644
--- a/scripts/genesis/extract-genesis.test.mjs
+++ b/scripts/genesis/extract-genesis.test.mjs
@@ -1,7 +1,7 @@
 #!/usr/bin/env node --test
 
 /**
- * Unit tests for the DotNS genesis extractor.
+ * Unit tests for the dotNS genesis extractor.
  *
  * The regression these guard against shipped once: the extractor followed only
  * the EIP-1967 proxy slot, so the two store implementations behind the
@@ -24,7 +24,7 @@ import {
   BEACON_IMPL_SLOT,
 } from "./extract-genesis.mjs";
 
-// Fixture: a miniature anvil dump shaped like the real DotNS deploy
+// Fixture: a miniature anvil dump shaped like the real dotNS deploy
 
 const REGISTRY = "0x00000000000000000000000000000000000000a1";
 const REGISTRY_IMPL = "0x00000000000000000000000000000000000000a2";
diff --git a/scripts/reports/4naly3er-report.py b/scripts/reports/4naly3er-report.py
index 6154cc909..27250b43e 100644
--- a/scripts/reports/4naly3er-report.py
+++ b/scripts/reports/4naly3er-report.py
@@ -47,7 +47,7 @@ def generate_html(findings):
     lines = []
     lines.append('<!DOCTYPE html><html lang="en" class="dark"><head><meta charset="utf-8">')
     lines.append('<meta name="viewport" content="width=device-width,initial-scale=1">')
-    lines.append("<title>DotNS 4naly3er Report</title>")
+    lines.append("<title>dotNS 4naly3er Report</title>")
     lines.append('<script src="https://cdn.tailwindcss.com"></script>')
     lines.append("<script>tailwind.config={darkMode:'class'}</script>")
     lines.append("</head>")
@@ -55,7 +55,7 @@ def generate_html(findings):
     lines.append('<div class="max-w-6xl mx-auto px-4 py-8">')
 
     lines.append('<div class="mb-8">')
-    lines.append('<h1 class="text-2xl font-bold text-white mb-1">DotNS 4naly3er Report</h1>')
+    lines.append('<h1 class="text-2xl font-bold text-white mb-1">dotNS 4naly3er Report</h1>')
     lines.append(f'<p class="text-sm text-gray-500">Generated {timestamp} | {total} findings</p>')
     lines.append("</div>")
 
diff --git a/scripts/reports/coverage-report.py b/scripts/reports/coverage-report.py
index 8b3684817..2f77d5cbd 100644
--- a/scripts/reports/coverage-report.py
+++ b/scripts/reports/coverage-report.py
@@ -89,7 +89,7 @@ def generate_html(files, total_line_coverage):
     lines = []
     lines.append('<!DOCTYPE html><html lang="en" class="dark"><head><meta charset="utf-8">')
     lines.append('<meta name="viewport" content="width=device-width,initial-scale=1">')
-    lines.append("<title>DotNS Coverage Report</title>")
+    lines.append("<title>dotNS Coverage Report</title>")
     lines.append('<script src="https://cdn.tailwindcss.com"></script>')
     lines.append("<script>tailwind.config={darkMode:'class'}</script>")
     lines.append("</head>")
@@ -97,7 +97,7 @@ def generate_html(files, total_line_coverage):
     lines.append('<div class="max-w-6xl mx-auto px-4 py-8">')
 
     lines.append('<div class="mb-8">')
-    lines.append('<h1 class="text-2xl font-bold text-white mb-1">DotNS Coverage Report</h1>')
+    lines.append('<h1 class="text-2xl font-bold text-white mb-1">dotNS Coverage Report</h1>')
     lines.append(f'<p class="text-sm text-gray-500">Generated {timestamp} | {len(files)} files</p>')
     lines.append("</div>")
 
diff --git a/scripts/reports/gas-report.py b/scripts/reports/gas-report.py
index 94492b556..cd6882da3 100644
--- a/scripts/reports/gas-report.py
+++ b/scripts/reports/gas-report.py
@@ -135,7 +135,7 @@ def generate_html(master_contracts, current_contracts):
     lines = []
     lines.append('<!DOCTYPE html><html lang="en" class="dark"><head><meta charset="utf-8">')
     lines.append('<meta name="viewport" content="width=device-width,initial-scale=1">')
-    lines.append("<title>DotNS Gas Report</title>")
+    lines.append("<title>dotNS Gas Report</title>")
     lines.append('<script src="https://cdn.tailwindcss.com"></script>')
     lines.append("<script>tailwind.config={darkMode:'class'}</script>")
     lines.append("</head>")
@@ -143,7 +143,7 @@ def generate_html(master_contracts, current_contracts):
     lines.append('<div class="max-w-6xl mx-auto px-4 py-8">')
 
     lines.append('<div class="mb-8">')
-    lines.append('<h1 class="text-2xl font-bold text-white mb-1">DotNS Gas Report</h1>')
+    lines.append('<h1 class="text-2xl font-bold text-white mb-1">dotNS Gas Report</h1>')
     lines.append(f'<p class="text-sm text-gray-500">Generated {timestamp} | {len(all_contract_names)} contracts</p>')
     lines.append("</div>")
 
diff --git a/scripts/reports/slither-report.py b/scripts/reports/slither-report.py
index 2deac7e28..034310fb1 100644
--- a/scripts/reports/slither-report.py
+++ b/scripts/reports/slither-report.py
@@ -48,7 +48,7 @@ def generate_html(findings):
     lines = []
     lines.append('<!DOCTYPE html><html lang="en" class="dark"><head><meta charset="utf-8">')
     lines.append('<meta name="viewport" content="width=device-width,initial-scale=1">')
-    lines.append("<title>DotNS Slither Report</title>")
+    lines.append("<title>dotNS Slither Report</title>")
     lines.append('<script src="https://cdn.tailwindcss.com"></script>')
     lines.append("<script>tailwind.config={darkMode:'class'}</script>")
     lines.append("</head>")
@@ -56,7 +56,7 @@ def generate_html(findings):
     lines.append('<div class="max-w-6xl mx-auto px-4 py-8">')
 
     lines.append('<div class="mb-8">')
-    lines.append('<h1 class="text-2xl font-bold text-white mb-1">DotNS Slither Report</h1>')
+    lines.append('<h1 class="text-2xl font-bold text-white mb-1">dotNS Slither Report</h1>')
     lines.append(f'<p class="text-sm text-gray-500">Generated {timestamp} | {total} findings</p>')
     lines.append("</div>")
 
diff --git a/scripts/reports/test-report.py b/scripts/reports/test-report.py
index 81205b7bd..f7846e108 100644
--- a/scripts/reports/test-report.py
+++ b/scripts/reports/test-report.py
@@ -85,7 +85,7 @@ def generate_html(suites):
     lines = []
     lines.append('<!DOCTYPE html><html lang="en" class="dark"><head><meta charset="utf-8">')
     lines.append('<meta name="viewport" content="width=device-width,initial-scale=1">')
-    lines.append("<title>DotNS Test Report</title>")
+    lines.append("<title>dotNS Test Report</title>")
     lines.append('<script src="https://cdn.tailwindcss.com"></script>')
     lines.append("<script>tailwind.config={darkMode:'class'}</script>")
     lines.append("</head>")
@@ -93,7 +93,7 @@ def generate_html(suites):
     lines.append('<div class="max-w-6xl mx-auto px-4 py-8">')
 
     lines.append('<div class="mb-8">')
-    lines.append('<h1 class="text-2xl font-bold text-white mb-1">DotNS Test Report</h1>')
+    lines.append('<h1 class="text-2xl font-bold text-white mb-1">dotNS Test Report</h1>')
     lines.append(f'<p class="text-sm text-gray-500">Generated {timestamp} | {len(suites)} suites</p>')
     lines.append("</div>")
 
diff --git a/test/base/BaseDotns.t.sol b/test/base/BaseDotns.t.sol
index 2d771ca59..ad7454b20 100644
--- a/test/base/BaseDotns.t.sol
+++ b/test/base/BaseDotns.t.sol
@@ -40,8 +40,8 @@ import {IPersonhood} from "../../contracts/external/personhood/IPersonhood.sol";
 import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
 
 /// @title BaseDotns
-/// @notice Common Foundry test base for deploying a DotNS stack behind UUPS proxies.
-/// @dev Deploys and wires the core DotNS contracts used by test suites:
+/// @notice Common Foundry test base for deploying a dotNS stack behind UUPS proxies.
+/// @dev Deploys and wires the core dotNS contracts used by test suites:
 ///      - StoreFactory: per-user Store instances used for immutable registration writes
 ///      - DotnsRegistrar: ERC721-backed registrar used to allocate label ownership
 ///      - DotnsRegistry: forward registry used to set subnode ownership under .dot
@@ -78,7 +78,7 @@ abstract contract BaseDotns is Test {
     /// @notice Deployed cost-model registry resolved by PopRules under `COST_MODEL`.
     DotnsCostModelRegistry public costModelRegistry;
 
-    /// @notice Deployed DotNS registrar instance.
+    /// @notice Deployed dotNS registrar instance.
     DotnsRegistrar public dotnsRegistrar;
 
     /// @notice Deployed registrar controller instance.
@@ -96,30 +96,42 @@ abstract contract BaseDotns is Test {
     /// @notice Deployed reverse resolver instance.
     DotnsReverseResolver public dotnsReverseResolver;
 
-    /// @notice Deployed PoP resolver instance (chat keys + lite links).
+    /// @notice Deployed PoP resolver instance (chat keys + device-name links).
     DotnsPopResolver public dotnsPopResolver;
 
-    /// @notice Deployed PoP controller instance (gateway-driven lite/full issuance).
+    /// @notice Deployed PoP controller instance (gateway-driven device-name and personhood-name
+    ///         issuance).
     DotnsPopController public dotnsPopController;
 
     /// @notice Deployed PoP lens instance (read-only view over PoP identity data).
     DotnsPopLens public dotnsPopLens;
 
-    /// @notice Selector for the typed reserveLiteName entrypoint.
-    bytes4 internal constant SELECTOR_RESERVE_LITE_TYPED =
-        bytes4(keccak256("reserveLiteName((string,address,bytes))"));
+    /// @notice Selector for the typed issueDeviceName entrypoint.
+    bytes4 internal constant SELECTOR_ISSUE_DEVICE_NAME =
+        bytes4(keccak256("issueDeviceName((string,address,bytes))"));
 
-    /// @notice Selector for the typed reserveBaseName entrypoint.
-    bytes4 internal constant SELECTOR_RESERVE_BASE_TYPED =
-        bytes4(keccak256("reserveBaseName(((string,address,bytes),string))"));
+    /// @notice Selector for the typed issueDeviceNameWithReservation entrypoint.
+    bytes4 internal constant SELECTOR_ISSUE_DEVICE_NAME_WITH_RESERVATION =
+        bytes4(keccak256("issueDeviceNameWithReservation(((string,address,bytes),string))"));
 
-    /// @notice Selector for the typed reserveBaseNameOnly entrypoint.
-    bytes4 internal constant SELECTOR_RESERVE_BASE_ONLY_TYPED =
-        bytes4(keccak256("reserveBaseNameOnly((address,string))"));
+    /// @notice Selector for the typed reservePersonhoodName entrypoint.
+    bytes4 internal constant SELECTOR_RESERVE_PERSONHOOD_NAME =
+        bytes4(keccak256("reservePersonhoodName((address,string))"));
 
-    /// @notice Selector for the typed registerBaseName entrypoint.
-    bytes4 internal constant SELECTOR_REGISTER_BASE_TYPED =
-        bytes4(keccak256("registerBaseName((string,address,(uint8,string,bytes)))"));
+    /// @notice Selector for the typed issuePersonhoodName entrypoint.
+    bytes4 internal constant SELECTOR_ISSUE_PERSONHOOD_NAME =
+        bytes4(keccak256("issuePersonhoodName((string,address,(uint8,string,bytes)))"));
+
+    /// @notice Selector of `reserveLiteName((string,address,bytes))`.
+    /// @dev A literal: the legacy selectors never change while the legacy interface exists, so a
+    ///      signature edit fails the pin in the legacy suite.
+    bytes4 internal constant SELECTOR_LEGACY_RESERVE_LITE_NAME = 0x220015c0;
+
+    /// @notice Selector of `reserveBaseName(((string,address,bytes),string))`.
+    bytes4 internal constant SELECTOR_LEGACY_RESERVE_BASE_NAME = 0xd89f1bce;
+
+    /// @notice Selector of `registerBaseName((string,address,(uint8,string,bytes)))`.
+    bytes4 internal constant SELECTOR_LEGACY_REGISTER_BASE_NAME = 0x7c4b376b;
 
     /// @notice Default reservation duration used by the PoP controller.
     uint64 public constant DEFAULT_RESERVATION_DURATION = 7 days;
@@ -157,24 +169,32 @@ abstract contract BaseDotns is Test {
     bytes32 public constant ZERO_HASH = bytes32(0);
 
     // Classification-valid labels for the PoP path (post PopRules enforcement).
-    // A stem of 7 behind a two-digit suffix classifies as PopLite. These carry the gateway's
+    // A stem of 7 behind a two-digit suffix classifies as Devicehood. These carry the gateway's
     // separator, which reaches the chain only through the PoP path: the public path rejects a
     // separator, so a dotted label is always gateway-issued.
-    /// @notice PoP lite classification label fixture A.
-    string internal constant LITE_LABEL_A = "michael.01";
-    /// @notice PoP lite classification label fixture B.
-    string internal constant LITE_LABEL_B = "matthew.02";
-    /// @notice PoP lite classification label fixture C.
-    string internal constant LITE_LABEL_C = "william.03";
-    /// @notice PoP lite classification label fixture D.
-    string internal constant LITE_LABEL_D = "richard.04";
-
-    // baselength 8 with no trailing digits classifies as PopFull.
-    /// @notice PoP full classification label fixture A.
+    /// @notice PoP device-name classification label fixture A.
+    string internal constant DEVICE_LABEL_A = "michael.01";
+    /// @notice PoP device-name classification label fixture B.
+    string internal constant DEVICE_LABEL_B = "matthew.02";
+    /// @notice PoP device-name classification label fixture C.
+    string internal constant DEVICE_LABEL_C = "william.03";
+    /// @notice PoP device-name classification label fixture D.
+    string internal constant DEVICE_LABEL_D = "richard.04";
+
+    // Base length 8 with no trailing digits classifies as Personhood.
+    /// @notice Personhood-name fixture A: a single name, as a person would choose it.
+    string internal constant PERSONHOOD_LABEL_A = "victoria";
+    /// @notice Personhood-name fixture B.
+    string internal constant PERSONHOOD_LABEL_B = "isabella";
+    /// @notice Personhood-name fixture C.
+    string internal constant PERSONHOOD_LABEL_C = "caroline";
+
+    // Ordinary labels for suites outside PoP: 8 letters, no digits and no device suffix.
+    /// @notice Plain label fixture A, for suites that register or grant a label outside PoP.
     string internal constant BASE_LABEL_A = "alicebob";
-    /// @notice PoP full classification label fixture B.
+    /// @notice Plain label fixture B.
     string internal constant BASE_LABEL_B = "wonderla";
-    /// @notice PoP full classification label fixture C.
+    /// @notice Plain label fixture C.
     string internal constant BASE_LABEL_C = "carolboy";
 
     // Measured whole at 11, which is 9 or more, so these classify as NoStatus.
@@ -355,7 +375,7 @@ abstract contract BaseDotns is Test {
         vm.stopPrank();
         vm.warp(block.timestamp + 365 days);
         // Default every account to `None` (NoStatus) on the personhood
-        // precompile. Per-account `_grantPopFull`/`_grantPopLite` calls install
+        // precompile. Per-account `_grantPersonhood`/`_grantDevicehood` calls install
         // more specific mocks that override this selector-only stub.
         vm.mockCall(
             DotnsConstants.PERSONHOOD,
@@ -425,14 +445,14 @@ abstract contract BaseDotns is Test {
         node = LabelUtils.namehashUnder(_tldNode(), LabelUtils.labelhashMemory(label));
     }
 
-    /// @notice Computes the hierarchical subnode for a lite label `<stem>.<suffix>`.
-    /// @dev A lite username is `stem` beneath the numeric container `suffix.tld`, so its node is
+    /// @notice Computes the hierarchical subnode for a device name `<stem>.<suffix>`.
+    /// @dev A device name is `stem` beneath the numeric container `suffix.tld`, so its node is
     ///      `namehash(namehash(tldNode, keccak(suffix)), keccak(stem))`, not a hash of the whole
-    ///      label. Mirrors @custom:function DotnsPopController._liteSubnode.
-    /// @param liteLabel Lite label, e.g. `michael.01`.
+    ///      label. Mirrors @custom:function DotnsPopController._deviceSubnode.
+    /// @param deviceLabel Device name, e.g. `michael.01`.
     /// @return node The subnode identifier.
-    function _liteNodeOf(string memory liteLabel) internal pure returns (bytes32 node) {
-        (string memory stem, string memory suffix) = StringUtils.splitLiteLabel(liteLabel);
+    function _deviceNodeOf(string memory deviceLabel) internal pure returns (bytes32 node) {
+        (string memory stem, string memory suffix) = StringUtils.splitDeviceLabel(deviceLabel);
         bytes32 parentNode =
             LabelUtils.namehashUnder(_tldNode(), LabelUtils.labelhashMemory(suffix));
         node = LabelUtils.namehashUnder(parentNode, LabelUtils.labelhashMemory(stem));
@@ -452,13 +472,14 @@ abstract contract BaseDotns is Test {
     /// @notice Mocks the personhood precompile so it returns `tier` for `who`
     ///         under the dotns context.
     /// @dev Single source of truth for tier mocking. Tier numbering matches
-    ///      @custom:contract IPersonhood: 0=None, 1=Lite, 2=Full. `contextAlias` is non-zero
+    ///      @custom:contract IPersonhood, which names them 0=None, 1=Lite, 2=Full;
+    ///      1 is `Devicehood` and 2 is `Personhood` here. `contextAlias` is non-zero
     ///      whenever `tier != 0` so callers that read it (cross-context
     ///      identity tests) still see a deterministic value.
     function _setUserPopStatus(address who, IPopRules.PopStatus tier) internal {
         uint8 status;
-        if (tier == IPopRules.PopStatus.PopFull) status = 2;
-        else if (tier == IPopRules.PopStatus.PopLite) status = 1;
+        if (tier == IPopRules.PopStatus.Personhood) status = 2;
+        else if (tier == IPopRules.PopStatus.Devicehood) status = 1;
         // PopStatus.Reserved is a label classification, never a user tier; map
         // anything else to None.
         bytes32 contextAlias = status == 0 ? bytes32(0) : keccak256(abi.encode(who, status));
@@ -471,14 +492,14 @@ abstract contract BaseDotns is Test {
         );
     }
 
-    /// @notice Grants PopFull status to `who` via the personhood precompile mock.
-    function _grantPopFull(address who) internal {
-        _setUserPopStatus(who, IPopRules.PopStatus.PopFull);
+    /// @notice Grants Personhood status to `who` via the personhood precompile mock.
+    function _grantPersonhood(address who) internal {
+        _setUserPopStatus(who, IPopRules.PopStatus.Personhood);
     }
 
-    /// @notice Grants PopLite status to `who` via the personhood precompile mock.
-    function _grantPopLite(address who) internal {
-        _setUserPopStatus(who, IPopRules.PopStatus.PopLite);
+    /// @notice Grants Devicehood status to `who` via the personhood precompile mock.
+    function _grantDevicehood(address who) internal {
+        _setUserPopStatus(who, IPopRules.PopStatus.Devicehood);
     }
 
     /// @notice Resets `who` back to `None` on the personhood precompile mock.
@@ -522,22 +543,22 @@ abstract contract BaseDotns is Test {
     /// against the resolver and store hold. Chat keys are persisted eagerly on the PoP
     /// resolver at reserve time regardless of settlement. Tests that want to observe
     /// cold-path semantics (label stashed, no store deployed) must call
-    /// @custom:function _rootReserveBaseName or @custom:function _rootReserveLiteName
-    /// directly.
+    /// @custom:function _rootIssueDeviceNameWithReservation or
+    /// @custom:function _rootIssueDeviceName directly.
     function _reservePop(
         address user,
-        string memory liteLabel,
+        string memory deviceLabel,
         bytes memory chatKey,
-        string memory reservedBaseLabel
+        string memory reservedLabel
     )
         internal
     {
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: liteLabel, user: user, chatKey: chatKey
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: deviceLabel, user: user, chatKey: chatKey
                 }),
-                reservedBaseLabel: reservedBaseLabel
+                reservedLabel: reservedLabel
             })
         );
         if (dotnsPopController.pendingClaimCountOf(user) != 0) {
@@ -546,28 +567,59 @@ abstract contract BaseDotns is Test {
         }
     }
 
-    /// @notice Dispatches the typed `reserveLiteName` call under a mocked Root origin.
-    function _rootReserveLiteName(IDotnsPopController.LiteRegistration memory params) internal {
-        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_RESERVE_LITE_TYPED, params));
+    /// @notice Dispatches the typed `issueDeviceName` call under a mocked Root origin.
+    function _rootIssueDeviceName(IDotnsPopController.DeviceNameIssuance memory params) internal {
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_ISSUE_DEVICE_NAME, params));
     }
 
     /// @notice Dispatches the typed `reserveBaseName` call under a mocked Root origin.
-    function _rootReserveBaseName(IDotnsPopController.BaseReservation memory params) internal {
-        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_RESERVE_BASE_TYPED, params));
+    function _rootIssueDeviceNameWithReservation(
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory params
+    )
+        internal
+    {
+        _dispatchFromRoot(
+            abi.encodeWithSelector(SELECTOR_ISSUE_DEVICE_NAME_WITH_RESERVATION, params)
+        );
     }
 
-    /// @notice Dispatches the typed `reserveBaseNameOnly` call under a mocked Root origin.
-    function _rootReserveBaseNameOnly(IDotnsPopController.BaseNameReservation memory params)
+    /// @notice Dispatches the typed `reservePersonhoodName` call under a mocked Root origin.
+    function _rootReservePersonhoodName(IDotnsPopController.PersonhoodNameReservation memory params)
         internal
     {
-        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_RESERVE_BASE_ONLY_TYPED, params));
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_RESERVE_PERSONHOOD_NAME, params));
     }
 
-    /// @notice Dispatches the typed `registerBaseName` call under a mocked Root origin.
+    /// @notice Dispatches the typed `issuePersonhoodName` call under a mocked Root origin.
     /// @dev Dispatches the label as written. The gateway sends what People Chain holds, so a
-    ///      helper that reshaped it would hide whether a fixture is a valid lite label.
-    function _rootRegisterBaseName(IDotnsPopController.FullRegistration memory params) internal {
-        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_REGISTER_BASE_TYPED, params));
+    ///      helper that reshaped it would hide whether a fixture is a valid device name.
+    function _rootIssuePersonhoodName(IDotnsPopController.PersonhoodNameIssuance memory params)
+        internal
+    {
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_ISSUE_PERSONHOOD_NAME, params));
+    }
+
+    /// @notice Dispatches the legacy `reserveLiteName` call under a mocked Root origin.
+    function _rootLegacyReserveLiteName(IDotnsPopController.DeviceNameIssuance memory params)
+        internal
+    {
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_LEGACY_RESERVE_LITE_NAME, params));
+    }
+
+    /// @notice Dispatches the legacy `reserveBaseName` call under a mocked Root origin.
+    function _rootLegacyReserveBaseName(
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory params
+    )
+        internal
+    {
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_LEGACY_RESERVE_BASE_NAME, params));
+    }
+
+    /// @notice Dispatches the legacy `registerBaseName` call under a mocked Root origin.
+    function _rootLegacyRegisterBaseName(IDotnsPopController.PersonhoodNameIssuance memory params)
+        internal
+    {
+        _dispatchFromRoot(abi.encodeWithSelector(SELECTOR_LEGACY_REGISTER_BASE_NAME, params));
     }
 
     /// @notice Calls `payload` on the PoP controller under a mocked Root origin.
@@ -591,25 +643,25 @@ abstract contract BaseDotns is Test {
         return data;
     }
 
-    /// @notice Constructs a `Link` that inherits the chat key from a prior lite label.
-    function _linkWithLite(string memory liteLabel)
+    /// @notice Constructs a `Link` that inherits the chat key from a prior device name.
+    function _linkWithDeviceName(string memory deviceLabel)
         internal
         pure
         returns (IDotnsPopController.Link memory)
     {
         return IDotnsPopController.Link({
-            kind: IDotnsPopController.LinkKind.LiteUsername, liteLabel: liteLabel, chatKey: ""
+            kind: IDotnsPopController.LinkKind.DeviceName, deviceLabel: deviceLabel, chatKey: ""
         });
     }
 
-    /// @notice Constructs a `Link` carrying a fresh chat key (no lite inheritance).
+    /// @notice Constructs a `Link` carrying a fresh chat key (no device-name inheritance).
     function _linkFresh(bytes memory chatKey)
         internal
         pure
         returns (IDotnsPopController.Link memory)
     {
         return IDotnsPopController.Link({
-            kind: IDotnsPopController.LinkKind.None, liteLabel: "", chatKey: chatKey
+            kind: IDotnsPopController.LinkKind.None, deviceLabel: "", chatKey: chatKey
         });
     }
 
@@ -717,7 +769,7 @@ abstract contract BaseDotns is Test {
 
     /// @notice Registers `label` for `labelOwner` under the requested PoP status and
     ///         returns its node.
-    /// @dev For NoStatus, no status is set on the oracle. For PopLite/PopFull, status is set
+    /// @dev For NoStatus, no status is set on the oracle. For Devicehood/Personhood, status is set
     ///      for `(labelOwner, label)` before commit-reveal.
     /// @param label The label to register (without the `.dot` suffix).
     /// @param labelOwner The address that will own the registered label.
diff --git a/test/fuzz/pop/PopFuzz.t.sol b/test/fuzz/pop/PopFuzz.t.sol
index 6d6a83256..92d8d0ab3 100644
--- a/test/fuzz/pop/PopFuzz.t.sol
+++ b/test/fuzz/pop/PopFuzz.t.sol
@@ -8,34 +8,34 @@ import {IPopRules} from "../../../contracts/pop/IPopRules.sol";
 /// @notice Property-based tests for @custom:contract PopRules classification, reservation and
 /// pricing.
 contract PopRulesFuzzTest is BaseDotns {
-    function testFuzz_popfull_user_can_access_poplite(uint256 seed, uint256 length) public {
+    function testFuzz_personhood_user_can_access_devicehood(uint256 seed, uint256 length) public {
         length = bound(length, 6, 8);
-        // PopLite is the gateway's separated form, so the stem carries the separator; `length`
-        // bounds the stem, which is what sets the band.
+        // Devicehood is the gateway's separated form, so the label carries the separator;
+        // `length` bounds the stem, which is what sets the band.
         string memory nameLabel = string(abi.encodePacked(_makeAlpha(seed, length), ".01"));
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         IPopRules.PriceWithMeta memory priceMetadata = popRules.priceWithCheck(nameLabel, ed);
 
-        assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.PopLite));
-        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.Devicehood));
+        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.Personhood));
     }
 
-    function testFuzz_popfull_user_can_access_nostatus(uint256 seed, uint256 length) public {
+    function testFuzz_personhood_user_can_access_nostatus(uint256 seed, uint256 length) public {
         length = bound(length, 9, 14);
         // Measured whole, so the suffix only lengthens it and the band stays NoStatus.
         string memory nameLabel = string(abi.encodePacked(_makeAlpha(seed, length), "01"));
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         IPopRules.PriceWithMeta memory priceMetadata = popRules.priceWithCheck(nameLabel, ed);
 
         assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.NoStatus));
-        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.Personhood));
     }
 
-    function testFuzz_nostatus_user_cannot_access_popfull(uint256 seed) public {
+    function testFuzz_nostatus_user_cannot_access_personhood(uint256 seed) public {
         string memory nameLabel = _makeAlpha(seed, 8);
 
         _grantNoStatus(ed);
@@ -103,7 +103,7 @@ contract PopRulesFuzzTest is BaseDotns {
         assertEq(priceMetadata.price, popRules.price(nameLabel));
     }
 
-    function testFuzz_expired_reservation_rolls_forward_to_next_lite_registrant(uint256 seed)
+    function testFuzz_expired_reservation_rolls_forward_to_next_device_registrant(uint256 seed)
         public
     {
         string memory baseName = _makeAlpha(seed, 6);
@@ -135,7 +135,7 @@ contract PopRulesFuzzTest is BaseDotns {
         baseName[0] = bytes1(uint8(baseName[0]) - 32);
         string memory mixedCaseName = string(abi.encodePacked(string(baseName), "01"));
 
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
 
         vm.expectPartialRevert(IPopRules.PopError.selector);
         popRules.priceWithCheck(mixedCaseName, ed);
diff --git a/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol b/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
index 996939001..c2f967ea9 100644
--- a/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
+++ b/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
@@ -26,20 +26,22 @@ contract DotnsPopControllerFuzz is BaseDotns {
         return StringUtils.uintToString(value);
     }
 
-    function testFuzz_reserveBaseName_accepts_any_two_digit_suffix(uint8 suffix) public {
+    function testFuzz_issueDeviceNameWithReservation_accepts_any_two_digit_suffix(uint8 suffix)
+        public
+    {
         suffix = uint8(bound(uint256(suffix), 0, 99));
         string memory label = string.concat("joseph", ".", _twoDigitDecimal(uint256(suffix)));
 
-        // Lite-tier label requires ed to hold PopLite (or PopFull) status so the
+        // Device-name label requires ed to hold Devicehood (or Personhood) status so the
         // `priceWithCheck` guard inside the controller accepts the reservation.
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
 
         _reservePop(ed, label, "", "");
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf(label)), ed);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(label)), ed);
     }
 
-    function testFuzz_reserveBaseName_persists_chat_key_exact_bytes(
+    function testFuzz_issueDeviceNameWithReservation_persists_chat_key_exact_bytes(
         uint8 suffix,
         bytes1 keySeed,
         bool useKey
@@ -49,12 +51,12 @@ contract DotnsPopControllerFuzz is BaseDotns {
         suffix = uint8(bound(uint256(suffix), 0, 99));
         string memory label = string.concat("joseph", ".", _twoDigitDecimal(uint256(suffix)));
 
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
 
         bytes memory chatKey = useKey ? _validChatKey(keySeed) : bytes("");
         _reservePop(ed, label, chatKey, "");
 
-        bytes32 node = _liteNodeOf(label);
+        bytes32 node = _deviceNodeOf(label);
         if (chatKey.length == 0) {
             assertEq(dotnsPopResolver.chatKey(node).length, 0);
         } else {
@@ -62,24 +64,24 @@ contract DotnsPopControllerFuzz is BaseDotns {
         }
     }
 
-    /// @dev The reservation covers the stem, and the stem is what a public registrant contends
-    ///      for: a digit-suffixed spelling is measured as written and so is an unrelated name
-    ///      the reservation never sees.
+    /// @dev The reservation covers the base name, and the base name is what a public registrant
+    ///      contends for: a digit-suffixed spelling is measured as written and so is an unrelated
+    ///      name the reservation never sees.
     function testFuzz_public_register_respects_popRules_reservation(bool reserveFirst) public {
-        string memory stem = "longnamebob";
+        string memory baseName = "longnamebob";
 
         if (reserveFirst) {
             // The reserved base label `longnamebob` classifies as NoStatus (11 characters); the
-            // lite label has to be PopLite-eligible. Tiago needs PopFull status so both
+            // device name has to be Devicehood-eligible. Tiago needs Personhood status so both
             // `priceWithCheck` calls inside `reserveBaseName` succeed.
-            _grantPopFull(tiago);
-            _reservePop(tiago, LITE_LABEL_A, "", stem);
+            _grantPersonhood(tiago);
+            _reservePop(tiago, DEVICE_LABEL_A, "", baseName);
         }
 
-        bytes32 secret = keccak256(abi.encodePacked(stem, ed, block.timestamp));
+        bytes32 secret = keccak256(abi.encodePacked(baseName, ed, block.timestamp));
         IDotnsRegistrarController.Registration memory registration =
             IDotnsRegistrarController.Registration({
-                label: stem,
+                label: baseName,
                 owner: ed,
                 secret: secret,
                 reserved: true,
@@ -95,16 +97,17 @@ contract DotnsPopControllerFuzz is BaseDotns {
         if (reserveFirst) {
             vm.expectRevert(
                 abi.encodeWithSelector(
-                    IPopRules.PopError.selector, "Base name reserved for original Lite registrant"
+                    IPopRules.PopError.selector,
+                    "Reserved for a device-name holder's personhood claim"
                 )
             );
             vm.prank(ed);
             dotnsRegistrarController.register{value: 1 ether}(registration);
         } else {
-            uint256 cost = popRules.priceWithCheck(stem, ed).price;
+            uint256 cost = popRules.priceWithCheck(baseName, ed).price;
             vm.prank(ed);
             dotnsRegistrarController.register{value: cost}(registration);
-            assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(stem))), ed);
+            assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(baseName))), ed);
         }
     }
 
@@ -124,15 +127,15 @@ contract DotnsPopControllerFuzz is BaseDotns {
         vm.prank(owner);
         dotnsPopController.setReservationDuration(duration);
 
-        // Reserving `BASE_LABEL_A` (PopFull classification) alongside the
-        // lite leg requires ed to hold PopFull status so both `priceWithCheck`
+        // Reserving `PERSONHOOD_LABEL_A` (Personhood classification) alongside the
+        // the issuance requires ed to hold Personhood status so both `priceWithCheck`
         // calls succeed.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, "", BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, "", PERSONHOOD_LABEL_A);
 
         vm.warp(block.timestamp + uint256(elapsed));
 
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         if (uint256(elapsed) <= uint256(duration)) {
             assertTrue(reserved);
             assertEq(holder, ed);
@@ -152,9 +155,9 @@ contract DotnsPopControllerFuzz is BaseDotns {
         string memory label = string.concat("joseph", ".", _twoDigitDecimal(uint256(suffix)));
         bytes memory chatKey = _validChatKey(keySeed);
 
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({liteLabel: label, user: ed, chatKey: chatKey})
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({label: label, user: ed, chatKey: chatKey})
         );
 
         IDotnsPopController.PendingClaim[] memory pending =
@@ -164,7 +167,7 @@ contract DotnsPopControllerFuzz is BaseDotns {
         assertEq(storeFactory.getLabelStore(ed), address(0));
         // Chat key is persisted eagerly on the resolver at reserve time, even though
         // the LabelStore write is deferred to settlement on the cold path.
-        bytes32 node = _liteNodeOf(label);
+        bytes32 node = _deviceNodeOf(label);
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
     }
 
@@ -178,15 +181,15 @@ contract DotnsPopControllerFuzz is BaseDotns {
         string memory label = string.concat("joseph", ".", _twoDigitDecimal(uint256(suffix)));
         bytes memory chatKey = _validChatKey(keySeed);
 
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({liteLabel: label, user: ed, chatKey: chatKey})
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({label: label, user: ed, chatKey: chatKey})
         );
 
         vm.prank(ed);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
 
-        bytes32 node = _liteNodeOf(label);
+        bytes32 node = _deviceNodeOf(label);
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(ILabelStore(store).getLabel(node), string.concat(label, protocolRegistry.tld()));
@@ -210,10 +213,10 @@ contract DotnsPopControllerFuzz is BaseDotns {
         vm.prank(owner);
         dotnsPopController.setReservationDuration(duration);
 
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x77)
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x77)
             })
         );
 
@@ -221,18 +224,18 @@ contract DotnsPopControllerFuzz is BaseDotns {
         vm.warp(uint256(mintedAt) + uint256(elapsed));
 
         // Stores always settle: settlement writes the label into the store whether or not the
-        // reservation deadline has passed, so age never strands a claim.
+        // claim is older than `reservationDuration`, so age never strands a claim.
         vm.prank(ed);
         (uint256 settledCount, bool moreRemaining) =
             dotnsPopController.settlePendingClaims(ed, type(uint256).max);
         assertEq(settledCount, 1);
         assertFalse(moreRemaining);
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(node), string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
diff --git a/test/fuzz/registrar/DotnsRegistrarControllerFuzz.t.sol b/test/fuzz/registrar/DotnsRegistrarControllerFuzz.t.sol
index e43eb3d50..227bf4c52 100644
--- a/test/fuzz/registrar/DotnsRegistrarControllerFuzz.t.sol
+++ b/test/fuzz/registrar/DotnsRegistrarControllerFuzz.t.sol
@@ -57,9 +57,9 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
 
     function testFuzz_register_refunds_overpayment_inline(uint256 extra, uint256 salt) public {
         address registrant = tiago;
-        string memory nameLabel = _labelPopFullPriced(bound(salt, 0, 64));
+        string memory nameLabel = _labelPersonhoodPriced(bound(salt, 0, 64));
 
-        _grantPopFull(registrant);
+        _grantPersonhood(registrant);
 
         IDotnsRegistrarController.Registration memory registration =
             _commitFor(nameLabel, registrant, false);
@@ -104,8 +104,8 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         address payer = leonardo;
         string memory nameLabel = _labelPopfull(bound(salt, 0, 64));
 
-        _grantPopFull(nameOwner);
-        _grantPopFull(payer);
+        _grantPersonhood(nameOwner);
+        _grantPersonhood(payer);
 
         IDotnsRegistrarController.Registration memory registration =
             _commitFor(nameLabel, nameOwner, true, payer);
@@ -151,7 +151,7 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         address recipient = leonardo;
         string memory nameLabel = _labelPopfull(bound(salt, 0, 64));
 
-        _grantPopFull(sender);
+        _grantPersonhood(sender);
 
         IDotnsRegistrarController.Registration memory registration =
             _commitFor(nameLabel, sender, true);
@@ -185,7 +185,7 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         uint256 primarySalt = bound(salt, 0, 63);
         string memory primaryName = _labelPopfull(primarySalt);
 
-        _grantPopFull(nameOwner);
+        _grantPersonhood(nameOwner);
 
         IDotnsRegistrarController.Registration memory primaryRegistration =
             _commitFor(primaryName, nameOwner, true);
@@ -198,7 +198,7 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
 
         string memory giftedName = _labelNoStatusPriced(primarySalt + 1);
 
-        _grantPopFull(payer);
+        _grantPersonhood(payer);
 
         IDotnsRegistrarController.Registration memory giftedRegistration =
             _commitFor(giftedName, nameOwner, true, payer);
@@ -299,7 +299,7 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         address recipient = leonardo;
         string memory nameLabel = _labelPopfull(bound(salt, 0, 64));
 
-        _grantPopFull(sender);
+        _grantPersonhood(sender);
 
         IDotnsRegistrarController.Registration memory registration =
             _commitFor(nameLabel, sender, true);
@@ -366,7 +366,7 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         vm.warp(block.timestamp + dotnsRegistrarController.minCommitmentAge() + 1);
     }
 
-    /// @notice Generate a label that classifies as PopFull (baselength 8, no trailing digits).
+    /// @notice Generate a label that classifies as Personhood (baselength 8, no trailing digits).
     function _labelPopfull(uint256 salt) internal pure returns (string memory label) {
         return string(abi.encodePacked("popful", _uintToAlphaFixed(salt, 2)));
     }
@@ -377,10 +377,10 @@ contract DotnsRegistrarControllerFuzzTest is BaseDotns {
         return string(abi.encodePacked("nostatu", _uintToAlphaFixed(salt, 2), "01"));
     }
 
-    /// @notice Generate an 8-character PopFull-tier label, measured whole, that prices above
-    ///         the floor so the amount is non-zero. A public fixture cannot be PopLite: that is
+    /// @notice Generate an 8-character Personhood-tier label, measured whole, that prices above
+    ///         the floor so the amount is non-zero. A public fixture cannot be Devicehood: that is
     ///         the gateway's separated form and this path rejects a separator.
-    function _labelPopFullPriced(uint256 salt) internal pure returns (string memory label) {
+    function _labelPersonhoodPriced(uint256 salt) internal pure returns (string memory label) {
         return string(abi.encodePacked("free", _uintToAlphaFixed(salt, 2), "01"));
     }
 
diff --git a/test/intergration/BasicDotns.reverts.t.sol b/test/intergration/BasicDotns.reverts.t.sol
index e436bbf77..6a18e88ca 100644
--- a/test/intergration/BasicDotns.reverts.t.sol
+++ b/test/intergration/BasicDotns.reverts.t.sol
@@ -11,18 +11,18 @@ import {IDotnsRegistrarController} from "../../contracts/registrars/IDotnsRegist
 /// @notice Integration coverage for revert paths protecting registration, subnames,
 ///         and resolver writes.
 contract BasicDotnsIntegrationReverts is BaseDotns {
-    /// @notice PopFull-classified label fixture exercised by the revert cases.
+    /// @notice Personhood-classified label fixture exercised by the revert cases.
     string internal constant NAME_POPFULL = "waytalls";
 
     /// @notice Sample CIDv1 content hash used as a record value.
     bytes internal constant CID_A =
         hex"e30101701220aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
 
-    function test_revert_poplite_cannot_register_popfull_required() public {
+    function test_revert_devicehood_cannot_register_personhood_required() public {
         string memory nameLabel = NAME_POPFULL;
         address registrant = ed;
 
-        _grantPopLite(registrant);
+        _grantDevicehood(registrant);
         vm.startPrank(registrant);
 
         bytes32 secret = keccak256(abi.encodePacked(nameLabel, registrant, block.timestamp));
@@ -41,11 +41,7 @@ contract BasicDotnsIntegrationReverts is BaseDotns {
 
         vm.warp(block.timestamp + dotnsRegistrarController.minCommitmentAge() + 1);
 
-        vm.expectRevert(
-            abi.encodeWithSelector(
-                IPopRules.PopError.selector, "Requires Full personhood verification"
-            )
-        );
+        vm.expectRevert(abi.encodeWithSelector(IPopRules.PopError.selector, "Requires personhood"));
         dotnsRegistrarController.register(registration);
         vm.stopPrank();
     }
@@ -54,7 +50,7 @@ contract BasicDotnsIntegrationReverts is BaseDotns {
         address parentOwner = ed;
         address attacker = tiago;
 
-        _grantPopFull(parentOwner);
+        _grantPersonhood(parentOwner);
         _commitAndRegister(NAME_POPFULL, parentOwner, true);
 
         bytes32 parentNode = _namehash(dotNode, keccak256(bytes(NAME_POPFULL)));
@@ -76,7 +72,7 @@ contract BasicDotnsIntegrationReverts is BaseDotns {
     function test_parent_can_reassign_existing_subdomain() public {
         address parentOwner = ed;
 
-        _grantPopFull(parentOwner);
+        _grantPersonhood(parentOwner);
         _commitAndRegister(NAME_POPFULL, parentOwner, true);
         bytes32 parentNode = _namehash(dotNode, keccak256(bytes(NAME_POPFULL)));
 
@@ -104,7 +100,7 @@ contract BasicDotnsIntegrationReverts is BaseDotns {
         address parentOwner = ed;
         address attacker = tiago;
 
-        _grantPopFull(parentOwner);
+        _grantPersonhood(parentOwner);
         _commitAndRegister(NAME_POPFULL, parentOwner, true);
 
         bytes32 node = _namehash(dotNode, keccak256(bytes(NAME_POPFULL)));
diff --git a/test/intergration/BasicDotns.t.sol b/test/intergration/BasicDotns.t.sol
index ac068afd4..31fefc7e3 100644
--- a/test/intergration/BasicDotns.t.sol
+++ b/test/intergration/BasicDotns.t.sol
@@ -10,9 +10,9 @@ import {ILabelStore} from "../../contracts/store/ILabelStore.sol";
 /// @notice End-to-end happy-path integration coverage for registration,
 ///         records, subnames, and ERC721 transfers across all PoP tiers.
 contract BasicDotnsIntegration is BaseDotns {
-    /// @notice PopFull-classified label fixture used by the integration flow.
+    /// @notice Personhood-classified label fixture used by the integration flow.
     string internal constant NAME_POPFULL = "waytalls";
-    /// @notice PopLite-classified label fixture used by the integration flow.
+    /// @notice Devicehood-classified label fixture used by the integration flow.
     string internal constant NAME_POPLITE = "way2tall01";
     /// @notice NoStatus-classified label fixture used by the integration flow.
     string internal constant NAME_NOSTATUS = "kitesurfing01";
@@ -37,8 +37,8 @@ contract BasicDotnsIntegration is BaseDotns {
         string transferRecipientSub;
     }
 
-    function test_popfull_end_to_end() public {
-        _grantPopFull(ed);
+    function test_personhood_end_to_end() public {
+        _grantPersonhood(ed);
 
         _flowEndToEnd(
             FlowParams({
@@ -55,8 +55,8 @@ contract BasicDotnsIntegration is BaseDotns {
         );
     }
 
-    function test_poplite_end_to_end() public {
-        _grantPopLite(leonardo);
+    function test_devicehood_end_to_end() public {
+        _grantDevicehood(leonardo);
 
         _flowEndToEnd(
             FlowParams({
@@ -222,7 +222,7 @@ contract BasicDotnsIntegration is BaseDotns {
         _commitAndRegister(NAME_NOSTATUS, victim, false);
         assertEq(dotnsReverseResolver.nameOf(victim), "");
 
-        _grantPopFull(victim);
+        _grantPersonhood(victim);
 
         string memory victimPrimary = "victimname01";
         _commitAndRegister(victimPrimary, victim, true);
diff --git a/test/intergration/PopLifecycleFlow.t.sol b/test/intergration/PopLifecycleFlow.t.sol
index 8c6daf07f..ec436751f 100644
--- a/test/intergration/PopLifecycleFlow.t.sol
+++ b/test/intergration/PopLifecycleFlow.t.sol
@@ -11,15 +11,13 @@ import {ILabelStore} from "../../contracts/store/ILabelStore.sol";
 import {LabelUtils} from "../../contracts/utils/LabelUtils.sol";
 
 /// @title PopLifecycleFlow
-/// @notice Integration coverage for a PoP-gateway-minted full username across
+/// @notice Integration coverage for a PoP-gateway-minted personhood name across
 ///         its full on-chain lifecycle: reservation, claim, record writes,
 ///         subname issuance, transfer, and cross-contract lookup paths a
-///         downstream consumer walks starting from the lite username string.
+///         downstream consumer walks starting from the device name string.
 contract PopLifecycleFlow is BaseDotns {
-    /// @notice Lite label fixture. Baselength 7 with 2 trailing digits classifies as PopLite.
-    string internal constant LITE_LABEL = "michael.01";
-    /// @notice Full label fixture. Baselength 9 with no trailing digits classifies as PopFull.
-    string internal constant FULL_LABEL = "alicefull";
+    /// @notice Device name fixture. Baselength 7 with 2 trailing digits classifies as Devicehood.
+    string internal constant DEVICE_LABEL = "michael.01";
     /// @notice Subname label used for the subnode portion of the flow.
     string internal constant SUB_LABEL = "app";
     /// @notice 65-byte canonical chat-key payload (secp256k1 uncompressed shape).
@@ -32,94 +30,102 @@ contract PopLifecycleFlow is BaseDotns {
     bytes internal constant CONTENT_HASH_B =
         hex"e30101701220bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
 
-    function test_recover_full_username_from_lite_label() public {
-        _mintLiteThenClaimFull(ed);
+    function test_recover_personhood_name_from_device_name() public {
+        _issueDeviceThenClaimPersonhood(ed);
 
-        bytes32 liteLabelhash = LabelUtils.labelhashMemory(LITE_LABEL);
-        bytes32 fullNode = dotnsPopResolver.fullClaim(liteLabelhash);
-        assertTrue(fullNode != bytes32(0), "lite label has no full claim");
+        bytes32 deviceLabelhash = LabelUtils.labelhashMemory(DEVICE_LABEL);
+        bytes32 personhoodNode = dotnsPopResolver.personhoodNodeOf(deviceLabelhash);
+        assertTrue(personhoodNode != bytes32(0), "device name has no personhood claim");
 
-        address owner = IERC721(address(dotnsRegistrar)).ownerOf(uint256(fullNode));
+        address owner = IERC721(address(dotnsRegistrar)).ownerOf(uint256(personhoodNode));
         assertEq(owner, ed);
-        assertEq(dotnsRegistrar.labelOf(uint256(fullNode)), FULL_LABEL);
-        assertEq(dotnsPopResolver.chatKey(fullNode), CHAT_KEY);
+        assertEq(dotnsRegistrar.labelOf(uint256(personhoodNode)), PERSONHOOD_LABEL_A);
+        assertEq(dotnsPopResolver.chatKey(personhoodNode), CHAT_KEY);
         // Same label mirrored in the owner's Store under the canonical store key.
         ILabelStore ownerStore = ILabelStore(storeFactory.getLabelStore(owner));
-        assertEq(ownerStore.getLabel(fullNode), string.concat(FULL_LABEL, protocolRegistry.tld()));
+        assertEq(
+            ownerStore.getLabel(personhoodNode),
+            string.concat(PERSONHOOD_LABEL_A, protocolRegistry.tld())
+        );
     }
 
-    function test_pop_full_name_is_soulbound_but_fully_usable() public {
-        _mintLiteThenClaimFull(ed);
+    function test_personhood_name_is_soulbound_but_fully_usable() public {
+        _issueDeviceThenClaimPersonhood(ed);
 
-        bytes32 fullNode = _nodeOf(FULL_LABEL);
-        uint256 fullTokenId = uint256(fullNode);
-        bytes32 liteLabelhash = LabelUtils.labelhashMemory(LITE_LABEL);
+        bytes32 personhoodNode = _nodeOf(PERSONHOOD_LABEL_A);
+        uint256 personhoodTokenId = uint256(personhoodNode);
+        bytes32 deviceLabelhash = LabelUtils.labelhashMemory(DEVICE_LABEL);
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(fullTokenId), ed);
-        assertEq(dotnsRegistry.owner(fullNode), ed);
-        assertEq(dotnsRegistrar.labelOf(fullTokenId), FULL_LABEL);
-        assertEq(dotnsPopResolver.chatKey(fullNode), CHAT_KEY);
-        assertEq(dotnsPopResolver.liteLink(fullNode), liteLabelhash);
-        assertEq(dotnsPopResolver.fullClaim(liteLabelhash), fullNode);
-        assertTrue(dotnsRegistrar.isSoulbound(fullTokenId));
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(personhoodTokenId), ed);
+        assertEq(dotnsRegistry.owner(personhoodNode), ed);
+        assertEq(dotnsRegistrar.labelOf(personhoodTokenId), PERSONHOOD_LABEL_A);
+        assertEq(dotnsPopResolver.chatKey(personhoodNode), CHAT_KEY);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodNode), deviceLabelhash);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceLabelhash), personhoodNode);
+        assertTrue(dotnsRegistrar.isSoulbound(personhoodTokenId));
 
         // The name is fully usable by its owner: records and subnames work.
         vm.prank(ed);
-        dotnsContentResolver.setContenthash(fullNode, CONTENT_HASH_A);
-        assertEq(dotnsContentResolver.contenthash(fullNode), CONTENT_HASH_A);
+        dotnsContentResolver.setContenthash(personhoodNode, CONTENT_HASH_A);
+        assertEq(dotnsContentResolver.contenthash(personhoodNode), CONTENT_HASH_A);
 
-        bytes32 subnode = _setSubnode(ed, fullNode, SUB_LABEL, FULL_LABEL, leonardo);
+        bytes32 subnode = _setSubnode(ed, personhoodNode, SUB_LABEL, PERSONHOOD_LABEL_A, leonardo);
         assertEq(dotnsRegistry.owner(subnode), leonardo);
 
         // It is soulbound: quoting a transfer and attempting one both revert, and ownership
         // does not move.
-        vm.expectRevert(abi.encodeWithSelector(IDotnsRegistrar.NameSoulbound.selector, fullTokenId));
-        dotnsRegistrar.quoteTransferFee(fullTokenId, tiago);
+        vm.expectRevert(
+            abi.encodeWithSelector(IDotnsRegistrar.NameSoulbound.selector, personhoodTokenId)
+        );
+        dotnsRegistrar.quoteTransferFee(personhoodTokenId, tiago);
 
-        vm.expectRevert(abi.encodeWithSelector(IDotnsRegistrar.NameSoulbound.selector, fullTokenId));
+        vm.expectRevert(
+            abi.encodeWithSelector(IDotnsRegistrar.NameSoulbound.selector, personhoodTokenId)
+        );
         vm.prank(ed);
-        dotnsRegistrar.transferFrom(ed, tiago, fullTokenId);
+        dotnsRegistrar.transferFrom(ed, tiago, personhoodTokenId);
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(fullTokenId), ed);
-        assertEq(dotnsRegistry.owner(fullNode), ed);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(personhoodTokenId), ed);
+        assertEq(dotnsRegistry.owner(personhoodNode), ed);
         // PoP-layer records and the owner's continued control are untouched by the blocked move.
-        assertEq(dotnsPopResolver.chatKey(fullNode), CHAT_KEY);
-        assertEq(dotnsPopResolver.fullClaim(liteLabelhash), fullNode);
-        assertEq(dotnsContentResolver.contenthash(fullNode), CONTENT_HASH_A);
+        assertEq(dotnsPopResolver.chatKey(personhoodNode), CHAT_KEY);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceLabelhash), personhoodNode);
+        assertEq(dotnsContentResolver.contenthash(personhoodNode), CONTENT_HASH_A);
         assertEq(dotnsRegistry.owner(subnode), leonardo);
 
         vm.prank(ed);
-        dotnsContentResolver.setContenthash(fullNode, CONTENT_HASH_B);
-        assertEq(dotnsContentResolver.contenthash(fullNode), CONTENT_HASH_B);
+        dotnsContentResolver.setContenthash(personhoodNode, CONTENT_HASH_B);
+        assertEq(dotnsContentResolver.contenthash(personhoodNode), CONTENT_HASH_B);
 
-        bytes32 reassignedSubnode = _setSubnode(ed, fullNode, SUB_LABEL, FULL_LABEL, tiago);
+        bytes32 reassignedSubnode =
+            _setSubnode(ed, personhoodNode, SUB_LABEL, PERSONHOOD_LABEL_A, tiago);
         assertEq(reassignedSubnode, subnode);
         assertEq(dotnsRegistry.owner(subnode), tiago);
-        // The lite name is a subname owned in the registry, not a transferable token.
-        assertEq(dotnsRegistry.owner(_liteNodeOf(LITE_LABEL)), ed);
-        assertFalse(dotnsRegistrar.exists(uint256(_liteNodeOf(LITE_LABEL))));
+        // The device name is a subname owned in the registry, not a transferable token.
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL)), ed);
+        assertFalse(dotnsRegistrar.exists(uint256(_deviceNodeOf(DEVICE_LABEL))));
     }
 
     function test_cold_gateway_reserve_then_user_settles_pending_claim() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL, user: ed, chatKey: CHAT_KEY
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: ed, chatKey: CHAT_KEY
             })
         );
 
-        bytes32 liteNode = _liteNodeOf(LITE_LABEL);
-        assertEq(dotnsRegistry.owner(liteNode), ed);
-        assertEq(dotnsRegistry.owner(liteNode), ed);
+        bytes32 deviceNode = _deviceNodeOf(DEVICE_LABEL);
+        assertEq(dotnsRegistry.owner(deviceNode), ed);
+        assertEq(dotnsRegistry.owner(deviceNode), ed);
         assertEq(storeFactory.getLabelStore(ed), address(0));
         // Chat key is persisted eagerly on the resolver at reserve time; only the
         // LabelStore write is deferred for cold-path users.
-        assertEq(dotnsPopResolver.chatKey(liteNode), CHAT_KEY);
+        assertEq(dotnsPopResolver.chatKey(deviceNode), CHAT_KEY);
 
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
-        assertEq(pending[0].label, LITE_LABEL);
+        assertEq(pending[0].label, DEVICE_LABEL);
         assertGt(pending[0].mintedAt, 0);
 
         vm.prank(ed);
@@ -128,18 +134,19 @@ contract PopLifecycleFlow is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(liteNode), string.concat(LITE_LABEL, protocolRegistry.tld())
+            ILabelStore(store).getLabel(deviceNode),
+            string.concat(DEVICE_LABEL, protocolRegistry.tld())
         );
-        assertEq(dotnsPopResolver.chatKey(liteNode), CHAT_KEY);
+        assertEq(dotnsPopResolver.chatKey(deviceNode), CHAT_KEY);
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
     }
 
     function test_reserve_settle_reserve_cycle_for_same_user() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL, user: ed, chatKey: CHAT_KEY
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: ed, chatKey: CHAT_KEY
             })
         );
         uint64 firstMintedAt = dotnsPopController.pendingClaims(ed, 0, 1)[0].mintedAt;
@@ -154,67 +161,67 @@ contract PopLifecycleFlow is BaseDotns {
 
         address store = storeFactory.getLabelStore(ed);
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL)),
-            string.concat(LITE_LABEL, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL)),
+            string.concat(DEVICE_LABEL, protocolRegistry.tld())
         );
 
         string memory secondLabel = "michael.02";
         bytes memory secondKey =
             hex"04beefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafedeadbeefcafe";
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: secondLabel, user: ed, chatKey: secondKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: secondLabel, user: ed, chatKey: secondKey
             })
         );
 
         // The user is warm now, so the second reservation writes straight into the store.
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(secondLabel)),
+            ILabelStore(store).getLabel(_deviceNodeOf(secondLabel)),
             string.concat(secondLabel, protocolRegistry.tld())
         );
-        assertEq(dotnsPopResolver.chatKey(_liteNodeOf(secondLabel)), secondKey);
+        assertEq(dotnsPopResolver.chatKey(_deviceNodeOf(secondLabel)), secondKey);
         assertGt(firstMintedAt, 0);
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
     }
 
     function test_gateway_name_with_live_pending_claim_is_soulbound_and_settles_for_owner() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL, user: ed, chatKey: CHAT_KEY
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: ed, chatKey: CHAT_KEY
             })
         );
 
-        // The lite name is a subname owned in the registry, not a transferable ERC-721 token, so it
-        // cannot be moved out of the beneficiary's wallet before settlement: there is no token to
-        // transfer and the owner holds no reassignment primitive. This is the path the issue
+        // The device name is a subname owned in the registry, not a transferable ERC-721 token, so
+        // it cannot be moved out of the beneficiary's wallet before settlement: there is no token
+        // to transfer and the owner holds no reassignment primitive. This is the path the issue
         // closes: a pre-claim transfer previously escaped tier pricing entirely.
-        bytes32 liteNode = _liteNodeOf(LITE_LABEL);
-        assertEq(dotnsRegistry.owner(liteNode), ed);
-        assertFalse(dotnsRegistrar.exists(uint256(liteNode)));
+        bytes32 deviceNode = _deviceNodeOf(DEVICE_LABEL);
+        assertEq(dotnsRegistry.owner(deviceNode), ed);
+        assertFalse(dotnsRegistrar.exists(uint256(deviceNode)));
 
         // The pending claim is keyed by the original user and still settles into their store.
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
-        assertEq(pending[0].label, LITE_LABEL);
+        assertEq(pending[0].label, DEVICE_LABEL);
         assertGt(pending[0].mintedAt, 0);
 
         vm.prank(ed);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
         address edStore = storeFactory.getLabelStore(ed);
         assertTrue(edStore != address(0));
-        bytes32 node = _liteNodeOf(LITE_LABEL);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL);
         assertEq(
-            ILabelStore(edStore).getLabel(node), string.concat(LITE_LABEL, protocolRegistry.tld())
+            ILabelStore(edStore).getLabel(node), string.concat(DEVICE_LABEL, protocolRegistry.tld())
         );
     }
 
     function test_lapsed_pending_claim_settles_and_deploys_store() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL, user: ed, chatKey: CHAT_KEY
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: ed, chatKey: CHAT_KEY
             })
         );
 
@@ -222,54 +229,55 @@ contract PopLifecycleFlow is BaseDotns {
 
         // Permissionless settlement from a stranger address: age never drops the claim, so the
         // store is deployed for the beneficiary and the label is written and readable.
-        bytes32 liteNode = _liteNodeOf(LITE_LABEL);
+        bytes32 deviceNode = _deviceNodeOf(DEVICE_LABEL);
         vm.prank(makeAddr("settler"));
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
 
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(liteNode), string.concat(LITE_LABEL, protocolRegistry.tld())
+            ILabelStore(store).getLabel(deviceNode),
+            string.concat(DEVICE_LABEL, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
     }
 
-    function test_lite_via_gateway_then_full_via_public_after_upgrade() public {
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL, user: ed, chatKey: CHAT_KEY
+    function test_device_name_via_gateway_then_personhood_name_via_public_after_upgrade() public {
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: ed, chatKey: CHAT_KEY
             })
         );
 
-        bytes32 liteNode = _liteNodeOf(LITE_LABEL);
-        assertEq(dotnsRegistry.owner(liteNode), ed);
+        bytes32 deviceNode = _deviceNodeOf(DEVICE_LABEL);
+        assertEq(dotnsRegistry.owner(deviceNode), ed);
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         string memory popfullLabel = "alicedef";
         _commitAndRegister(popfullLabel, ed, false);
 
-        bytes32 fullNode = _nodeOf(popfullLabel);
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(fullNode)), ed);
-        assertEq(dotnsRegistry.owner(liteNode), ed);
+        bytes32 personhoodNode = _nodeOf(popfullLabel);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(personhoodNode)), ed);
+        assertEq(dotnsRegistry.owner(deviceNode), ed);
     }
 
-    /// @notice Mints the lite label for `user` then claims the full label against it.
-    /// @dev Grants PopFull up front so both the lite reservation leg and the
-    ///      reservedBaseLabel leg pass `priceWithCheck`.
-    function _mintLiteThenClaimFull(address user) internal {
-        // The reservedBaseLabel leg of reserveBaseName now runs
-        // priceWithCheck on FULL_LABEL too, and FULL_LABEL classifies as
-        // PopFull. Granting PopFull up front satisfies classification/tier
-        // on both the lite leg (PopLite classification, admitted by the
-        // PopFull superset) and the full-person claim.
-        _grantPopFull(user);
-        _reservePop(user, LITE_LABEL, CHAT_KEY, FULL_LABEL);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: FULL_LABEL, user: user, link: _linkWithLite(LITE_LABEL)
+    /// @notice Mints the device name for `user` then claims the personhood label against it.
+    /// @dev Grants Personhood up front so both the device-name reservation leg and the
+    ///      reservedLabel leg pass `priceWithCheck`.
+    function _issueDeviceThenClaimPersonhood(address user) internal {
+        // The reservedLabel leg of reserveBaseName now runs
+        // priceWithCheck on PERSONHOOD_LABEL_A too, and PERSONHOOD_LABEL_A classifies as
+        // Personhood. Granting Personhood up front satisfies classification/tier
+        // on both the device-name issuance (Devicehood classification, admitted by the
+        // Personhood superset) and the personhood claim.
+        _grantPersonhood(user);
+        _reservePop(user, DEVICE_LABEL, CHAT_KEY, PERSONHOOD_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: user, link: _linkWithDeviceName(DEVICE_LABEL)
             })
         );
     }
diff --git a/test/intergration/StoreIntegration.t.sol b/test/intergration/StoreIntegration.t.sol
index 3150dd517..ece1f0d33 100644
--- a/test/intergration/StoreIntegration.t.sol
+++ b/test/intergration/StoreIntegration.t.sol
@@ -51,7 +51,7 @@ contract StoreIntegrationTest is BaseDotns {
     }
 
     function test_pop_controller_registration_writes_label_store() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         string memory base = BASE_LABEL_A;
         // DotnsPopResolver.setChatKey requires exactly 65 bytes (uncompressed ECDSA pubkey).
@@ -61,8 +61,10 @@ contract StoreIntegrationTest is BaseDotns {
             chatKey[i] = bytes1(uint8(i + 1));
         }
 
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: base, user: ed, link: _linkFresh(chatKey)})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: base, user: ed, link: _linkFresh(chatKey)
+            })
         );
 
         vm.prank(ed);
diff --git a/test/invariant/escrow/DotnsNameEscrowInvariant.t.sol b/test/invariant/escrow/DotnsNameEscrowInvariant.t.sol
index e81a2bd1b..99752fcef 100644
--- a/test/invariant/escrow/DotnsNameEscrowInvariant.t.sol
+++ b/test/invariant/escrow/DotnsNameEscrowInvariant.t.sol
@@ -5,7 +5,7 @@ import {BaseDotns} from "../../base/BaseDotns.t.sol";
 import {IDotnsNameEscrow} from "../../../contracts/escrow/IDotnsNameEscrow.sol";
 import {EscrowHandler} from "./EscrowHandler.t.sol";
 
-/// @title Dotns Name Escrow Invariant Suite
+/// @title dotNS Name Escrow Invariant Suite
 /// @notice Asserts solvency, custody, and recipient-locking properties of the name escrow
 ///         across randomised registration, release, withdraw, claim, and transfer flows.
 contract DotnsNameEscrowInvariantTest is BaseDotns {
diff --git a/test/invariant/escrow/EscrowHandler.t.sol b/test/invariant/escrow/EscrowHandler.t.sol
index 752da2722..3fd67404b 100644
--- a/test/invariant/escrow/EscrowHandler.t.sol
+++ b/test/invariant/escrow/EscrowHandler.t.sol
@@ -162,7 +162,7 @@ contract EscrowHandler is Test {
     ///      randomly aligns or splits their PoP statuses, and dispatches the controller
     ///      `register()` call from the payer. Routes to the deposit, depositProtocolFee,
     ///      or skip branch depending on the resulting tier prices. Revert-safe: if the
-    ///      computed price is zero on both sides (PoPLite/PoPFull no-cost path) the call
+    ///      computed price is zero on both sides (Devicehood/Personhood no-cost path) the call
     ///      still completes but ghost state is only updated where state actually changed.
     /// @param ownerSeed Seed selecting the registrant.
     /// @param payerSeed Seed selecting the payer.
@@ -174,21 +174,21 @@ contract EscrowHandler is Test {
         address ownerAddr = _pickDifferentActor(payer, payerSeed);
         if (ownerAddr == address(0)) return;
 
-        // Tier-status assignment: 0 = both NoStatus, 1 = elevate payer to PopFull,
-        // 2 = elevate owner to PopLite, 3 = elevate both (no fee differential).
+        // Tier-status assignment: 0 = both NoStatus, 1 = elevate payer to Personhood,
+        // 2 = elevate owner to Devicehood, 3 = elevate both (no fee differential).
         uint256 mode = bound(statusSeed, 0, 3);
         if (mode == 0) {
             _mockPersonhoodTier(payer, IPopRules.PopStatus.NoStatus);
             _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.NoStatus);
         } else if (mode == 1) {
-            _mockPersonhoodTier(payer, IPopRules.PopStatus.PopFull);
+            _mockPersonhoodTier(payer, IPopRules.PopStatus.Personhood);
             _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.NoStatus);
         } else if (mode == 2) {
             _mockPersonhoodTier(payer, IPopRules.PopStatus.NoStatus);
-            _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.PopLite);
+            _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.Devicehood);
         } else if (mode == 3) {
-            _mockPersonhoodTier(payer, IPopRules.PopStatus.PopFull);
-            _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.PopFull);
+            _mockPersonhoodTier(payer, IPopRules.PopStatus.Personhood);
+            _mockPersonhoodTier(ownerAddr, IPopRules.PopStatus.Personhood);
         }
 
         string memory label = _generateUniqueLabel();
@@ -450,7 +450,7 @@ contract EscrowHandler is Test {
     }
 
     /// @notice Sets a random PoP status for an actor mid-run.
-    /// @dev Bound: 0 = NoStatus, 1 = PopLite, 2 = PopFull. Allows the fuzzer to flip
+    /// @dev Bound: 0 = NoStatus, 1 = Devicehood, 2 = Personhood. Allows the fuzzer to flip
     ///      tiers between handler calls so subsequent registrations and transfers exercise
     ///      every routing branch.
     /// @param actorSeed Seed selecting the actor whose status flips.
@@ -469,8 +469,8 @@ contract EscrowHandler is Test {
     /// @param tier Verification tier to report for `account`.
     function _mockPersonhoodTier(address account, IPopRules.PopStatus tier) internal {
         uint8 statusByte;
-        if (tier == IPopRules.PopStatus.PopFull) statusByte = 2;
-        else if (tier == IPopRules.PopStatus.PopLite) statusByte = 1;
+        if (tier == IPopRules.PopStatus.Personhood) statusByte = 2;
+        else if (tier == IPopRules.PopStatus.Devicehood) statusByte = 1;
 
         bytes32 contextAlias =
             statusByte == 0 ? bytes32(0) : keccak256(abi.encode(account, statusByte));
diff --git a/test/invariant/registrar/DotnsPopControllerInvariant.t.sol b/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
index 1bb895c38..8251b98bf 100644
--- a/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
+++ b/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
@@ -63,7 +63,7 @@ contract DotnsPopControllerInvariant is BaseDotns {
     ///      warp, relink and the two settlement paths) fill no list of their own and are left
     ///      to the campaign.
     function _seedCoverage() internal {
-        // A reserve, then a claim on the same base label, so a lite name and a full-person name
+        // A reserve, then a claim on the same base label, so a device name and a personhood name
         // both exist and the actor's store is settled.
         handler.reserve(0, 0, true);
         handler.claim(0, 0);
@@ -71,10 +71,10 @@ contract DotnsPopControllerInvariant is BaseDotns {
         // An odd base index takes a label of the public path's own, which the gateway cannot
         // have claimed; the transfer then picks the public token that registration minted.
         handler.publicRegister(1, 1);
-        handler.attemptTransfer(handler.mintedLiteTokenCount(), 0);
+        handler.attemptTransfer(handler.mintedDeviceTokenCount(), 0);
 
         // Sub-labels come from a seed and most are not valid DNS labels, so walk seeds until
-        // one is accepted under a full-person parent.
+        // one is accepted under a personhood parent.
         for (uint256 seed; seed < 64 && handler.subnodeCreatedCount() == 0; ++seed) {
             handler.createSubname(seed, seed, seed);
         }
@@ -91,7 +91,7 @@ contract DotnsPopControllerInvariant is BaseDotns {
     }
 
     /// @notice A user-created subname never collides with a name the gateway issued.
-    /// @dev A gateway full-person name is a second-level node and a gateway lite name is a subname
+    /// @dev A gateway personhood name is a second-level node and a gateway device name is a subname
     ///      of its numeric container; a subname a user builds under a name they own must land on
     ///      neither, or a user could reach a gateway-issued node.
     function invariant_subnames_never_reach_a_gateway_node() public view {
@@ -102,7 +102,8 @@ contract DotnsPopControllerInvariant is BaseDotns {
             bytes32 subnode = handler.subnodesCreated(i);
             for (uint256 j = 0; j < gatewayCount; j++) {
                 string memory label = handler.gatewayLabelsSeen(j);
-                bytes32 gatewayNode = _carriesSeparator(label) ? _liteNodeOf(label) : _nodeOf(label);
+                bytes32 gatewayNode =
+                    _carriesSeparator(label) ? _deviceNodeOf(label) : _nodeOf(label);
                 assertTrue(subnode != gatewayNode, "subnode collided with a gateway name");
             }
         }
@@ -149,11 +150,11 @@ contract DotnsPopControllerInvariant is BaseDotns {
             string memory label = handler.gatewayLabelsSeen(i);
             assertFalse(handler.isPublicLabel(label), "gateway label taken publicly");
             if (_carriesSeparator(label)) {
-                // A lite name is a subname owned in the registry, non-transferable because there is
-                // no token behind it, not through the soulbound flag.
-                bytes32 node = _liteNodeOf(label);
-                assertTrue(dotnsRegistry.owner(node) != address(0), "gateway lite name unowned");
-                assertFalse(dotnsRegistrar.exists(uint256(node)), "gateway lite name is a token");
+                // A device name is a subname owned in the registry, non-transferable because there
+                // is no token behind it, not through the soulbound flag.
+                bytes32 node = _deviceNodeOf(label);
+                assertTrue(dotnsRegistry.owner(node) != address(0), "gateway device name unowned");
+                assertFalse(dotnsRegistrar.exists(uint256(node)), "gateway device name is a token");
             } else {
                 assertTrue(dotnsRegistrar.isSoulbound(uint256(_nodeOf(label))), "gateway name free");
             }
@@ -236,56 +237,72 @@ contract DotnsPopControllerInvariant is BaseDotns {
         }
     }
 
-    /// @notice For every historic (liteLabelhash, fullNode) pair the resolver's
+    /// @notice For every historic (deviceLabelhash, personhoodNode) pair the resolver's
     ///         forward and reverse indexes either still round-trip to each
     ///         other or have both been cleared by a later overwrite. A partial
     ///         overwrite, where one side still points at a stale partner, is
     ///         the corruption signature this invariant guards against.
-    function invariant_fullClaim_liteLink_are_inverse() public view {
+    function invariant_personhoodLink_deviceLink_are_inverse() public view {
         uint256 n = handler.claimedCount();
         for (uint256 i = 0; i < n; i++) {
-            bytes32 liteLabelhash = handler.claimedLiteLabelhashes(i);
-            bytes32 fullNode = handler.claimedFullNodes(i);
+            bytes32 deviceLabelhash = handler.claimedDeviceLabelhashes(i);
+            bytes32 personhoodNode = handler.claimedPersonhoodNodes(i);
 
-            bytes32 currentFullForLite = dotnsPopResolver.fullClaim(liteLabelhash);
-            bytes32 currentLiteForFull = dotnsPopResolver.liteLink(fullNode);
+            bytes32 currentPersonhoodForDevice = dotnsPopResolver.personhoodNodeOf(deviceLabelhash);
+            bytes32 currentDeviceForPersonhood = dotnsPopResolver.deviceLabelhashOf(personhoodNode);
 
             // Either the pair is still live on both sides, or both sides
             // have been cleared. Anything else is a partial overwrite.
-            if (currentFullForLite == fullNode) {
-                assertEq(currentLiteForFull, liteLabelhash, "live fullClaim but liteLink drifted");
-            } else if (currentLiteForFull == liteLabelhash) {
-                assertEq(currentFullForLite, fullNode, "live liteLink but fullClaim drifted");
+            if (currentPersonhoodForDevice == personhoodNode) {
+                assertEq(
+                    currentDeviceForPersonhood,
+                    deviceLabelhash,
+                    "live personhoodNodeOf but deviceLabelhashOf drifted"
+                );
+            } else if (currentDeviceForPersonhood == deviceLabelhash) {
+                assertEq(
+                    currentPersonhoodForDevice,
+                    personhoodNode,
+                    "live deviceLabelhashOf but personhoodNodeOf drifted"
+                );
             }
             // Else: both sides were overwritten. Covered by the stale
             // invariants below.
         }
     }
 
-    /// @notice No stale `liteLink`: for every touched fullNode, a non-zero
-    ///         liteLink value round-trips through `fullClaim` back to the same
-    ///         fullNode. A drifting liteLink is the corruption footprint this
+    /// @notice No stale `deviceLabelhashOf`: for every touched personhoodNode, a non-zero
+    ///         device labelhash round-trips through `personhoodNodeOf` back to the same
+    ///         personhoodNode. A drifting device labelhash is the corruption footprint this
     ///         invariant guards against.
-    function invariant_no_stale_liteLink() public view {
+    function invariant_no_stale_deviceLabelhash() public view {
         uint256 n = handler.claimedCount();
         for (uint256 i = 0; i < n; i++) {
-            bytes32 fullNode = handler.claimedFullNodes(i);
-            bytes32 currentLite = dotnsPopResolver.liteLink(fullNode);
-            if (currentLite == bytes32(0)) continue;
-            assertEq(dotnsPopResolver.fullClaim(currentLite), fullNode, "stale liteLink");
+            bytes32 personhoodNode = handler.claimedPersonhoodNodes(i);
+            bytes32 currentDevice = dotnsPopResolver.deviceLabelhashOf(personhoodNode);
+            if (currentDevice == bytes32(0)) continue;
+            assertEq(
+                dotnsPopResolver.personhoodNodeOf(currentDevice),
+                personhoodNode,
+                "stale deviceLabelhashOf"
+            );
         }
     }
 
-    /// @notice No stale `fullClaim`: symmetric to `invariant_no_stale_liteLink`,
-    ///         every claimed liteLabelhash with a non-zero fullClaim round-trips
-    ///         through `liteLink` back to the same liteLabelhash.
-    function invariant_no_stale_fullClaim() public view {
+    /// @notice No stale `personhoodNodeOf`: symmetric to `invariant_no_stale_deviceLabelhash`,
+    ///         every claimed deviceLabelhash with a non-zero personhood node round-trips
+    ///         through `deviceLabelhashOf` back to the same deviceLabelhash.
+    function invariant_no_stale_personhoodNode() public view {
         uint256 n = handler.claimedCount();
         for (uint256 i = 0; i < n; i++) {
-            bytes32 liteLabelhash = handler.claimedLiteLabelhashes(i);
-            bytes32 currentFull = dotnsPopResolver.fullClaim(liteLabelhash);
-            if (currentFull == bytes32(0)) continue;
-            assertEq(dotnsPopResolver.liteLink(currentFull), liteLabelhash, "stale fullClaim");
+            bytes32 deviceLabelhash = handler.claimedDeviceLabelhashes(i);
+            bytes32 currentPersonhood = dotnsPopResolver.personhoodNodeOf(deviceLabelhash);
+            if (currentPersonhood == bytes32(0)) continue;
+            assertEq(
+                dotnsPopResolver.deviceLabelhashOf(currentPersonhood),
+                deviceLabelhash,
+                "stale personhoodNodeOf"
+            );
         }
     }
 
@@ -349,22 +366,22 @@ contract DotnsPopControllerInvariant is BaseDotns {
         assertEq(page.length, count, "count != enumeration length");
     }
 
-    /// @notice Settlement writes labels and never strands a minted name. A full-person name is a
-    ///         token whose settled label reads back from the registrar; a lite name is a registry
+    /// @notice Settlement writes labels and never strands a minted name. A personhood name is a
+    ///         token whose settled label reads back from the registrar; a device name is a registry
     ///         subname whose settled label lives in the owner's store. Either is settled or still
     ///         staged in the owner's pending queue, so a minted name is never left in neither
     /// place.
-    /// @dev The stranded case the old model allowed, a lapsed entry swept out of the queue with
-    ///      nothing written, is now unreachable: settlement always writes the label regardless of
-    ///      the reservation deadline. A deployed store and a pending claim are mutually exclusive
-    /// in this suite, so a lite name whose owner holds a store has necessarily been settled.
+    /// @dev A pending entry is never dropped without its label being written: settlement always
+    ///      writes the label, whatever the claim's age. A deployed store and a pending claim are
+    ///      mutually exclusive in this suite, so a device name whose owner holds a store has
+    ///      necessarily been settled.
     function invariant_settled_names_written_and_never_stranded() public view {
-        uint256 n = handler.mintedLiteTokenCount();
+        uint256 n = handler.mintedDeviceTokenCount();
         for (uint256 i = 0; i < n; i++) {
-            uint256 id = handler.mintedLiteTokenIds(i);
+            uint256 id = handler.mintedDeviceTokenIds(i);
 
             if (dotnsRegistrar.exists(id)) {
-                // Full-person name: a tokenised second-level name. A settled name reads its label
+                // Personhood name: a tokenised second-level name. A settled name reads its label
                 // back from the registrar; otherwise it must still be staged in its owner's queue.
                 if (bytes(dotnsRegistrar.labelOf(id)).length != 0) continue;
                 assertTrue(
@@ -374,28 +391,28 @@ contract DotnsPopControllerInvariant is BaseDotns {
                 continue;
             }
 
-            // Lite name: a registry subname, not a token. It is owned in the registry, and settled
-            // into the owner's store or still staged in pending. Store and pending are mutually
-            // exclusive here, so a deployed store means the label was written.
+            // Device name: a registry subname, not a token. It is owned in the registry, and
+            // settled into the owner's store or still staged in pending. Store and pending are
+            // mutually exclusive here, so a deployed store means the label was written.
             bytes32 node = bytes32(id);
             address nameOwner = dotnsRegistry.owner(node);
-            assertTrue(nameOwner != address(0), "lite name lost its registry owner");
+            assertTrue(nameOwner != address(0), "device name lost its registry owner");
             if (IStoreFactory(address(storeFactory)).getLabelStore(nameOwner) != address(0)) {
                 continue;
             }
-            assertTrue(_stagedInPending(nameOwner, node), "lite name neither settled nor staged");
+            assertTrue(_stagedInPending(nameOwner, node), "device name neither settled nor staged");
         }
     }
 
     /// @notice Whether `owner` holds a pending claim whose label derives to `node`.
-    /// @dev A lite label carries the separator and derives to its subnode; any other label derives
+    /// @dev A device name carries the separator and derives to its subnode; any other label derives
     ///      to a second-level node under the TLD.
     function _stagedInPending(address owner, bytes32 node) internal view returns (bool staged) {
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(owner, 0, type(uint256).max);
         for (uint256 j = 0; j < pending.length; j++) {
             bytes32 pendingNode = _carriesSeparator(pending[j].label)
-                ? _liteNodeOf(pending[j].label)
+                ? _deviceNodeOf(pending[j].label)
                 : _nodeOf(pending[j].label);
             if (pendingNode == node) return true;
         }
diff --git a/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol b/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
index 70b4ae56e..45467623d 100644
--- a/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
+++ b/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
@@ -31,15 +31,15 @@ contract DotnsRegistrarControllerInvariantTest is BaseDotns {
 
         vm.deal(address(handler), 1000 ether);
 
-        handler.addActor(ed, IPopRules.PopStatus.PopFull);
-        handler.addActor(leonardo, IPopRules.PopStatus.PopLite);
+        handler.addActor(ed, IPopRules.PopStatus.Personhood);
+        handler.addActor(leonardo, IPopRules.PopStatus.Devicehood);
         handler.addActor(tiago, IPopRules.PopStatus.NoStatus);
 
         // Additional actors for richer multi-user transfer chains.
         address alice = _createUser("alice");
         address bob = _createUser("bob");
-        handler.addActor(alice, IPopRules.PopStatus.PopFull);
-        handler.addActor(bob, IPopRules.PopStatus.PopLite);
+        handler.addActor(alice, IPopRules.PopStatus.Personhood);
+        handler.addActor(bob, IPopRules.PopStatus.Devicehood);
 
         targetContract(address(handler));
 
diff --git a/test/invariant/registrar/DotnsRegistrarReservedGrantInvariant.t.sol b/test/invariant/registrar/DotnsRegistrarReservedGrantInvariant.t.sol
index 78621251f..aff8791de 100644
--- a/test/invariant/registrar/DotnsRegistrarReservedGrantInvariant.t.sol
+++ b/test/invariant/registrar/DotnsRegistrarReservedGrantInvariant.t.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 import {BaseDotns} from "../../base/BaseDotns.t.sol";
 import {ReservedGrantHandler} from "./ReservedGrantHandler.t.sol";
 
-/// @title Dotns Reserved Grant Invariant Suite
+/// @title dotNS Reserved Grant Invariant Suite
 /// @notice Asserts the properties the grant-gated reserved path exists to provide, across any
 ///         reachable interleaving of grants, relayed mints, ungranted attempts and double spends:
 ///         only granted labels mint, they mint to the beneficiary rather than the submitter, a
diff --git a/test/invariant/registrar/DotnsRegistrarSoulboundInvariant.t.sol b/test/invariant/registrar/DotnsRegistrarSoulboundInvariant.t.sol
index 014fe288f..5f7495bc1 100644
--- a/test/invariant/registrar/DotnsRegistrarSoulboundInvariant.t.sol
+++ b/test/invariant/registrar/DotnsRegistrarSoulboundInvariant.t.sol
@@ -4,7 +4,7 @@ pragma solidity ^0.8.34;
 import {BaseDotns} from "../../base/BaseDotns.t.sol";
 import {SoulboundHandler} from "./SoulboundHandler.t.sol";
 
-/// @title Dotns Registrar Soulbound Invariant Suite
+/// @title dotNS Registrar Soulbound Invariant Suite
 /// @notice Asserts that PoP-gateway (soulbound) names never change owner across any reachable
 ///         sequence of mints and transfer attempts, and that the campaign actually exercises
 ///         soulbound tokens rather than passing vacuously.
diff --git a/test/invariant/registrar/PopControllerHandler.t.sol b/test/invariant/registrar/PopControllerHandler.t.sol
index 32819c7c3..8ebc2c613 100644
--- a/test/invariant/registrar/PopControllerHandler.t.sol
+++ b/test/invariant/registrar/PopControllerHandler.t.sol
@@ -24,7 +24,7 @@ import {IPersonhood} from "../../../contracts/external/personhood/IPersonhood.so
 /// @notice Bounded random-action handler for @custom:contract DotnsPopController invariant tests.
 /// @dev Cycles through an actor set and a fixed base-label set so the fuzzer
 ///      explores combinations deterministically. Tracks every labelhash that has
-///      hosted a reservation, every minted lite token, and every successful
+///      hosted a reservation, every minted device name, and every successful
 ///      claim so invariants can iterate over just what exists.
 contract PopControllerHandler is Test {
     /// @notice The PoP controller under test.
@@ -35,7 +35,7 @@ contract PopControllerHandler is Test {
     DotnsRegistrar public immutable REGISTRAR;
     /// @notice Pricing and classification, read to quote a public registration.
     IPopRules public immutable POP_RULES;
-    /// @notice The hierarchical registry, where a lite name lives as a subname of its container.
+    /// @notice The hierarchical registry, where a device name lives as a subname of its container.
     IDotnsRegistry public immutable REGISTRY;
     /// @notice Node hash of the suite's TLD, injected from the deployed protocol registry.
     /// @dev Keeps the handler rooted at the same TLD the protocol under test uses, without a
@@ -53,32 +53,32 @@ contract PopControllerHandler is Test {
     bytes32[] public reservedLabelsSeen;
     /// @notice Dedup set for `reservedLabelsSeen` to keep iteration cheap.
     mapping(bytes32 labelhash => bool) internal _tracked;
-    /// @notice Monotonic per-actor counter feeding the lite-label suffix so
+    /// @notice Monotonic per-actor counter feeding the device-name suffix so
     ///         each generated label is unique inside an actor's namespace.
-    mapping(address actor => uint64 suffix) internal _liteSuffix;
+    mapping(address actor => uint64 suffix) internal _deviceSuffix;
 
-    /// @notice Lite tokens minted through the handler (one push per successful
-    ///         reserve, plus the lite and full nodes pushed on claim and the
-    ///         full node pushed on reLink). Used by the labelOf-non-empty
+    /// @notice Device names minted through the handler (one push per successful
+    ///         reserve, plus the device and personhood nodes pushed on claim and the
+    ///         personhood node pushed on reLink). Used by the labelOf-non-empty
     ///         invariant to enumerate the token space without scanning the
     ///         full uint256 id range.
-    uint256[] public mintedLiteTokenIds;
-
-    /// @notice Full nodes minted through successful claims, captured alongside
-    ///         the lite labelhash they were linked against. Used by the
-    ///         fullClaim/liteLink inverse invariant: for each entry,
-    ///         fullClaim(liteHash) == node.
-    bytes32[] public claimedFullNodes;
-    /// @notice Lite labelhashes paired index-for-index with `claimedFullNodes`.
-    bytes32[] public claimedLiteLabelhashes;
-
-    /// @notice Prior lite labels reserved by the handler. Used by reLink
-    ///         actions so the fuzzer can re-use an existing lite label
+    uint256[] public mintedDeviceTokenIds;
+
+    /// @notice Personhood nodes minted through successful claims, captured alongside
+    ///         the device-name labelhash they were linked against. Used by the
+    ///         personhoodNodeOf/deviceLabelhashOf inverse invariant: for each entry,
+    ///         personhoodNodeOf(deviceLabelhash) == node.
+    bytes32[] public claimedPersonhoodNodes;
+    /// @notice Device-name labelhashes paired index-for-index with `claimedPersonhoodNodes`.
+    bytes32[] public claimedDeviceLabelhashes;
+
+    /// @notice Prior device names reserved by the handler. Used by reLink
+    ///         actions so the fuzzer can re-use an existing device name
     ///         against a fresh base claim, driving the resolver overwrite
     ///         paths under repeated `(baseLabel, actor)` reuse. Kept as
     ///         the raw string because the controller re-hashes internally
     ///         on every call.
-    string[] public priorLiteLabels;
+    string[] public priorDeviceLabels;
 
     /// @notice Every label the gateway has issued, deduplicated.
     /// @dev Provenance is written once at mint, so this set only grows. The monotonicity
@@ -125,7 +125,7 @@ contract PopControllerHandler is Test {
     mapping(address actor => bool) internal _pendingActorTracked;
 
     /// @notice Seeds the actor pool, base-label set, and personhood mocks so
-    ///         every action call admits both lite and base classifications.
+    ///         every action call admits both device-name and base classifications.
     /// @param controller_ The PoP controller under test.
     /// @param publicController_ The public commit-reveal controller.
     /// @param registrar_ The ERC-721 registrar both controllers mint through.
@@ -149,19 +149,19 @@ contract PopControllerHandler is Test {
         REGISTRY = registry_;
         TLD_NODE = tldNode_;
         actors = actors_;
-        // baselength 8, no trailing digits: PopFull classification.
+        // baselength 8, no trailing digits: Personhood classification.
         baseLabels.push("alicebob");
         // length 12, no trailing digits: NoStatus classification. A reservable base label
-        // keys the reservation queue, which only ever holds a digit-free stem.
+        // keys the reservation queue, which only ever holds a digit-free base name.
         baseLabels.push("wonderlandxy");
         // baselength 10, no trailing digits: NoStatus classification.
         baseLabels.push("carolcarol");
 
-        // Every actor needs PopFull status on the personhood precompile so the
+        // Every actor needs Personhood status on the personhood precompile so the
         // classification/tier guard in PopRules.priceWithCheck admits every
-        // label the handler can generate: PopLite lite labels (PopFull is a
-        // superset of PopLite), PopFull base labels, and NoStatus base labels
-        // (which merely require userStatus != PopLite).
+        // label the handler can generate: Devicehood device names (Personhood is a
+        // superset of Devicehood), Personhood base labels, and NoStatus base labels
+        // (which merely require userStatus != Devicehood).
         for (uint256 i = 0; i < actors_.length; i++) {
             _mockPersonhoodTier(actors_[i], 2);
         }
@@ -178,7 +178,7 @@ contract PopControllerHandler is Test {
     /// @notice Mocks the personhood precompile so `account` reports the given
     ///         status byte for the protocol's personhood context.
     /// @dev Status byte mirrors the precompile's wire format: 0 = NoStatus,
-    ///      1 = PopLite, 2 = PopFull. A zero status clears the context alias.
+    ///      1 = Devicehood, 2 = Personhood. A zero status clears the context alias.
     function _mockPersonhoodTier(address account, uint8 statusByte) internal {
         bytes32 contextAlias =
             statusByte == 0 ? bytes32(0) : keccak256(abi.encode(account, statusByte));
@@ -212,19 +212,19 @@ contract PopControllerHandler is Test {
     }
 
     /// @notice Number of token ids the handler has ever recorded as minted.
-    function mintedLiteTokenCount() external view returns (uint256) {
-        return mintedLiteTokenIds.length;
+    function mintedDeviceTokenCount() external view returns (uint256) {
+        return mintedDeviceTokenIds.length;
     }
 
-    /// @notice Number of successful (lite, full) claim pairs the handler has
+    /// @notice Number of successful (device, personhood) claim pairs the handler has
     ///         recorded.
     function claimedCount() external view returns (uint256) {
-        return claimedFullNodes.length;
+        return claimedPersonhoodNodes.length;
     }
 
-    /// @notice Number of prior lite labels available for reLink replay.
-    function priorLiteLabelCount() external view returns (uint256) {
-        return priorLiteLabels.length;
+    /// @notice Number of prior device names available for reLink replay.
+    function priorDeviceLabelCount() external view returns (uint256) {
+        return priorDeviceLabels.length;
     }
 
     /// @notice Number of actors the handler has ever seen with a pending claim.
@@ -232,30 +232,31 @@ contract PopControllerHandler is Test {
         return pendingClaimActorsSeen.length;
     }
 
-    /// @notice Reserves a lite label for an actor, optionally enqueueing on a
+    /// @notice Reserves a device name for an actor, optionally enqueueing on a
     ///         base label.
     /// @dev Swallows known-good reverts (QueueFull, AlreadyReserved, ERC721
     ///      collision) so the runner keeps exploring.
     function reserve(uint256 actorIndex, uint256 baseIndex, bool attachReservation) external {
         address actor = _actor(actorIndex);
-        _liteSuffix[actor]++;
-        string memory liteLabel = _buildLiteLabel("rsv", actor, _liteSuffix[actor]);
+        _deviceSuffix[actor]++;
+        string memory deviceLabel = _buildDeviceLabel("rsv", actor, _deviceSuffix[actor]);
         string memory reservedBase = attachReservation ? _baseLabel(baseIndex) : "";
 
-        IDotnsPopController.BaseReservation memory params = IDotnsPopController.BaseReservation({
-            lite: IDotnsPopController.LiteRegistration({
-                liteLabel: liteLabel, user: actor, chatKey: ""
-            }),
-            reservedBaseLabel: reservedBase
-        });
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory params =
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: deviceLabel, user: actor, chatKey: ""
+                }),
+                reservedLabel: reservedBase
+            });
 
-        if (_callReserveBaseName(params)) {
+        if (_callIssueDeviceNameWithReservation(params)) {
             if (attachReservation) _track(keccak256(bytes(reservedBase)));
-            // A lite name is a subname beneath its numeric container, not a token, so record its
+            // A device name is a subname beneath its numeric container, not a token, so record its
             // subnode rather than the whole-label hash.
-            mintedLiteTokenIds.push(uint256(SubnodeUtils.liteSubnodeOf(TLD_NODE, liteLabel)));
-            priorLiteLabels.push(liteLabel);
-            _trackGatewayLabel(liteLabel);
+            mintedDeviceTokenIds.push(uint256(SubnodeUtils.deviceSubnodeOf(TLD_NODE, deviceLabel)));
+            priorDeviceLabels.push(deviceLabel);
+            _trackGatewayLabel(deviceLabel);
             _trackPendingActor(actor);
         }
     }
@@ -264,7 +265,7 @@ contract PopControllerHandler is Test {
     ///         head of the queue for the picked base label.
     /// @dev Missing preconditions (wrong actor, expired head, empty queue)
     ///      surface as a revert and are swallowed so the runner keeps
-    ///      leg and the full register leg.
+    ///      leg and the personhood issuance leg.
     function claim(uint256 actorIndex, uint256 baseIndex) external {
         address actor = _actor(actorIndex);
         string memory baseLabel = _baseLabel(baseIndex);
@@ -273,73 +274,77 @@ contract PopControllerHandler is Test {
         if (reservation.labelhash == bytes32(0)) return;
         if (reservation.labelhash != keccak256(bytes(baseLabel))) return;
 
-        _liteSuffix[actor]++;
-        string memory liteLabel = _buildLiteLabel("clm", actor, _liteSuffix[actor]);
+        _deviceSuffix[actor]++;
+        string memory deviceLabel = _buildDeviceLabel("clm", actor, _deviceSuffix[actor]);
 
-        IDotnsPopController.BaseReservation memory liteParams = IDotnsPopController.BaseReservation({
-            lite: IDotnsPopController.LiteRegistration({
-                liteLabel: liteLabel, user: actor, chatKey: ""
-            }),
-            reservedBaseLabel: ""
-        });
-        if (!_callReserveBaseName(liteParams)) return;
-        // Recorded here rather than after the full leg below: the subname exists from this point,
-        // and a full leg that reverts would otherwise leave it outside every invariant's reach. A
-        // lite name is a subname beneath its numeric container, not a token, so record its subnode.
-        mintedLiteTokenIds.push(uint256(SubnodeUtils.liteSubnodeOf(TLD_NODE, liteLabel)));
-        priorLiteLabels.push(liteLabel);
-        _trackGatewayLabel(liteLabel);
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory deviceParams =
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: deviceLabel, user: actor, chatKey: ""
+                }),
+                reservedLabel: ""
+            });
+        if (!_callIssueDeviceNameWithReservation(deviceParams)) return;
+        // Recorded here rather than after the personhood leg below: the subname exists from this
+        // point, and a personhood leg that reverts would otherwise leave it outside every
+        // invariant's reach. A device name is a subname beneath its numeric container, not a token,
+        // so record its subnode.
+        mintedDeviceTokenIds.push(uint256(SubnodeUtils.deviceSubnodeOf(TLD_NODE, deviceLabel)));
+        priorDeviceLabels.push(deviceLabel);
+        _trackGatewayLabel(deviceLabel);
         _trackPendingActor(actor);
 
-        // The lite leg stashed a pending claim. Settle it now so the base
+        // The the issuance stashed a pending claim. Settle it now so the base
         // registration below takes the warm path; the pending-claim mechanism
         // forbids a second stash for the same user.
         vm.prank(actor);
         try CONTROLLER.settlePendingClaims(actor, type(uint256).max) {} catch {}
 
         IDotnsPopController.Link memory link = IDotnsPopController.Link({
-            kind: IDotnsPopController.LinkKind.LiteUsername, liteLabel: liteLabel, chatKey: ""
+            kind: IDotnsPopController.LinkKind.DeviceName, deviceLabel: deviceLabel, chatKey: ""
         });
-        IDotnsPopController.FullRegistration memory fullParams =
-            IDotnsPopController.FullRegistration({label: baseLabel, user: actor, link: link});
-        if (!_callRegisterBaseName(fullParams)) return;
-
-        bytes32 fullNode = LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
-        claimedLiteLabelhashes.push(LabelUtils.labelhashMemory(liteLabel));
-        claimedFullNodes.push(fullNode);
-        mintedLiteTokenIds.push(uint256(fullNode));
+        IDotnsPopController.PersonhoodNameIssuance memory personhoodParams =
+            IDotnsPopController.PersonhoodNameIssuance({label: baseLabel, user: actor, link: link});
+        if (!_callIssuePersonhoodName(personhoodParams)) return;
+
+        bytes32 personhoodNode =
+            LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
+        claimedDeviceLabelhashes.push(LabelUtils.labelhashMemory(deviceLabel));
+        claimedPersonhoodNodes.push(personhoodNode);
+        mintedDeviceTokenIds.push(uint256(personhoodNode));
         _trackGatewayLabel(baseLabel);
     }
 
-    /// @notice Re-registers an already-used lite label against a fresh
-    ///         base-label claim so the same liteHash maps to a new fullNode.
+    /// @notice Re-registers an already-used device name against a fresh
+    ///         base-label claim so the same deviceLabelhash maps to a new personhoodNode.
     /// @dev Drives the resolver overwrite paths. When the handler
     ///      re-uses the same (baseLabel, actor) pair later it also exercises
-    ///      the symmetric case: same fullNode mapped to a new liteHash.
-    function reLink(uint256 actorIndex, uint256 baseIndex, uint256 liteIndex) external {
-        uint256 liteCount = priorLiteLabels.length;
-        if (liteCount == 0) return;
+    ///      the symmetric case: same personhoodNode mapped to a new deviceLabelhash.
+    function reLink(uint256 actorIndex, uint256 baseIndex, uint256 deviceIndex) external {
+        uint256 deviceCount = priorDeviceLabels.length;
+        if (deviceCount == 0) return;
 
         address actor = _actor(actorIndex);
         string memory baseLabel = _baseLabel(baseIndex);
-        string memory liteLabel = priorLiteLabels[liteIndex % liteCount];
+        string memory deviceLabel = priorDeviceLabels[deviceIndex % deviceCount];
 
         IDotnsPopController.UserReservation memory reservation = CONTROLLER.userReservation(actor);
         if (reservation.labelhash == bytes32(0)) return;
         if (reservation.labelhash != keccak256(bytes(baseLabel))) return;
 
         IDotnsPopController.Link memory link = IDotnsPopController.Link({
-            kind: IDotnsPopController.LinkKind.LiteUsername, liteLabel: liteLabel, chatKey: ""
+            kind: IDotnsPopController.LinkKind.DeviceName, deviceLabel: deviceLabel, chatKey: ""
         });
-        IDotnsPopController.FullRegistration memory params =
-            IDotnsPopController.FullRegistration({label: baseLabel, user: actor, link: link});
-        if (!_callRegisterBaseName(params)) return;
-
-        bytes32 liteLabelhash = LabelUtils.labelhashMemory(liteLabel);
-        bytes32 fullNode = LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
-        claimedLiteLabelhashes.push(liteLabelhash);
-        claimedFullNodes.push(fullNode);
-        mintedLiteTokenIds.push(uint256(fullNode));
+        IDotnsPopController.PersonhoodNameIssuance memory params =
+            IDotnsPopController.PersonhoodNameIssuance({label: baseLabel, user: actor, link: link});
+        if (!_callIssuePersonhoodName(params)) return;
+
+        bytes32 deviceLabelhash = LabelUtils.labelhashMemory(deviceLabel);
+        bytes32 personhoodNode =
+            LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
+        claimedDeviceLabelhashes.push(deviceLabelhash);
+        claimedPersonhoodNodes.push(personhoodNode);
+        mintedDeviceTokenIds.push(uint256(personhoodNode));
         _trackGatewayLabel(baseLabel);
     }
 
@@ -394,7 +399,7 @@ contract PopControllerHandler is Test {
         address registrant = publicActors[actorIndex % publicActors.length];
         // Alternate between a contested base label and one of the public path's own. The
         // contested half exercises the race; the fresh half keeps the public side populated
-        // even in a run where the gateway holds every shared stem, so the provenance
+        // even in a run where the gateway holds every shared base name, so the provenance
         // invariant always has a public label to check. Ten characters classifies NoStatus.
         string memory label = baseIndex % 2 == 0
             ? _baseLabel(baseIndex)
@@ -406,7 +411,7 @@ contract PopControllerHandler is Test {
         ) {
             price = quote.price;
         } catch {
-            // A stem the gateway queue holds for someone else, or a tier the registrant does
+            // A base name the gateway queue holds for someone else, or a tier the registrant does
             // not meet, is priced nowhere. Both are ordinary contention.
             return;
         }
@@ -449,13 +454,13 @@ contract PopControllerHandler is Test {
     ///      registered one moves once the fee is paid. The recipient is a public actor either
     ///      way, so a moved name never deposits a `LabelStore` on a gateway actor.
     function attemptTransfer(uint256 tokenIndex, uint256 toIndex) external {
-        uint256 gatewayCount = mintedLiteTokenIds.length;
+        uint256 gatewayCount = mintedDeviceTokenIds.length;
         uint256 total = gatewayCount + publicTokenIds.length;
         if (total == 0) return;
 
         uint256 pick = tokenIndex % total;
         uint256 tokenId =
-            pick < gatewayCount ? mintedLiteTokenIds[pick] : publicTokenIds[pick - gatewayCount];
+            pick < gatewayCount ? mintedDeviceTokenIds[pick] : publicTokenIds[pick - gatewayCount];
         if (!REGISTRAR.exists(tokenId)) return;
 
         address from = REGISTRAR.ownerOf(tokenId);
@@ -480,10 +485,10 @@ contract PopControllerHandler is Test {
 
     /// @notice Creates an arbitrary subname under a gateway-issued name.
     /// @dev Interleaves subname creation with gateway mints so no subnode can quietly land on an
-    ///      issued name. A lite parent is skipped: this derives the parent node by hashing the
-    ///      whole label under the TLD, which is not a node the gateway minted for a lite name, so
-    ///      the existence check returns early. The subnode owner comes from `publicActors` so a
-    ///      subname never deposits a `LabelStore` on a gateway actor.
+    ///      issued name. A device-name parent is skipped: this derives the parent node by hashing
+    ///      the whole label under the TLD, which is not a node the gateway minted for a device
+    ///      name, so the existence check returns early. The subnode owner comes from `publicActors`
+    ///      so a subname never deposits a `LabelStore` on a gateway actor.
     function createSubname(uint256 parentIndex, uint256 subLabelSeed, uint256 toIndex) external {
         uint256 n = gatewayLabelsSeen.length;
         if (n == 0) return;
@@ -551,12 +556,14 @@ contract PopControllerHandler is Test {
     /// @dev Returns true on success and false on revert so the caller's
     ///      bookkeeping (ghost arrays) stays consistent with on-chain state.
     /// @return ok Whether the underlying call succeeded.
-    function _callReserveBaseName(IDotnsPopController.BaseReservation memory params)
+    function _callIssueDeviceNameWithReservation(
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory params
+    )
         internal
         returns (bool ok)
     {
         _mockOriginIsRoot(true);
-        try CONTROLLER.reserveBaseName(params) {
+        try CONTROLLER.issueDeviceNameWithReservation(params) {
             ok = true;
         } catch {
             ok = false;
@@ -567,14 +574,14 @@ contract PopControllerHandler is Test {
         _mockOriginIsRoot(false);
     }
 
-    /// @notice Mirror of `_callReserveBaseName` for `registerBaseName`.
+    /// @notice Mirror of `_callIssueDeviceNameWithReservation` for `issuePersonhoodName`.
     /// @return ok Whether the underlying call succeeded.
-    function _callRegisterBaseName(IDotnsPopController.FullRegistration memory params)
+    function _callIssuePersonhoodName(IDotnsPopController.PersonhoodNameIssuance memory params)
         internal
         returns (bool ok)
     {
         _mockOriginIsRoot(true);
-        try CONTROLLER.registerBaseName(params) {
+        try CONTROLLER.issuePersonhoodName(params) {
             ok = true;
         } catch {
             ok = false;
@@ -591,15 +598,15 @@ contract PopControllerHandler is Test {
         );
     }
 
-    /// @notice Builds a classification-valid PoP lite label.
+    /// @notice Builds a classification-valid PoP device name.
     /// @dev Shape: `<tag><4 letters from actor>.<2 digits>`, the separated form the gateway
-    ///      accepts. The stem is 7 characters, which classifies as PopLite under PopRules, and
+    ///      accepts. The stem is 7 characters, which classifies as Devicehood under PopRules, and
     ///      the separator and digits are the suffix. Tag disambiguates the reserve vs claim call
     ///      sites so neither collides with the other in the ERC721 namespace. The letter block
-    ///      is derived from the actor address via keccak so each actor lives in its own lite
+    ///      is derived from the actor address via keccak so each actor lives in its own device-name
     ///      namespace. Suffix wraps modulo 100 so the label keeps exactly two digits;
     ///      collisions past 100 reuses are swallowed by the caller's try/catch.
-    function _buildLiteLabel(
+    function _buildDeviceLabel(
         string memory tag,
         address actor,
         uint64 suffix
diff --git a/test/invariant/registrar/RegistrarControllerHandler.t.sol b/test/invariant/registrar/RegistrarControllerHandler.t.sol
index bd81e23b4..81706442d 100644
--- a/test/invariant/registrar/RegistrarControllerHandler.t.sol
+++ b/test/invariant/registrar/RegistrarControllerHandler.t.sol
@@ -166,13 +166,13 @@ contract RegistrarControllerHandler is Test {
     }
 
     /// @notice Mocks the personhood precompile so it reports `tier` for `account`.
-    /// @dev Mirrors the `BaseDotns._setUserPopStatus` mapping (PopFull = 2,
-    ///      PopLite = 1, anything else = 0) so the handler stays consistent
+    /// @dev Mirrors the `BaseDotns._setUserPopStatus` mapping (Personhood = 2,
+    ///      Devicehood = 1, anything else = 0) so the handler stays consistent
     ///      with the test base.
     function _mockPersonhoodTier(address account, IPopRules.PopStatus tier) internal {
         uint8 statusByte;
-        if (tier == IPopRules.PopStatus.PopFull) statusByte = 2;
-        else if (tier == IPopRules.PopStatus.PopLite) statusByte = 1;
+        if (tier == IPopRules.PopStatus.Personhood) statusByte = 2;
+        else if (tier == IPopRules.PopStatus.Devicehood) statusByte = 1;
 
         bytes32 contextAlias =
             statusByte == 0 ? bytes32(0) : keccak256(abi.encode(account, statusByte));
diff --git a/test/invariant/registry/DotnsRegistryInvariant.t.sol b/test/invariant/registry/DotnsRegistryInvariant.t.sol
index 3d90c3d20..28f73787e 100644
--- a/test/invariant/registry/DotnsRegistryInvariant.t.sol
+++ b/test/invariant/registry/DotnsRegistryInvariant.t.sol
@@ -6,7 +6,7 @@ import {IDotnsRegistry} from "../../../contracts/registry/IDotnsRegistry.sol";
 import {IPopRules} from "../../../contracts/pop/IPopRules.sol";
 import {RegistryHandler} from "./RegistryHandler.t.sol";
 
-/// @title Dotns Registry Invariant Suite
+/// @title dotNS Registry Invariant Suite
 /// @notice Asserts authorisation, persistence, and parent-reassignment properties of the
 ///         hierarchical registry across randomised registration, subnode creation, and
 ///         transfer flows.
@@ -29,12 +29,12 @@ contract DotnsRegistryInvariantTest is BaseDotns {
 
         vm.deal(address(handler), 1000 ether);
 
-        handler.addActor(ed, IPopRules.PopStatus.PopFull);
-        handler.addActor(leonardo, IPopRules.PopStatus.PopLite);
+        handler.addActor(ed, IPopRules.PopStatus.Personhood);
+        handler.addActor(leonardo, IPopRules.PopStatus.Devicehood);
         handler.addActor(tiago, IPopRules.PopStatus.NoStatus);
 
         address alice = _createUser("alice");
-        handler.addActor(alice, IPopRules.PopStatus.PopFull);
+        handler.addActor(alice, IPopRules.PopStatus.Personhood);
 
         targetContract(address(handler));
 
diff --git a/test/invariant/registry/RegistryHandler.t.sol b/test/invariant/registry/RegistryHandler.t.sol
index 5d95f71e1..91fa7e26e 100644
--- a/test/invariant/registry/RegistryHandler.t.sol
+++ b/test/invariant/registry/RegistryHandler.t.sol
@@ -122,8 +122,8 @@ contract RegistryHandler is Test {
     /// @param tier Verification tier to report for `account`.
     function _mockPersonhoodTier(address account, IPopRules.PopStatus tier) internal {
         uint8 statusByte;
-        if (tier == IPopRules.PopStatus.PopFull) statusByte = 2;
-        else if (tier == IPopRules.PopStatus.PopLite) statusByte = 1;
+        if (tier == IPopRules.PopStatus.Personhood) statusByte = 2;
+        else if (tier == IPopRules.PopStatus.Devicehood) statusByte = 1;
 
         bytes32 contextAlias =
             statusByte == 0 ? bytes32(0) : keccak256(abi.encode(account, statusByte));
diff --git a/test/unit/escrow/DotnsNameEscrow.t.sol b/test/unit/escrow/DotnsNameEscrow.t.sol
index 87227ca7b..2fe4feb4a 100644
--- a/test/unit/escrow/DotnsNameEscrow.t.sol
+++ b/test/unit/escrow/DotnsNameEscrow.t.sol
@@ -34,8 +34,8 @@ contract GhostNft is ERC721 {
 ///         @custom:contract DotnsNameEscrow, plus the pull-payment and solvency guarantees.
 contract DotnsNameEscrowTest is BaseDotns {
     /// @notice Default label used across most tests.
-    /// @dev Nine-character stem that classifies as NoStatus; the flat deposit equals
-    ///      BASE_DEPOSIT.
+    /// @dev Eleven characters measured as written, which classifies as NoStatus; the flat deposit
+    ///      equals BASE_DEPOSIT.
     string internal constant LABEL = "labelnine01";
 
     /// @notice Register `label` for `nameOwner` under the NoStatus PoP tier and return its tokenId.
@@ -219,7 +219,7 @@ contract DotnsNameEscrowTest is BaseDotns {
 
     function test_self_registration_seeds_funded_position() public {
         string memory popLabel = "selfregis";
-        bytes32 node = _register(popLabel, ed, IPopRules.PopStatus.PopFull);
+        bytes32 node = _register(popLabel, ed, IPopRules.PopStatus.Personhood);
         uint256 tokenId = uint256(node);
 
         vm.prank(ed);
@@ -410,9 +410,9 @@ contract DotnsNameEscrowTest is BaseDotns {
     function test_funded_position_rebinds_to_new_holder_on_transfer() public {
         string memory label = BASE_LABEL_A;
 
-        _grantPopFull(ed);
-        _grantPopFull(leonardo);
-        _register(label, ed, IPopRules.PopStatus.PopFull);
+        _grantPersonhood(ed);
+        _grantPersonhood(leonardo);
+        _register(label, ed, IPopRules.PopStatus.Personhood);
         uint256 tokenId = _tokenIdForLabel(label);
 
         IDotnsNameEscrow.ReleasePosition memory before = dotnsNameEscrow.getReleasePosition(tokenId);
@@ -456,8 +456,8 @@ contract DotnsNameEscrowTest is BaseDotns {
     function test_downgrade_transfer_pays_name_price() public {
         string memory label = "lights01";
 
-        _grantPopFull(ed);
-        _grantPopLite(leonardo);
+        _grantPersonhood(ed);
+        _grantDevicehood(leonardo);
 
         _commitAndRegister(label, ed, false);
 
@@ -484,17 +484,17 @@ contract DotnsNameEscrowTest is BaseDotns {
         // Downward cross-tier transfer of a funded NoStatus name: the friction fee settles to
         // protocol fees and the deposit travels with the NFT. There is no transfer-time refund:
         // `position.recipient` rebinds to the new holder, the locked deposit follows, and only
-        // the new holder can later release into escrow. Promoting `ed` to PopFull before the
+        // the new holder can later release into escrow. Promoting `ed` to Personhood before the
         // transfer forces `PopRules.transferFloor` to return the base fee D while the position
         // still carries the original `BASE_DEPOSIT` deposit, so both legs of `chargeTransferFee`
         // run in one call.
         uint256 tokenId = _registerNoStatus(LABEL, ed);
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         uint256 startingPrice = popRules.price(LABEL);
         uint256 quotedFee = dotnsRegistrar.quoteTransferFee(tokenId, leonardo);
-        assertEq(quotedFee, startingPrice, "PopFull holder downgrading to NoStatus pays D");
+        assertEq(quotedFee, startingPrice, "Personhood holder downgrading to NoStatus pays D");
 
         uint256 reservesBefore = dotnsNameEscrow.reserves(address(0));
         uint256 protocolFeesBefore = dotnsNameEscrow.protocolFees();
@@ -761,14 +761,14 @@ contract DotnsNameEscrowTest is BaseDotns {
     /// @notice Verified payer sponsoring a NoStatus owner on a NoStatus-tier label pays
     ///         exactly D under the max-not-sum rule.
     /// @dev `priced.price` equals D because the owner is NoStatus, and `transferFloor` returns
-    ///      D because the payer's PopFull tier downgrades into the owner's NoStatus tier. The
+    ///      D because the payer's Personhood tier downgrades into the owner's NoStatus tier. The
     ///      controller charges `max(priced.price, friction) = D` and routes the entire charge
     ///      into protocol fees; the owner-side refundable position is seeded with zero
     ///      amount, so reserves must not move.
     function test_cross_payer_verified_sponsors_nostatus_pays_only_D() public {
         string memory label = "crosspayr01";
 
-        _grantPopFull(leonardo);
+        _grantPersonhood(leonardo);
         // ed left at default NoStatus tier.
 
         uint256 priorProtocolFees = dotnsNameEscrow.protocolFees();
@@ -810,8 +810,8 @@ contract DotnsNameEscrowTest is BaseDotns {
     function test_cross_payer_pays_the_curve_into_fees() public {
         string memory label = BASE_LABEL_A;
 
-        _grantPopFull(leonardo);
-        _grantPopFull(ed);
+        _grantPersonhood(leonardo);
+        _grantPersonhood(ed);
 
         uint256 ownPrice = popRules.price(label);
         uint256 priorProtocolFees = dotnsNameEscrow.protocolFees();
@@ -845,12 +845,12 @@ contract DotnsNameEscrowTest is BaseDotns {
     ///      it, so `max(ownerPrice, friction)` collapses to the owner price. The whole charge
     ///      routes to protocol fees with no refundable deposit.
     function test_cross_payer_downgrade_charges_only_owner_price() public {
-        // LITE_LABEL_A carries the gateway's separator, which the public path this test drives
+        // DEVICE_LABEL_A carries the gateway's separator, which the public path this test drives
         // rejects, so the label here is a flat one in the same tier.
         string memory label = "michael01";
 
-        _grantPopFull(leonardo);
-        _grantPopLite(ed);
+        _grantPersonhood(leonardo);
+        _grantDevicehood(ed);
 
         uint256 ownPrice = popRules.price(label);
         uint256 priorProtocolFees = dotnsNameEscrow.protocolFees();
diff --git a/test/unit/escrow/DotnsNameEscrowRedeem.t.sol b/test/unit/escrow/DotnsNameEscrowRedeem.t.sol
index 4f182c3c2..a479125b7 100644
--- a/test/unit/escrow/DotnsNameEscrowRedeem.t.sol
+++ b/test/unit/escrow/DotnsNameEscrowRedeem.t.sol
@@ -20,8 +20,8 @@ contract DotnsNameEscrowRedeemTest is BaseDotns {
     /// @notice 14-char label classifying as NoStatus, so registration seeds a funded position.
     string internal constant FUNDED_LABEL = "redeemlabela01";
 
-    /// @notice 6-char digit-free label classifying as PopFull, registered on the cross-payer path
-    ///         so its deposit position carries a zero amount.
+    /// @notice 6-char digit-free label classifying as Personhood, registered on the cross-payer
+    ///         path so its deposit position carries a zero amount.
     string internal constant FREE_LABEL = "redeem";
 
     /// @notice Register `label` for `nameOwner` at `status` and return its tokenId.
@@ -322,7 +322,8 @@ contract DotnsNameEscrowRedeemTest is BaseDotns {
     ///      right to recover their own name for no consideration whatsoever. `withdraw` is also a
     ///      step a holder has every reason to make before a name can be recycled.
     function test_zero_amount_withdrawal_does_not_forfeit_the_redeem_right() public {
-        uint256 tokenId = _registerCrossPayer(FREE_LABEL, ed, leonardo, IPopRules.PopStatus.PopFull);
+        uint256 tokenId =
+            _registerCrossPayer(FREE_LABEL, ed, leonardo, IPopRules.PopStatus.Personhood);
         assertEq(_positionOf(tokenId).amount, 0, "this case needs a zero-amount position");
 
         _approveAndRelease(tokenId, ed);
@@ -439,7 +440,8 @@ contract DotnsNameEscrowRedeemTest is BaseDotns {
     ///      Under a `released && claimed` reclaim gate that would make the name permanently
     ///      unregisterable.
     function test_zero_amount_release_becomes_reclaimable_without_any_withdrawal() public {
-        uint256 tokenId = _registerCrossPayer(FREE_LABEL, ed, leonardo, IPopRules.PopStatus.PopFull);
+        uint256 tokenId =
+            _registerCrossPayer(FREE_LABEL, ed, leonardo, IPopRules.PopStatus.Personhood);
 
         assertEq(
             _positionOf(tokenId).amount,
diff --git a/test/unit/pop/PopRules.t.sol b/test/unit/pop/PopRules.t.sol
index ee8599a6b..131402c5f 100644
--- a/test/unit/pop/PopRules.t.sol
+++ b/test/unit/pop/PopRules.t.sol
@@ -23,20 +23,20 @@ contract PopRulesTests is BaseDotns {
         assertEq(classificationMessage, "Reserved for Governance");
     }
 
-    function test_classify_poplite() public view {
+    function test_classify_devicehood() public view {
         (IPopRules.PopStatus classificationStatus, string memory classificationMessage) =
             popRules.classifyName("lights.01");
 
-        assertEq(uint256(classificationStatus), uint256(IPopRules.PopStatus.PopLite));
-        assertEq(classificationMessage, "Requires Lite personhood verification");
+        assertEq(uint256(classificationStatus), uint256(IPopRules.PopStatus.Devicehood));
+        assertEq(classificationMessage, "Requires devicehood");
     }
 
-    function test_classify_popfull() public view {
+    function test_classify_personhood() public view {
         (IPopRules.PopStatus classificationStatus, string memory classificationMessage) =
             popRules.classifyName("alicebob");
 
-        assertEq(uint256(classificationStatus), uint256(IPopRules.PopStatus.PopFull));
-        assertEq(classificationMessage, "Requires Full personhood verification");
+        assertEq(uint256(classificationStatus), uint256(IPopRules.PopStatus.Personhood));
+        assertEq(classificationMessage, "Requires personhood");
     }
 
     function test_classify_nostatus() public view {
@@ -59,10 +59,10 @@ contract PopRulesTests is BaseDotns {
     ///      these is measured as written: `andrew1` is seven characters and `andrew123` is nine.
     function test_classify_accepts_any_flat_digit_count() public view {
         (IPopRules.PopStatus oneDigit,) = popRules.classifyName("andrew1");
-        assertEq(uint256(oneDigit), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(oneDigit), uint256(IPopRules.PopStatus.Personhood));
 
         (IPopRules.PopStatus twoDigits,) = popRules.classifyName("andrew01");
-        assertEq(uint256(twoDigits), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(twoDigits), uint256(IPopRules.PopStatus.Personhood));
 
         (IPopRules.PopStatus threeDigits,) = popRules.classifyName("andrew123");
         assertEq(uint256(threeDigits), uint256(IPopRules.PopStatus.NoStatus));
@@ -75,32 +75,36 @@ contract PopRulesTests is BaseDotns {
         assertEq(uint256(webThree), uint256(IPopRules.PopStatus.Reserved));
 
         (IPopRules.PopStatus interior,) = popRules.classifyName("micha3l");
-        assertEq(uint256(interior), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(interior), uint256(IPopRules.PopStatus.Personhood));
     }
 
-    /// @dev A lite label's suffix is fixed by its shape, so a wrong digit count fails the shape
+    /// @dev A device name's suffix is fixed by its shape, so a wrong digit count fails the shape
     ///      check rather than the count check and never reaches classification.
-    function test_classify_reverts_for_a_lite_suffix_of_the_wrong_length() public {
+    function test_classify_reverts_for_a_device_suffix_of_the_wrong_length() public {
         vm.expectRevert(
             abi.encodeWithSelector(
                 IPopRules.PopError.selector,
-                "Name must be a lowercase ASCII DNS label or a lite label"
+                "Name must be a lowercase ASCII DNS label or a device name"
             )
         );
         popRules.classifyName("andrew.1");
     }
 
-    /// @dev The gateway's suffix is not part of the name the candidate chose, so a lite label
+    /// @dev The gateway's suffix is not part of the name the candidate chose, so a device name
     ///      prices as its stem, while its flat spelling is a different, longer name. The flat
     ///      launch model charges one deposit at every length, so the rule is only observable on
     ///      a length-sensitive curve; this switches to the scarcity model to see it.
-    function test_a_lite_suffix_prices_as_its_stem() public {
+    function test_a_device_suffix_prices_as_its_stem() public {
         vm.startPrank(owner);
         costModelRegistry.register(IDotnsPricing(address(scarcityPricing)));
         costModelRegistry.setCurrentVersion(scarcityPricing.version());
         vm.stopPrank();
 
-        assertEq(popRules.price("andrew.01"), popRules.price("andrew"), "lite prices as its stem");
+        assertEq(
+            popRules.price("andrew.01"),
+            popRules.price("andrew"),
+            "a device name prices as its stem"
+        );
         assertTrue(
             popRules.price("andrew01") != popRules.price("andrew"),
             "the flat spelling is a longer name"
@@ -108,14 +112,14 @@ contract PopRulesTests is BaseDotns {
     }
 
     function test_verified_person_pays_the_deposit_for_premium() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         assertEq(popRules.priceWithCheck("alicebob", ed).price, BASE_DEPOSIT);
         assertEq(popRules.priceWithCheck("lights", ed).price, BASE_DEPOSIT);
     }
 
     function test_transfer_reprices_at_own_length() public {
-        _grantPopFull(leonardo);
+        _grantPersonhood(leonardo);
 
         assertEq(popRules.transferFloor("lights", leonardo, tiago), BASE_DEPOSIT);
         assertEq(popRules.transferFloor("lights", leonardo, leonardo), 0);
@@ -128,40 +132,36 @@ contract PopRulesTests is BaseDotns {
         popRules.priceWithCheck("hello", ed);
     }
 
-    function test_price_with_check_revert_full_needed() public {
-        vm.expectRevert(
-            abi.encodeWithSelector(
-                IPopRules.PopError.selector, "Requires Full personhood verification"
-            )
-        );
+    function test_price_with_check_revert_personhood_needed() public {
+        vm.expectRevert(abi.encodeWithSelector(IPopRules.PopError.selector, "Requires personhood"));
         popRules.priceWithCheck("alicebob", ed);
     }
 
-    function test_popfull_user_can_access_poplite_name() public {
-        _grantPopFull(ed);
+    function test_personhood_user_can_access_devicehood_name() public {
+        _grantPersonhood(ed);
 
         IPopRules.PriceWithMeta memory priceMetadata = popRules.priceWithCheck("lights.01", ed);
 
-        assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.PopLite));
-        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.PopFull));
+        assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.Devicehood));
+        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.Personhood));
         assertEq(priceMetadata.price, BASE_DEPOSIT);
     }
 
-    function test_poplite_user_can_access_nostatus_name() public {
-        _grantPopLite(ed);
+    function test_devicehood_user_can_access_nostatus_name() public {
+        _grantDevicehood(ed);
 
         IPopRules.PriceWithMeta memory priceMetadata =
             popRules.priceWithCheck("longnamehere.01", ed);
 
         assertEq(uint256(priceMetadata.status), uint256(IPopRules.PopStatus.NoStatus));
-        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.PopLite));
+        assertEq(uint256(priceMetadata.userStatus), uint256(IPopRules.PopStatus.Devicehood));
         assertEq(priceMetadata.price, BASE_DEPOSIT);
     }
 
     function test_base_reservation_blocks_others() public {
         // Authorise this test contract as a registrar controller so it may call
-        // reserveBaseName (gated by DotnsRegistrar.controllers). Passes the stem
-        // directly per the stems-only public boundary.
+        // reserveBaseName (gated by DotnsRegistrar.controllers). Passes the base name
+        // directly, as the public boundary takes base names only.
         _authoriseTestAsController();
 
         popRules.reserveBaseName("lights", leonardo);
@@ -175,7 +175,7 @@ contract PopRulesTests is BaseDotns {
 
         vm.expectRevert(
             abi.encodeWithSelector(
-                IPopRules.PopError.selector, "Base name reserved for original Lite registrant"
+                IPopRules.PopError.selector, "Reserved for a device-name holder's personhood claim"
             )
         );
         popRules.priceWithCheck("lights", tiago);
@@ -194,7 +194,7 @@ contract PopRulesTests is BaseDotns {
 
     function test_short_names_closed_reverts_direct_path() public {
         _setShortNames(false);
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         vm.expectRevert(
             abi.encodeWithSelector(IPopRules.PopError.selector, "Short names are not for sale")
         );
@@ -211,14 +211,14 @@ contract PopRulesTests is BaseDotns {
 
     function test_open_band_priced_while_short_names_closed() public {
         _setShortNames(false);
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
         // longnamehere is 12 characters, so the switch never gates it.
         assertEq(popRules.priceWithCheck("longnamehere", ed).price, BASE_DEPOSIT);
     }
 
     function test_enabling_short_names_opens_the_market() public {
         _setShortNames(false);
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         _setShortNames(true);
         assertEq(popRules.priceWithCheck("alicebob", ed).price, BASE_DEPOSIT);
     }
@@ -268,10 +268,10 @@ contract PopRulesTests is BaseDotns {
     }
 
     function test_transferFloor_matches_model() public {
-        // A PopFull sender handing a NoStatus name to a NoStatus recipient pays the name's own
+        // A Personhood sender handing a NoStatus name to a NoStatus recipient pays the name's own
         // price, which is the registered model's amount for its base length.
         string memory label = "longnamehere";
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         uint256 floor = popRules.transferFloor(label, ed, leonardo);
         assertEq(floor, costModelRegistry.priceForBaseLength(bytes(label).length));
     }
diff --git a/test/unit/pop/PopRulesClassification.t.sol b/test/unit/pop/PopRulesClassification.t.sol
index 2e39dc3bf..af45f2b11 100644
--- a/test/unit/pop/PopRulesClassification.t.sol
+++ b/test/unit/pop/PopRulesClassification.t.sol
@@ -12,9 +12,9 @@ import {IPopRules} from "../../../contracts/pop/IPopRules.sol";
 ///      and reads no storage, so a tier is a function of the label alone. Anything that needs a
 ///      cost model or a reservation belongs in the proxy-backed suite instead.
 contract PopRulesClassificationTests is Test {
-    /// @notice Guard message for a string that is neither a DNS label nor a lite label.
+    /// @notice Guard message for a string that is neither a DNS label nor a device name.
     string internal constant SHAPE_ERROR =
-        "Name must be a lowercase ASCII DNS label or a lite label";
+        "Name must be a lowercase ASCII DNS label or a device name";
 
     PopRules internal rules;
 
@@ -31,24 +31,24 @@ contract PopRulesClassificationTests is Test {
         vm.expectRevert(abi.encodeWithSelector(IPopRules.PopError.selector, reason));
     }
 
-    /// @dev Base length is the stem, so a two-digit suffix does not count towards the band
-    ///      whether or not it carries the gateway's separator.
-    function test_classify_measures_a_lite_label_by_its_stem() public view {
+    /// @dev Base length is the length of the base name, so a two-digit suffix does not count
+    ///      towards the band whether or not it carries the gateway's separator.
+    function test_classify_measures_a_device_name_by_its_stem() public view {
         _assertTier("alice.42", IPopRules.PopStatus.Reserved);
-        _assertTier("joseph.42", IPopRules.PopStatus.PopLite);
-        _assertTier("benjamin.42", IPopRules.PopStatus.PopLite);
+        _assertTier("joseph.42", IPopRules.PopStatus.Devicehood);
+        _assertTier("benjamin.42", IPopRules.PopStatus.Devicehood);
         _assertTier("elizabeth.42", IPopRules.PopStatus.NoStatus);
     }
 
     /// @notice The separator is meaning, not presentation: it is what makes a name an identity.
-    /// @dev A lite label is measured by the stem the candidate chose, because the gateway
+    /// @dev A device name is measured by the stem the candidate chose, because the gateway
     ///      allocated the digits. An ordinary label is measured as written. So the two spellings
-    ///      are different names in different bands, and only the separated one is PopLite.
+    ///      are different names in different bands, and only the separated one is Devicehood.
     function test_classify_differs_with_and_without_the_separator() public view {
-        _assertTier("joseph.42", IPopRules.PopStatus.PopLite);
-        _assertTier("joseph42", IPopRules.PopStatus.PopFull);
+        _assertTier("joseph.42", IPopRules.PopStatus.Devicehood);
+        _assertTier("joseph42", IPopRules.PopStatus.Personhood);
 
-        _assertTier("michael.01", IPopRules.PopStatus.PopLite);
+        _assertTier("michael.01", IPopRules.PopStatus.Devicehood);
         _assertTier("michael01", IPopRules.PopStatus.NoStatus);
 
         _assertTier("elizabeth.42", IPopRules.PopStatus.NoStatus);
@@ -56,28 +56,33 @@ contract PopRulesClassificationTests is Test {
     }
 
     /// @notice The regression test for deriving the digit count by subtraction.
-    /// @dev `bytes(name).length - baseLength` is 3 for a lite label, never 2, so a subtraction
-    ///      based check classifies every lite name in the 6-8 band as PopFull. These rows catch
-    ///      it, which is why they assert PopLite rather than merely "not Reserved".
-    function test_classify_puts_a_lite_label_in_the_lite_tier_not_the_full_tier() public view {
+    /// @dev `bytes(name).length - baseLength` is 3 for a device name, never 2, so a subtraction
+    ///      based check classifies every device name in the 6-8 band as Personhood. These rows
+    ///      catch it, which is why they assert Devicehood rather than merely "not Reserved".
+    function test_classify_puts_a_device_name_in_the_devicehood_tier_not_the_personhood_tier()
+        public
+        view
+    {
         (IPopRules.PopStatus sixChar,) = rules.classifyName("joseph.42");
-        assertEq(uint256(sixChar), uint256(IPopRules.PopStatus.PopLite), "stem 6 is PopLite");
+        assertEq(uint256(sixChar), uint256(IPopRules.PopStatus.Devicehood), "stem 6 is Devicehood");
 
         (IPopRules.PopStatus eightChar,) = rules.classifyName("benjamin.42");
-        assertEq(uint256(eightChar), uint256(IPopRules.PopStatus.PopLite), "stem 8 is PopLite");
+        assertEq(
+            uint256(eightChar), uint256(IPopRules.PopStatus.Devicehood), "stem 8 is Devicehood"
+        );
     }
 
     function test_classify_measures_a_label_without_a_suffix_whole() public view {
         _assertTier("alice", IPopRules.PopStatus.Reserved);
-        _assertTier("joseph", IPopRules.PopStatus.PopFull);
-        _assertTier("benjamin", IPopRules.PopStatus.PopFull);
+        _assertTier("joseph", IPopRules.PopStatus.Personhood);
+        _assertTier("benjamin", IPopRules.PopStatus.Personhood);
         _assertTier("elizabeth", IPopRules.PopStatus.NoStatus);
     }
 
     /// @dev An ordinary name carrying digits stays registrable, measured as written.
     function test_classify_accepts_an_ordinary_flat_digit_suffix() public view {
         _assertTier("longnamebob01", IPopRules.PopStatus.NoStatus);
-        _assertTier("lights01", IPopRules.PopStatus.PopFull);
+        _assertTier("lights01", IPopRules.PopStatus.Personhood);
     }
 
     /// @dev No digit count is privileged or rejected, and none is stripped: a name ending in
@@ -85,15 +90,15 @@ contract PopRulesClassificationTests is Test {
     function test_classify_accepts_a_flat_suffix_of_any_length() public view {
         _assertTier("iamtherealbob0", IPopRules.PopStatus.NoStatus);
         _assertTier("elizabeth12345", IPopRules.PopStatus.NoStatus);
-        _assertTier("blink182", IPopRules.PopStatus.PopFull);
+        _assertTier("blink182", IPopRules.PopStatus.Personhood);
         _assertTier("web3", IPopRules.PopStatus.Reserved);
     }
 
-    /// @dev A lite label's suffix is fixed by its shape, so a wrong count fails the shape check
+    /// @dev A device name's suffix is fixed by its shape, so a wrong count fails the shape check
     ///      before the count check can see it.
-    /// @dev A separator is legal only on a lite label, so a string carrying one that misses
-    ///      the shape in any way is neither a DNS label nor a lite label.
-    function test_classify_reverts_for_a_malformed_lite_label() public {
+    /// @dev A separator is legal only on a device name, so a string carrying one that misses
+    ///      the shape in any way is neither a DNS label nor a device name.
+    function test_classify_reverts_for_a_malformed_device_name() public {
         _expectRevert(SHAPE_ERROR);
         rules.classifyName("joseph.4");
 
@@ -108,7 +113,7 @@ contract PopRulesClassificationTests is Test {
         rules.classifyName("jos3ph.42");
     }
 
-    /// @dev Only a lite label is shortened, so `joseph.42` contends with a reservation on
+    /// @dev Only a device name is shortened, so `joseph.42` contends with a reservation on
     ///      `joseph` while `joseph42` is an unrelated name that contends with nothing.
     function test_stripDigits_shortens_only_the_separated_form() public view {
         assertEq(rules.stripDigits("joseph.42"), "joseph");
@@ -116,13 +121,13 @@ contract PopRulesClassificationTests is Test {
         assertEq(rules.stripDigits("blink182"), "blink182");
     }
 
-    /// @dev A stem returned as `joseph.` would fail `isSingleLabelMemory` in the registrar
+    /// @dev A base name returned as `joseph.` would fail `isSingleLabelMemory` in the registrar
     ///      controller and silently skip the reclaim branch's reservation release.
     function test_stripDigits_leaves_no_trailing_separator() public view {
-        string memory stem = rules.stripDigits("joseph.42");
-        bytes memory raw = bytes(stem);
-        assertTrue(raw.length > 0, "stem is not empty");
-        assertTrue(raw[raw.length - 1] != ".", "stem carries no trailing separator");
+        string memory baseName = rules.stripDigits("joseph.42");
+        bytes memory raw = bytes(baseName);
+        assertTrue(raw.length > 0, "base name is not empty");
+        assertTrue(raw[raw.length - 1] != ".", "base name carries no trailing separator");
     }
 
     function test_stripDigits_returns_a_suffixless_label_verbatim() public view {
@@ -130,8 +135,8 @@ contract PopRulesClassificationTests is Test {
     }
 
     /// @dev Must answer the question rather than revert, since the controller asks it of
-    ///      labels that may be lite.
-    function test_isBaseName_answers_false_for_a_lite_label() public view {
+    ///      labels that may be device-name.
+    function test_isBaseName_answers_false_for_a_device_name() public view {
         assertFalse(rules.isBaseName("joseph.42"));
         assertTrue(rules.isBaseName("elizabeth"));
     }
diff --git a/test/unit/registrar/DotnsPopController.t.sol b/test/unit/registrar/DotnsPopController.t.sol
index 787820977..1706ff3b6 100644
--- a/test/unit/registrar/DotnsPopController.t.sol
+++ b/test/unit/registrar/DotnsPopController.t.sol
@@ -22,16 +22,16 @@ import {Vm} from "forge-std/Vm.sol";
 ///         tests assert specific behaviours that do not benefit from input
 ///         variation.
 contract DotnsPopControllerTests is BaseDotns {
-    function test_reserveBaseName_mints_and_wires_registry_and_resolver() public {
-        // Lite path requires PopLite tier and a classification-valid lite label.
-        _grantPopFull(ed);
+    function test_issueDeviceNameWithReservation_mints_and_wires_registry_and_resolver() public {
+        // Device-name path requires Devicehood tier and a classification-valid device name.
+        _grantPersonhood(ed);
         bytes memory chatKey = _validChatKey(0x01);
 
-        _reservePop(ed, LITE_LABEL_A, chatKey, "");
+        _reservePop(ed, DEVICE_LABEL_A, chatKey, "");
 
-        // A lite username is a subnode under its numeric container, not a tokenised name, so its
+        // A device name is a subnode under its numeric container, not a tokenised name, so its
         // ownership lives in the registry record rather than the registrar's ERC-721 ledger.
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         assertEq(dotnsRegistry.owner(node), ed);
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
 
@@ -51,9 +51,9 @@ contract DotnsPopControllerTests is BaseDotns {
     ///         does not re-mint it.
     /// @dev A re-mint would revert on the already-registered container, so the second reservation
     ///      succeeding, with the container owner unchanged, is proof it took the reuse path.
-    function test_second_lite_stem_reuses_the_container() public {
-        _grantPopFull(ed);
-        _grantPopFull(leonardo);
+    function test_second_device_stem_reuses_the_container() public {
+        _grantPersonhood(ed);
+        _grantPersonhood(leonardo);
 
         _reservePop(ed, "michael.01", _validChatKey(0x01), "");
         bytes32 containerNode = _nodeOf("01");
@@ -62,177 +62,199 @@ contract DotnsPopControllerTests is BaseDotns {
         _reservePop(leonardo, "matthew.01", _validChatKey(0x02), "");
 
         assertEq(dotnsRegistry.owner(containerNode), containerOwner, "container not re-owned");
-        assertEq(dotnsRegistry.owner(_liteNodeOf("michael.01")), ed, "first stem owned by ed");
+        assertEq(dotnsRegistry.owner(_deviceNodeOf("michael.01")), ed, "first stem owned by ed");
         assertEq(
-            dotnsRegistry.owner(_liteNodeOf("matthew.01")),
+            dotnsRegistry.owner(_deviceNodeOf("matthew.01")),
             leonardo,
             "second stem owned by leonardo"
         );
     }
 
-    function test_reserveBaseName_reverts_when_origin_is_not_root() public {
+    function test_issueDeviceNameWithReservation_reverts_when_origin_is_not_root() public {
         _mockOriginIsRoot(false);
         vm.expectRevert(IDotnsPopController.NotRoot.selector);
-        dotnsPopController.reserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: ""
+        dotnsPopController.issueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: ""
                 }),
-                reservedBaseLabel: ""
+                reservedLabel: ""
             })
         );
     }
 
-    function test_reserveBaseName_enqueues_when_reserved_label_provided() public {
+    function test_issueDeviceNameWithReservation_enqueues_when_reserved_label_provided() public {
         // `PopRules.priceWithCheck` admits only the live reservation holder on
         // a given base stem, so the queue is single-occupant. Multi-occupant
         // queue coverage lives in the invariant suite.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), PERSONHOOD_LABEL_A);
 
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(reserved);
         assertEq(holder, ed);
     }
 
-    function test_registerBaseName_claim_emits_claim_event_and_not_standalone() public {
-        // ed gets a different PopFull-classified base label via standalone mint.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_claim_emits_reservation_claimed() public {
+        // ed gets a different Personhood-classified base label via standalone mint.
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
 
         vm.recordLogs();
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
         Vm.Log[] memory logs = vm.getRecordedLogs();
 
-        _assertEventEmittedOnce(logs, keccak256("BaseNameClaimed(bytes32,address,string)"));
-        _assertEventNotEmitted(logs, keccak256("StandaloneNameRegistered(bytes32,address,string)"));
+        _assertEventEmittedOnce(logs, keccak256("ReservationClaimed(bytes32,address)"));
+        _assertEventEmittedOnce(logs, keccak256("PersonhoodNameIssued(bytes32,address,string)"));
 
-        (bool reserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(reserved);
     }
 
-    function test_registerBaseName_standalone_emits_standalone_event_and_not_claim() public {
-        _grantPopFull(tiago);
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_standalone_emits_no_reservation_claimed() public {
+        _grantPersonhood(tiago);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0x01), PERSONHOOD_LABEL_A);
         // `priceWithCheck` admits only the live reservation holder on a given
         // base stem, so the standalone mint runs against a separate, free stem
         // owned by a different user; this asserts neither user sees state leak
         // from the other.
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
 
         vm.recordLogs();
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_C, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_C, user: ed, link: link
+            })
         );
         Vm.Log[] memory logs = vm.getRecordedLogs();
 
-        _assertEventEmittedOnce(logs, keccak256("StandaloneNameRegistered(bytes32,address,string)"));
-        _assertEventNotEmitted(logs, keccak256("BaseNameClaimed(bytes32,address,string)"));
+        _assertEventEmittedOnce(logs, keccak256("PersonhoodNameIssued(bytes32,address,string)"));
+        _assertEventNotEmitted(logs, keccak256("ReservationClaimed(bytes32,address)"));
     }
 
-    function test_registerBaseName_claim_inherits_chat_key_from_lite_node() public {
-        // Promote ed to PopFull so the standalone PopFull-classified mint passes.
-        _grantPopFull(ed);
-        bytes memory liteChatKey = _validChatKey(0xaa);
-        _reservePop(ed, LITE_LABEL_A, liteChatKey, BASE_LABEL_A);
+    function test_issuePersonhoodName_claim_inherits_chat_key_from_device_node() public {
+        // Promote ed to Personhood so the standalone Personhood-classified mint passes.
+        _grantPersonhood(ed);
+        bytes memory deviceChatKey = _validChatKey(0xaa);
+        _reservePop(ed, DEVICE_LABEL_A, deviceChatKey, PERSONHOOD_LABEL_A);
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        bytes32 fullNode = _nodeOf(BASE_LABEL_A);
-        assertEq(dotnsPopResolver.chatKey(fullNode), liteChatKey);
-        assertEq(dotnsPopResolver.liteLink(fullNode), keccak256(bytes(LITE_LABEL_A)));
+        bytes32 personhoodNode = _nodeOf(PERSONHOOD_LABEL_A);
+        assertEq(dotnsPopResolver.chatKey(personhoodNode), deviceChatKey);
+        assertEq(
+            dotnsPopResolver.deviceLabelhashOf(personhoodNode), keccak256(bytes(DEVICE_LABEL_A))
+        );
     }
 
-    function test_registerBaseName_claim_wipes_entire_queue() public {
+    function test_issuePersonhoodName_claim_wipes_entire_queue() public {
         // `priceWithCheck` admits only the live reservation holder on a given
         // base stem, so the queue stays single-occupant; after the holder
         // claims, the stem is free for a fresh reservation from any user.
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
-
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
+
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        _reservePop(tiago, LITE_LABEL_D, _validChatKey(0x04), BASE_LABEL_B);
-        (, address wonderHolder) = dotnsPopController.isReservedForClaim(BASE_LABEL_B);
+        _reservePop(tiago, DEVICE_LABEL_D, _validChatKey(0x04), PERSONHOOD_LABEL_B);
+        (, address wonderHolder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_B);
         assertEq(wonderHolder, tiago);
     }
 
-    function test_registerBaseName_standalone_auto_relinquishes_users_other_reservation() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_standalone_auto_relinquishes_users_other_reservation()
+        public
+    {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0x02));
 
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_B, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_B, user: ed, link: link
+            })
         );
 
-        (bool reserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(reserved);
     }
 
-    function test_registerBaseName_standalone_with_lite_link_silently_relinquishes() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_standalone_with_device_link_relinquishes_the_other_reservation()
+        public
+    {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
-        _grantPopFull(ed);
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
+        _grantPersonhood(ed);
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
 
         vm.recordLogs();
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_B, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_B, user: ed, link: link
+            })
         );
         Vm.Log[] memory logs = vm.getRecordedLogs();
 
-        _assertEventEmittedOnce(logs, keccak256("StandaloneNameRegistered(bytes32,address,string)"));
-        _assertEventEmittedOnce(logs, keccak256("LiteToFullLinked(bytes32,bytes32)"));
-        _assertEventNotEmitted(logs, keccak256("BaseNameClaimed(bytes32,address,string)"));
-        _assertEventNotEmitted(logs, keccak256("ReservationRelinquished(bytes32,address)"));
+        _assertEventEmittedOnce(logs, keccak256("PersonhoodNameIssued(bytes32,address,string)"));
+        _assertEventEmittedOnce(logs, keccak256("DeviceNameLinked(bytes32,bytes32)"));
+        _assertEventNotEmitted(logs, keccak256("ReservationClaimed(bytes32,address)"));
+        _assertEventEmittedOnce(logs, keccak256("ReservationRelinquished(bytes32,address)"));
 
-        bytes32 fullNode = _nodeOf(BASE_LABEL_B);
-        assertEq(dotnsPopResolver.liteLink(fullNode), keccak256(bytes(LITE_LABEL_A)));
+        bytes32 personhoodNode = _nodeOf(PERSONHOOD_LABEL_B);
+        assertEq(
+            dotnsPopResolver.deviceLabelhashOf(personhoodNode), keccak256(bytes(DEVICE_LABEL_A))
+        );
 
-        (bool reserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(reserved);
     }
 
-    function test_registerBaseName_reverts_when_origin_is_not_root() public {
+    function test_issuePersonhoodName_reverts_when_origin_is_not_root() public {
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xaa));
 
         _mockOriginIsRoot(false);
         vm.expectRevert(IDotnsPopController.NotRoot.selector);
-        dotnsPopController.registerBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        dotnsPopController.issuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
     }
 
     function test_relinquishReservation_promotes_next_waiter_when_head_leaves() public {
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
         vm.prank(ed);
         dotnsPopController.relinquishReservation();
 
-        (bool empty,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool empty,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(empty);
 
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0x02), BASE_LABEL_A);
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0x02), PERSONHOOD_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(reserved);
         assertEq(holder, tiago);
     }
@@ -246,12 +268,12 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_setReservationDuration_shortening_retroactively_expires_live_entries() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         // Enqueue alice under the default duration (7 days).
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
         (bool liveBefore, address holderBefore) =
-            dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+            dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(liveBefore);
         assertEq(holderBefore, ed);
         // Warp 2 days forward (still well within the original 7-day window).
@@ -261,7 +283,7 @@ contract DotnsPopControllerTests is BaseDotns {
         vm.prank(owner);
         dotnsPopController.setReservationDuration(1 days);
 
-        (bool liveAfter,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool liveAfter,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(liveAfter);
     }
 
@@ -275,34 +297,34 @@ contract DotnsPopControllerTests is BaseDotns {
         // Two independent reads must agree: the per-user reservation pointer
         // (`userReservation`) and the per-base claim view (`isReservedForClaim`).
         // Both change atomically when the same user re-reserves on a new stem.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
         IDotnsPopController.UserReservation memory firstReservation =
             dotnsPopController.userReservation(ed);
-        assertEq(firstReservation.labelhash, keccak256(bytes(BASE_LABEL_A)));
+        assertEq(firstReservation.labelhash, keccak256(bytes(PERSONHOOD_LABEL_A)));
         // Second reservation by the same user on a different stem drops the
         // first slot and installs the new one.
-        _reservePop(ed, LITE_LABEL_B, _validChatKey(0x02), BASE_LABEL_B);
+        _reservePop(ed, DEVICE_LABEL_B, _validChatKey(0x02), PERSONHOOD_LABEL_B);
 
         IDotnsPopController.UserReservation memory secondReservation =
             dotnsPopController.userReservation(ed);
-        assertEq(secondReservation.labelhash, keccak256(bytes(BASE_LABEL_B)));
+        assertEq(secondReservation.labelhash, keccak256(bytes(PERSONHOOD_LABEL_B)));
 
-        (bool firstReserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool firstReserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(firstReserved);
 
         (bool secondReserved, address secondHolder) =
-            dotnsPopController.isReservedForClaim(BASE_LABEL_B);
+            dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_B);
         assertTrue(secondReserved);
         assertEq(secondHolder, ed);
     }
 
     function test_reEnqueue_after_own_expiry_promotes_same_user_to_head() public {
-        string memory baseStem = BASE_LABEL_A;
-        _grantPopFull(ed);
+        string memory baseStem = PERSONHOOD_LABEL_A;
+        _grantPersonhood(ed);
 
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), baseStem);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), baseStem);
         // Warp past the reservation window and fire the GC so ed's pointer gets
         // cleared by `_advanceExpiredHead`. If the expiry path forgets the
         // per-user pointer, the second reserve call below hits `AlreadyReserved`
@@ -312,8 +334,8 @@ contract DotnsPopControllerTests is BaseDotns {
 
         (bool expiredReserved,) = dotnsPopController.isReservedForClaim(baseStem);
         assertFalse(expiredReserved);
-        // Same user reserves the same stem again with a fresh lite label.
-        _reservePop(ed, LITE_LABEL_B, _validChatKey(0x02), baseStem);
+        // Same user reserves the same stem again with a fresh device name.
+        _reservePop(ed, DEVICE_LABEL_B, _validChatKey(0x02), baseStem);
 
         (bool nowReserved, address holder) = dotnsPopController.isReservedForClaim(baseStem);
         assertTrue(nowReserved);
@@ -321,17 +343,17 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_claim_then_reEnqueue_on_same_stem_resets_cleanly() public {
-        string memory baseStem = BASE_LABEL_A;
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
+        string memory baseStem = PERSONHOOD_LABEL_A;
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
 
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), baseStem);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), baseStem);
         // Claim wipes the queue via `_clearQueue` which must also drop
         // `_reservedBaseLabel[labelhash]` and release the PopRules slot. Missing
         // any one of those lets the next reservation inherit stale state.
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: baseStem, user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: baseStem, user: ed, link: link})
         );
 
         (bool oldSlot, address oldHolder) = dotnsPopController.isReservedForClaim(baseStem);
@@ -339,41 +361,42 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(oldHolder, address(0));
         // Fresh stem, different user. If the previous queue leaked, this enqueue
         // would either revert or land the wrong head address on PopRules.
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0x02), BASE_LABEL_B);
-        (bool newSlot, address newHolder) = dotnsPopController.isReservedForClaim(BASE_LABEL_B);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0x02), PERSONHOOD_LABEL_B);
+        (bool newSlot, address newHolder) =
+            dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_B);
         assertTrue(newSlot);
         assertEq(newHolder, tiago);
 
-        (address popHolder,) = popRules.getBaseNameReservation(BASE_LABEL_B);
+        (address popHolder,) = popRules.getBaseNameReservation(PERSONHOOD_LABEL_B);
         assertEq(popHolder, tiago);
     }
 
     function test_expireReservation_is_permissionless() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
         vm.warp(block.timestamp + dotnsPopController.reservationDuration() + 1);
         // Anyone can call. Pinning this prevents a future patch from silently
         // adding `onlyRoot` and breaking permissionless garbage collection.
         address stranger = makeAddr("stranger");
         vm.prank(stranger);
-        dotnsPopController.expireReservation(BASE_LABEL_A);
+        dotnsPopController.expireReservation(PERSONHOOD_LABEL_A);
 
-        (bool reserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(reserved);
     }
 
     function test_head_expires_clears_slot_for_next_reserver() public {
-        string memory baseStem = BASE_LABEL_A;
-        _grantPopFull(ed);
-        _grantPopFull(leonardo);
+        string memory baseStem = PERSONHOOD_LABEL_A;
+        _grantPersonhood(ed);
+        _grantPersonhood(leonardo);
 
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), baseStem);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), baseStem);
 
         vm.warp(block.timestamp + dotnsPopController.reservationDuration() + 1);
         dotnsPopController.expireReservation(baseStem);
 
-        _reservePop(leonardo, LITE_LABEL_C, _validChatKey(0x03), baseStem);
+        _reservePop(leonardo, DEVICE_LABEL_C, _validChatKey(0x03), baseStem);
 
         (bool reserved, address holder) = dotnsPopController.isReservedForClaim(baseStem);
         assertTrue(reserved);
@@ -384,51 +407,51 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_entry_point_format_rejections() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
         // The shape check runs before any pricing, so "michael" is rejected for carrying no
         // separator rather than for anything about its tier.
-        vm.expectRevert(IDotnsPopController.InvalidLiteLabel.selector);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({liteLabel: "michael", user: ed, chatKey: ""})
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({label: "michael", user: ed, chatKey: ""})
         );
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xaa));
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "not.valid", user: ed, link: link})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "not.valid", user: ed, link: link})
         );
     }
 
-    function test_same_stem_lite_and_base_occupy_distinct_registrar_tokens() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "");
-        // "michael" (baselength 7, no trailing digits) classifies as PopFull
-        // and shares the lite's stem, so both tokens coexist on the registrar.
-        _grantPopFull(tiago);
+    function test_same_stem_device_and_personhood_names_occupy_distinct_nodes() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "");
+        // "michael" (baselength 7, no trailing digits) classifies as Personhood
+        // and shares the device name's stem, so both tokens coexist on the registrar.
+        _grantPersonhood(tiago);
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xbb));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "michael", user: tiago, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "michael", user: tiago, link: link})
         );
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf(LITE_LABEL_A)), ed);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("michael"))), tiago);
     }
 
     function test_both_controllers_can_mint_on_shared_registrar() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
         _commitAndRegister("longnamebob01", tiago, true);
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf(LITE_LABEL_A)), ed);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("longnamebob01"))), tiago);
     }
 
     function test_gateway_reserved_name_rejects_public_register_by_other_user() public {
-        _grantPopFull(tiago);
+        _grantPersonhood(tiago);
         // The gateway reserves the stem, and the stem is what the reservation blocks: a public
         // registrant contends for `longnamebob` itself.
-        _reservePop(tiago, LITE_LABEL_A, _validChatKey(0x11), "longnamebob");
+        _reservePop(tiago, DEVICE_LABEL_A, _validChatKey(0x11), "longnamebob");
 
         (address holder,) = popRules.getBaseNameReservation("longnamebob");
         assertEq(holder, tiago);
@@ -455,7 +478,7 @@ contract DotnsPopControllerTests is BaseDotns {
 
         vm.expectRevert(
             abi.encodeWithSelector(
-                IPopRules.PopError.selector, "Base name reserved for original Lite registrant"
+                IPopRules.PopError.selector, "Reserved for a device-name holder's personhood claim"
             )
         );
         vm.prank(ed);
@@ -463,8 +486,8 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_gateway_reserved_name_allows_holder_to_register_via_public() public {
-        _grantPopFull(tiago);
-        _reservePop(tiago, LITE_LABEL_A, _validChatKey(0x11), "longnamebob");
+        _grantPersonhood(tiago);
+        _reservePop(tiago, DEVICE_LABEL_A, _validChatKey(0x11), "longnamebob");
 
         _commitAndRegister("longnamebob", tiago, true);
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("longnamebob"))), tiago);
@@ -475,50 +498,50 @@ contract DotnsPopControllerTests is BaseDotns {
     ///      shares no stem with it and a stranger may take it. This is the guarantee that
     ///      replaces the old cross-flow, where the two spellings collided.
     function test_gateway_reservation_does_not_cover_a_digit_suffixed_name() public {
-        _grantPopFull(tiago);
-        _reservePop(tiago, LITE_LABEL_A, _validChatKey(0x11), "longnamebob");
+        _grantPersonhood(tiago);
+        _reservePop(tiago, DEVICE_LABEL_A, _validChatKey(0x11), "longnamebob");
 
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         _commitAndRegister("longnamebob01", ed, true);
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("longnamebob01"))), ed);
     }
 
-    function test_second_pop_lite_mint_of_same_label_reverts() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "");
+    function test_second_device_name_issuance_of_same_label_reverts() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "");
 
-        // Re-issuing a lite name is rejected at the controller before any registry write, so a
+        // Re-issuing a device name is rejected at the controller before any registry write, so a
         // duplicate dispatch cannot rehome the identity or overwrite its records.
-        _grantPopFull(tiago);
-        vm.expectRevert(IDotnsPopController.LiteNameAlreadyIssued.selector);
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: tiago, chatKey: _validChatKey(0xbb)
+        _grantPersonhood(tiago);
+        vm.expectRevert(IDotnsPopController.DeviceNameAlreadyIssued.selector);
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: tiago, chatKey: _validChatKey(0xbb)
                 }),
-                reservedBaseLabel: ""
+                reservedLabel: ""
             })
         );
     }
 
-    /// @notice A lite name's owner can host a subname beneath it.
-    /// @dev A lite name is itself a subname the owner controls in the registry, so the owner holds
-    ///      the parent authority @custom:function IDotnsRegistry.setSubnodeOwner requires and can
-    ///      graft their own subnames beneath it, such as a device name `phone.michael.01`.
-    function test_lite_name_owner_can_host_a_subname() public {
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xb4)
+    /// @notice A device name's owner can host a subname beneath it.
+    /// @dev A device name is itself a subname the owner controls in the registry, so the owner
+    ///      holds the parent authority @custom:function IDotnsRegistry.setSubnodeOwner requires and
+    ///      can graft their own subnames beneath it, such as a device name `phone.michael.01`.
+    function test_device_name_owner_can_host_a_subname() public {
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xb4)
             })
         );
 
-        // A lite name is a subname the owner controls, so they can host their own subnames beneath
-        // it, such as a device name `phone.michael.01`.
+        // A device name is a subname the owner controls, so they can host their own subnames
+        // beneath it, such as a device name `phone.michael.01`.
         IDotnsRegistry.SubnodeRecord memory subnodeRecord = IDotnsRegistry.SubnodeRecord({
-            parentNode: _liteNodeOf(LITE_LABEL_A),
+            parentNode: _deviceNodeOf(DEVICE_LABEL_A),
             subLabel: "phone",
-            parentLabel: LITE_LABEL_A,
+            parentLabel: DEVICE_LABEL_A,
             owner: ed,
             persist: true
         });
@@ -534,10 +557,10 @@ contract DotnsPopControllerTests is BaseDotns {
     ///      inside the same call, so the assertion that it still reads false is what proves the
     ///      failed mint took the provenance write with it. A public name that answered
     ///      `isPopIssued` would pass for a person.
-    function test_pop_full_mint_after_public_register_reverts_and_writes_no_provenance() public {
+    function test_personhood_mint_after_public_register_reverts_and_writes_no_provenance() public {
         string memory label = "longnamebobx";
 
-        _grantPopFull(tiago);
+        _grantPersonhood(tiago);
         _commitAndRegister(label, tiago, true);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xd1));
@@ -546,20 +569,22 @@ contract DotnsPopControllerTests is BaseDotns {
                 IDotnsRegistrar.NameNotAvailable.selector, uint256(_nodeOf(label))
             )
         );
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: label, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: label, user: ed, link: link})
         );
 
         assertFalse(dotnsPopController.isPopIssued(label), "provenance survived a failed mint");
         assertFalse(dotnsRegistrar.isSoulbound(uint256(_nodeOf(label))), "public name locked");
     }
 
-    function test_public_register_after_pop_full_mint_reverts_at_registrar() public {
-        // "longnamebobx" is classification-NoStatus, so ed keeps default status. A full-person
+    function test_public_register_after_personhood_mint_reverts_at_registrar() public {
+        // "longnamebobx" is classification-NoStatus, so ed keeps default status. A personhood
         // label carries no digit suffix.
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "longnamebobx", user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: "longnamebobx", user: ed, link: link
+            })
         );
 
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("longnamebobx"))), ed);
@@ -591,17 +616,19 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_owner_of_pop_minted_name_can_create_subname() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        bytes32 parentNode = _nodeOf(BASE_LABEL_A);
+        bytes32 parentNode = _nodeOf(PERSONHOOD_LABEL_A);
         IDotnsRegistry.SubnodeRecord memory subnodeRecord = IDotnsRegistry.SubnodeRecord({
             parentNode: parentNode,
             subLabel: "app",
-            parentLabel: BASE_LABEL_A,
+            parentLabel: PERSONHOOD_LABEL_A,
             owner: leonardo,
             persist: true
         });
@@ -613,17 +640,19 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_non_owner_cannot_create_subname_under_pop_minted_name() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        bytes32 parentNode = _nodeOf(BASE_LABEL_A);
+        bytes32 parentNode = _nodeOf(PERSONHOOD_LABEL_A);
         IDotnsRegistry.SubnodeRecord memory subnodeRecord = IDotnsRegistry.SubnodeRecord({
             parentNode: parentNode,
             subLabel: "app",
-            parentLabel: BASE_LABEL_A,
+            parentLabel: PERSONHOOD_LABEL_A,
             owner: tiago,
             persist: true
         });
@@ -637,16 +666,16 @@ contract DotnsPopControllerTests is BaseDotns {
         // A name minted through the public commit-reveal flow already has an owner, so a PoP
         // reservation over it could never be redeemed. The guard rejects it at reserve time
         // rather than admitting it and only failing at claim, which would have locked every
-        // lite name built on that stem for the full reservation window.
+        // device name built on that stem for the full reservation window.
         _commitAndRegister("longnamebob", ed, true);
 
-        _grantPopFull(tiago);
-        vm.expectRevert(IDotnsPopController.BaseNameAlreadyRegistered.selector);
-        _reservePop(tiago, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(tiago);
+        vm.expectRevert(IDotnsPopController.PersonhoodNameUnavailable.selector);
+        _reservePop(tiago, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
-        // The guard runs before the lite mint, so the whole call aborts and no lite name is
-        // minted for the candidate.
-        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(LITE_LABEL_A))));
+        // The guard runs before the device-name mint, so the whole call aborts and no device name
+        // is minted for the candidate.
+        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(DEVICE_LABEL_A))));
 
         // No reservation was recorded, so the stem family stays open to other candidates.
         (bool reserved,) = dotnsPopController.isReservedForClaim("longnamebob");
@@ -654,8 +683,8 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_enqueue_becomesHead_writes_popRules_reservation() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
         (address holder, uint64 expires) = popRules.getBaseNameReservation("longnamebob");
         assertEq(holder, ed);
@@ -663,12 +692,12 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_claim_releases_popRules_slot() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "longnamebob", user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "longnamebob", user: ed, link: link})
         );
 
         (address holder,) = popRules.getBaseNameReservation("longnamebob");
@@ -676,8 +705,8 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_relinquish_last_releases_popRules_slot() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
         vm.prank(ed);
         dotnsPopController.relinquishReservation();
@@ -687,8 +716,8 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_advanceExpiredHead_last_expire_releases_popRules_slot() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
         vm.warp(block.timestamp + dotnsPopController.reservationDuration() + 1);
         dotnsPopController.expireReservation("longnamebob");
@@ -697,44 +726,47 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(holder, address(0));
     }
 
-    function test_reserveBaseName_reverts_for_digit_suffixed_reserved_base_label() public {
-        _grantPopFull(ed);
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob01");
+    function test_issueDeviceNameWithReservation_reverts_for_digit_suffixed_reserved_label()
+        public
+    {
+        _grantPersonhood(ed);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob01");
     }
 
-    function test_reserveBaseName_reverts_when_reserved_label_already_registered() public {
-        // George worked example: ed reserves and then claims the base name, which frees the
-        // stem slot on PopRules. A later lite candidate must not be able to queue a reservation
-        // over the now-registered name: the queue keys by stem, so an unclaimable reservation
-        // would hold that stem for the full reservation window and block every lite name built
-        // on it.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: "longnamebob", user: ed, link: _linkWithLite(LITE_LABEL_A)
+    function test_issueDeviceNameWithReservation_reverts_when_reserved_label_already_registered()
+        public
+    {
+        // George worked example: ed reserves and then claims the base name, which frees the stem
+        // slot on PopRules. A later device-name candidate must not be able to queue a reservation
+        // over the now-registered name: the queue keys by stem, so an unclaimable reservation would
+        // hold that stem for the full reservation window and block every device name built on it.
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: "longnamebob", user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
             })
         );
 
-        _grantPopFull(tiago);
-        vm.expectRevert(IDotnsPopController.BaseNameAlreadyRegistered.selector);
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0xbb), "longnamebob");
+        _grantPersonhood(tiago);
+        vm.expectRevert(IDotnsPopController.PersonhoodNameUnavailable.selector);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0xbb), "longnamebob");
     }
 
     /// @dev Claiming the stem takes the name, so nothing is left for a stranger to register.
     ///      What the claim releases is the reservation slot on PopRules, which is what this
     ///      asserts; a digit-suffixed spelling would prove nothing, being an unrelated name.
     function test_claim_clears_the_reservation_slot() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
         (address beforeClaim,) = popRules.getBaseNameReservation("longnamebob");
         assertEq(beforeClaim, ed, "reserved for the claimant");
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "longnamebob", user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "longnamebob", user: ed, link: link})
         );
 
         (address afterClaim,) = popRules.getBaseNameReservation("longnamebob");
@@ -743,13 +775,13 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_public_stranger_can_mint_after_reservation_expires() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
 
         vm.warp(block.timestamp + dotnsPopController.reservationDuration() + 1);
         dotnsPopController.expireReservation("longnamebob");
 
-        _grantPopFull(tiago);
+        _grantPersonhood(tiago);
         _commitAndRegister("longnamebob", tiago, true);
         assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf("longnamebob"))), tiago);
     }
@@ -760,12 +792,12 @@ contract DotnsPopControllerTests is BaseDotns {
         _mockOriginIsRoot(false);
         vm.prank(address(dotnsRegistrarController));
         vm.expectRevert(IDotnsPopController.NotRoot.selector);
-        dotnsPopController.reserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: ""
+        dotnsPopController.issueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: ""
                 }),
-                reservedBaseLabel: "longnamebob"
+                reservedLabel: "longnamebob"
             })
         );
     }
@@ -806,259 +838,270 @@ contract DotnsPopControllerTests is BaseDotns {
         assertFalse(reservedAfter);
     }
 
-    function test_registerBaseName_standalone_succeeds_when_head_is_expired() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_standalone_succeeds_when_head_is_expired() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
         // Walk past both the controller and PopRules expiry windows so
         // nothing blocks tiago's priceWithCheck.
         vm.warp(block.timestamp + popRules.MAX_RESERVATION_TIME() + 1);
 
-        _grantPopFull(tiago);
+        _grantPersonhood(tiago);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: tiago, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: tiago, link: link
+            })
         );
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(BASE_LABEL_A))), tiago);
+        assertEq(
+            IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(PERSONHOOD_LABEL_A))), tiago
+        );
     }
 
-    function test_registerBaseName_standalone_succeeds_when_queue_empty() public {
-        _grantPopFull(ed);
+    function test_issuePersonhoodName_standalone_succeeds_when_queue_empty() public {
+        _grantPersonhood(ed);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xcf));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(BASE_LABEL_A))), ed);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(PERSONHOOD_LABEL_A))), ed);
     }
 
-    function test_registerBaseName_claim_path_bypasses_standalone_holder_guard() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_claim_path_bypasses_standalone_holder_guard() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(BASE_LABEL_A))), ed);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(PERSONHOOD_LABEL_A))), ed);
     }
 
-    function test_registerBaseName_guard_blocks_stranger_and_preserves_claim() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+    function test_issuePersonhoodName_guard_blocks_stranger_and_preserves_claim() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
-        _grantPopFull(tiago);
+        _grantPersonhood(tiago);
         IDotnsPopController.Link memory strangerLink = _linkFresh(_validChatKey(0xbb));
         vm.expectPartialRevert(IDotnsPopController.NotHolder.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: BASE_LABEL_A, user: tiago, link: strangerLink
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: tiago, link: strangerLink
             })
         );
         // A's reservation is intact; A claims successfully.
-        IDotnsPopController.Link memory claimLink = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: claimLink})
+        IDotnsPopController.Link memory claimLink = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: claimLink
+            })
         );
 
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(BASE_LABEL_A))), ed);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(PERSONHOOD_LABEL_A))), ed);
     }
 
-    function test_registerBaseName_reverts_for_governance_length_name() public {
-        _grantPopFull(ed);
+    function test_issuePersonhoodName_reverts_for_governance_length_name() public {
+        _grantPersonhood(ed);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xaa));
         // Stem "alice" has baselength 5; classifies as `Reserved for Governance`,
         // which the PoP controller's governance guard rejects.
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
 
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "alice", user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "alice", user: ed, link: link})
         );
     }
 
-    function test_reserveBaseName_reserved_label_classification_reverts() public {
-        _grantPopFull(ed);
+    function test_issueDeviceNameWithReservation_reserved_label_classification_reverts() public {
+        _grantPersonhood(ed);
 
-        // Lite leg uses a valid lite label; reserved leg uses a <=5-char stem,
+        // The issuance uses a valid device name; reserved leg uses a <=5-char stem,
         // which classifies as `Reserved for Governance` and is rejected by the
         // PoP controller's governance guard.
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
                 }),
-                reservedBaseLabel: "alice"
+                reservedLabel: "alice"
             })
         );
     }
 
-    function test_registerBaseName_popFull_user_on_popFull_label_succeeds() public {
-        _grantPopFull(ed);
+    function test_issuePersonhoodName_personhood_user_on_personhood_label_succeeds() public {
+        _grantPersonhood(ed);
 
         uint256 controllerBalanceBefore = address(dotnsPopController).balance;
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xaa));
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
         // No native token moves on the PoP path.
         assertEq(address(dotnsPopController).balance, controllerBalanceBefore);
-        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(BASE_LABEL_A))), ed);
+        assertEq(IERC721(address(dotnsRegistrar)).ownerOf(uint256(_nodeOf(PERSONHOOD_LABEL_A))), ed);
     }
 
-    function test_reserveLiteName_succeeds_regardless_of_base_reservation() public {
-        string memory baseStem = BASE_LABEL_A;
+    function test_issueDeviceName_succeeds_regardless_of_stem_reservation() public {
+        string memory baseStem = PERSONHOOD_LABEL_A;
         // Occupy the base stem with a live reservation.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), baseStem);
-        // A different user calls reserveLiteName on a different lite label.
-        address fresh = makeAddr("freshLite");
-        _grantPopLite(fresh);
-
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "stephen.01", user: fresh, chatKey: _validChatKey(0xcc)
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), baseStem);
+        // A different user calls issueDeviceName on a different device name.
+        address fresh = makeAddr("freshDevice");
+        _grantDevicehood(fresh);
+
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "stephen.01", user: fresh, chatKey: _validChatKey(0xcc)
             })
         );
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf("stephen.01")), fresh);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf("stephen.01")), fresh);
     }
 
-    function test_reserveLiteName_reverts_for_non_lite_format() public {
-        _grantPopFull(ed);
+    function test_issueDeviceName_reverts_for_non_device_format() public {
+        _grantPersonhood(ed);
 
-        vm.expectRevert(IDotnsPopController.InvalidLiteLabel.selector);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "alice", user: ed, chatKey: _validChatKey(0xaa)
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "alice", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
     }
 
-    function test_reserveLiteName_reverts_when_suffix_is_not_exactly_two_digits() public {
-        _grantPopFull(ed);
+    function test_issueDeviceName_reverts_when_suffix_is_not_exactly_two_digits() public {
+        _grantPersonhood(ed);
 
-        vm.expectRevert(IDotnsPopController.InvalidLiteLabel.selector);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "michael.001", user: ed, chatKey: _validChatKey(0xaa)
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "michael.001", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
     }
 
-    function test_reserveLiteName_reverts_when_the_stem_is_governance_reserved() public {
-        _grantPopFull(ed);
+    function test_issueDeviceName_reverts_when_the_stem_is_governance_reserved() public {
+        _grantPersonhood(ed);
 
-        // `abcd.12` is a well-formed lite label whose four-letter stem classifies as Reserved,
+        // `abcd.12` is a well-formed device name whose four-letter stem classifies as Reserved,
         // so classification is what rejects it rather than the shape.
-        vm.expectRevert(IDotnsPopController.InvalidLiteLabel.selector);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "abcd.12", user: ed, chatKey: _validChatKey(0xaa)
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "abcd.12", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
     }
 
-    function test_reserveLiteName_succeeds_for_long_stem() public {
-        _grantPopLite(ed);
+    function test_issueDeviceName_succeeds_for_long_stem() public {
+        _grantDevicehood(ed);
 
         // `andrewsays.01` has a stem of 10, which classifies as NoStatus. The gateway may issue
-        // it as a lite username regardless of stem length.
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "andrewsays.01", user: ed, chatKey: _validChatKey(0xaa)
+        // it as a device name regardless of stem length.
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "andrewsays.01", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf("andrewsays.01")), ed);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf("andrewsays.01")), ed);
     }
 
-    /// @notice A public registration is not an identity and appears in neither listing.
-    /// @dev Both listings require provenance, so a name the gateway never minted is absent from
-    ///      both however it is spelled. Without that, `joseph42` would read as a full-person
-    ///      identity purely because it is a single label.
-    function test_lens_omits_a_public_registration_from_both_listings() public {
-        _grantPopFull(ed);
+    /// @notice A public registration is not an identity and is not listed.
+    /// @dev The listing requires provenance, so a name the gateway never minted is absent however
+    ///      it is spelled. Without that, `joseph42` would read as a personhood name purely because
+    ///      it is a single label.
+    function test_lens_omits_a_public_registration() public {
+        _grantPersonhood(ed);
         _commitAndRegister("joseph42", ed, true);
 
         assertFalse(dotnsPopController.isPopIssued("joseph42"), "the gateway did not mint it");
 
-        assertEq(dotnsPopLens.fullNamesOf(ed, 0, 10).length, 0, "not a full-person identity");
-        assertEq(dotnsPopLens.liteNamesOf(ed, 0, 10).length, 0, "nor a lite one");
-        assertEq(dotnsPopLens.fullNameCountOf(ed), 0);
-        assertEq(dotnsPopLens.liteNameCountOf(ed), 0);
+        assertEq(dotnsPopLens.namesOf(ed, 0, 10).length, 0, "not an identity");
+        assertEq(dotnsPopLens.nameCountOf(ed), 0);
     }
 
-    /// @notice A full-person gateway name lists as full, not lite.
-    /// @dev `isPopIssued` covers every name the controller mints, lite and full alike, so it
-    ///      cannot say which kind a name is. The separator does that. Keying the lite listing on
-    ///      provenance alone would move every full-person identity into it.
-    function test_lens_lists_a_full_person_name_as_full() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
+    /// @notice Device names and personhood names come back in one listing.
+    /// @dev `isPopIssued` covers every name the controller mints, of both kinds, and the label
+    ///      shape tells them apart: a device name carries its separator.
+    function test_lens_lists_device_and_personhood_names_together() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        assertTrue(dotnsPopController.isPopIssued(BASE_LABEL_A), "both kinds carry provenance");
-        assertTrue(dotnsPopController.isPopIssued(LITE_LABEL_A), "both kinds carry provenance");
-
-        IDotnsPopLens.Name[] memory full = dotnsPopLens.fullNamesOf(ed, 0, 10);
-        assertEq(full.length, 1, "the full-person name is in the full listing");
-        assertEq(full[0].label, BASE_LABEL_A);
+        assertTrue(
+            dotnsPopController.isPopIssued(PERSONHOOD_LABEL_A), "both kinds carry provenance"
+        );
+        assertTrue(dotnsPopController.isPopIssued(DEVICE_LABEL_A), "both kinds carry provenance");
 
-        IDotnsPopLens.Name[] memory lite = dotnsPopLens.liteNamesOf(ed, 0, 10);
-        assertEq(lite.length, 1, "and the lite name is in the lite listing");
-        assertEq(lite[0].label, LITE_LABEL_A);
+        IDotnsPopLens.Name[] memory names = dotnsPopLens.namesOf(ed, 0, 10);
+        assertEq(names.length, 2, "both names are listed");
+        assertTrue(_namesContainNode(names, _nodeOf(PERSONHOOD_LABEL_A)), "the personhood name");
+        assertTrue(_namesContainNode(names, _deviceNodeOf(DEVICE_LABEL_A)), "and the device name");
+        assertEq(dotnsPopLens.nameCountOf(ed), 2);
     }
 
-    /// @notice A full-person name is letters only, the same rule a lite stem follows.
+    /// @notice A personhood name is letters only, the same rule a device-name stem follows.
     /// @dev The hyphen and interior-digit cases are the ones a trailing-digit check misses:
     ///      `alice-bob` and `micha3l` are valid DNS labels and would otherwise be issued as
-    ///      identities, while being impossible as lite stems. All three revert with this
+    ///      identities, while being impossible as device-name stems. All three revert with this
     ///      interface's own error.
-    function test_registerBaseName_rejects_a_label_that_is_not_letters_only() public {
+    function test_issuePersonhoodName_rejects_a_label_that_is_not_letters_only() public {
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xa1));
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "alice-bob", user: ed, link: link})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "alice-bob", user: ed, link: link})
         );
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "micha3l", user: ed, link: link})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "micha3l", user: ed, link: link})
         );
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "Joseph", user: ed, link: link})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "Joseph", user: ed, link: link})
         );
     }
 
-    /// @dev The reservation entrypoints share `_validateBaseLabel`, so a hyphen is rejected
+    /// @dev The reservation entrypoints share `_validatePersonhoodLabel`, so a hyphen is rejected
     ///      there too rather than resolving to an empty queue.
     function test_reservation_entrypoints_reject_a_label_that_is_not_letters_only() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xa2), "alice-bob");
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xa2), "alice-bob");
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
         dotnsPopController.expireReservation("alice-bob");
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
         dotnsPopController.isReservedForClaim("micha3l");
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xa3), "Joseph");
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xa3), "Joseph");
     }
 
     /// @notice The controller answers its own ERC-165 id and nothing else.
@@ -1074,16 +1117,16 @@ contract DotnsPopControllerTests is BaseDotns {
     /// @dev The node is the hash of the whole string, so it is not the node a subname path
     ///      would produce for the same text. Pinning both is what makes "keep the dot"
     ///      concrete rather than cosmetic.
-    function test_reserveLiteName_stores_the_label_with_its_separator() public {
-        _grantPopLite(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "michael.01", user: ed, chatKey: _validChatKey(0xaa)
+    function test_issueDeviceName_stores_the_label_with_its_separator() public {
+        _grantDevicehood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "michael.01", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
         // The name is a subname under its numeric container, owned in the registry record.
-        bytes32 subnamePathNode = _liteNodeOf("michael.01");
+        bytes32 subnamePathNode = _deviceNodeOf("michael.01");
         assertEq(dotnsRegistry.owner(subnamePathNode), ed);
 
         // The whole-label reading is a different node and is never minted as a token.
@@ -1093,12 +1136,12 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_isPopIssued_is_set_at_mint() public {
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
         assertFalse(dotnsPopController.isPopIssued("michael.01"), "not issued before the mint");
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "michael.01", user: ed, chatKey: _validChatKey(0xaa)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "michael.01", user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
@@ -1117,11 +1160,11 @@ contract DotnsPopControllerTests is BaseDotns {
     ///      name stashed as a pending claim must already answer true.
     function test_isPopIssued_holds_across_cold_path_settlement() public {
         address cold = makeAddr("coldClaimant");
-        _grantPopLite(cold);
+        _grantDevicehood(cold);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: "william.03", user: cold, chatKey: _validChatKey(0xbb)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: "william.03", user: cold, chatKey: _validChatKey(0xbb)
             })
         );
 
@@ -1134,134 +1177,139 @@ contract DotnsPopControllerTests is BaseDotns {
         assertTrue(dotnsPopController.isPopIssued("william.03"), "still true once settled");
     }
 
-    /// @dev Provenance covers every name this controller mints, not only the lite ones, because
-    ///      it records who issued the name rather than which tier it sits in.
-    function test_isPopIssued_covers_full_person_names() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
+    /// @dev Provenance covers every name this controller mints, not only the device-name ones,
+    ///      because it records who issued the name rather than which tier it sits in.
+    function test_isPopIssued_covers_personhood_names() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
 
-        IDotnsPopController.Link memory link = _linkWithLite(LITE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: ed, link: link})
+        IDotnsPopController.Link memory link = _linkWithDeviceName(DEVICE_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: link
+            })
         );
 
-        assertTrue(dotnsPopController.isPopIssued(BASE_LABEL_A));
+        assertTrue(dotnsPopController.isPopIssued(PERSONHOOD_LABEL_A));
     }
 
-    function test_reserveLiteName_reverts_when_origin_is_not_root() public {
+    function test_issueDeviceName_reverts_when_origin_is_not_root() public {
         _mockOriginIsRoot(false);
         vm.expectRevert(IDotnsPopController.NotRoot.selector);
-        dotnsPopController.reserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        dotnsPopController.issueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
     }
 
-    function test_reserveBaseName_lite_and_base_legs_both_succeed_in_one_call() public {
-        _grantPopFull(ed);
+    function test_issueDeviceNameWithReservation_issuance_and_reservation_both_succeed_in_one_call()
+        public
+    {
+        _grantPersonhood(ed);
 
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
                 }),
-                reservedBaseLabel: BASE_LABEL_A
+                reservedLabel: PERSONHOOD_LABEL_A
             })
         );
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf(LITE_LABEL_A)), ed);
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
 
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(reserved);
         assertEq(holder, ed);
     }
 
-    function test_split_gateway_flow_mints_lite_then_reserves_base() public {
-        _grantPopFull(ed);
+    function test_split_gateway_flow_issues_device_name_then_reserves_personhood_name() public {
+        _grantPersonhood(ed);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
-        assertEq(dotnsRegistry.owner(_liteNodeOf(LITE_LABEL_A)), ed);
-        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(BASE_LABEL_A))));
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
+        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(PERSONHOOD_LABEL_A))));
 
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: BASE_LABEL_A})
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
         );
 
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(reserved);
         assertEq(holder, ed);
-        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(BASE_LABEL_A))));
+        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(PERSONHOOD_LABEL_A))));
     }
 
-    function test_reserveBaseNameOnly_reverts_when_origin_is_not_root() public {
+    function test_reservePersonhoodName_reverts_when_origin_is_not_root() public {
         _mockOriginIsRoot(false);
         vm.expectRevert(IDotnsPopController.NotRoot.selector);
-        dotnsPopController.reserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: BASE_LABEL_A})
+        dotnsPopController.reservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
         );
     }
 
-    function test_reserveBaseNameOnly_reverts_for_reserved_or_suffixed_labels() public {
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: "alice"})
+    function test_reservePersonhoodName_reverts_for_reserved_or_suffixed_labels() public {
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: "alice"})
         );
 
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: "longnamebob01"})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: "longnamebob01"})
         );
     }
 
-    function test_reserveBaseNameOnly_reverts_when_label_already_registered() public {
+    function test_reservePersonhoodName_reverts_when_label_already_registered() public {
         // The standalone reservation entrypoint shares the same guard: a base name that already
         // has an owner on the registrar can never be redeemed, so the reservation is rejected up
         // front rather than discovered to be unusable at claim time.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0xaa), "longnamebob");
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: "longnamebob", user: ed, link: _linkWithLite(LITE_LABEL_A)
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0xaa), "longnamebob");
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: "longnamebob", user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
             })
         );
 
-        vm.expectRevert(IDotnsPopController.BaseNameAlreadyRegistered.selector);
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: tiago, reservedBaseLabel: "longnamebob"})
+        vm.expectRevert(IDotnsPopController.PersonhoodNameUnavailable.selector);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: tiago, label: "longnamebob"})
         );
     }
 
-    function test_reserveBaseNameOnly_does_not_mint_lite_or_base_name() public {
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: BASE_LABEL_A})
+    function test_reservePersonhoodName_does_not_issue_a_name() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
         );
 
-        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(LITE_LABEL_A))));
-        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(BASE_LABEL_A))));
+        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(DEVICE_LABEL_A))));
+        assertFalse(dotnsRegistrar.exists(uint256(_nodeOf(PERSONHOOD_LABEL_A))));
 
-        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertTrue(reserved);
         assertEq(holder, ed);
     }
 
-    function test_reserveBaseNameOnly_same_user_can_replace_prior_reservation() public {
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: BASE_LABEL_A})
+    function test_reservePersonhoodName_same_user_can_replace_prior_reservation() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
         );
-        _rootReserveBaseNameOnly(
-            IDotnsPopController.BaseNameReservation({user: ed, reservedBaseLabel: BASE_LABEL_B})
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_B})
         );
 
-        (bool firstReserved,) = dotnsPopController.isReservedForClaim(BASE_LABEL_A);
+        (bool firstReserved,) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
         assertFalse(firstReserved);
 
-        (bool secondReserved, address holder) = dotnsPopController.isReservedForClaim(BASE_LABEL_B);
+        (bool secondReserved, address holder) =
+            dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_B);
         assertTrue(secondReserved);
         assertEq(holder, ed);
     }
@@ -1271,14 +1319,14 @@ contract DotnsPopControllerTests is BaseDotns {
         // gateway can settle a user's pending claim, deploying the user's store and writing the
         // stashed label. The settled name lands in the beneficiary's store, and the settlement
         // event records the third party as the settler.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
-        bytes32 labelhash = keccak256(bytes(LITE_LABEL_A));
+        bytes32 labelhash = keccak256(bytes(DEVICE_LABEL_A));
         address expectedStore =
             vm.computeCreateAddress(address(storeFactory), vm.getNonce(address(storeFactory)));
 
@@ -1290,17 +1338,17 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertEq(store, expectedStore);
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, ".dot")
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, ".dot")
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
     function test_user_settles_own_pending_claim_after_gateway_mint() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
@@ -1310,17 +1358,17 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, ".dot")
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, ".dot")
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
     function test_claimLabelStore_settles_callers_own_pending_claim() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
@@ -1331,22 +1379,22 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
     function test_settle_deploys_store_when_user_has_none() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0xaa)
             })
         );
 
-        assertEq(dotnsPopController.pendingClaims(ed, 0, 1)[0].label, LITE_LABEL_A);
+        assertEq(dotnsPopController.pendingClaims(ed, 0, 1)[0].label, DEVICE_LABEL_A);
         assertEq(storeFactory.getLabelStore(ed), address(0));
 
         (uint256 settledCount, bool moreRemaining) =
@@ -1357,40 +1405,40 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, ".dot")
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, ".dot")
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
-    function test_registerBaseName_zero_length_label_reverts() public {
-        _grantPopFull(ed);
+    function test_issuePersonhoodName_zero_length_label_reverts() public {
+        _grantPersonhood(ed);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xaa));
-        vm.expectRevert(IDotnsPopController.InvalidBaseLabel.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: "", user: ed, link: link})
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({label: "", user: ed, link: link})
         );
     }
 
-    function test_reserveBaseName_accepts_65_byte_chat_key() public {
-        _grantPopFull(ed);
+    function test_issueDeviceNameWithReservation_accepts_65_byte_chat_key() public {
+        _grantPersonhood(ed);
 
         bytes memory chatKey = _validChatKey(0x42);
 
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: chatKey
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: chatKey
                 }),
-                reservedBaseLabel: ""
+                reservedLabel: ""
             })
         );
 
         vm.prank(ed);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
     }
 
@@ -1414,16 +1462,16 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_gatewayReserve_stashes_pending_claim_when_user_has_no_label_store() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         bytes memory chatKey = _validChatKey(0x01);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: chatKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: chatKey
             })
         );
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         assertEq(dotnsRegistry.owner(node), ed);
         assertEq(storeFactory.getLabelStore(ed), address(0));
         // Chat key is now persisted eagerly on the resolver at reserve time, even when
@@ -1432,17 +1480,17 @@ contract DotnsPopControllerTests is BaseDotns {
 
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
-        assertEq(pending[0].label, LITE_LABEL_A);
+        assertEq(pending[0].label, DEVICE_LABEL_A);
         assertGt(pending[0].mintedAt, 0);
     }
 
     function test_settle_deploys_store_and_writes_label_and_chat_key() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         bytes memory chatKey = _validChatKey(0x07);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: chatKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: chatKey
             })
         );
 
@@ -1452,9 +1500,9 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         assertEq(
-            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(node), string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
 
@@ -1462,16 +1510,16 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_settle_emits_settled_and_name_registered() public {
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         bytes memory chatKey = _validChatKey(0x03);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: chatKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: chatKey
             })
         );
 
-        bytes32 labelhash = keccak256(bytes(LITE_LABEL_A));
+        bytes32 labelhash = keccak256(bytes(DEVICE_LABEL_A));
         address expectedStore =
             vm.computeCreateAddress(address(storeFactory), vm.getNonce(address(storeFactory)));
 
@@ -1479,7 +1527,7 @@ contract DotnsPopControllerTests is BaseDotns {
         vm.expectEmit(true, true, false, true, address(dotnsPopController));
         emit IDotnsPopController.PendingClaimSettled(ed, labelhash, expectedStore, ed);
         vm.expectEmit(true, true, true, true, address(dotnsPopController));
-        emit IDotnsPopController.NameRegistered(LITE_LABEL_A, labelhash, ed, expectedStore);
+        emit IDotnsPopController.NameRegistered(DEVICE_LABEL_A, labelhash, ed, expectedStore);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
     }
 
@@ -1498,20 +1546,20 @@ contract DotnsPopControllerTests is BaseDotns {
         // A large queue is drained in bounded batches so a single settlement can never exceed the
         // block gas limit. Settling with a limit below the queue length reports the residue and a
         // follow-up call clears it.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x05)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x05)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: ed, chatKey: _validChatKey(0x06)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: ed, chatKey: _validChatKey(0x06)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_C, user: ed, chatKey: _validChatKey(0x07)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_C, user: ed, chatKey: _validChatKey(0x07)
             })
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 3);
@@ -1530,21 +1578,21 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
-    function test_settle_on_expiry_by_third_party_writes_label() public {
-        // Age never gates settlement: a claim warped past its reservation deadline still settles
+    function test_settle_after_reservation_duration_by_third_party_writes_label() public {
+        // Age never gates settlement: a claim warped past `reservationDuration` still settles
         // in full. A third party drives the settlement, the store is deployed for the beneficiary,
         // the label is written, the queue empties, the beneficiary leaves the enumeration set, and
         // the settler is recorded on the event.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x02)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x02)
             })
         );
 
         vm.warp(block.timestamp + DEFAULT_RESERVATION_DURATION + 1);
 
-        bytes32 labelhash = keccak256(bytes(LITE_LABEL_A));
+        bytes32 labelhash = keccak256(bytes(DEVICE_LABEL_A));
         address expectedStore =
             vm.computeCreateAddress(address(storeFactory), vm.getNonce(address(storeFactory)));
 
@@ -1559,8 +1607,8 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertEq(store, expectedStore);
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
@@ -1570,10 +1618,10 @@ contract DotnsPopControllerTests is BaseDotns {
         // The old model dropped lapsed entries; stores now always settle. Warping past the
         // reservation duration and settling writes the label into the store rather than
         // discarding it.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x04)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x04)
             })
         );
 
@@ -1585,34 +1633,34 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
     }
 
-    function test_reserveLiteName_piles_second_pending_claim_when_caller_has_no_store() public {
+    function test_issueDeviceName_piles_second_pending_claim_when_caller_has_no_store() public {
         // The Root gateway origin cannot deploy a LabelStore, so a store-less user keeps
         // accumulating deferred names instead of reverting; a single signed-origin
         // settlement writes them all at once.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x05)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x05)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: ed, chatKey: _validChatKey(0x06)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: ed, chatKey: _validChatKey(0x06)
             })
         );
 
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
         assertEq(pending.length, 2);
-        assertEq(pending[0].label, LITE_LABEL_A);
-        assertEq(pending[1].label, LITE_LABEL_B);
+        assertEq(pending[0].label, DEVICE_LABEL_A);
+        assertEq(pending[1].label, DEVICE_LABEL_B);
         assertEq(dotnsPopController.pendingClaimUserCount(), 1);
 
         vm.prank(ed);
@@ -1621,12 +1669,12 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_B)),
-            string.concat(LITE_LABEL_B, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_B)),
+            string.concat(DEVICE_LABEL_B, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
@@ -1637,34 +1685,34 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
-    function test_registerBaseName_claim_by_store_less_full_person_piles_then_settles() public {
-        // Regression: a store-less full person reserves a lite name plus a base reservation
-        // (the lite leg stashes a deferred claim because Root cannot deploy the store), then
-        // claims the base name. The base mint stashes a second deferred claim instead of
+    function test_issuePersonhoodName_claim_by_store_less_personhood_piles_then_settles() public {
+        // Regression: a store-less personhood holder reserves a device name plus a base reservation
+        // (the device-name issuance stashes a deferred claim because Root cannot deploy the store),
+        // then claims the base name. The base mint stashes a second deferred claim instead of
         // reverting; one signed-origin settlement deploys the store and settles both.
-        _grantPopFull(ed);
-        _rootReserveBaseName(
-            IDotnsPopController.BaseReservation({
-                lite: IDotnsPopController.LiteRegistration({
-                    liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x31)
+        _grantPersonhood(ed);
+        _rootIssueDeviceNameWithReservation(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x31)
                 }),
-                reservedBaseLabel: BASE_LABEL_A
+                reservedLabel: PERSONHOOD_LABEL_A
             })
         );
         assertEq(storeFactory.getLabelStore(ed), address(0));
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 1);
 
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: BASE_LABEL_A, user: ed, link: _linkWithLite(LITE_LABEL_A)
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
             })
         );
 
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
         assertEq(pending.length, 2);
-        assertEq(pending[0].label, LITE_LABEL_A);
-        assertEq(pending[1].label, BASE_LABEL_A);
+        assertEq(pending[0].label, DEVICE_LABEL_A);
+        assertEq(pending[1].label, PERSONHOOD_LABEL_A);
 
         vm.prank(ed);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
@@ -1672,34 +1720,34 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(
-            ILabelStore(store).getLabel(_nodeOf(BASE_LABEL_A)),
-            string.concat(BASE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_nodeOf(PERSONHOOD_LABEL_A)),
+            string.concat(PERSONHOOD_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
 
     function test_pendingClaimUsers_enumeration_mirrors_stash_and_settle() public {
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _grantPopFull(leonardo);
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _grantPersonhood(leonardo);
 
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: tiago, chatKey: _validChatKey(0x02)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: tiago, chatKey: _validChatKey(0x02)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
             })
         );
 
@@ -1723,10 +1771,10 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_pendingClaimUsers_returns_empty_when_offset_past_count() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
             })
         );
 
@@ -1734,13 +1782,13 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(empty.length, 0);
     }
 
-    function test_settle_at_exact_expiry_boundary_writes_label() public {
-        // Age is irrelevant to settlement: at the exact reservation deadline the claim still
-        // settles and writes its label rather than being treated as forfeit.
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x11)
+    function test_settle_at_exactly_reservation_duration_writes_label() public {
+        // Age is irrelevant to settlement: exactly `reservationDuration` after the mint the claim
+        // still settles and writes its label rather than being treated as forfeit.
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x11)
             })
         );
 
@@ -1753,8 +1801,8 @@ contract DotnsPopControllerTests is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(_liteNodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(_deviceNodeOf(DEVICE_LABEL_A)),
+            string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
     }
@@ -1762,11 +1810,11 @@ contract DotnsPopControllerTests is BaseDotns {
     function test_settle_is_keyed_by_user_arg_other_stash_untouched() public {
         // Settlement targets the `user` argument, not the caller: settling for a user with no
         // stash is a no-op and does not disturb another user's pending claim.
-        _grantPopFull(ed);
+        _grantPersonhood(ed);
         bytes memory chatKey = _validChatKey(0x12);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: chatKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: chatKey
             })
         );
 
@@ -1778,7 +1826,7 @@ contract DotnsPopControllerTests is BaseDotns {
 
         IDotnsPopController.PendingClaim[] memory pending =
             dotnsPopController.pendingClaims(ed, 0, type(uint256).max);
-        assertEq(pending[0].label, LITE_LABEL_A);
+        assertEq(pending[0].label, DEVICE_LABEL_A);
         assertGt(pending[0].mintedAt, 0);
         assertEq(storeFactory.getLabelStore(ed), address(0));
         assertEq(storeFactory.getLabelStore(tiago), address(0));
@@ -1786,22 +1834,22 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_pendingClaimUsers_pagination_boundary_cases() public {
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _grantPopFull(leonardo);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _grantPersonhood(leonardo);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: tiago, chatKey: _validChatKey(0x02)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: tiago, chatKey: _validChatKey(0x02)
             })
         );
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
             })
         );
 
@@ -1815,28 +1863,28 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_settle_with_empty_chat_key_skips_resolver_write() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({liteLabel: LITE_LABEL_A, user: ed, chatKey: ""})
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({label: DEVICE_LABEL_A, user: ed, chatKey: ""})
         );
 
         vm.prank(ed);
         dotnsPopController.settlePendingClaims(ed, type(uint256).max);
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_A);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_A);
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, protocolRegistry.tld())
+            ILabelStore(store).getLabel(node), string.concat(DEVICE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopResolver.chatKey(node).length, 0);
     }
 
     function test_gatewayReserve_warm_user_after_settle_writes_directly_without_stashing() public {
-        _grantPopFull(ed);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: ed, chatKey: _validChatKey(0x21)
+        _grantPersonhood(ed);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x21)
             })
         );
 
@@ -1846,15 +1894,15 @@ contract DotnsPopControllerTests is BaseDotns {
         assertTrue(store != address(0));
 
         bytes memory secondChatKey = _validChatKey(0x22);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: ed, chatKey: secondChatKey
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: ed, chatKey: secondChatKey
             })
         );
 
-        bytes32 node = _liteNodeOf(LITE_LABEL_B);
+        bytes32 node = _deviceNodeOf(DEVICE_LABEL_B);
         assertEq(
-            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_B, protocolRegistry.tld())
+            ILabelStore(store).getLabel(node), string.concat(DEVICE_LABEL_B, protocolRegistry.tld())
         );
         assertEq(dotnsPopResolver.chatKey(node), secondChatKey);
         assertEq(dotnsPopController.pendingClaimCountOf(ed), 0);
@@ -1864,12 +1912,12 @@ contract DotnsPopControllerTests is BaseDotns {
     function test_advanceExpiredHead_promotes_waiter_and_resyncs_popRules() public {
         string memory stem = "longnamebob";
         uint64 duration = dotnsPopController.reservationDuration();
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
 
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), stem);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), stem);
         vm.warp(block.timestamp + uint256(duration) / 2);
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0x02), stem);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0x02), stem);
 
         bytes32 labelhash = keccak256(bytes(stem));
         (uint64 head, uint64 tail) = dotnsPopController.reservationMeta(labelhash);
@@ -1900,191 +1948,237 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_multiWaiter_standaloneGuard_rejects_non_head_user() public {
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
-        _reservePop(tiago, LITE_LABEL_B, _validChatKey(0x02), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
+        _reservePop(tiago, DEVICE_LABEL_B, _validChatKey(0x02), PERSONHOOD_LABEL_A);
 
         IDotnsPopController.Link memory link = _linkFresh(_validChatKey(0xbb));
         vm.expectPartialRevert(IDotnsPopController.NotHolder.selector);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({label: BASE_LABEL_A, user: tiago, link: link})
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: tiago, link: link
+            })
         );
     }
 
-    function test_liteNamesOf_and_fullNamesOf_split_issued_names_by_shape() public {
-        // Settled names read back from the store; a pending gateway name reads from the queue with
-        // a live deadline; the two shapes never cross into each other's list; an untouched account
-        // returns empty lists and zero counts.
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: BASE_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
+    function test_namesOf_lists_issued_names_with_settlement_state() public {
+        // Settled names read back from the store; a pending gateway name reads from the queue; an
+        // untouched account returns an empty list and a zero count.
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
             })
         );
 
-        _grantPopFull(leonardo);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
+        _grantPersonhood(leonardo);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x03)
             })
         );
 
-        IDotnsPopLens.Name[] memory edLite = dotnsPopLens.liteNamesOf(ed, 0, type(uint256).max);
-        assertEq(edLite.length, 1);
-        assertEq(edLite[0].node, _liteNodeOf(LITE_LABEL_A));
-        assertEq(edLite[0].label, LITE_LABEL_A);
-        assertTrue(edLite[0].settled);
-        assertEq(edLite[0].deadline, 0);
-
-        IDotnsPopLens.Name[] memory edFull = dotnsPopLens.fullNamesOf(ed, 0, type(uint256).max);
-        assertEq(edFull.length, 1);
-        assertEq(edFull[0].node, _nodeOf(BASE_LABEL_A));
-        assertEq(edFull[0].label, BASE_LABEL_A);
-        assertTrue(edFull[0].settled);
-
-        assertEq(dotnsPopLens.liteNameCountOf(ed), 1);
-        assertEq(dotnsPopLens.fullNameCountOf(ed), 1);
-
-        IDotnsPopLens.Name[] memory leoLite =
-            dotnsPopLens.liteNamesOf(leonardo, 0, type(uint256).max);
-        assertEq(leoLite.length, 1);
-        assertEq(leoLite[0].node, _liteNodeOf(LITE_LABEL_C));
-        assertEq(leoLite[0].label, LITE_LABEL_C);
-        assertFalse(leoLite[0].settled);
-        assertGt(leoLite[0].deadline, 0);
-        assertEq(dotnsPopLens.liteNameCountOf(leonardo), 1);
-        assertEq(dotnsPopLens.fullNameCountOf(leonardo), 0);
-
-        assertEq(dotnsPopLens.liteNamesOf(tiago, 0, type(uint256).max).length, 0);
-        assertEq(dotnsPopLens.fullNamesOf(tiago, 0, type(uint256).max).length, 0);
-        assertEq(dotnsPopLens.liteNameCountOf(tiago), 0);
-        assertEq(dotnsPopLens.fullNameCountOf(tiago), 0);
-    }
-
-    function test_liteNamesOf_pagination_slices_and_clamps() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_B, user: ed, chatKey: _validChatKey(0x02)
+        IDotnsPopLens.Name[] memory edNames = dotnsPopLens.namesOf(ed, 0, type(uint256).max);
+        assertEq(edNames.length, 2);
+        IDotnsPopLens.Name memory edDevice = _nameWithNode(edNames, _deviceNodeOf(DEVICE_LABEL_A));
+        assertEq(edDevice.label, DEVICE_LABEL_A);
+        assertTrue(edDevice.settled);
+        IDotnsPopLens.Name memory edPersonhood = _nameWithNode(edNames, _nodeOf(PERSONHOOD_LABEL_A));
+        assertEq(edPersonhood.label, PERSONHOOD_LABEL_A);
+        assertTrue(edPersonhood.settled);
+        assertEq(dotnsPopLens.nameCountOf(ed), 2);
+
+        IDotnsPopLens.Name[] memory leoNames = dotnsPopLens.namesOf(leonardo, 0, type(uint256).max);
+        assertEq(leoNames.length, 1);
+        assertEq(leoNames[0].node, _deviceNodeOf(DEVICE_LABEL_C));
+        assertEq(leoNames[0].label, DEVICE_LABEL_C);
+        assertFalse(leoNames[0].settled);
+        assertEq(dotnsPopLens.nameCountOf(leonardo), 1);
+
+        assertEq(dotnsPopLens.namesOf(tiago, 0, type(uint256).max).length, 0);
+        assertEq(dotnsPopLens.nameCountOf(tiago), 0);
+    }
+
+    function test_namesOf_pagination_slices_and_clamps() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_B, user: ed, chatKey: _validChatKey(0x02)
             })
         );
 
-        assertEq(dotnsPopLens.liteNameCountOf(ed), 2);
+        assertEq(dotnsPopLens.nameCountOf(ed), 2);
 
-        IDotnsPopLens.Name[] memory first = dotnsPopLens.liteNamesOf(ed, 0, 1);
+        IDotnsPopLens.Name[] memory first = dotnsPopLens.namesOf(ed, 0, 1);
         assertEq(first.length, 1);
-        IDotnsPopLens.Name[] memory second = dotnsPopLens.liteNamesOf(ed, 1, 1);
+        IDotnsPopLens.Name[] memory second = dotnsPopLens.namesOf(ed, 1, 1);
         assertEq(second.length, 1);
         assertTrue(first[0].node != second[0].node);
 
-        assertEq(dotnsPopLens.liteNamesOf(ed, 2, 1).length, 0);
+        assertEq(dotnsPopLens.namesOf(ed, 2, 1).length, 0);
 
         // A limit above the internal page ceiling is clamped rather than reverting; the account
         // holds fewer names than the ceiling, so the full set still comes back.
         IDotnsPopLens.Name[] memory clamped =
-            dotnsPopLens.liteNamesOf(ed, 0, DotnsConstants.MAX_PAGE_SIZE + 1);
+            dotnsPopLens.namesOf(ed, 0, DotnsConstants.MAX_PAGE_SIZE + 1);
         assertEq(clamped.length, 2);
     }
 
     function test_name_listings_exclude_names_owned_by_others() public {
         // The listing re-checks registrar ownership per entry, so a name owned by another account
         // never surfaces in this account's list.
-        _grantPopFull(ed);
-        _grantPopFull(tiago);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
-        _reservePop(tiago, LITE_LABEL_C, _validChatKey(0x02), "");
+        _grantPersonhood(ed);
+        _grantPersonhood(tiago);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
+        _reservePop(tiago, DEVICE_LABEL_C, _validChatKey(0x02), "");
 
-        IDotnsPopLens.Name[] memory edLite = dotnsPopLens.liteNamesOf(ed, 0, type(uint256).max);
-        assertEq(edLite.length, 1);
-        assertFalse(_namesContainNode(edLite, _liteNodeOf(LITE_LABEL_C)));
+        IDotnsPopLens.Name[] memory edDevice = dotnsPopLens.namesOf(ed, 0, type(uint256).max);
+        assertEq(edDevice.length, 1);
+        assertFalse(_namesContainNode(edDevice, _deviceNodeOf(DEVICE_LABEL_C)));
 
-        IDotnsPopLens.Name[] memory tiagoLite =
-            dotnsPopLens.liteNamesOf(tiago, 0, type(uint256).max);
-        assertEq(tiagoLite.length, 1);
-        assertFalse(_namesContainNode(tiagoLite, _liteNodeOf(LITE_LABEL_A)));
+        IDotnsPopLens.Name[] memory tiagoDevice = dotnsPopLens.namesOf(tiago, 0, type(uint256).max);
+        assertEq(tiagoDevice.length, 1);
+        assertFalse(_namesContainNode(tiagoDevice, _deviceNodeOf(DEVICE_LABEL_A)));
     }
 
     function test_nameDetail_and_nameDetailByNode_report_record() public {
-        _grantPopFull(ed);
-        bytes memory liteChatKey = _validChatKey(0xaa);
-        _reservePop(ed, LITE_LABEL_A, liteChatKey, BASE_LABEL_A);
-        _rootRegisterBaseName(
-            IDotnsPopController.FullRegistration({
-                label: BASE_LABEL_A, user: ed, link: _linkWithLite(LITE_LABEL_A)
-            })
-        );
-
-        bytes32 fullNode = _nodeOf(BASE_LABEL_A);
-        IDotnsPopLens.NameDetail memory full = dotnsPopLens.nameDetail(BASE_LABEL_A);
-        assertEq(full.node, fullNode);
-        assertEq(full.label, BASE_LABEL_A);
-        assertEq(full.owner, ed);
-        assertTrue(full.exists);
-        assertTrue(full.settled);
-        assertTrue(full.tier == IPopRules.PopStatus.PopFull);
-        assertEq(full.chatKey, liteChatKey);
-        assertEq(full.liteLink, keccak256(bytes(LITE_LABEL_A)));
-        // A base label is never a lite labelhash, so no promoted node is keyed under it.
-        assertEq(full.fullClaim, bytes32(0));
-
-        // Holding the lite label lets nameDetail recover the promoted full node.
-        IDotnsPopLens.NameDetail memory lite = dotnsPopLens.nameDetail(LITE_LABEL_A);
-        assertEq(lite.fullClaim, fullNode);
-
-        // A settled lite name that was never promoted carries no full claim, and the by-node
-        // overload leaves it zero.
-        _grantPopFull(leonardo);
-        _reservePop(leonardo, LITE_LABEL_C, _validChatKey(0xbb), "");
+        _grantPersonhood(ed);
+        bytes memory deviceChatKey = _validChatKey(0xaa);
+        _reservePop(ed, DEVICE_LABEL_A, deviceChatKey, PERSONHOOD_LABEL_A);
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
+            })
+        );
+
+        bytes32 personhoodNode = _nodeOf(PERSONHOOD_LABEL_A);
+        IDotnsPopLens.NameDetail memory personhood = dotnsPopLens.nameDetail(PERSONHOOD_LABEL_A);
+        assertEq(personhood.node, personhoodNode);
+        assertEq(personhood.label, PERSONHOOD_LABEL_A);
+        assertEq(personhood.owner, ed);
+        assertTrue(personhood.exists);
+        assertTrue(personhood.settled);
+        assertTrue(personhood.requiredTier == IPopRules.PopStatus.Personhood);
+        assertEq(personhood.chatKey, deviceChatKey);
+        assertEq(personhood.deviceLabelhash, keccak256(bytes(DEVICE_LABEL_A)));
+        // A base label is never a device-name labelhash, so no promoted node is keyed under it.
+        assertEq(personhood.personhoodNode, bytes32(0));
+
+        // Holding the device name lets nameDetail recover the promoted personhood node.
+        IDotnsPopLens.NameDetail memory device = dotnsPopLens.nameDetail(DEVICE_LABEL_A);
+        assertEq(device.personhoodNode, personhoodNode);
+
+        // A settled device name that was never promoted carries no personhood claim, and the
+        // by-node overload leaves it zero.
+        _grantPersonhood(leonardo);
+        _reservePop(leonardo, DEVICE_LABEL_C, _validChatKey(0xbb), "");
         IDotnsPopLens.NameDetail memory coldByNode =
-            dotnsPopLens.nameDetailByNode(_liteNodeOf(LITE_LABEL_C));
+            dotnsPopLens.nameDetailByNode(_deviceNodeOf(DEVICE_LABEL_C));
         assertTrue(coldByNode.exists);
-        assertEq(coldByNode.fullClaim, bytes32(0));
+        assertEq(coldByNode.personhoodNode, bytes32(0));
 
         // Unknown name and node never revert and return a zeroed record.
         IDotnsPopLens.NameDetail memory unknownName = dotnsPopLens.nameDetail("nothingxx");
         assertFalse(unknownName.exists);
         assertEq(unknownName.owner, address(0));
         assertEq(bytes(unknownName.label).length, 0);
-        assertEq(unknownName.fullClaim, bytes32(0));
+        assertEq(unknownName.personhoodNode, bytes32(0));
 
         IDotnsPopLens.NameDetail memory unknownNode =
             dotnsPopLens.nameDetailByNode(bytes32(uint256(0xdead)));
         assertFalse(unknownNode.exists);
         assertEq(unknownNode.owner, address(0));
-        assertEq(unknownNode.fullClaim, bytes32(0));
+        assertEq(unknownNode.personhoodNode, bytes32(0));
     }
 
-    /// @notice `nameDetail` classifies a cold-path lite name before it settles, not only after.
+    /// @notice `nameDetail` classifies a cold-path device name before it settles, not only after.
     /// @dev A pending subname has no label recoverable from its node, so `nameDetail` classifies
     /// the caller-supplied label. Before this was wired the tier read `NoStatus` until settlement
     ///      wrote the label into the store.
-    function test_nameDetail_classifies_a_cold_lite_name_before_and_after_settlement() public {
-        address fresh = makeAddr("coldlite");
-        _grantPopLite(fresh);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_A, user: fresh, chatKey: _validChatKey(0x01)
+    function test_nameDetail_classifies_a_cold_device_name_before_and_after_settlement() public {
+        address fresh = makeAddr("colddevice");
+        _grantDevicehood(fresh);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: fresh, chatKey: _validChatKey(0x01)
             })
         );
 
         // Cold path: the claim is staged and no store is deployed yet.
         assertEq(storeFactory.getLabelStore(fresh), address(0), "cold user has no store yet");
-        IDotnsPopLens.NameDetail memory pending = dotnsPopLens.nameDetail(LITE_LABEL_A);
+        IDotnsPopLens.NameDetail memory pending = dotnsPopLens.nameDetail(DEVICE_LABEL_A);
         assertTrue(pending.exists, "subname owned before settlement");
         assertFalse(pending.settled, "not settled yet");
-        assertEq(pending.label, LITE_LABEL_A, "caller label supplied before settlement");
-        assertTrue(pending.tier == IPopRules.PopStatus.PopLite, "classified as lite before settle");
+        assertEq(pending.label, DEVICE_LABEL_A, "caller label supplied before settlement");
+        assertTrue(
+            pending.requiredTier == IPopRules.PopStatus.Devicehood,
+            "classified as devicehood before settle"
+        );
 
         vm.prank(fresh);
         dotnsPopController.settlePendingClaims(fresh, type(uint256).max);
 
-        IDotnsPopLens.NameDetail memory settled = dotnsPopLens.nameDetail(LITE_LABEL_A);
+        IDotnsPopLens.NameDetail memory settled = dotnsPopLens.nameDetail(DEVICE_LABEL_A);
+        assertTrue(settled.settled, "settled after draining the queue");
+        assertEq(settled.label, DEVICE_LABEL_A, "label recovered from the store after settlement");
+        assertTrue(
+            settled.requiredTier == IPopRules.PopStatus.Devicehood,
+            "still devicehood after settlement"
+        );
+    }
+
+    /// @notice `nameDetail` reports an unsettled personhood name's label and tier.
+    /// @dev The registrar reads a tokenised name's label from the holder's `LabelStore`, which a
+    ///      store-less holder does not have yet, so the lens falls back to the caller's label.
+    function test_nameDetail_reports_an_unsettled_personhood_name() public {
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh("")
+            })
+        );
+        assertEq(dotnsPopController.pendingClaimCountOf(ed), 1, "the claim is pending");
+
+        IDotnsPopLens.NameDetail memory detail = dotnsPopLens.nameDetail(PERSONHOOD_LABEL_A);
+        assertTrue(detail.exists, "minted before settlement");
+        assertFalse(detail.settled, "not settled yet");
+        assertEq(detail.label, PERSONHOOD_LABEL_A, "caller label supplied before settlement");
+        assertTrue(
+            detail.requiredTier == IPopRules.PopStatus.Personhood,
+            "classified as personhood before settlement"
+        );
+    }
+
+    /// @notice `nameDetailByNode` leaves an unsettled personhood name's label empty until
+    ///         settlement makes it recoverable from the node.
+    function test_nameDetailByNode_recovers_a_personhood_label_only_after_settlement() public {
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh("")
+            })
+        );
+        bytes32 node = _nodeOf(PERSONHOOD_LABEL_A);
+
+        IDotnsPopLens.NameDetail memory pending = dotnsPopLens.nameDetailByNode(node);
+        assertTrue(pending.exists, "minted before settlement");
+        assertFalse(pending.settled, "not settled yet");
+        assertEq(pending.label, "", "no label recoverable from the node before settlement");
+        assertTrue(
+            pending.requiredTier == IPopRules.PopStatus.NoStatus, "unclassified without a label"
+        );
+
+        vm.prank(ed);
+        dotnsPopController.settlePendingClaims(ed, type(uint256).max);
+
+        IDotnsPopLens.NameDetail memory settled = dotnsPopLens.nameDetailByNode(node);
         assertTrue(settled.settled, "settled after draining the queue");
-        assertEq(settled.label, LITE_LABEL_A, "label recovered from the store after settlement");
-        assertTrue(settled.tier == IPopRules.PopStatus.PopLite, "still lite after settlement");
+        assertEq(settled.label, PERSONHOOD_LABEL_A, "label recovered after settlement");
+        assertTrue(
+            settled.requiredTier == IPopRules.PopStatus.Personhood,
+            "classified as personhood after settlement"
+        );
     }
 
     /// @notice A store row whose node key is not its own text's node is neither counted nor listed.
@@ -2093,14 +2187,14 @@ contract DotnsPopControllerTests is BaseDotns {
     /// are
     ///      derived together), so this injects one directly to pin the guard.
     function test_lens_ignores_a_store_row_whose_node_does_not_match_its_text() public {
-        _grantPopFull(ed);
-        _grantPopFull(leonardo);
+        _grantPersonhood(ed);
+        _grantPersonhood(leonardo);
 
-        // ed holds a legitimate lite name, which deploys ed's store and counts once.
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
-        assertEq(dotnsPopLens.liteNameCountOf(ed), 1, "one legitimate lite name");
+        // ed holds a legitimate device name, which deploys ed's store and counts once.
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
+        assertEq(dotnsPopLens.nameCountOf(ed), 1, "one legitimate device name");
 
-        // A second lite name, issued to leonardo, so its text reads as PoP-issued.
+        // A second device name, issued to leonardo, so its text reads as PoP-issued.
         _reservePop(leonardo, "another.01", _validChatKey(0x02), "");
 
         // ed owns a storeless subname beneath the numeric container. Only a registered controller
@@ -2127,19 +2221,23 @@ contract DotnsPopControllerTests is BaseDotns {
 
         // The forged row is owned by ed and its text is PoP-issued, but its node does not match the
         // text, so the listing excludes it and the count stays one.
-        assertEq(dotnsPopLens.liteNameCountOf(ed), 1, "forged row excluded from the count");
-        IDotnsPopLens.Name[] memory lite = dotnsPopLens.liteNamesOf(ed, 0, type(uint256).max);
-        assertEq(lite.length, 1, "forged row excluded from the listing");
-        assertEq(lite[0].node, _liteNodeOf(LITE_LABEL_A), "only the legitimate lite name is listed");
+        assertEq(dotnsPopLens.nameCountOf(ed), 1, "forged row excluded from the count");
+        IDotnsPopLens.Name[] memory names = dotnsPopLens.namesOf(ed, 0, type(uint256).max);
+        assertEq(names.length, 1, "forged row excluded from the listing");
+        assertEq(
+            names[0].node,
+            _deviceNodeOf(DEVICE_LABEL_A),
+            "only the legitimate device name is listed"
+        );
     }
 
     function test_profileOf_reports_store_pending_and_reservation() public {
         // A store-less user with a staged claim, a settled user holding a reservation, and an
         // untouched account each report distinct profile facts.
-        _grantPopFull(leonardo);
-        _rootReserveLiteName(
-            IDotnsPopController.LiteRegistration({
-                liteLabel: LITE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x01)
+        _grantPersonhood(leonardo);
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_C, user: leonardo, chatKey: _validChatKey(0x01)
             })
         );
         IDotnsPopLens.PopProfile memory cold = dotnsPopLens.profileOf(leonardo);
@@ -2147,12 +2245,12 @@ contract DotnsPopControllerTests is BaseDotns {
         assertEq(cold.pendingClaimCount, 1);
         assertEq(cold.reservationLabelhash, bytes32(0));
 
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x02), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x02), PERSONHOOD_LABEL_A);
         IDotnsPopLens.PopProfile memory warm = dotnsPopLens.profileOf(ed);
         assertTrue(warm.hasLabelStore);
         assertEq(warm.pendingClaimCount, 0);
-        assertEq(warm.reservationLabelhash, keccak256(bytes(BASE_LABEL_A)));
+        assertEq(warm.reservationLabelhash, keccak256(bytes(PERSONHOOD_LABEL_A)));
 
         IDotnsPopLens.PopProfile memory empty = dotnsPopLens.profileOf(tiago);
         assertFalse(empty.hasLabelStore);
@@ -2161,17 +2259,32 @@ contract DotnsPopControllerTests is BaseDotns {
     }
 
     function test_reservedBaseLabelOf_returns_label_or_empty() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), BASE_LABEL_A);
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
 
         assertEq(
-            dotnsPopController.reservedBaseLabelOf(keccak256(bytes(BASE_LABEL_A))), BASE_LABEL_A
+            dotnsPopController.reservedLabelOf(keccak256(bytes(PERSONHOOD_LABEL_A))),
+            PERSONHOOD_LABEL_A
         );
         assertEq(
-            bytes(dotnsPopController.reservedBaseLabelOf(keccak256(bytes("unknownbase")))).length, 0
+            bytes(dotnsPopController.reservedLabelOf(keccak256(bytes("unknownbase")))).length, 0
         );
     }
 
+    function _nameWithNode(
+        IDotnsPopLens.Name[] memory names,
+        bytes32 node
+    )
+        internal
+        pure
+        returns (IDotnsPopLens.Name memory)
+    {
+        for (uint256 i; i < names.length; ++i) {
+            if (names[i].node == node) return names[i];
+        }
+        revert("no name with that node");
+    }
+
     function _namesContainNode(
         IDotnsPopLens.Name[] memory names,
         bytes32 node
diff --git a/test/unit/registrar/DotnsPopControllerLegacy.t.sol b/test/unit/registrar/DotnsPopControllerLegacy.t.sol
new file mode 100644
index 000000000..de5406c18
--- /dev/null
+++ b/test/unit/registrar/DotnsPopControllerLegacy.t.sol
@@ -0,0 +1,654 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {BaseDotns} from "../../base/BaseDotns.t.sol";
+import {IDotnsPopController} from "../../../contracts/registrars/IDotnsPopController.sol";
+import {
+    IDotnsPopControllerLegacy
+} from "../../../contracts/registrars/IDotnsPopControllerLegacy.sol";
+import {Vm} from "forge-std/Vm.sol";
+
+/// @title DotnsPopControllerLegacyTests
+/// @notice The legacy entrypoints, and the reservation-queue events.
+/// @dev The legacy selectors and error selectors are pinned as literals, because the legacy
+///      interface exists to keep them unchanged. Each legacy entrypoint is checked against its
+///      replacement from the same state: identical events and state on success, identical revert
+///      data on every shared error. Every `InvalidLiteLabel` / `InvalidBaseLabel` revert reachable
+///      from a legacy entrypoint is exercised from both the legacy entrypoint and its replacement,
+///      which reverts with the new error instead. The shape check inside `_validateDeviceLabel` is
+///      preceded by the same check at each of its callers, so it is reached through them and has no
+///      test of its own.
+contract DotnsPopControllerLegacyTests is BaseDotns {
+    // Selectors and interfaces
+
+    function test_legacy_selectors_are_pinned() public pure {
+        assertEq(
+            IDotnsPopControllerLegacy.reserveLiteName.selector, SELECTOR_LEGACY_RESERVE_LITE_NAME
+        );
+        assertEq(
+            IDotnsPopControllerLegacy.reserveBaseName.selector, SELECTOR_LEGACY_RESERVE_BASE_NAME
+        );
+        assertEq(
+            IDotnsPopControllerLegacy.registerBaseName.selector, SELECTOR_LEGACY_REGISTER_BASE_NAME
+        );
+    }
+
+    function test_legacy_error_selectors_are_pinned() public pure {
+        assertEq(IDotnsPopControllerLegacy.InvalidLiteLabel.selector, bytes4(0x5c6c2eea));
+        assertEq(IDotnsPopControllerLegacy.InvalidBaseLabel.selector, bytes4(0x39e67d31));
+    }
+
+    function test_new_selectors_differ_from_the_legacy_ones() public pure {
+        assertTrue(
+            IDotnsPopController.issueDeviceName.selector != SELECTOR_LEGACY_RESERVE_LITE_NAME
+        );
+        assertTrue(
+            IDotnsPopController.issueDeviceNameWithReservation.selector
+                != SELECTOR_LEGACY_RESERVE_BASE_NAME
+        );
+        assertTrue(
+            IDotnsPopController.issuePersonhoodName.selector != SELECTOR_LEGACY_REGISTER_BASE_NAME
+        );
+    }
+
+    function test_supports_both_interfaces() public view {
+        assertTrue(
+            dotnsPopController.supportsInterface(type(IDotnsPopController).interfaceId),
+            "current interface"
+        );
+        assertTrue(
+            dotnsPopController.supportsInterface(type(IDotnsPopControllerLegacy).interfaceId),
+            "legacy interface"
+        );
+    }
+
+    // Legacy entrypoints have the same effect as their replacements
+
+    function test_reserveLiteName_matches_issueDeviceName() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
+        );
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+            });
+
+        _assertSameEffect(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveLiteName, (issuance)),
+            abi.encodeCall(IDotnsPopController.issueDeviceName, (issuance)),
+            ed,
+            DEVICE_LABEL_A,
+            PERSONHOOD_LABEL_A
+        );
+    }
+
+    function test_reserveBaseName_matches_issueDeviceNameWithReservation() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: tiago, label: PERSONHOOD_LABEL_A})
+        );
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_B})
+        );
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory params =
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+                }),
+                reservedLabel: PERSONHOOD_LABEL_A
+            });
+
+        _assertSameEffect(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveBaseName, (params)),
+            abi.encodeCall(IDotnsPopController.issueDeviceNameWithReservation, (params)),
+            ed,
+            DEVICE_LABEL_A,
+            PERSONHOOD_LABEL_A
+        );
+    }
+
+    function test_registerBaseName_matches_issuePersonhoodName_on_a_linked_claim() public {
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: tiago, label: PERSONHOOD_LABEL_A})
+        );
+        IDotnsPopController.PersonhoodNameIssuance memory params =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
+            });
+
+        _assertSameEffect(
+            abi.encodeCall(IDotnsPopControllerLegacy.registerBaseName, (params)),
+            abi.encodeCall(IDotnsPopController.issuePersonhoodName, (params)),
+            ed,
+            DEVICE_LABEL_A,
+            PERSONHOOD_LABEL_A
+        );
+    }
+
+    function test_registerBaseName_matches_issuePersonhoodName_without_a_reservation() public {
+        IDotnsPopController.PersonhoodNameIssuance memory params =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
+            });
+
+        _assertSameEffect(
+            abi.encodeCall(IDotnsPopControllerLegacy.registerBaseName, (params)),
+            abi.encodeCall(IDotnsPopController.issuePersonhoodName, (params)),
+            ed,
+            DEVICE_LABEL_A,
+            PERSONHOOD_LABEL_A
+        );
+    }
+
+    function test_legacy_reserveLiteName_issues_a_device_name() public {
+        vm.recordLogs();
+        _rootLegacyReserveLiteName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: _validChatKey(0x01)
+            })
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
+        assertTrue(dotnsPopController.isPopIssued(DEVICE_LABEL_A));
+        assertEq(dotnsPopResolver.chatKey(_deviceNodeOf(DEVICE_LABEL_A)), _validChatKey(0x01));
+        assertEq(_countEvents(logs, keccak256("DeviceNameIssued(bytes32,address,string)")), 1);
+    }
+
+    function test_legacy_reserveBaseName_issues_and_reserves() public {
+        _rootLegacyReserveBaseName(
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: IDotnsPopController.DeviceNameIssuance({
+                    label: DEVICE_LABEL_A, user: ed, chatKey: ""
+                }),
+                reservedLabel: PERSONHOOD_LABEL_A
+            })
+        );
+
+        assertEq(dotnsRegistry.owner(_deviceNodeOf(DEVICE_LABEL_A)), ed);
+        assertEq(
+            dotnsPopController.userReservation(ed).labelhash,
+            keccak256(bytes(PERSONHOOD_LABEL_A)),
+            "the reservation is queued"
+        );
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(PERSONHOOD_LABEL_A);
+        assertTrue(reserved);
+        assertEq(holder, ed);
+    }
+
+    function test_legacy_registerBaseName_issues_a_personhood_name() public {
+        vm.recordLogs();
+        _rootLegacyRegisterBaseName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
+            })
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        assertEq(dotnsRegistry.owner(_nodeOf(PERSONHOOD_LABEL_A)), ed);
+        assertTrue(dotnsPopController.isPopIssued(PERSONHOOD_LABEL_A));
+        assertEq(_countEvents(logs, keccak256("PersonhoodNameIssued(bytes32,address,string)")), 1);
+    }
+
+    // Label errors: legacy entrypoints revert with the legacy errors, replacements with the new
+    // ones
+
+    /// @notice `_issueDeviceName`, shape check: a label with no separator.
+    function test_device_name_shape_error_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({label: "michael", user: ed, chatKey: ""});
+
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidLiteLabel.selector);
+        _rootLegacyReserveLiteName(issuance);
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(issuance);
+
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            IDotnsPopController.DeviceNameIssuanceWithReservation({
+                issuance: issuance, reservedLabel: ""
+            });
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidLiteLabel.selector);
+        _rootLegacyReserveBaseName(combined);
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceNameWithReservation(combined);
+    }
+
+    /// @notice `_issueDeviceName`, classification check: a stem short enough to be reserved.
+    function test_device_name_reserved_stem_error_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({label: "abc.01", user: ed, chatKey: ""});
+
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidLiteLabel.selector);
+        _rootLegacyReserveLiteName(issuance);
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssueDeviceName(issuance);
+    }
+
+    /// @notice `_issuePersonhoodName`, classification check: a governance-reserved length.
+    function test_personhood_name_reserved_length_error_on_both_paths() public {
+        IDotnsPopController.PersonhoodNameIssuance memory issuance =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: "abcde", user: ed, link: _linkFresh("")
+            });
+
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidBaseLabel.selector);
+        _rootLegacyRegisterBaseName(issuance);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(issuance);
+    }
+
+    /// @notice `_issuePersonhoodName`, device-link shape check.
+    function test_device_link_shape_error_on_both_paths() public {
+        IDotnsPopController.PersonhoodNameIssuance memory issuance =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkWithDeviceName("michael")
+            });
+
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidLiteLabel.selector);
+        _rootLegacyRegisterBaseName(issuance);
+        vm.expectRevert(IDotnsPopController.InvalidDeviceLabel.selector);
+        _rootIssuePersonhoodName(issuance);
+    }
+
+    /// @notice `_validatePersonhoodLabel`, shape check, from the personhood issuance and from the
+    ///         reservation of the combined entrypoint.
+    function test_personhood_name_shape_error_on_both_paths() public {
+        IDotnsPopController.PersonhoodNameIssuance memory issuance =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: "alice1", user: ed, link: _linkFresh("")
+            });
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidBaseLabel.selector);
+        _rootLegacyRegisterBaseName(issuance);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssuePersonhoodName(issuance);
+
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            _combined(DEVICE_LABEL_A, "alice1");
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidBaseLabel.selector);
+        _rootLegacyReserveBaseName(combined);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssueDeviceNameWithReservation(combined);
+    }
+
+    /// @notice `_validatePersonhoodLabel` from the callers that are not legacy entrypoints: always
+    ///         the new error.
+    function test_personhood_name_shape_error_on_non_legacy_callers() public {
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        dotnsPopController.expireReservation("alice1");
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        dotnsPopController.isReservedForClaim("alice1");
+    }
+
+    /// @notice `_validateReservablePersonhoodLabel`, classification check: a reserved length.
+    function test_reservable_label_classification_error_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            _combined(DEVICE_LABEL_A, "abcde");
+        vm.expectRevert(IDotnsPopControllerLegacy.InvalidBaseLabel.selector);
+        _rootLegacyReserveBaseName(combined);
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootIssueDeviceNameWithReservation(combined);
+
+        vm.expectRevert(IDotnsPopController.InvalidPersonhoodLabel.selector);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: "abcde"})
+        );
+    }
+
+    // Errors the legacy entrypoints share with their replacements
+
+    function test_non_root_callers_are_rejected_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({label: DEVICE_LABEL_A, user: ed, chatKey: ""});
+        bytes memory expected = abi.encodeWithSelector(IDotnsPopController.NotRoot.selector);
+
+        vm.expectRevert(expected);
+        IDotnsPopControllerLegacy(address(dotnsPopController)).reserveLiteName(issuance);
+        vm.expectRevert(expected);
+        dotnsPopController.issueDeviceName(issuance);
+    }
+
+    function test_invalid_chat_key_error_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: ed, chatKey: hex"01"
+            });
+        bytes memory expected =
+            abi.encodeWithSelector(IDotnsPopController.InvalidChatKey.selector, uint256(1));
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveLiteName, (issuance)),
+            abi.encodeCall(IDotnsPopController.issueDeviceName, (issuance)),
+            expected
+        );
+
+        IDotnsPopController.PersonhoodNameIssuance memory personhood =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(hex"01")
+            });
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.registerBaseName, (personhood)),
+            abi.encodeCall(IDotnsPopController.issuePersonhoodName, (personhood)),
+            expected
+        );
+    }
+
+    function test_second_device_name_issuance_error_on_both_paths() public {
+        IDotnsPopController.DeviceNameIssuance memory issuance =
+            IDotnsPopController.DeviceNameIssuance({label: DEVICE_LABEL_A, user: ed, chatKey: ""});
+        _rootIssueDeviceName(issuance);
+
+        bytes memory expected =
+            abi.encodeWithSelector(IDotnsPopController.DeviceNameAlreadyIssued.selector);
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveLiteName, (issuance)),
+            abi.encodeCall(IDotnsPopController.issueDeviceName, (issuance)),
+            expected
+        );
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            _combined(DEVICE_LABEL_A, PERSONHOOD_LABEL_A);
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveBaseName, (combined)),
+            abi.encodeCall(IDotnsPopController.issueDeviceNameWithReservation, (combined)),
+            expected
+        );
+    }
+
+    function test_device_link_the_user_does_not_own_error_on_both_paths() public {
+        _rootIssueDeviceName(
+            IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL_A, user: tiago, chatKey: ""
+            })
+        );
+        IDotnsPopController.PersonhoodNameIssuance memory params =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkWithDeviceName(DEVICE_LABEL_A)
+            });
+
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.registerBaseName, (params)),
+            abi.encodeCall(IDotnsPopController.issuePersonhoodName, (params)),
+            abi.encodeWithSelector(
+                IDotnsPopController.DeviceNameNotOwned.selector,
+                ed,
+                keccak256(bytes(DEVICE_LABEL_A))
+            )
+        );
+    }
+
+    function test_registered_reserved_label_error_on_both_paths() public {
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: tiago, link: _linkFresh("")
+            })
+        );
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            _combined(DEVICE_LABEL_A, PERSONHOOD_LABEL_A);
+
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveBaseName, (combined)),
+            abi.encodeCall(IDotnsPopController.issueDeviceNameWithReservation, (combined)),
+            abi.encodeWithSelector(IDotnsPopController.PersonhoodNameUnavailable.selector)
+        );
+    }
+
+    function test_label_held_by_another_waiter_error_on_both_paths() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: tiago, label: PERSONHOOD_LABEL_A})
+        );
+        IDotnsPopController.PersonhoodNameIssuance memory params =
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh("")
+            });
+
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.registerBaseName, (params)),
+            abi.encodeCall(IDotnsPopController.issuePersonhoodName, (params)),
+            abi.encodeWithSelector(
+                IDotnsPopController.NotHolder.selector, ed, keccak256(bytes(PERSONHOOD_LABEL_A))
+            )
+        );
+    }
+
+    function test_full_queue_error_on_both_paths() public {
+        for (uint256 i; i < dotnsPopController.MAX_RESERVATION_QUEUE(); ++i) {
+            _rootReservePersonhoodName(
+                IDotnsPopController.PersonhoodNameReservation({
+                    user: makeAddr(string.concat("waiter", vm.toString(i))),
+                    label: PERSONHOOD_LABEL_A
+                })
+            );
+        }
+        IDotnsPopController.DeviceNameIssuanceWithReservation memory combined =
+            _combined(DEVICE_LABEL_A, PERSONHOOD_LABEL_A);
+
+        _assertBothRevertWith(
+            abi.encodeCall(IDotnsPopControllerLegacy.reserveBaseName, (combined)),
+            abi.encodeCall(IDotnsPopController.issueDeviceNameWithReservation, (combined)),
+            abi.encodeWithSelector(
+                IDotnsPopController.QueueFull.selector, keccak256(bytes(PERSONHOOD_LABEL_A))
+            )
+        );
+    }
+
+    // Every reservation-queue exit emits an event
+
+    function test_claim_emits_claimed_and_evicts_every_other_waiter() public {
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: tiago, label: PERSONHOOD_LABEL_A})
+        );
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({
+                user: leonardo, label: PERSONHOOD_LABEL_A
+            })
+        );
+
+        vm.recordLogs();
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
+            })
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        bytes32 claimed = keccak256("ReservationClaimed(bytes32,address)");
+        bytes32 evicted = keccak256("ReservationEvicted(bytes32,address)");
+        assertEq(_countEventsFor(logs, claimed, ed), 1, "the claimant's claim");
+        assertEq(_countEventsFor(logs, evicted, tiago), 1, "first waiter evicted");
+        assertEq(_countEventsFor(logs, evicted, leonardo), 1, "second waiter evicted");
+        assertEq(_countEventsFor(logs, evicted, ed), 0, "the claimant is not evicted");
+        assertEq(dotnsPopController.userReservation(tiago).labelhash, bytes32(0));
+        assertEq(dotnsPopController.userReservation(leonardo).labelhash, bytes32(0));
+    }
+
+    function test_standalone_issuance_relinquishes_the_users_other_reservation() public {
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), PERSONHOOD_LABEL_A);
+
+        vm.recordLogs();
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_B, user: ed, link: _linkFresh(_validChatKey(0x02))
+            })
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        bytes32 relinquished = keccak256("ReservationRelinquished(bytes32,address)");
+        assertEq(_countEventsFor(logs, relinquished, ed), 1, "the dropped entry is recorded");
+        assertEq(_countEvents(logs, keccak256("ReservationClaimed(bytes32,address)")), 0);
+        assertEq(dotnsPopController.userReservation(ed).labelhash, bytes32(0));
+    }
+
+    function test_re_reservation_relinquishes_the_previous_entry() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
+        );
+
+        vm.recordLogs();
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_B})
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        bytes32 relinquished = keccak256("ReservationRelinquished(bytes32,address)");
+        assertEq(_countEventsFor(logs, relinquished, ed), 1);
+        assertEq(
+            dotnsPopController.userReservation(ed).labelhash, keccak256(bytes(PERSONHOOD_LABEL_B))
+        );
+    }
+
+    function test_relinquishReservation_emits_exactly_once() public {
+        _rootReservePersonhoodName(
+            IDotnsPopController.PersonhoodNameReservation({user: ed, label: PERSONHOOD_LABEL_A})
+        );
+
+        vm.recordLogs();
+        vm.prank(ed);
+        dotnsPopController.relinquishReservation();
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        assertEq(_countEvents(logs, keccak256("ReservationRelinquished(bytes32,address)")), 1);
+    }
+
+    function test_issuance_without_a_reservation_emits_no_relinquish() public {
+        vm.recordLogs();
+        _rootIssuePersonhoodName(
+            IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL_A, user: ed, link: _linkFresh(_validChatKey(0x02))
+            })
+        );
+        Vm.Log[] memory logs = vm.getRecordedLogs();
+
+        assertEq(_countEvents(logs, keccak256("ReservationRelinquished(bytes32,address)")), 0);
+    }
+
+    // Helpers
+
+    function _combined(
+        string memory deviceLabel,
+        string memory reservedLabel
+    )
+        internal
+        view
+        returns (IDotnsPopController.DeviceNameIssuanceWithReservation memory)
+    {
+        return IDotnsPopController.DeviceNameIssuanceWithReservation({
+            issuance: IDotnsPopController.DeviceNameIssuance({
+                label: deviceLabel, user: ed, chatKey: ""
+            }),
+            reservedLabel: reservedLabel
+        });
+    }
+
+    /// @dev Runs `legacyPayload` and `replacementPayload` from the same state and requires the same
+    ///      events, in order and byte for byte, and the same observable state afterwards.
+    function _assertSameEffect(
+        bytes memory legacyPayload,
+        bytes memory replacementPayload,
+        address user,
+        string memory deviceLabel,
+        string memory personhoodLabel
+    )
+        internal
+    {
+        uint256 snapshot = vm.snapshotState();
+        vm.recordLogs();
+        _dispatchFromRoot(legacyPayload);
+        Vm.Log[] memory legacyLogs = vm.getRecordedLogs();
+        bytes memory legacyState = _observableState(user, deviceLabel, personhoodLabel);
+
+        vm.revertToState(snapshot);
+        vm.recordLogs();
+        _dispatchFromRoot(replacementPayload);
+        Vm.Log[] memory replacementLogs = vm.getRecordedLogs();
+
+        assertGt(legacyLogs.length, 0, "the call emits events");
+        assertEq(legacyLogs.length, replacementLogs.length, "same number of events");
+        for (uint256 i; i < legacyLogs.length; ++i) {
+            assertEq(legacyLogs[i].emitter, replacementLogs[i].emitter, "same emitter");
+            assertEq(
+                abi.encode(legacyLogs[i].topics),
+                abi.encode(replacementLogs[i].topics),
+                "same topics"
+            );
+            assertEq(legacyLogs[i].data, replacementLogs[i].data, "same data");
+        }
+        assertEq(_observableState(user, deviceLabel, personhoodLabel), legacyState, "same state");
+    }
+
+    /// @dev Records, reservation and pending claims the gateway entrypoints write for `user`.
+    function _observableState(
+        address user,
+        string memory deviceLabel,
+        string memory personhoodLabel
+    )
+        internal
+        view
+        returns (bytes memory)
+    {
+        bytes32 deviceNode = _deviceNodeOf(deviceLabel);
+        bytes32 personhoodNode = _nodeOf(personhoodLabel);
+        (bool reserved, address holder) = dotnsPopController.isReservedForClaim(personhoodLabel);
+        return bytes.concat(
+            abi.encode(
+                dotnsRegistry.owner(deviceNode),
+                dotnsRegistry.owner(personhoodNode),
+                dotnsPopController.isPopIssued(deviceLabel),
+                dotnsPopController.isPopIssued(personhoodLabel),
+                dotnsPopResolver.chatKey(deviceNode),
+                dotnsPopResolver.chatKey(personhoodNode)
+            ),
+            abi.encode(
+                dotnsPopResolver.deviceLabelhashOf(personhoodNode),
+                dotnsPopResolver.personhoodNodeOf(keccak256(bytes(deviceLabel))),
+                dotnsPopController.userReservation(user),
+                reserved,
+                holder,
+                dotnsPopController.pendingClaimCountOf(user)
+            )
+        );
+    }
+
+    /// @dev Requires both payloads to revert under Root with exactly `expected`.
+    function _assertBothRevertWith(
+        bytes memory legacyPayload,
+        bytes memory replacementPayload,
+        bytes memory expected
+    )
+        internal
+    {
+        assertEq(_rootRevertData(legacyPayload), expected, "legacy entrypoint");
+        assertEq(_rootRevertData(replacementPayload), expected, "replacement");
+    }
+
+    function _rootRevertData(bytes memory payload) internal returns (bytes memory data) {
+        _mockOriginIsRoot(true);
+        bool ok;
+        (ok, data) = address(dotnsPopController).call(payload);
+        _mockOriginIsRoot(false);
+        assertFalse(ok, "the call reverts");
+    }
+
+    function _countEvents(Vm.Log[] memory logs, bytes32 sig) internal pure returns (uint256 count) {
+        for (uint256 i; i < logs.length; ++i) {
+            if (logs[i].topics.length != 0 && logs[i].topics[0] == sig) ++count;
+        }
+    }
+
+    /// @dev Counts `sig` events whose second indexed topic is `user`; every reservation event
+    ///      indexes the labelhash first and the user second.
+    function _countEventsFor(
+        Vm.Log[] memory logs,
+        bytes32 sig,
+        address user
+    )
+        internal
+        pure
+        returns (uint256 count)
+    {
+        for (uint256 i; i < logs.length; ++i) {
+            if (
+                logs[i].topics.length > 2 && logs[i].topics[0] == sig
+                    && logs[i].topics[2] == bytes32(uint256(uint160(user)))
+            ) ++count;
+        }
+    }
+}
diff --git a/test/unit/registrar/DotnsRegistrar.t.sol b/test/unit/registrar/DotnsRegistrar.t.sol
index 6092e1374..ed11cfb11 100644
--- a/test/unit/registrar/DotnsRegistrar.t.sol
+++ b/test/unit/registrar/DotnsRegistrar.t.sol
@@ -363,9 +363,9 @@ contract DotnsRegistrarTests is BaseDotns {
 
     function test_transfer_reverts_when_fee_required_but_no_value_attached() public {
         string memory label = "feerequired01";
-        // Grant Full to ed so the mint succeeds, but leave leonardo at NoStatus so the
+        // Grant personhood to ed so the mint succeeds, but leave leonardo at NoStatus so the
         // transfer floor charges a non-zero downgrade fee.
-        _register(label, ed, IPopRules.PopStatus.PopFull);
+        _register(label, ed, IPopRules.PopStatus.Personhood);
         uint256 tokenId = _tokenIdForLabel(label);
 
         uint256 fee = dotnsRegistrar.quoteTransferFee(tokenId, leonardo);
@@ -444,8 +444,8 @@ contract DotnsRegistrarTests is BaseDotns {
         assertTrue(dotnsRegistrar.supportsInterface(type(IERC721).interfaceId));
     }
 
-    /// @notice Mints a name as if through the PoP gateway: the caller is the address registered
-    /// under `POP_CONTROLLER`, and the gateway path passes an empty label.
+    /// @notice Mints a name as if through the dotNS gateway pallet: the caller is the address
+    /// registered under `POP_CONTROLLER`, and the gateway path passes an empty label.
     function _mintSoulbound(
         string memory label,
         address nameOwner
diff --git a/test/unit/registrar/DotnsRegistrarController.t.sol b/test/unit/registrar/DotnsRegistrarController.t.sol
index 0fa85c112..d66ec3f93 100644
--- a/test/unit/registrar/DotnsRegistrarController.t.sol
+++ b/test/unit/registrar/DotnsRegistrarController.t.sol
@@ -146,7 +146,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_register_reverts_at_exact_expiry_boundary() public {
         string memory nameLabel = "alicebobx";
         address nameOwner = ed;
-        _grantPopFull(nameOwner);
+        _grantPersonhood(nameOwner);
 
         IDotnsRegistrarController.Registration memory registration =
             IDotnsRegistrarController.Registration({
@@ -178,11 +178,11 @@ contract DotnsRegistrarControllerTest is BaseDotns {
         vm.stopPrank();
     }
 
-    function test_register_popfull_wires_all_records() public {
+    function test_register_personhood_wires_all_records() public {
         string memory nameLabel = "web2summit";
         address nameOwner = ed;
 
-        _grantPopFull(nameOwner);
+        _grantPersonhood(nameOwner);
 
         vm.prank(owner);
         storeFactory.deployLabelStoreFor(nameOwner);
@@ -222,13 +222,13 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     }
 
     /// @notice A two-digit second-level name is unreachable, which is what keeps a subname
-    ///         from spelling a lite name.
+    ///         from spelling a device name.
     /// @dev `joseph.42` reads either as one label or as `joseph` beneath `42`, and the second
     ///      reading needs `42` to exist. No production controller entry point can create it:
     ///      this path requires three characters, and both gateway paths are letters only. An
     ///      owner-authorised controller calling the registrar directly is not bound by either,
     ///      so the invariant holds over entry points rather than over the registrar. Pinned
-    ///      here because it rests on a length floor that reads as unrelated to lite names.
+    ///      here because it rests on a length floor that reads as unrelated to device names.
     ///      `register` is called directly rather than through `_commitAndRegister`, which
     ///      quotes `priceWithCheck` first and would revert on the reserved tier instead. No
     ///      commitment is needed: the label is validated before one is consumed.
@@ -250,21 +250,21 @@ contract DotnsRegistrarControllerTest is BaseDotns {
         dotnsRegistrarController.register(registration);
     }
 
-    /// @notice A public registration reserves no stem.
+    /// @notice A public registration reserves no base name.
     /// @dev PopRules' reservation slot belongs to the gateway queue, and `register` writes none
-    ///      of its own. Pinned here because a stem the public path reserved silently would
+    ///      of its own. Pinned here because a base name the public path reserved silently would
     ///      block the gateway's own registrant for the whole reservation window.
     function test_public_register_reserves_no_base_name() public {
         string memory nameLabel = "lights01";
         address nameOwner = ed;
 
-        _grantPopFull(nameOwner);
+        _grantPersonhood(nameOwner);
         _commitAndRegister(nameLabel, nameOwner, true);
 
         assertEq(dotnsRegistrar.ownerOf(_tokenIdForLabel(nameLabel)), nameOwner);
 
         (bool isReserved,,) = popRules.isBaseNameReserved(popRules.stripDigits(nameLabel));
-        assertFalse(isReserved, "no stem reserved by a public registration");
+        assertFalse(isReserved, "no base name reserved by a public registration");
     }
 
     function test_register_does_not_overwrite_third_party_reverse_record() public {
@@ -516,7 +516,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_transfer_writes_label_and_creates_store() public {
         string memory nameLabel = "alicetransfer01";
 
-        _register(nameLabel, ed, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, ed, IPopRules.PopStatus.Personhood);
 
         assertEq(storeFactory.getLabelStore(leonardo), address(0));
 
@@ -540,7 +540,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_transfer_back_skips_locked_entry() public {
         string memory nameLabel = "carolreturn01";
 
-        _register(nameLabel, ed, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, ed, IPopRules.PopStatus.Personhood);
 
         uint256 tokenId = _tokenIdForLabel(nameLabel);
 
@@ -562,7 +562,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_transfer_clears_primary_reverse_name_when_current_name_is_moved() public {
         string memory nameLabel = "primarymove01";
 
-        _register(nameLabel, ed, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, ed, IPopRules.PopStatus.Personhood);
 
         uint256 tokenId = _tokenIdForLabel(nameLabel);
         assertEq(dotnsReverseResolver.nameOf(ed), "primarymove01.dot");
@@ -580,7 +580,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
 
         assertEq(storeFactory.getLabelStore(address(0)), address(0));
 
-        _register(nameLabel, tiago, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, tiago, IPopRules.PopStatus.Personhood);
 
         ILabelStore tiagoStore = ILabelStore(storeFactory.getLabelStore(tiago));
         uint256 tokenId = _tokenIdForLabel(nameLabel);
@@ -592,7 +592,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_safe_transfer_writes_to_store() public {
         string memory nameLabel = "safexfer01";
 
-        _register(nameLabel, ed, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, ed, IPopRules.PopStatus.Personhood);
 
         uint256 tokenId = _tokenIdForLabel(nameLabel);
 
@@ -614,7 +614,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
         address payer = ed;
         address ownerAddr = leonardo;
 
-        _grantPopFull(payer);
+        _grantPersonhood(payer);
 
         bytes32 secret = keccak256(abi.encodePacked(popfullLabel, ownerAddr, block.timestamp));
         IDotnsRegistrarController.Registration memory registration =
@@ -644,7 +644,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
                 IPopRules.OwnerStatusInsufficient.selector,
                 popfullLabel,
                 IPopRules.PopStatus.NoStatus,
-                IPopRules.PopStatus.PopFull
+                IPopRules.PopStatus.Personhood
             )
         );
         dotnsRegistrarController.register{value: charge}(registration);
@@ -653,7 +653,7 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     function test_transfer_via_approved_operator_writes_to_store() public {
         string memory nameLabel = "opxfer01";
 
-        _register(nameLabel, ed, IPopRules.PopStatus.PopFull);
+        _register(nameLabel, ed, IPopRules.PopStatus.Personhood);
 
         uint256 tokenId = _tokenIdForLabel(nameLabel);
 
@@ -1096,9 +1096,10 @@ contract DotnsRegistrarControllerTest is BaseDotns {
     // Regression: the paid path's governance-reserved rejection is unchanged by the grant gate.
 
     /// @dev A reserved-tier label (base length five or fewer) is refused on the paid path whoever
-    /// pays. The cross-payer branch distinguishes a governance-reserved label from a stem held by
-    /// another user, so it reverts `GovernanceReserved` rather than `NameReserved`. Reserved-tier
-    /// labels reach circulation only through `registerReserved`, and a grant does not change that.
+    /// pays. The cross-payer branch distinguishes a governance-reserved label from a base name
+    /// held by another user: this one reverts `GovernanceReserved`, and `NameReserved` is kept for
+    /// the held base name. Reserved-tier labels reach circulation only through `registerReserved`,
+    /// and a grant does not change that.
     function test_register_rejects_a_governance_reserved_label_for_a_cross_payer() public {
         string memory nameLabel = "alice";
 
diff --git a/test/unit/registrar/DotnsRegistrarControllerLifecycle.t.sol b/test/unit/registrar/DotnsRegistrarControllerLifecycle.t.sol
index 5c00e657d..e58e8c649 100644
--- a/test/unit/registrar/DotnsRegistrarControllerLifecycle.t.sol
+++ b/test/unit/registrar/DotnsRegistrarControllerLifecycle.t.sol
@@ -20,15 +20,15 @@ import {ReentrantOverpaymentAttacker} from "../../helpers/ReentrantOverpaymentAt
 ///         and reentrancy guarding.
 contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
     /// @dev The subject is the reclaim path, not the tier: release to escrow, withdraw, let the
-    ///      redeem window elapse, then a new owner reclaims. PopFull because `lights01` is
-    ///      measured whole at eight characters and no public label reaches PopLite.
+    ///      redeem window elapse, then a new owner reclaims. Personhood because `lights01` is
+    ///      measured whole at eight characters and no public label reaches Devicehood.
     function test_register_reclaim_succeeds_for_new_owner() public {
         string memory label = "lights01";
 
         address originalOwner = ed;
         address newOwner = leonardo;
-        _grantPopFull(originalOwner);
-        _grantPopFull(newOwner);
+        _grantPersonhood(originalOwner);
+        _grantPersonhood(newOwner);
 
         _commitAndRegister(label, originalOwner, true);
 
@@ -69,10 +69,10 @@ contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
         dotnsRegistrarController.register{value: registrationPrice}(registration);
 
         assertEq(dotnsRegistrar.ownerOf(tokenId), newOwner);
-        // A public registration reserves no stem, so reclaim has no slot to take over and none
+        // A public registration reserves no base name, so reclaim has no slot to take over and none
         // to garbage-collect.
         (bool isReserved,,) = popRules.isBaseNameReserved(popRules.stripDigits(label));
-        assertFalse(isReserved, "no stem reserved by either registration");
+        assertFalse(isReserved, "no base name reserved by either registration");
     }
 
     function test_register_cross_payer_charges_max_not_sum_of_price_and_reach() public {
@@ -80,7 +80,7 @@ contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
         address payer = leonardo;
         address nameOwner = ed;
 
-        _grantPopFull(payer);
+        _grantPersonhood(payer);
         _grantNoStatus(nameOwner);
 
         uint256 ownerPrice = popRules.priceWithoutCheck(label, nameOwner).price;
@@ -124,7 +124,7 @@ contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
         address payer = leonardo;
         address nameOwner = ed;
 
-        _grantPopFull(payer);
+        _grantPersonhood(payer);
         _grantNoStatus(nameOwner);
 
         uint256 ownerPrice = popRules.priceWithoutCheck(label, nameOwner).price;
@@ -200,7 +200,7 @@ contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
     function test_register_creates_funded_position_for_self_registration() public {
         string memory label = BASE_LABEL_A;
         address nameOwner = ed;
-        _grantPopFull(nameOwner);
+        _grantPersonhood(nameOwner);
 
         IDotnsRegistrarController.Registration memory registration =
             IDotnsRegistrarController.Registration({
@@ -347,7 +347,7 @@ contract DotnsRegistrarControllerLifecycleTest is BaseDotns {
         string memory firstLabel = "primary01";
         string memory secondLabel = "secondary01";
 
-        _grantPopLite(ed);
+        _grantDevicehood(ed);
 
         _commitAndRegister(firstLabel, ed, true);
         assertEq(dotnsReverseResolver.nameOf(ed), string.concat(firstLabel, ".dot"));
diff --git a/test/unit/registry/DotnsProtocolRegistryDeclarations.t.sol b/test/unit/registry/DotnsProtocolRegistryDeclarations.t.sol
index bd02417dd..ea0c81f61 100644
--- a/test/unit/registry/DotnsProtocolRegistryDeclarations.t.sol
+++ b/test/unit/registry/DotnsProtocolRegistryDeclarations.t.sol
@@ -169,7 +169,7 @@ contract DotnsProtocolRegistryDeclarationTests is BaseDotns {
         assertEq(registry.expectedCodehash(DotnsConstants.REGISTRAR), bytes32(0));
     }
 
-    /// @notice `version()` on every DotNS contract mirrors the registry's declared release, so
+    /// @notice `version()` on every dotNS contract mirrors the registry's declared release, so
     ///         the whole network answers with one synchronised value: empty before the first
     ///         declaration, the declared tag after, with no per-contract bookkeeping. Sampled
     ///         across every mirror the fixture deploys, including a claimed user store.
diff --git a/test/unit/registry/DotnsRegistry.t.sol b/test/unit/registry/DotnsRegistry.t.sol
index 3d29cb57a..5082d4337 100644
--- a/test/unit/registry/DotnsRegistry.t.sol
+++ b/test/unit/registry/DotnsRegistry.t.sol
@@ -41,7 +41,7 @@ contract DotnsRegistryTests is BaseDotns {
     }
 
     /// @notice A separator is never valid in a subname label.
-    /// @dev This is what reserves the dotted-label space to the PoP gateway. Loosen it and a
+    /// @dev This is what reserves the dotted-label space to the gateway path. Loosen it and a
     ///      subname could be minted whose label equals a person's, putting two claimants on one
     ///      node. Both subnode entry points are checked, since either would open the space.
     function test_subname_label_carrying_a_separator_is_rejected() public {
@@ -75,7 +75,7 @@ contract DotnsRegistryTests is BaseDotns {
     }
 
     /// @notice A subname created outside the gateway carries no person provenance.
-    /// @dev The gateway issues a lite name as the subname `michael` under `01` and records it in
+    /// @dev The gateway issues a device name as the subname `michael` under `01` and records it in
     ///      `_popIssued`. This test creates the same subname directly, without the gateway, and
     ///      shows it reads back as not `isPopIssued`: provenance, not the name text, is what marks
     /// a gateway-issued person. No production controller entry point can create the parent here:
@@ -378,7 +378,7 @@ contract DotnsRegistryTests is BaseDotns {
 
     function test_revert_subnode_owner_with_parent_label_mismatch() public {
         string memory parentLabel = "actualparent01";
-        bytes32 parentNode = _register(parentLabel, ed, IPopRules.PopStatus.PopFull);
+        bytes32 parentNode = _register(parentLabel, ed, IPopRules.PopStatus.Personhood);
 
         IDotnsRegistry.SubnodeRecord memory subnodeRecord = IDotnsRegistry.SubnodeRecord({
             parentNode: parentNode,
@@ -616,8 +616,8 @@ contract DotnsRegistryTests is BaseDotns {
     function test_same_sublabel_under_different_parents_owned_by_same_address() public {
         string memory parentLabelA = "alphaomega";
         string memory parentLabelB = "bravobro";
-        bytes32 parentNodeA = _register(parentLabelA, owner, IPopRules.PopStatus.PopFull);
-        bytes32 parentNodeB = _register(parentLabelB, owner, IPopRules.PopStatus.PopFull);
+        bytes32 parentNodeA = _register(parentLabelA, owner, IPopRules.PopStatus.Personhood);
+        bytes32 parentNodeB = _register(parentLabelB, owner, IPopRules.PopStatus.Personhood);
 
         string memory subLabel = "app";
 
diff --git a/test/unit/resolver/DotnsPopResolver.t.sol b/test/unit/resolver/DotnsPopResolver.t.sol
index b3cc5d033..8aee730ab 100644
--- a/test/unit/resolver/DotnsPopResolver.t.sol
+++ b/test/unit/resolver/DotnsPopResolver.t.sol
@@ -31,26 +31,26 @@ contract DotnsPopResolverTests is BaseDotns {
         dotnsPopResolver.setChatKey(_nodeOf("alice42"), _validChatKey(0x04));
     }
 
-    function test_setLiteLink_writes_and_emits() public {
-        bytes32 fullNode = _nodeOf("alice");
-        bytes32 liteLabelhash = keccak256(bytes("alice42"));
+    function test_setDeviceLink_writes_and_emits() public {
+        bytes32 personhoodNode = _nodeOf("alice");
+        bytes32 deviceLabelhash = keccak256(bytes("alice42"));
 
         vm.prank(address(dotnsPopController));
         vm.expectEmit(true, true, false, false);
-        emit IDotnsPopResolver.LiteLinkUpdated(fullNode, liteLabelhash);
-        dotnsPopResolver.setLiteLink(fullNode, liteLabelhash);
+        emit IDotnsPopResolver.DeviceLinkUpdated(personhoodNode, deviceLabelhash);
+        dotnsPopResolver.setDeviceLink(personhoodNode, deviceLabelhash);
         // Both directions must be populated by a single write: forward
-        // (full => lite) and reverse (lite => full). The reverse index is what
-        // downstream consumers (Nova) use to answer "given this lite username,
-        // which full name did they claim?".
-        assertEq(dotnsPopResolver.liteLink(fullNode), liteLabelhash);
-        assertEq(dotnsPopResolver.fullClaim(liteLabelhash), fullNode);
+        // (personhood => device) and reverse (device => personhood). The reverse index is what
+        // downstream consumers (Nova) use to answer "given this device name,
+        // which personhood name did they claim?".
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodNode), deviceLabelhash);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceLabelhash), personhoodNode);
     }
 
-    function test_setLiteLink_reverts_for_unauthorised_caller() public {
+    function test_setDeviceLink_reverts_for_unauthorised_caller() public {
         vm.prank(ed);
         vm.expectRevert(abi.encodeWithSelector(IDotnsPopResolver.NotPopController.selector, ed));
-        dotnsPopResolver.setLiteLink(_nodeOf("alice"), keccak256(bytes("alice42")));
+        dotnsPopResolver.setDeviceLink(_nodeOf("alice"), keccak256(bytes("alice42")));
     }
 
     function test_setChatKey_accepts_zero_node_as_passthrough() public {
@@ -67,11 +67,11 @@ contract DotnsPopResolverTests is BaseDotns {
         assertEq(dotnsPopResolver.chatKey(bytes32(0)), key);
     }
 
-    function test_setLiteLink_accepts_zero_inputs_as_passthrough() public {
+    function test_setDeviceLink_accepts_zero_inputs_as_passthrough() public {
         vm.prank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(bytes32(0), bytes32(0));
-        assertEq(dotnsPopResolver.liteLink(bytes32(0)), bytes32(0));
-        assertEq(dotnsPopResolver.fullClaim(bytes32(0)), bytes32(0));
+        dotnsPopResolver.setDeviceLink(bytes32(0), bytes32(0));
+        assertEq(dotnsPopResolver.deviceLabelhashOf(bytes32(0)), bytes32(0));
+        assertEq(dotnsPopResolver.personhoodNodeOf(bytes32(0)), bytes32(0));
     }
 
     function test_rotating_pop_controller_changes_authorised_writer() public {
@@ -174,156 +174,156 @@ contract DotnsPopResolverTests is BaseDotns {
         dotnsPopResolver.setChatKey(_nodeOf("alice42"), key);
     }
 
-    function test_setLiteLink_same_full_node_relink_clears_old_reverse() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 liteX = keccak256(bytes("alice42"));
-        bytes32 liteY = keccak256(bytes("alice99"));
+    function test_setDeviceLink_same_personhood_node_relink_clears_old_reverse() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 deviceX = keccak256(bytes("alice42"));
+        bytes32 deviceY = keccak256(bytes("alice99"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullA, liteY);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceY);
         vm.stopPrank();
         // Old reverse must be cleared so downstream consumers stop resolving
-        // `liteX` to `fullA`.
-        assertEq(dotnsPopResolver.fullClaim(liteX), bytes32(0));
+        // `deviceX` to `personhoodA`.
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), bytes32(0));
         // New pair round-trips cleanly.
-        assertEq(dotnsPopResolver.liteLink(fullA), liteY);
-        assertEq(dotnsPopResolver.fullClaim(liteY), fullA);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), deviceY);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceY), personhoodA);
     }
 
-    function test_setLiteLink_same_lite_relink_clears_old_forward() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 fullB = _nodeOf("bob");
-        bytes32 liteX = keccak256(bytes("alice42"));
+    function test_setDeviceLink_same_device_relink_clears_old_forward() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 personhoodB = _nodeOf("bob");
+        bytes32 deviceX = keccak256(bytes("alice42"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullB, liteX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodB, deviceX);
         vm.stopPrank();
-        // Old forward must be cleared so `fullA` no longer claims `liteX`.
-        assertEq(dotnsPopResolver.liteLink(fullA), bytes32(0));
+        // Old forward must be cleared so `personhoodA` no longer claims `deviceX`.
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), bytes32(0));
         // New pair round-trips.
-        assertEq(dotnsPopResolver.liteLink(fullB), liteX);
-        assertEq(dotnsPopResolver.fullClaim(liteX), fullB);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodB), deviceX);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), personhoodB);
     }
 
-    function test_setLiteLink_idempotent_relink_keeps_both_indices() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 liteX = keccak256(bytes("alice42"));
+    function test_setDeviceLink_idempotent_relink_keeps_both_indices() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 deviceX = keccak256(bytes("alice42"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullA, liteX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
         vm.stopPrank();
         // Writing the same pair twice must not accidentally delete either
-        // side: the `oldLite == liteLabelhash` and `oldFull == fullNode`
+        // side: the `oldDevice == deviceLabelhash` and `oldPersonhood == personhoodNode`
         // guards in the implementation are the things under test here.
-        assertEq(dotnsPopResolver.liteLink(fullA), liteX);
-        assertEq(dotnsPopResolver.fullClaim(liteX), fullA);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), deviceX);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), personhoodA);
     }
 
-    function test_setLiteLink_chain_returns_to_original_without_drift() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 liteX = keccak256(bytes("alice42"));
-        bytes32 liteY = keccak256(bytes("alice99"));
+    function test_setDeviceLink_chain_returns_to_original_without_drift() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 deviceX = keccak256(bytes("alice42"));
+        bytes32 deviceY = keccak256(bytes("alice99"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullA, liteY);
-        dotnsPopResolver.setLiteLink(fullA, liteX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceY);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
         vm.stopPrank();
         // After A -> X -> Y -> X, only the (A, X) pair survives.
-        assertEq(dotnsPopResolver.liteLink(fullA), liteX);
-        assertEq(dotnsPopResolver.fullClaim(liteX), fullA);
-        assertEq(dotnsPopResolver.fullClaim(liteY), bytes32(0));
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), deviceX);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), personhoodA);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceY), bytes32(0));
     }
 
-    function test_setLiteLink_cross_chain_no_drift() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 fullB = _nodeOf("bob");
-        bytes32 liteX = keccak256(bytes("alice42"));
+    function test_setDeviceLink_cross_chain_no_drift() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 personhoodB = _nodeOf("bob");
+        bytes32 deviceX = keccak256(bytes("alice42"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullB, liteX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodB, deviceX);
         vm.stopPrank();
         // A must no longer appear as a claimant of anything, only B.
-        assertEq(dotnsPopResolver.liteLink(fullA), bytes32(0));
-        assertEq(dotnsPopResolver.liteLink(fullB), liteX);
-        assertEq(dotnsPopResolver.fullClaim(liteX), fullB);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), bytes32(0));
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodB), deviceX);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), personhoodB);
     }
 
-    function test_setLiteLink_quadrangle_clears_both_stale_inverses() public {
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 fullB = _nodeOf("bob");
-        bytes32 liteX = keccak256(bytes("alice42"));
-        bytes32 liteY = keccak256(bytes("bob42"));
+    function test_setDeviceLink_quadrangle_clears_both_stale_inverses() public {
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 personhoodB = _nodeOf("bob");
+        bytes32 deviceX = keccak256(bytes("alice42"));
+        bytes32 deviceY = keccak256(bytes("bob42"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullB, liteY);
-        dotnsPopResolver.setLiteLink(fullA, liteY);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodB, deviceY);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceY);
         vm.stopPrank();
         // After (A,X), (B,Y), (A,Y): only (A,Y) remains. B's forward link
         // and X's reverse link must both be cleared.
-        assertEq(dotnsPopResolver.liteLink(fullA), liteY);
-        assertEq(dotnsPopResolver.liteLink(fullB), bytes32(0));
-        assertEq(dotnsPopResolver.fullClaim(liteY), fullA);
-        assertEq(dotnsPopResolver.fullClaim(liteX), bytes32(0));
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), deviceY);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodB), bytes32(0));
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceY), personhoodA);
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), bytes32(0));
     }
 
-    function test_setLiteLink_with_zero_lite_is_passthrough() public {
-        bytes32 fullA = _nodeOf("alice");
+    function test_setDeviceLink_with_zero_device_is_passthrough() public {
+        bytes32 personhoodA = _nodeOf("alice");
         // Pin current behaviour for the zero-hash edge: the setter does not
-        // revert on a zero `liteLabelhash` and writes both indices at the
+        // revert on a zero `deviceLabelhash` and writes both indices at the
         // zero key. Any future validator that rejects zero inputs lands
         // here as a failing assertion.
         vm.prank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, bytes32(0));
+        dotnsPopResolver.setDeviceLink(personhoodA, bytes32(0));
 
-        assertEq(dotnsPopResolver.liteLink(fullA), bytes32(0));
-        assertEq(dotnsPopResolver.fullClaim(bytes32(0)), fullA);
+        assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), bytes32(0));
+        assertEq(dotnsPopResolver.personhoodNodeOf(bytes32(0)), personhoodA);
     }
 
-    function test_setLiteLink_long_chain_invariant_holds_at_every_step() public {
-        // Ten sequential re-links of the same `fullNode` to fresh lite
+    function test_setDeviceLink_long_chain_invariant_holds_at_every_step() public {
+        // Ten sequential re-links of the same `personhoodNode` to fresh device-name
         // labelhashes. At each step the forward and reverse indices must
-        // round-trip for the current pair, and the previous lite's reverse
+        // round-trip for the current pair, and the previous device name's reverse
         // entry must have been cleared.
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 previousLite = bytes32(0);
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 previousDevice = bytes32(0);
 
         vm.startPrank(address(dotnsPopController));
         for (uint256 i = 1; i <= 10; i++) {
-            bytes32 currentLite = keccak256(abi.encodePacked("alice", i));
-            dotnsPopResolver.setLiteLink(fullA, currentLite);
+            bytes32 currentDevice = keccak256(abi.encodePacked("alice", i));
+            dotnsPopResolver.setDeviceLink(personhoodA, currentDevice);
             // Current pair round-trips.
-            assertEq(dotnsPopResolver.liteLink(fullA), currentLite);
-            assertEq(dotnsPopResolver.fullClaim(currentLite), fullA);
+            assertEq(dotnsPopResolver.deviceLabelhashOf(personhoodA), currentDevice);
+            assertEq(dotnsPopResolver.personhoodNodeOf(currentDevice), personhoodA);
             // Previous reverse entry was nulled.
-            if (previousLite != bytes32(0)) {
-                assertEq(dotnsPopResolver.fullClaim(previousLite), bytes32(0));
+            if (previousDevice != bytes32(0)) {
+                assertEq(dotnsPopResolver.personhoodNodeOf(previousDevice), bytes32(0));
             }
 
-            previousLite = currentLite;
+            previousDevice = currentDevice;
         }
         vm.stopPrank();
     }
 
-    function test_setLiteLink_old_lite_reads_zero_after_relink() public {
-        // Integration-shaped assertion: a consumer that cached the old lite
-        // hash and later queries `fullClaim` must see `bytes32(0)`, not a
-        // stale fullNode.
-        bytes32 fullA = _nodeOf("alice");
-        bytes32 liteX = keccak256(bytes("alice42"));
-        bytes32 liteY = keccak256(bytes("alice99"));
+    function test_setDeviceLink_old_device_reads_zero_after_relink() public {
+        // Integration-shaped assertion: a consumer that cached the old device-name
+        // hash and later queries `personhoodNodeOf` must see `bytes32(0)`, not a
+        // stale personhoodNode.
+        bytes32 personhoodA = _nodeOf("alice");
+        bytes32 deviceX = keccak256(bytes("alice42"));
+        bytes32 deviceY = keccak256(bytes("alice99"));
 
         vm.startPrank(address(dotnsPopController));
-        dotnsPopResolver.setLiteLink(fullA, liteX);
-        dotnsPopResolver.setLiteLink(fullA, liteY);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceX);
+        dotnsPopResolver.setDeviceLink(personhoodA, deviceY);
         vm.stopPrank();
 
-        assertEq(dotnsPopResolver.fullClaim(liteX), bytes32(0));
+        assertEq(dotnsPopResolver.personhoodNodeOf(deviceX), bytes32(0));
     }
     // 65-byte chat-key helper now lives on BaseDotns as `_validChatKey`.
 }
diff --git a/test/unit/resolver/DotnsReverseResolver.t.sol b/test/unit/resolver/DotnsReverseResolver.t.sol
index 2205f46c7..55d0b576a 100644
--- a/test/unit/resolver/DotnsReverseResolver.t.sol
+++ b/test/unit/resolver/DotnsReverseResolver.t.sol
@@ -11,10 +11,10 @@ import {IDotnsReverseResolver} from "../../../contracts/resolvers/IDotnsReverseR
 ///         @custom:function nameOf read.
 contract DotnsReverseResolverTests is BaseDotns {
     /// @notice Label fixture used by tests that need a labelled, transferable name.
-    /// @dev Stem of nine characters with a two-digit suffix; classifies as NoStatus.
+    /// @dev Eleven characters measured as written, digits included; classifies as NoStatus.
     string internal constant CLAIM_LABEL = "claimuser01";
     /// @notice Secondary label fixture used by overwrite and transfer tests.
-    /// @dev Stem of nine characters with a two-digit suffix; classifies as NoStatus.
+    /// @dev Twelve characters measured as written, digits included; classifies as NoStatus.
     string internal constant ALT_LABEL = "secondname01";
 
     function test_nameof_returns_empty_when_unset() public view {
@@ -116,18 +116,18 @@ contract DotnsReverseResolverTests is BaseDotns {
         assertEq(dotnsReverseResolver.nameOf(leonardo), string.concat(CLAIM_LABEL, ".dot"));
     }
 
-    /// @notice A lite username owner can claim and reverse-resolve it.
-    /// @dev A lite name is a registry subname, not a token, so the claim reads ownership through
+    /// @notice A device name owner can claim and reverse-resolve it.
+    /// @dev A device name is a registry subname, not a token, so the claim reads ownership through
     /// the registry at the stem-under-container node rather than from the registrar's ERC-721
     ///      ledger, and the reverse read resolves the same node.
-    function test_claim_and_nameof_for_a_lite_username() public {
-        _grantPopFull(ed);
-        _reservePop(ed, LITE_LABEL_A, _validChatKey(0x01), "");
+    function test_claim_and_nameof_for_a_device_name() public {
+        _grantPersonhood(ed);
+        _reservePop(ed, DEVICE_LABEL_A, _validChatKey(0x01), "");
 
         vm.prank(ed);
-        dotnsReverseResolver.claimReverseRecord(LITE_LABEL_A);
+        dotnsReverseResolver.claimReverseRecord(DEVICE_LABEL_A);
 
-        assertEq(dotnsReverseResolver.nameOf(ed), string.concat(LITE_LABEL_A, ".dot"));
+        assertEq(dotnsReverseResolver.nameOf(ed), string.concat(DEVICE_LABEL_A, ".dot"));
     }
 
     function test_nameof_fails_closed_when_caller_no_longer_owns_stored_name() public {
diff --git a/test/unit/utils/StringUtils.t.sol b/test/unit/utils/StringUtils.t.sol
index 9222a2063..15ad10615 100644
--- a/test/unit/utils/StringUtils.t.sol
+++ b/test/unit/utils/StringUtils.t.sol
@@ -17,16 +17,16 @@ contract StringUtilsHarness {
         return value.isSingleLabel();
     }
 
-    function isPersonLabel(string calldata value) external pure returns (bool) {
-        return value.isPersonLabel();
+    function isPersonhoodLabel(string calldata value) external pure returns (bool) {
+        return value.isPersonhoodLabel();
     }
 
-    function isLitePersonLabel(string calldata value) external pure returns (bool) {
-        return value.isLitePersonLabel();
+    function isDeviceLabel(string calldata value) external pure returns (bool) {
+        return value.isDeviceLabel();
     }
 
-    function isLitePersonLabelMemory(string calldata value) external pure returns (bool) {
-        return StringUtils.isLitePersonLabelMemory(value);
+    function isDeviceLabelMemory(string calldata value) external pure returns (bool) {
+        return StringUtils.isDeviceLabelMemory(value);
     }
 
     function isNamePath(string calldata value) external pure returns (bool) {
@@ -35,8 +35,8 @@ contract StringUtilsHarness {
 }
 
 /// @title StringUtilsTests
-/// @notice Unit tests for the lite-label shape predicate and the letters-only name predicate.
-/// @dev A lite label is the only shape in DotNS permitted to carry a separator, and its stem
+/// @notice Unit tests for the device-name shape predicate and the letters-only name predicate.
+/// @dev A device name is the only shape in dotNS permitted to carry a separator, and its stem
 ///      is letters only, which is stricter than a DNS label. A digit suffix is not exclusive:
 ///      an ordinary label may end in digits. These tests are the definition of that boundary.
 contract StringUtilsTests is Test {
@@ -56,87 +56,87 @@ contract StringUtilsTests is Test {
     }
 
     /// @notice Asserts both data locations agree, then that they agree with `expected`.
-    function _assertLite(string memory value, bool expected) internal view {
-        bool fromCalldata = utils.isLitePersonLabel(value);
-        bool fromMemory = utils.isLitePersonLabelMemory(value);
+    function _assertDeviceLabel(string memory value, bool expected) internal view {
+        bool fromCalldata = utils.isDeviceLabel(value);
+        bool fromMemory = utils.isDeviceLabelMemory(value);
         assertEq(fromCalldata, fromMemory, "calldata and memory variants disagree");
         assertEq(fromCalldata, expected, value);
     }
 
-    /// @notice The same letters-only rule a lite stem uses, applied to a whole label.
-    /// @dev Mirrors the gateway pallet's `is_valid_person`, so a full-person label admits no
+    /// @notice The same letters-only rule a device-name stem uses, applied to a whole label.
+    /// @dev Mirrors the gateway pallet's `is_valid_person`, so a personhood name admits no
     ///      digits and no hyphens. No floor on length: that is the governance-reserved band.
-    function test_isPersonLabel_accepts_letters_only() public view {
-        assertTrue(utils.isPersonLabel("alicebob"));
-        assertTrue(utils.isPersonLabel("a"));
-        assertTrue(utils.isPersonLabel(_stem(63)));
+    function test_isPersonhoodLabel_accepts_letters_only() public view {
+        assertTrue(utils.isPersonhoodLabel("alicebob"));
+        assertTrue(utils.isPersonhoodLabel("a"));
+        assertTrue(utils.isPersonhoodLabel(_stem(63)));
 
-        assertFalse(utils.isPersonLabel("alice-bob"), "no hyphens");
-        assertFalse(utils.isPersonLabel("micha3l"), "no interior digits");
-        assertFalse(utils.isPersonLabel("alicebob01"), "no digit suffix");
-        assertFalse(utils.isPersonLabel("Alicebob"), "no uppercase");
-        assertFalse(utils.isPersonLabel(""), "not empty");
-        assertFalse(utils.isPersonLabel(_stem(64)), "bounded at 63 octets");
+        assertFalse(utils.isPersonhoodLabel("alice-bob"), "no hyphens");
+        assertFalse(utils.isPersonhoodLabel("micha3l"), "no interior digits");
+        assertFalse(utils.isPersonhoodLabel("alicebob01"), "no digit suffix");
+        assertFalse(utils.isPersonhoodLabel("Alicebob"), "no uppercase");
+        assertFalse(utils.isPersonhoodLabel(""), "not empty");
+        assertFalse(utils.isPersonhoodLabel(_stem(64)), "bounded at 63 octets");
     }
 
-    function test_isLitePersonLabel_accepts_the_dotted_shape() public view {
-        _assertLite("joseph.42", true);
-        _assertLite("joseph.00", true);
-        _assertLite("elizabeth.42", true);
-        _assertLite(string.concat(_stem(63), ".42"), true);
+    function test_isDeviceLabel_accepts_the_dotted_shape() public view {
+        _assertDeviceLabel("joseph.42", true);
+        _assertDeviceLabel("joseph.00", true);
+        _assertDeviceLabel("elizabeth.42", true);
+        _assertDeviceLabel(string.concat(_stem(63), ".42"), true);
     }
 
     /// @dev The shape puts no floor on the stem: how short a name may be is policy, held by
-    ///      PopRules as the governance-reserved band, so a short stem is a well-formed lite
+    ///      PopRules as the governance-reserved band, so a short stem is a well-formed device-name
     ///      label that classification then rejects.
-    function test_isLitePersonLabel_puts_no_floor_on_the_stem() public view {
-        _assertLite("a.42", true);
-        _assertLite("josep.42", true);
-        _assertLite(string.concat(_stem(1), ".42"), true);
+    function test_isDeviceLabel_puts_no_floor_on_the_stem() public view {
+        _assertDeviceLabel("a.42", true);
+        _assertDeviceLabel("josep.42", true);
+        _assertDeviceLabel(string.concat(_stem(1), ".42"), true);
     }
 
     /// @dev The stem is the name a person chose, which People Chain restricts to lowercase
     ///      letters, so it is stricter than a DNS label: no digits, no hyphens, no uppercase.
-    function test_isLitePersonLabel_requires_a_letters_only_stem() public view {
-        _assertLite("alice-bob.99", false);
-        _assertLite("josep4.42", false);
-        _assertLite("jos3ph.42", false);
-        _assertLite("joseph1.42", false);
-        _assertLite("Joseph.42", false);
+    function test_isDeviceLabel_requires_a_letters_only_stem() public view {
+        _assertDeviceLabel("alice-bob.99", false);
+        _assertDeviceLabel("josep4.42", false);
+        _assertDeviceLabel("jos3ph.42", false);
+        _assertDeviceLabel("joseph1.42", false);
+        _assertDeviceLabel("Joseph.42", false);
     }
 
-    function test_isLitePersonLabel_rejects_a_missing_or_repeated_separator() public view {
-        _assertLite("joseph42", false);
-        _assertLite("jos.eph.42", false);
-        _assertLite(".42", false);
-        _assertLite("joseph.", false);
+    function test_isDeviceLabel_rejects_a_missing_or_repeated_separator() public view {
+        _assertDeviceLabel("joseph42", false);
+        _assertDeviceLabel("jos.eph.42", false);
+        _assertDeviceLabel(".42", false);
+        _assertDeviceLabel("joseph.", false);
     }
 
-    function test_isLitePersonLabel_rejects_any_suffix_but_two_digits() public view {
-        _assertLite("joseph.4", false);
-        _assertLite("joseph.123", false);
-        _assertLite("joseph.4x", false);
-        _assertLite("joseph.x4", false);
+    function test_isDeviceLabel_rejects_any_suffix_but_two_digits() public view {
+        _assertDeviceLabel("joseph.4", false);
+        _assertDeviceLabel("joseph.123", false);
+        _assertDeviceLabel("joseph.4x", false);
+        _assertDeviceLabel("joseph.x4", false);
     }
 
-    function test_isLitePersonLabel_rejects_a_non_canonical_stem() public view {
-        _assertLite("jos_eph.42", false);
-        _assertLite("-joseph.42", false);
-        _assertLite("joseph-.42", false);
-        _assertLite(string.concat(_stem(64), ".42"), false);
+    function test_isDeviceLabel_rejects_a_non_canonical_stem() public view {
+        _assertDeviceLabel("jos_eph.42", false);
+        _assertDeviceLabel("-joseph.42", false);
+        _assertDeviceLabel("joseph-.42", false);
+        _assertDeviceLabel(string.concat(_stem(64), ".42"), false);
     }
 
-    function test_isLitePersonLabel_rejects_the_empty_string() public view {
-        _assertLite("", false);
+    function test_isDeviceLabel_rejects_the_empty_string() public view {
+        _assertDeviceLabel("", false);
     }
 
-    /// @dev The bound moved from the whole label to the stem, so a lite label runs three octets
+    /// @dev The bound moved from the whole label to the stem, so a device name runs three octets
     ///      past the single-label limit. Pinned because it is a deliberate widening.
-    function test_isLitePersonLabel_bounds_the_stem_not_the_whole_label() public view {
+    function test_isDeviceLabel_bounds_the_stem_not_the_whole_label() public view {
         string memory longest = string.concat(_stem(63), ".42");
-        assertEq(bytes(longest).length, 66, "longest lite label is 66 octets");
-        _assertLite(longest, true);
-        assertFalse(utils.isSingleLabel(longest), "a lite label is not a single DNS label");
+        assertEq(bytes(longest).length, 66, "longest device name is 66 octets");
+        _assertDeviceLabel(longest, true);
+        assertFalse(utils.isSingleLabel(longest), "a device name is not a single DNS label");
     }
 
     /// @notice A path of exactly @custom:constant StringUtils.MAX_NAME_PATH_OCTETS octets passes.

From bbcd7377dd75bd874e6d5110bac5a5abf08cd1c3 Mon Sep 17 00:00:00 2001
From: Giuseppe Re <giuseppe.re@parity.io>
Date: Fri, 2 Oct 2026 13:51:06 +0200
Subject: [PATCH 13/22] ci(release): publish only from tag pushes, fix Usage
 and Deployments in release notes (#325)

## Description

Fixes the release-pipeline problems hit while publishing v1.0.0.

**Dispatch runs could not publish.** The `release tags` ruleset lets
only the dotns team create `v*` tags. A `workflow_dispatch` run built
and tested everything, created the draft, and then
[failed](https://github.com/paritytech/dotns/actions/runs/36723620824)
at "Publish release": publishing a draft is the moment GitHub creates
its tag, and the workflow token is not allowed to (`Cannot create ref
due to creations being restricted`).

Both publish workflows now run only on a tag push:

- `workflow_dispatch` is removed from `publish-release.yml` and
`publish-prerelease.yml`.
- "Resolve release tag" reads the tag that started the run. The
dispatch-only guard against an existing tag, and its token, are gone.
- The concurrency group keys on `github.ref_name`, which is now always
the tag.

**Release body fixes**

- The Usage snippet imported `Store.json`, which no release ships. It
now imports `LabelStore.json` (both workflows).
- The Deployments section implied the listed networks run the release
being published. It now says a network can still run an earlier release
until it is upgraded, and points to how to tell: the protocol registry's
`protocolVersion()`

Docs are also fixed accordingly.

## Type

- [x] Bug fix
- [ ] Feature
- [ ] Breaking change
- [x] Documentation
- [ ] Chore
- [ ] Refactor
- [ ] Security

## Scope

- [ ] Registration
- [ ] Resolver
- [ ] Store
- [ ] Proof of Personhood
- [ ] Deployment scripts
- [ ] Tests

## Related Issues

## Fixes

Issues during the v1.0.0 release process.

## Checklist

### Code

- [x] Follows project style
- [ ] `forge build` passes
- [ ] `forge test` passes
- [ ] No new compiler warnings

### Testing

- [ ] New tests added for changed behavior
- [ ] Fuzz tests added where applicable
- [ ] Invariant tests verified

### Security

- [x] No new `selfdestruct` or `delegatecall`
- [x] Access control reviewed
- [x] No storage layout conflicts (for upgradeable contracts)

### Documentation

- [ ] NatSpec updated on changed interfaces
- [x] README updated if needed

### Breaking Changes

- [x] No breaking changes
- [ ] Breaking changes documented below

**Breaking changes:**

## How to test

You could test it by triggering a new pre-release.

## Notes

- Repo setting to update after merge: the `releases` environment still
allows `master` as a deployment ref, which only the dispatch path used.
Remove it so the environment matches RELEASE_ARTIFACTS.
- The v1.0.0 release notes were corrected by hand for the same two body
issues; this PR stops later releases from repeating them.
---
 .github/workflows/publish-prerelease.yml | 72 +++++++++++-----------
 .github/workflows/publish-release.yml    | 77 +++++++++++++-----------
 README.md                                |  8 +--
 RELEASE_ARTIFACTS.md                     |  4 +-
 scripts/js/release-metadata.mjs          |  2 +
 5 files changed, 85 insertions(+), 78 deletions(-)

diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml
index 35d759bad..51d7caf82 100644
--- a/.github/workflows/publish-prerelease.yml
+++ b/.github/workflows/publish-prerelease.yml
@@ -1,30 +1,47 @@
 name: Publish Beta Package
 
-# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, and the
-# job below pauses on the `releases` environment for a reviewer, so a release takes two
-# distinct human actions: cutting the tag, and approving the run it starts.
+# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, the
+# `guard` job refuses a tag whose commit is not on master, and the gated job pauses on the
+# `releases` environment for a reviewer. A release therefore ships reviewed master code and
+# takes two distinct human actions: cutting the tag, and approving the run it starts.
 on:
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+-*"
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Pre-release version, e.g. v0.5.5-rc1. The tag is created from the selected branch."
-        required: true
-        type: string
 
 permissions:
   contents: write
 
-# Two runs for the same version would race to attach assets to the same draft. On a
-# dispatch `github.ref_name` is the branch, so key on the requested version instead.
+# Two runs for the same version would race to attach assets to the same draft.
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.version || github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: false
 
 jobs:
+  # Runs first, with no environment and read-only access: a tag that does not point at a
+  # commit on master stops here, before a reviewer is asked to approve and before any
+  # secret is read. master only takes pull requests, which need an approving review, so
+  # this keeps every release on reviewed code.
+  guard:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Require the tagged commit to be on master
+        run: |
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
+            echo "::error::$GITHUB_REF_NAME points at $GITHUB_SHA, which is not on master. Tag a commit on master."
+            exit 1
+          fi
+          echo "$GITHUB_REF_NAME points at $GITHUB_SHA, which is on master."
+
   beta-release:
+    needs: guard
     runs-on: ubuntu-latest
     # Gated: this job reads the genesis owner key, which lives only on the `releases`
     # environment, so every run waits for a reviewer's approval there.
@@ -34,19 +51,12 @@ jobs:
     env:
       DOTNS_TLDS: testnet paseo
     steps:
-      # On workflow_dispatch the tag does not exist yet; the release step creates it
-      # from the branch this run was started on. Read through an env var rather than
-      # interpolating the input into the script.
+      # The run is started by pushing the tag, so the tag already exists and is the release's
+      # identity. Only the tag push triggers this workflow: the `release tags` ruleset keeps
+      # the workflow's token from creating a `v*` tag, so a run without one could not publish.
       - name: Resolve release tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-          INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
-            TAG="$INPUT_VERSION"
-          else
-            TAG="$GITHUB_REF_NAME"
-          fi
+          TAG="$GITHUB_REF_NAME"
           # The suffix is restricted to characters GitHub keeps verbatim in an asset
           # name; a space, for instance, is rewritten to a dot and would fail the
           # asset check after a full build. Segmented like run.sh's semver check
@@ -56,16 +66,8 @@ jobs:
             echo "::error::Pre-release version must look like v1.2.3-rc1, got '$TAG'."
             exit 1
           fi
-          # A release created for an existing tag is cut at that tag's commit: GitHub
-          # ignores target_commitish when the tag is already there. The ABIs would come
-          # from this branch while the release pointed somewhere else.
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] \
-            && gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" >/dev/null 2>&1; then
-            echo "::error::Tag $TAG already exists; use a different version."
-            exit 1
-          fi
           echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
-          echo "Releasing $TAG from $GITHUB_REF_NAME."
+          echo "Releasing $TAG."
 
       - name: Reject a pre-published release
         env:
@@ -238,7 +240,7 @@ jobs:
           ### Usage
 
           ```ts
-          import StoreAbi from "./abis/Store.json";
+          import LabelStoreAbi from "./abis/LabelStore.json";
           import RegistrarAbi from "./abis/DotnsRegistrar.json";
           ```
           ENDOFBODY
@@ -291,10 +293,8 @@ jobs:
       - name: Create draft pre-release with artifacts
         uses: softprops/action-gh-release@v2
         with:
-          # Explicit because on workflow_dispatch there is no tag to infer; the action
-          # creates it at this run's commit.
+          # The tag that started this run.
           tag_name: ${{ env.RELEASE_TAG }}
-          target_commitish: ${{ github.sha }}
           files: |
             dotns-abis-*.zip
             release/abis/*.json
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 1fb0af90a..b55a8f8d4 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -1,30 +1,47 @@
 name: Publish Release Package
 
-# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, and the
-# job below pauses on the `releases` environment for a reviewer, so a release takes two
-# distinct human actions: cutting the tag, and approving the run it starts.
+# Creating a `v*` tag is restricted to the dotns team by the `release tags` ruleset, the
+# `guard` job refuses a tag whose commit is not on master, and the gated job pauses on the
+# `releases` environment for a reviewer. A release therefore ships reviewed master code and
+# takes two distinct human actions: cutting the tag, and approving the run it starts.
 on:
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to release, e.g. v0.5.5. The tag is created from the selected branch."
-        required: true
-        type: string
 
 permissions:
   contents: write
 
-# Two runs for the same version would race to attach assets to the same draft. On a
-# dispatch `github.ref_name` is the branch, so key on the requested version instead.
+# Two runs for the same version would race to attach assets to the same draft.
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.version || github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: false
 
 jobs:
+  # Runs first, with no environment and read-only access: a tag that does not point at a
+  # commit on master stops here, before a reviewer is asked to approve and before any
+  # secret is read. master only takes pull requests, which need an approving review, so
+  # this keeps every release on reviewed code.
+  guard:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Require the tagged commit to be on master
+        run: |
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
+            echo "::error::$GITHUB_REF_NAME points at $GITHUB_SHA, which is not on master. Tag a commit on master."
+            exit 1
+          fi
+          echo "$GITHUB_REF_NAME points at $GITHUB_SHA, which is on master."
+
   release:
+    needs: guard
     runs-on: ubuntu-latest
     # Gated: this job reads the genesis owner key, which lives only on the `releases`
     # environment, so every run waits for a reviewer's approval there.
@@ -34,33 +51,18 @@ jobs:
     env:
       DOTNS_TLDS: testnet paseo
     steps:
-      # On workflow_dispatch the tag does not exist yet; the release step creates it
-      # from the branch this run was started on. Read through an env var rather than
-      # interpolating the input into the script.
+      # The run is started by pushing the tag, so the tag already exists and is the release's
+      # identity. Only the tag push triggers this workflow: the `release tags` ruleset keeps
+      # the workflow's token from creating a `v*` tag, so a run without one could not publish.
       - name: Resolve release tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-          INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
-            TAG="$INPUT_VERSION"
-          else
-            TAG="$GITHUB_REF_NAME"
-          fi
+          TAG="$GITHUB_REF_NAME"
           if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "::error::Version must look like v1.2.3, got '$TAG'."
             exit 1
           fi
-          # A release created for an existing tag is cut at that tag's commit: GitHub
-          # ignores target_commitish when the tag is already there. The ABIs would come
-          # from this branch while the release pointed somewhere else.
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] \
-            && gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" >/dev/null 2>&1; then
-            echo "::error::Tag $TAG already exists; use a different version."
-            exit 1
-          fi
           echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
-          echo "Releasing $TAG from $GITHUB_REF_NAME."
+          echo "Releasing $TAG."
 
       - name: Reject a pre-published release
         env:
@@ -230,7 +232,7 @@ jobs:
           ### Usage
 
           ```ts
-          import StoreAbi from "./abis/Store.json";
+          import LabelStoreAbi from "./abis/LabelStore.json";
           import RegistrarAbi from "./abis/DotnsRegistrar.json";
           ```
           ENDOFBODY
@@ -251,6 +253,11 @@ jobs:
             echo "|---------|---------:|"
             jq -r '.networks | to_entries[] | "| \(.key) | \(.value.chainId) |"' release/deployments.json
             echo ""
+            echo "A network can still run an earlier release until it is upgraded to this one. Its protocol"
+            echo "registry's \`protocolVersion()\` returns the release it runs as bare semver (\`1.0.0\`, no \`v\`),"
+            echo "or an empty string when the network has never declared one. \`deployments:verify --tag\`"
+            echo "checks the chain against a release ([Verifying a release]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/blob/$TAG/RELEASE_ARTIFACTS.md#verifying-a-release))."
+            echo ""
             echo "- **Addresses:** [deployments.json]($ASSET_BASE/deployments.json)"
             echo "- **Release contents:** [release-manifest.json]($ASSET_BASE/release-manifest.json)"
             echo "- **Code identity:** [codehashes.json]($ASSET_BASE/codehashes.json) (stripped-metadata build hashes of this release's contracts; input to upgrade checks)"
@@ -307,10 +314,8 @@ jobs:
       - name: Create draft release with artifacts
         uses: softprops/action-gh-release@v2
         with:
-          # Explicit because on workflow_dispatch there is no tag to infer; the action
-          # creates it at this run's commit.
+          # The tag that started this run.
           tag_name: ${{ env.RELEASE_TAG }}
-          target_commitish: ${{ github.sha }}
           files: |
             dotns-abis-*.zip
             release/abis/*.json
diff --git a/README.md b/README.md
index 1b30b0452..9a0d59333 100644
--- a/README.md
+++ b/README.md
@@ -37,13 +37,13 @@ Deployment notes are in [DEPLOYMENTS.md](./DEPLOYMENTS.md). Network addresses ar
 
 A release publishes the contract ABIs and the deployed addresses as GitHub release assets, described in [RELEASE_ARTIFACTS.md](./RELEASE_ARTIFACTS.md). It does not deploy anything; deploying contracts to a network is a separate process, described in [DEPLOYMENTS.md](./DEPLOYMENTS.md).
 
-Run **Publish Release Package** from the Actions tab, pick the branch to release from, and enter the version (`v0.5.5`). The workflow does the rest: it builds, tests, extracts the ABIs listed in [.github/abi-contracts.txt](./.github/abi-contracts.txt), generates the address and manifest files, creates the release as a draft with every asset attached, verifies the set against what the build produced, and only then publishes. Pushing a matching tag runs the same workflow, so `git tag v0.5.5 && git push origin v0.5.5` remains equivalent.
+A release starts from its tag. A member of the dotns team tags the commit to release and pushes the tag: `git tag v0.5.5 <commit> && git push origin v0.5.5`. Only the team can create `v*` tags, which the `release tags` ruleset enforces, so the workflow cannot create one itself. The tagged commit must be on `master`, which only takes pull requests that need an approving review; the workflow refuses any other tag before asking for approval. The push starts **Publish Release Package**, which waits for a reviewer's approval on the `releases` environment and then does the rest: it builds, tests, extracts the ABIs listed in [.github/abi-contracts.txt](./.github/abi-contracts.txt), generates the address and manifest files, creates the release as a draft with every asset attached, verifies the set against what the build produced, and only then publishes.
 
-Pre-releases use **Publish Beta Package** with a suffixed version, `v0.5.5-rc1`. The version is the release identity; the `version` field in `package.json` is unrelated and nothing reads it.
+Pre-releases work the same way with a suffixed tag, `v0.5.5-rc1`, whose push starts **Publish Beta Package**. The tag is the release identity; the `version` field in `package.json` is unrelated and nothing reads it.
 
-Do not create releases through the GitHub UI's release form, or with `gh release create`. Both publish immediately, and because this repository has immutable releases enabled, a published release can no longer accept assets: only its title and notes stay editable. A release made that way carries no ABIs at all. The workflow rejects an already-published version before building, so the mistake fails in seconds rather than silently shipping an empty release.
+Do not create releases through the GitHub UI's release form, or with `gh release create`. Both publish immediately, and because this repository has immutable releases enabled, a published release can no longer accept assets: only its title and notes stay editable. A release made that way carries no ABIs at all. The workflow rejects an already-published version before building, so the mistake fails in seconds and no empty release ships.
 
-If a run fails partway, re-run it from the Actions tab; the draft is updated rather than duplicated. One case needs a manual step: the upload replaces an asset of the same name but never removes others, so if the contract list changed since the failed run, the draft still carries the assets it no longer expects and the verification step will keep refusing to publish. Delete the draft and re-run. If the version has already been published, use a different one, since its assets cannot be changed.
+If a run fails partway, re-run it from its page in the Actions tab; the draft is updated in place. A re-run builds the same commit, because a pushed `v*` tag stays where it is: the `release tags` ruleset blocks deleting or moving one for everyone outside the dotns team, and the team does not move a pushed release tag either. So a re-run only helps when the failure is outside the code (a flaky step, an expired approval); a failure that needs a code fix needs a new version. When you abandon a version that way, delete its draft from the Releases page so it does not linger unpublished. One case needs a manual step: the upload replaces an asset of the same name but never removes others, so if the contract list changed since the failed run, the draft still carries the assets it no longer expects and the verification step will keep refusing to publish. Delete the draft and re-run. If the version has already been published, use a different one, since its assets cannot be changed.
 
 ## Economics
 
diff --git a/RELEASE_ARTIFACTS.md b/RELEASE_ARTIFACTS.md
index dd544d13a..b80046fe7 100644
--- a/RELEASE_ARTIFACTS.md
+++ b/RELEASE_ARTIFACTS.md
@@ -129,8 +129,8 @@ key that owns every contract in it. The environment holds:
   pair right after the toolchain is installed and fails the run on a mismatch, so a mistyped
   key dies before anything is built.
 - Required reviewers: the dotns team. Every release run pauses for one approval.
-- Deployment refs: `master` (for `workflow_dispatch`) and `v[0-9]*` tags. A dispatch started
-  from any other branch stops at the environment gate.
+- Deployment refs: `v[0-9]*` tags. Both workflows run only on a tag push, so a run from any
+  other ref stops at the environment gate.
 
 Creating a `v*` tag is itself restricted to the dotns team by the `release tags` ruleset, so a
 release takes two distinct human actions: cutting the tag, and approving the run it starts.
diff --git a/scripts/js/release-metadata.mjs b/scripts/js/release-metadata.mjs
index acaf49fb6..c5692c5b7 100644
--- a/scripts/js/release-metadata.mjs
+++ b/scripts/js/release-metadata.mjs
@@ -837,6 +837,8 @@ function verify(args) {
     ]).replace(/^"|"$/g, "");
     if (declaredVersion === tag) {
       console.log(`  ok   protocolVersion ${declaredVersion}`);
+    } else if (declaredVersion === "") {
+      problems.push(`chain declares no protocol version, expected '${tag}'`);
     } else {
       problems.push(`chain declares protocol version '${declaredVersion}', expected '${tag}'`);
     }

From 62a8c2c413a2d5aac603fd83c3f50f25b0fe1637 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 15:43:19 +0200
Subject: [PATCH 14/22] chore(upgrades): replace the v0.8.0 campaign with
 v0.8.0 snapshots from chain

Removes the v0.7.0 to v0.8.0 campaign (snapshots, store-factory migrator,
ownership rotation, ten upgrade scripts and fork tests, runbook); it stays
in history under upgrades/paseo-nv2-v0.8.0.

Adds snapshots of the four contracts this campaign upgrades (DotnsRegistry,
PopRules, DotnsPopResolver, DotnsPopController), copied from
upgrades/paseo-nv2-v0.8.0 with the code-changed files of their import
closure. verify-snapshots.sh reproduces all five deployed implementations
on Paseo, DotnsRegistrar included. LayoutCompatibility covers the four.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 contracts/escrow/DotnsNameEscrowOld.sol       | 819 ------------------
 contracts/pop/IDotnsCostModelRegistryOld.sol  |  87 --
 contracts/pop/IDotnsPricingOld.sol            |  32 -
 contracts/pop/IPopRulesOld.sol                | 355 ++++++++
 contracts/pop/PopRulesOld.sol                 |  98 ++-
 .../registrars/DotnsPopControllerOld.sol      | 175 ++--
 .../DotnsRegistrarControllerOld.sol           | 484 -----------
 contracts/registrars/DotnsRegistrarOld.sol    | 130 +--
 .../registrars/IDotnsPopControllerOld.sol     | 528 +++++++++++
 contracts/registrars/IDotnsRegistrarOld.sol   | 190 ----
 .../registry/DotnsProtocolRegistryOld.sol     | 112 ---
 contracts/registry/DotnsRegistryOld.sol       |  93 +-
 .../registry/IDotnsProtocolRegistryOld.sol    |  51 --
 contracts/registry/IDotnsRegistryOld.sol      | 164 ----
 .../resolvers/DotnsContentResolverOld.sol     | 152 ----
 contracts/resolvers/DotnsPopResolverOld.sol   |  50 +-
 contracts/resolvers/DotnsResolverOld.sol      | 100 ---
 .../resolvers/DotnsReverseResolverOld.sol     | 146 ----
 contracts/resolvers/IDotnsPopResolverOld.sol  |  86 ++
 contracts/store/IStoreFactoryOld.sol          | 157 ----
 contracts/store/StoreFactoryMigrator.sol      | 366 --------
 contracts/utils/DotnsConstantsOld.sol         | 192 ----
 contracts/utils/RegistrationUtilsOld.sol      |  97 ---
 contracts/utils/StoreUtilsOld.sol             |  60 --
 contracts/utils/StringUtilsOld.sol            | 295 +++++++
 contracts/utils/SubnodeUtilsOld.sol           |  39 +-
 contracts/utils/SystemUtilsOld.sol            |  21 -
 contracts/whitelist/DotnsNameWhitelistOld.sol | 512 -----------
 docs/PASEO-V080-RUNBOOK.md                    | 287 ------
 scripts/deploy/MigrateStoreFactory.s.sol      | 273 ------
 scripts/deploy/RotateOwnership.s.sol          | 286 ------
 scripts/deploy/UpgradeContentResolver.s.sol   |  76 --
 scripts/deploy/UpgradeNameEscrow.s.sol        |  75 --
 scripts/deploy/UpgradeNameWhitelist.s.sol     |  75 --
 scripts/deploy/UpgradePopController.s.sol     |  75 --
 scripts/deploy/UpgradePopResolver.s.sol       |  75 --
 scripts/deploy/UpgradeProtocolRegistry.s.sol  |  77 --
 scripts/deploy/UpgradeRegistrar.s.sol         |  75 --
 .../deploy/UpgradeRegistrarController.s.sol   |  78 --
 scripts/deploy/UpgradeResolver.s.sol          |  75 --
 scripts/deploy/UpgradeReverseResolver.s.sol   |  76 --
 test/fork/MigrateStoreFactory.t.sol           | 211 -----
 test/fork/RotateOwnership.t.sol               | 153 ----
 test/fork/UpgradeContentResolver.t.sol        |  70 --
 test/fork/UpgradeNameEscrow.t.sol             |  71 --
 test/fork/UpgradeNameWhitelist.t.sol          |  67 --
 test/fork/UpgradePopController.t.sol          |  66 --
 test/fork/UpgradePopResolver.t.sol            |  70 --
 test/fork/UpgradeProtocolRegistry.t.sol       |  87 --
 test/fork/UpgradeRegistrar.t.sol              |  73 --
 test/fork/UpgradeRegistrarController.t.sol    |  76 --
 test/fork/UpgradeResolver.t.sol               |  70 --
 test/fork/UpgradeReverseResolver.t.sol        |  70 --
 test/unit/store/StoreFactoryMigrator.t.sol    | 203 -----
 test/unit/upgrade/LayoutCompatibility.t.sol   |  99 +--
 55 files changed, 1603 insertions(+), 6977 deletions(-)
 delete mode 100644 contracts/escrow/DotnsNameEscrowOld.sol
 delete mode 100644 contracts/pop/IDotnsCostModelRegistryOld.sol
 delete mode 100644 contracts/pop/IDotnsPricingOld.sol
 create mode 100644 contracts/pop/IPopRulesOld.sol
 delete mode 100644 contracts/registrars/DotnsRegistrarControllerOld.sol
 create mode 100644 contracts/registrars/IDotnsPopControllerOld.sol
 delete mode 100644 contracts/registrars/IDotnsRegistrarOld.sol
 delete mode 100644 contracts/registry/DotnsProtocolRegistryOld.sol
 delete mode 100644 contracts/registry/IDotnsProtocolRegistryOld.sol
 delete mode 100644 contracts/registry/IDotnsRegistryOld.sol
 delete mode 100644 contracts/resolvers/DotnsContentResolverOld.sol
 delete mode 100644 contracts/resolvers/DotnsResolverOld.sol
 delete mode 100644 contracts/resolvers/DotnsReverseResolverOld.sol
 create mode 100644 contracts/resolvers/IDotnsPopResolverOld.sol
 delete mode 100644 contracts/store/IStoreFactoryOld.sol
 delete mode 100644 contracts/store/StoreFactoryMigrator.sol
 delete mode 100644 contracts/utils/DotnsConstantsOld.sol
 delete mode 100644 contracts/utils/RegistrationUtilsOld.sol
 delete mode 100644 contracts/utils/StoreUtilsOld.sol
 create mode 100644 contracts/utils/StringUtilsOld.sol
 delete mode 100644 contracts/utils/SystemUtilsOld.sol
 delete mode 100644 contracts/whitelist/DotnsNameWhitelistOld.sol
 delete mode 100644 docs/PASEO-V080-RUNBOOK.md
 delete mode 100644 scripts/deploy/MigrateStoreFactory.s.sol
 delete mode 100644 scripts/deploy/RotateOwnership.s.sol
 delete mode 100644 scripts/deploy/UpgradeContentResolver.s.sol
 delete mode 100644 scripts/deploy/UpgradeNameEscrow.s.sol
 delete mode 100644 scripts/deploy/UpgradeNameWhitelist.s.sol
 delete mode 100644 scripts/deploy/UpgradePopController.s.sol
 delete mode 100644 scripts/deploy/UpgradePopResolver.s.sol
 delete mode 100644 scripts/deploy/UpgradeProtocolRegistry.s.sol
 delete mode 100644 scripts/deploy/UpgradeRegistrar.s.sol
 delete mode 100644 scripts/deploy/UpgradeRegistrarController.s.sol
 delete mode 100644 scripts/deploy/UpgradeResolver.s.sol
 delete mode 100644 scripts/deploy/UpgradeReverseResolver.s.sol
 delete mode 100644 test/fork/MigrateStoreFactory.t.sol
 delete mode 100644 test/fork/RotateOwnership.t.sol
 delete mode 100644 test/fork/UpgradeContentResolver.t.sol
 delete mode 100644 test/fork/UpgradeNameEscrow.t.sol
 delete mode 100644 test/fork/UpgradeNameWhitelist.t.sol
 delete mode 100644 test/fork/UpgradePopController.t.sol
 delete mode 100644 test/fork/UpgradePopResolver.t.sol
 delete mode 100644 test/fork/UpgradeProtocolRegistry.t.sol
 delete mode 100644 test/fork/UpgradeRegistrar.t.sol
 delete mode 100644 test/fork/UpgradeRegistrarController.t.sol
 delete mode 100644 test/fork/UpgradeResolver.t.sol
 delete mode 100644 test/fork/UpgradeReverseResolver.t.sol
 delete mode 100644 test/unit/store/StoreFactoryMigrator.t.sol

diff --git a/contracts/escrow/DotnsNameEscrowOld.sol b/contracts/escrow/DotnsNameEscrowOld.sol
deleted file mode 100644
index cfc70c71e..000000000
--- a/contracts/escrow/DotnsNameEscrowOld.sol
+++ /dev/null
@@ -1,819 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {ReentrancyGuardTransient} from "@openzeppelin/contracts/utils/ReentrancyGuardTransient.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
-import {IDotnsNameEscrow} from "./IDotnsNameEscrow.sol";
-import {IDotnsRegistrarOld} from "../registrars/IDotnsRegistrarOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-
-/// @title Dotns Name Escrow
-/// @notice Holds refundable deposits for registered names and manages the release/reclaim
-/// lifecycle. @custom:security-contact admin@parity.io
-contract DotnsNameEscrowOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ReentrancyGuardTransient,
-    ERC165Upgradeable,
-    IERC721Receiver,
-    IDotnsNameEscrow
-{
-    /// @notice Maximum page size for releasedTokens pagination.
-    uint256 public constant MAX_RELEASED_PAGE_SIZE = 200;
-
-    /// @notice Maximum page size for pendingRefunds pagination and batch claims.
-    uint256 public constant MAX_REFUND_PAGE_SIZE = 200;
-
-    /// @notice Upper bound on the configurable release-cooldown.
-    /// @dev The cooldown gates only the release-to-withdraw delay, not the long-lived deposit lock
-    ///      and not the reclaim boundary (see `redeemWindow`), so it is intentionally kept short.
-    ///      Capping at one hour also keeps the cast to `uint64` well below the saturation point at
-    ///      every plausible block timestamp.
-    uint256 public constant MAX_COOLDOWN = 1 hours;
-
-    /// @notice Upper bound on the configurable redeem window.
-    /// @dev The redeem window is a different quantity from the cooldown: it is the period after
-    ///      release in which only the previous holder may act, and it gates reclaim rather than
-    ///      withdrawal. The bound limits how long policy can hold a released name out of
-    ///      circulation, and keeps the cast to `uint64` in release well below saturation.
-    uint256 public constant MAX_REDEEM_WINDOW = 30 days;
-
-    /// @notice Lower bound on the configurable redeem window.
-    /// @dev A window short enough to elapse before its holder can plausibly notice the release
-    ///      offers no protection at all, and one of zero length turns every release into an
-    ///      immediate hand-off to whoever is watching. The floor keeps the window long enough to
-    ///      span a holder being asleep or away for a day, so the guarantee survives any setting
-    ///      the owner is able to choose.
-    uint256 public constant MIN_REDEEM_WINDOW = 1 days;
-
-    /// @notice The protocol registry for resolving sibling contract addresses.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @notice Delay after release before the deposit withdrawal may be credited.
-    /// @dev Forces a delay between `release` and `withdraw`. It does not bound reclaim: the
-    ///      release-to-reclaim boundary is `redeemWindow`, a separate and longer quantity. Also
-    ///      supplies the per-entry clock for time-locked refund credits, which is why raising it
-    ///      would slow every refund path and not just the deposit one.
-    uint256 public cooldown;
-
-    /// @notice Total amount of a specific asset reserved across all positions.
-    /// @dev Keyed by asset so future ERC20 support can track per-token liabilities independently;
-    ///      `address(0)` represents the native token and is the only asset currently accepted.
-    mapping(address asset => uint256 amount) public tokenReserved;
-
-    /// @notice Per-token escrow position storing recipient, amount, lifecycle flags and cooldown.
-    mapping(uint256 tokenId => ReleasePosition position) private _positions;
-
-    /// @notice Ordered set of tokens currently in escrow custody, used for paginated enumeration.
-    uint256[] private _releasedTokens;
-
-    /// @notice Reverse lookup into `_releasedTokens` (one-based) for O(1) remove-by-swap.
-    mapping(uint256 tokenId => uint256 indexPlusOne) private _releasedIndexPlusOne;
-
-    /// @notice Cumulative balance of non-refundable protocol fees; only accumulates.
-    /// @dev Credited by cross-paid registration fees and transfer fees. Never debited: protocol
-    ///      fees do not back refunds, which draw solely on the per-asset reserve.
-    uint256 public protocolFees;
-
-    /// @notice Pull-payment ledger storing each recipient's claimable refund balance.
-    /// @dev Per-recipient isolation ensures a failing or reentrant receiver cannot block other
-    ///      users' withdrawals. Used as the fallback path for registration overpayments whose
-    ///      direct push back to `msg.sender` failed (because the caller is a contract that
-    ///      rejects incoming value).
-    mapping(address recipient => uint256 amount) private _pendingWithdrawals;
-
-    /// @notice Time-locked refund ledger keyed by entryId.
-    /// @dev Every credit allocates a fresh entryId so per-entry cooldowns are independent and
-    ///      drip-feed credits cannot reset an existing entry's clock.
-    mapping(uint256 entryId => RefundEntry entry) private _refundEntries;
-
-    /// @notice Per-recipient list of pending entryIds for paginated enumeration and batch claim.
-    mapping(address recipient => uint256[] entryIds) private _entriesByRecipient;
-
-    /// @notice Reverse lookup into `_entriesByRecipient` (one-based) for O(1) remove-by-swap.
-    mapping(uint256 entryId => uint256 indexPlusOne) private _entryIndexPlusOne;
-
-    /// @notice Monotonic counter assigning entryIds to new refund credits.
-    uint256 private _nextEntryId;
-
-    /// @notice Period after release during which only the previous holder may act.
-    /// @dev Distinct from `cooldown`. Inside this window the holder may `redeem` the name back
-    ///      and nobody else may take it (`available` reports false); once it elapses `reclaim`
-    ///      becomes permissionless and any unwithdrawn deposit is credited to the recipient
-    ///      rather than stranded.
-    uint256 public redeemWindow;
-
-    /// @dev Reserved storage space to allow for layout changes in future upgrades. A variable
-    /// appended above must shrink this array by the same number of slots, so an upgrade never
-    /// moves the slots of anything already stored.
-    uint256[50] private __gap;
-
-    /// @notice Restricts calls to the configured registrar controller.
-    modifier onlyController() {
-        _onlyController();
-        _;
-    }
-
-    /// @notice Restricts calls to the configured registrar from the protocol registry.
-    modifier onlyRegistrar() {
-        _onlyRegistrar();
-        _;
-    }
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the name escrow.
-    /// @dev Runs once behind the proxy; subsequent calls trigger @custom:reverts
-    ///      InvalidInitialization via the `initializer` modifier. `registry` must be non-zero,
-    ///      otherwise @custom:reverts InvalidAsset; `cooldownSeconds` is forwarded to
-    ///      @custom:function updateCooldown, which rejects a zero value (@custom:reverts
-    ///      InvalidCooldown) and any value above @custom:constant MAX_COOLDOWN (@custom:reverts
-    ///      CooldownTooLong), and emits @custom:emits CooldownUpdated as part of seeding the
-    ///      initial cooldown. `redeemWindowSeconds` is forwarded to @custom:function
-    ///      updateRedeemWindow, which rejects any value below @custom:constant MIN_REDEEM_WINDOW
-    ///      (@custom:reverts RedeemWindowTooShort) or above @custom:constant MAX_REDEEM_WINDOW
-    ///      (@custom:reverts RedeemWindowTooLong), and emits @custom:emits RedeemWindowUpdated.
-    /// @param registry Protocol registry used to resolve registrar and controller addresses.
-    /// @param cooldownSeconds Delay after release before the deposit withdrawal may be credited.
-    /// @param redeemWindowSeconds Period after release in which only the previous holder may act.
-    function initialize(
-        IDotnsProtocolRegistryOld registry,
-        uint256 cooldownSeconds,
-        uint256 redeemWindowSeconds
-    )
-        external
-        initializer
-    {
-        require(address(registry) != address(0), InvalidAsset());
-
-        __Ownable_init(msg.sender);
-        __ERC165_init();
-
-        protocolRegistry = registry;
-        updateCooldown(cooldownSeconds);
-        updateRedeemWindow(redeemWindowSeconds);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function updateCooldown(uint256 newCooldown) public override onlyOwner {
-        require(newCooldown != 0, InvalidCooldown());
-        require(newCooldown <= MAX_COOLDOWN, CooldownTooLong(newCooldown, MAX_COOLDOWN));
-
-        uint256 currentCooldown = cooldown;
-        cooldown = newCooldown;
-
-        emit CooldownUpdated(currentCooldown, newCooldown);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function updateRedeemWindow(uint256 newRedeemWindow) public override onlyOwner {
-        require(
-            newRedeemWindow >= MIN_REDEEM_WINDOW,
-            RedeemWindowTooShort(newRedeemWindow, MIN_REDEEM_WINDOW)
-        );
-        require(
-            newRedeemWindow <= MAX_REDEEM_WINDOW,
-            RedeemWindowTooLong(newRedeemWindow, MAX_REDEEM_WINDOW)
-        );
-
-        uint256 currentRedeemWindow = redeemWindow;
-        redeemWindow = newRedeemWindow;
-
-        emit RedeemWindowUpdated(currentRedeemWindow, newRedeemWindow);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function getReleasePosition(uint256 tokenId)
-        external
-        view
-        override
-        returns (ReleasePosition memory position)
-    {
-        position = _positions[tokenId];
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function releasedTokenCount() external view override returns (uint256 count) {
-        count = _releasedTokens.length;
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function reserves(address asset) external view returns (uint256 amount) {
-        amount = tokenReserved[asset];
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function releasedTokens(
-        uint256 start,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (uint256[] memory tokenIds)
-    {
-        require(limit != 0 && limit <= MAX_RELEASED_PAGE_SIZE, InvalidPageSize(limit));
-
-        uint256 length = _releasedTokens.length;
-        if (start >= length) return new uint256[](0);
-
-        uint256 end = start + limit;
-        if (end > length) end = length;
-
-        tokenIds = new uint256[](end - start);
-        uint256 outIndex = 0;
-        for (uint256 i = start; i < end; ++i) {
-            tokenIds[outIndex] = _releasedTokens[i];
-            ++outIndex;
-        }
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function deposit(DepositParams calldata params) external payable override onlyController {
-        // Reject mismatched amount/msg.value so callers cannot under-fund a position.
-        require(msg.value == params.amount, InvalidAmount());
-        // Only native deposits are currently supported; ERC20 support can be added in a
-        // future upgrade by relaxing this check and routing transfers via SafeERC20.
-        require(params.asset == address(0), AssetNotSupported(params.asset));
-        require(params.recipient != address(0), InvalidRecipient());
-
-        ReleasePosition storage position = _positions[params.tokenId];
-
-        // Use `recipient` as the "is this slot funded?" sentinel so zero-amount
-        // positions (seeded by cross-paid registrations, which pay a fee rather than a deposit)
-        // still count as present and cannot be re-seeded with a different recipient.
-        require(position.recipient == address(0), PositionAlreadyFunded(params.tokenId));
-        require(!position.released, AlreadyReleased(params.tokenId));
-
-        position.asset = params.asset;
-        position.amount = params.amount;
-        position.recipient = params.recipient;
-
-        tokenReserved[position.asset] += params.amount;
-
-        emit NativeDepositRecorded(params.tokenId, params.amount);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function creditOverpayment(address recipient) external payable override onlyController {
-        require(recipient != address(0), InvalidRecipient());
-        require(msg.value != 0, InvalidAmount());
-        _pendingWithdrawals[recipient] += msg.value;
-        emit OverpaymentRefunded(recipient, msg.value);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function depositProtocolFee(ProtocolFeeDepositParams calldata params)
-        external
-        payable
-        override
-        onlyController
-    {
-        require(msg.value > 0, InvalidAmount());
-
-        protocolFees += msg.value;
-
-        emit CrossTierFeePaid(
-            params.tokenId,
-            params.payer,
-            params.recipient,
-            msg.value,
-            /* isRegistration */
-            true
-        );
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function chargeTransferFee(ChargeTransferFeeParams calldata params)
-        external
-        payable
-        override
-        onlyRegistrar
-        returns (uint256 charged)
-    {
-        ReleasePosition storage position = _positions[params.tokenId];
-        // Released positions are mid-lifecycle in escrow custody and must not be rebound; the
-        // recipient is the original releaser who will claim the refund. The canonical transfer
-        // path never reaches here for released tokens (`_update` short-circuits on escrow-touching
-        // transfers) but the guard hardens the contract against a divergent registrar.
-        require(!position.released, AlreadyReleased(params.tokenId));
-
-        address priorRecipient = position.recipient;
-
-        uint256 fee = params.transferFee;
-        require(msg.value >= fee, InsufficientValue());
-
-        // Deposits follow the NFT, not the depositor. When the position is funded the locked
-        // deposit travels with the name; when it is a zero-amount lifecycle marker the marker
-        // travels with it. In both cases the position is rebound to the new holder so only
-        // the current holder can later release into escrow and claim the refund.
-        if (priorRecipient != address(0) && params.to != priorRecipient) {
-            position.recipient = params.to;
-        }
-
-        charged = fee;
-
-        if (fee > 0) {
-            protocolFees += fee;
-            emit CrossTierFeePaid(
-                params.tokenId,
-                params.payer,
-                params.to,
-                fee,
-                /* isRegistration */
-                false
-            );
-        }
-
-        uint256 overpayment = msg.value - fee;
-        if (overpayment > 0) {
-            _creditRefund(params.payer, overpayment, params.tokenId);
-        }
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function release(uint256 tokenId) external override nonReentrant {
-        IDotnsRegistrarOld registrar = _registrar();
-
-        address currentOwner = registrar.ownerOf(tokenId);
-
-        ReleasePosition storage position = _positions[tokenId];
-        // Recipient is the canonical "is this position present?" sentinel; zero-amount positions
-        // seeded for cross-paid registrations are still releasable so every minted name has a
-        // reachable lifecycle.
-        require(position.recipient != address(0), DepositNotConfigured(tokenId));
-        require(!position.released, AlreadyReleased(tokenId));
-
-        // Position recipient mirrors the current NFT holder (rebound on every transfer), so the
-        // holder gate collapses to a single equality check. Approved operators cannot release on
-        // behalf of the holder because the recipient field is keyed to the holder, not to any
-        // approval set; this keeps the deposit refund flow tied to the on-chain owner.
-        require(
-            msg.sender == currentOwner && msg.sender == position.recipient,
-            NotRefundRecipient(msg.sender, tokenId)
-        );
-
-        bool approvedForEscrow = registrar.getApproved(tokenId) == address(this)
-            || registrar.isApprovedForAll(currentOwner, address(this));
-
-        require(approvedForEscrow, EscrowNotApproved(tokenId));
-
-        // Fail closed on an unseeded window rather than stamping `redeemableUntil` at the current
-        // timestamp, which would collapse the holder's exclusive redeem phase to zero length and
-        // open permissionless reclaim the instant the name is released. Only reachable on a proxy
-        // upgraded without pairing the upgrade with `updateRedeemWindow`.
-        uint256 currentRedeemWindow = redeemWindow;
-        require(currentRedeemWindow != 0, RedeemWindowNotConfigured());
-
-        // Snapshot the position fields once into stack locals so the trailing event emit reuses
-        // them without three extra warm SLOADs after the state mutation. Both casts to `uint64` are
-        // safe because `cooldown` and `redeemWindow` are bounded by @custom:constant MAX_COOLDOWN
-        // and @custom:constant MAX_REDEEM_WINDOW respectively.
-        address asset = position.asset;
-        uint256 amount = position.amount;
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint64 availableAt = uint64(block.timestamp + cooldown);
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint64 redeemUntil = uint64(block.timestamp + currentRedeemWindow);
-
-        position.withdrawAvailableAt = availableAt;
-        position.redeemableUntil = redeemUntil;
-        position.released = true;
-
-        registrar.safeTransferFrom(currentOwner, address(this), tokenId);
-
-        _addReleasedToken(tokenId);
-
-        emit NameReleased(tokenId, msg.sender, asset, amount, availableAt, redeemUntil);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function withdraw(uint256 tokenId) external override nonReentrant {
-        ReleasePosition storage position = _positions[tokenId];
-
-        require(position.released, NotReleased(tokenId));
-        require(!position.claimed, AlreadyClaimed(tokenId));
-        require(position.recipient == msg.sender, NotRefundRecipient(msg.sender, tokenId));
-        require(
-            block.timestamp >= position.withdrawAvailableAt,
-            WithdrawalTooEarly(tokenId, position.withdrawAvailableAt, block.timestamp)
-        );
-
-        _settleDeposit(position, tokenId, msg.sender);
-    }
-
-    /// @notice Moves a position's outstanding deposit onto the recipient's pull-payment balance.
-    /// @dev Shared by @custom:function withdraw, where the recipient pulls the deposit themselves,
-    ///      and by @custom:function reclaim, where a third party takes the name and the deposit is
-    ///      settled on the departing holder's behalf. Both credit the same ledger and neither
-    ///      transfers value, so the accounting is identical and lives here once. The per-asset
-    ///      `tokenReserved` pool backs the refund in full, and @custom:reverts InsufficientFunds
-    ///      when it cannot cover the amount owed. Emits @custom:emits RefundWithdrawn.
-    ///      A zero-amount position is a no-op: it writes nothing and emits nothing, which keeps the
-    ///      free-registration lifecycle free of meaningless ledger entries and events.
-    /// @param position Storage pointer to the position being settled.
-    /// @param recipient Address credited with the deposit. Always the position recipient.
-    function _settleDeposit(
-        ReleasePosition storage position,
-        uint256 tokenId,
-        address recipient
-    )
-        private
-    {
-        uint256 owed = position.amount;
-        address asset = position.asset;
-
-        // Nothing to settle: return before touching `claimed`. That flag is what `redeem` reads to
-        // decide whether the holder has already been paid for the name, so setting it here would
-        // make a zero-amount `withdraw`, which pays nothing and emits nothing, silently forfeit
-        // the holder's right to recover their own name for no consideration at all. Free PopFull
-        // and PopLite registrations seed exactly these positions, and `withdraw` is the step the
-        // old contract required before a name could be recycled, so that is a path holders will
-        // take.
-        if (owed == 0) return;
-
-        // Effects: from here the deposit really is being handed over, so the flag is set.
-        position.claimed = true;
-
-        // The per-asset reserve backs every refundable deposit; protocol fees are non-refundable
-        // and never cover a refund.
-        require(
-            tokenReserved[asset] >= owed, InsufficientFunds(tokenId, owed, tokenReserved[asset])
-        );
-
-        position.amount = 0;
-        tokenReserved[asset] -= owed;
-
-        _pendingWithdrawals[recipient] += owed;
-
-        emit RefundWithdrawn(tokenId, recipient, asset, owed);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function claimWithdrawal() external override nonReentrant returns (uint256 amount) {
-        amount = _pendingWithdrawals[msg.sender];
-        require(amount > 0, NoPendingWithdrawal());
-
-        // Effects before interaction.
-        _pendingWithdrawals[msg.sender] = 0;
-
-        (bool ok,) = payable(msg.sender).call{value: amount}("");
-        // tokenId is not meaningful here since a single pending balance can aggregate
-        // multiple positions; surface 0 to keep the existing error shape.
-        require(ok, RefundFailed(0));
-
-        emit WithdrawalClaimed(msg.sender, amount);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function pendingWithdrawal(address recipient) external view override returns (uint256 amount) {
-        amount = _pendingWithdrawals[recipient];
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function claimRefund(uint256 entryId) external override nonReentrant returns (uint256 amount) {
-        // Storage pointer over memory copy: only the fields we actually need are SLOAD-ed.
-        RefundEntry storage entry = _refundEntries[entryId];
-        amount = entry.amount;
-        // Check existence first so a deleted (already-claimed or unknown) entry surfaces a clear
-        // `NoSuchRefundEntry` rather than the recipient-mismatch revert that would otherwise fire
-        // against the zero-address sentinel.
-        require(amount > 0, NoSuchRefundEntry(entryId));
-        uint256 entryTokenId = entry.tokenId;
-        require(entry.recipient == msg.sender, NotRefundRecipient(msg.sender, entryTokenId));
-        require(block.timestamp >= entry.availableAt, RefundLocked(entryId, entry.availableAt));
-
-        _removeRefundEntry(entryId, msg.sender);
-
-        (bool ok,) = payable(msg.sender).call{value: amount}("");
-        require(ok, RefundFailed(entryTokenId));
-
-        emit RefundClaimed(msg.sender, entryId, amount);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function claimRefundsBatch(uint256[] calldata entryIds)
-        external
-        override
-        nonReentrant
-        returns (uint256 totalAmount)
-    {
-        uint256 length = entryIds.length;
-        require(length > 0 && length <= MAX_REFUND_PAGE_SIZE, InvalidPageSize(length));
-
-        for (uint256 i; i < length; ++i) {
-            uint256 entryId = entryIds[i];
-            RefundEntry storage entry = _refundEntries[entryId];
-            uint256 amount = entry.amount;
-            require(amount > 0, NoSuchRefundEntry(entryId));
-            require(entry.recipient == msg.sender, NotRefundRecipient(msg.sender, entry.tokenId));
-            require(block.timestamp >= entry.availableAt, RefundLocked(entryId, entry.availableAt));
-
-            totalAmount += amount;
-            _removeRefundEntry(entryId, msg.sender);
-
-            emit RefundClaimed(msg.sender, entryId, amount);
-        }
-
-        (bool ok,) = payable(msg.sender).call{value: totalAmount}("");
-        require(ok, RefundFailed(0));
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function pendingRefundCount(address recipient) external view override returns (uint256 count) {
-        count = _entriesByRecipient[recipient].length;
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function pendingRefundIds(
-        address recipient,
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (uint256[] memory entryIds)
-    {
-        require(limit > 0 && limit <= MAX_REFUND_PAGE_SIZE, InvalidPageSize(limit));
-
-        uint256[] storage all = _entriesByRecipient[recipient];
-        uint256 total = all.length;
-        if (offset >= total) return new uint256[](0);
-
-        uint256 end = offset + limit;
-        if (end > total) end = total;
-
-        entryIds = new uint256[](end - offset);
-        for (uint256 i = 0; i < entryIds.length; ++i) {
-            entryIds[i] = all[offset + i];
-        }
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function pendingRefunds(
-        address recipient,
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (uint256[] memory entryIds, RefundEntry[] memory entries)
-    {
-        require(limit > 0 && limit <= MAX_REFUND_PAGE_SIZE, InvalidPageSize(limit));
-
-        uint256[] storage all = _entriesByRecipient[recipient];
-        uint256 total = all.length;
-        if (offset >= total) {
-            return (new uint256[](0), new RefundEntry[](0));
-        }
-
-        uint256 end = offset + limit;
-        if (end > total) end = total;
-
-        uint256 count = end - offset;
-        entryIds = new uint256[](count);
-        entries = new RefundEntry[](count);
-        for (uint256 i = 0; i < count; ++i) {
-            uint256 entryId = all[offset + i];
-            entryIds[i] = entryId;
-            entries[i] = _refundEntries[entryId];
-        }
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function refundEntry(uint256 entryId)
-        external
-        view
-        override
-        returns (RefundEntry memory entry)
-    {
-        entry = _refundEntries[entryId];
-    }
-
-    /// @notice Internal helper: allocate a new entryId and credit a refund to `recipient`.
-    /// @dev Assigns the next monotonic entryId, stores the entry, appends to the recipient's
-    /// enumeration array, and emits @custom:emits RefundCredited. The cooldown is read from the
-    /// configured `cooldown` storage value; @custom:constant MAX_COOLDOWN bounds it so the cast to
-    /// `uint64` cannot truncate for any plausible block timestamp.
-    function _creditRefund(
-        address recipient,
-        uint256 amount,
-        uint256 tokenId
-    )
-        internal
-        returns (uint256 entryId)
-    {
-        require(recipient != address(0), InvalidRecipient());
-        require(amount > 0, InvalidAmount());
-
-        entryId = ++_nextEntryId;
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint64 availableAt = uint64(block.timestamp + cooldown);
-
-        _refundEntries[entryId] = RefundEntry({
-            recipient: recipient, amount: amount, availableAt: availableAt, tokenId: tokenId
-        });
-
-        uint256[] storage list = _entriesByRecipient[recipient];
-        list.push(entryId);
-        _entryIndexPlusOne[entryId] = list.length;
-
-        emit RefundCredited(recipient, entryId, amount, availableAt, tokenId);
-    }
-
-    /// @notice Internal helper: delete a refund entry and swap-pop its slot in the recipient's
-    ///         enumeration array.
-    function _removeRefundEntry(uint256 entryId, address recipient) internal {
-        uint256 indexPlusOne = _entryIndexPlusOne[entryId];
-        // Caller is expected to have validated existence already; defensive check kept cheap.
-        if (indexPlusOne == 0) return;
-
-        uint256 index = indexPlusOne - 1;
-        uint256[] storage list = _entriesByRecipient[recipient];
-        uint256 lastIndex = list.length - 1;
-
-        if (index != lastIndex) {
-            uint256 movedEntryId = list[lastIndex];
-            list[index] = movedEntryId;
-            _entryIndexPlusOne[movedEntryId] = indexPlusOne;
-        }
-        list.pop();
-
-        delete _entryIndexPlusOne[entryId];
-        delete _refundEntries[entryId];
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function reclaim(
-        uint256 tokenId,
-        address newOwner
-    )
-        external
-        override
-        onlyController
-        nonReentrant
-    {
-        require(isReclaimable(tokenId), NotReclaimable(tokenId));
-
-        ReleasePosition storage position = _positions[tokenId];
-        address previousRecipient = position.recipient;
-
-        // Settle before deleting: the departing holder keeps their claim on the deposit even though
-        // they are losing the name. `_settleDeposit` is a no-op for a zero-amount position and for
-        // one already withdrawn, so the common paths cost nothing extra.
-        _settleDeposit(position, tokenId, previousRecipient);
-
-        delete _positions[tokenId];
-        _removeReleasedToken(tokenId);
-
-        _registrar().safeTransferFrom(address(this), newOwner, tokenId);
-
-        emit NameReclaimed(tokenId, previousRecipient, newOwner);
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    /// @dev `public` rather than `external` so `reclaim` can gate on it without a self-call, which
-    ///      is what keeps the condition in one place instead of two.
-    function isReclaimable(uint256 tokenId) public view override returns (bool reclaimable) {
-        ReleasePosition storage position = _positions[tokenId];
-
-        // The gate is the elapsed redeem window, not the `claimed` flag. Gating on `claimed` would
-        // make recyclability depend on the previous holder choosing to withdraw, which strands the
-        // name whenever they have no reason to: a zero-amount position has nothing to collect, so
-        // "never withdraws" is the default rather than the exception. The window bounds the wait
-        // instead, and reclaim settles any unwithdrawn value rather than holding it hostage.
-        //
-        // Lifecycle state only. `reclaim` also settles the deposit, which can in principle revert
-        // `InsufficientFunds` when the reserved balance cannot cover the amount owed, so a true
-        // answer here is a claim about the window rather than a guarantee
-        // that the call is funded. The two coincide because `tokenReserved` is by construction the
-        // exact sum of live position amounts: only `deposit` credits it, and only `_settleDeposit`
-        // debits it, by exactly the amount it zeroes. `invariant_reserves_match_positions` holds
-        // that construction, and `invariant_reclaimable_positions_are_fundable` asserts the
-        // implication directly, so a change that broke the coincidence would fail the suite rather
-        // than surface as a name advertised and then unregisterable.
-        reclaimable = position.released && block.timestamp >= position.redeemableUntil;
-    }
-
-    /// @inheritdoc IDotnsNameEscrow
-    function redeem(uint256 tokenId) external override nonReentrant {
-        ReleasePosition storage position = _positions[tokenId];
-
-        require(position.recipient == msg.sender, NotRefundRecipient(msg.sender, tokenId));
-        // One error for the whole state predicate: unreleased, already withdrawn, or past the
-        // window are all simply "not redeemable" from the caller's point of view, and collapsing
-        // them avoids leaking a three-way state machine into the revert surface.
-        require(
-            position.released && !position.claimed && block.timestamp < position.redeemableUntil,
-            NotRedeemable(tokenId)
-        );
-
-        // Restore the pre-release state and nothing more. Recipient, asset and amount are left
-        // untouched so the deposit stays locked against the name; clearing the clocks means a later
-        // release starts a fresh pair rather than inheriting stale deadlines.
-        position.released = false;
-        position.withdrawAvailableAt = 0;
-        position.redeemableUntil = 0;
-
-        _removeReleasedToken(tokenId);
-
-        _registrar().safeTransferFrom(address(this), msg.sender, tokenId);
-
-        emit NameRedeemed(tokenId, msg.sender);
-    }
-
-    /// @inheritdoc IERC721Receiver
-    function onERC721Received(
-        address,
-        address,
-        uint256 tokenId,
-        bytes calldata
-    )
-        external
-        view
-        override
-        returns (bytes4 selector)
-    {
-        require(msg.sender == address(_registrar()), NotAcceptedTransfer(msg.sender));
-        // Only accept transfers that this contract itself initiated via `release`. A holder calling
-        // `registrar.safeTransferFrom(holder, escrow, tokenId)` directly would otherwise land the
-        // NFT in custody with no `released` position, leaving the token (and any prior deposit)
-        // permanently unreachable through `withdraw` / `reclaim`.
-        require(_positions[tokenId].released, UnsolicitedDeposit(tokenId));
-        selector = IERC721Receiver.onERC721Received.selector;
-    }
-
-    /// @inheritdoc ERC165Upgradeable
-    function supportsInterface(bytes4 interfaceId) public view override returns (bool supported) {
-        supported = interfaceId == type(IDotnsNameEscrow).interfaceId
-            || interfaceId == type(IERC721Receiver).interfaceId
-            || super.supportsInterface(interfaceId);
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @notice Returns the configured registrar from the protocol registry.
-    function _registrar() internal view returns (IDotnsRegistrarOld registrar) {
-        registrar = IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
-    }
-
-    /// @notice Restricts calls to the configured controller from the protocol registry.
-    function _onlyController() internal view {
-        address controller = protocolRegistry.get(DotnsConstantsOld.CONTROLLER);
-        require(msg.sender == controller, NotController(msg.sender));
-    }
-
-    /// @notice Restricts calls to the configured registrar from the protocol registry.
-    function _onlyRegistrar() internal view {
-        address registrar = protocolRegistry.get(DotnsConstantsOld.REGISTRAR);
-        require(msg.sender == registrar, NotRegistrar(msg.sender));
-    }
-
-    /// @notice Adds a token to the released-token set if absent.
-    function _addReleasedToken(uint256 tokenId) internal {
-        if (_releasedIndexPlusOne[tokenId] != 0) return;
-
-        _releasedTokens.push(tokenId);
-        _releasedIndexPlusOne[tokenId] = _releasedTokens.length;
-    }
-
-    /// @notice Removes a token from the released-token set if present.
-    function _removeReleasedToken(uint256 tokenId) internal {
-        uint256 indexPlusOne = _releasedIndexPlusOne[tokenId];
-        if (indexPlusOne == 0) return;
-
-        uint256 index = indexPlusOne - 1;
-        uint256 lastIndex = _releasedTokens.length - 1;
-
-        if (index != lastIndex) {
-            uint256 lastTokenId = _releasedTokens[lastIndex];
-            _releasedTokens[index] = lastTokenId;
-            _releasedIndexPlusOne[lastTokenId] = index + 1;
-        }
-
-        _releasedTokens.pop();
-        delete _releasedIndexPlusOne[tokenId];
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/pop/IDotnsCostModelRegistryOld.sol b/contracts/pop/IDotnsCostModelRegistryOld.sol
deleted file mode 100644
index 5d1d689a0..000000000
--- a/contracts/pop/IDotnsCostModelRegistryOld.sol
+++ /dev/null
@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {IDotnsPricingOld} from "./IDotnsPricingOld.sol";
-
-/// @title DotNS Cost Model Registry
-/// @notice Holds every cost model the protocol has run and names the current one.
-/// @dev The address registered under `DotnsConstantsOld.COST_MODEL` points here, set once and never
-///      repointed. Changing the live curve registers a new model, which adds its version and moves
-///      the current pointer. Prior models stay live and priceable by version, so a registration
-///      committed against an earlier curve settles at the amount it committed to.
-/// @custom:security-contact admin@parity.io
-interface IDotnsCostModelRegistryOld {
-    /// @notice Emitted when a model is registered and becomes current.
-    /// @param version The model's version identifier.
-    /// @param model The model address now serving that version.
-    event CostModelRegistered(uint256 indexed version, address indexed model);
-
-    /// @notice Emitted when the current version is pointed at an already-registered model.
-    /// @param version The version now serving fresh pricing.
-    event CurrentModelSet(uint256 indexed version);
-
-    /// @notice Thrown when registering a model whose version is already held.
-    /// @param version The version already registered.
-    error AlreadyRegistered(uint256 version);
-
-    /// @notice Thrown when pricing against a version that was never registered.
-    /// @param version The version with no registered model.
-    error UnknownVersion(uint256 version);
-
-    /// @notice Thrown when registering a model whose version is zero, which is the sentinel for
-    ///         an unregistered version and so cannot name a real model.
-    error ZeroVersion();
-
-    /// @notice Thrown when a registration reveals at a different version than it committed to.
-    /// @dev Raised where a commit-reveal flow binds a version at commit and checks it at reveal, so
-    ///      the version a name prices at cannot move after the commitment is made.
-    /// @param committed The version bound when the commitment was made.
-    /// @param revealed The version supplied at reveal.
-    error PricingVersionMismatch(uint256 committed, uint256 revealed);
-
-    /// @notice Registers a model and makes it current.
-    /// @dev Owner-only. Keys the model by its own `version`, so a version can be registered once;
-    ///      a repeat triggers @custom:reverts AlreadyRegistered. Moves the current pointer to the
-    ///      new version and emits @custom:emits CostModelRegistered.
-    /// @param model The cost model to register.
-    function register(IDotnsPricingOld model) external;
-
-    /// @notice Points the current version at an already-registered model.
-    /// @dev Owner-only. Reverts to a previously registered version without redeploying it, so
-    ///      governance can roll fresh pricing back to an earlier curve. @custom:reverts
-    ///      UnknownVersion when no model is registered for `version`. Emits @custom:emits
-    ///      CurrentModelSet.
-    /// @param version The already-registered version to make current.
-    function setCurrentVersion(uint256 version) external;
-
-    /// @notice Returns the model registered for a version, or the zero address when none.
-    /// @param version The version to look up.
-    /// @return model The model registered for that version.
-    function modelOf(uint256 version) external view returns (IDotnsPricingOld model);
-
-    /// @notice Returns the version currently serving fresh pricing.
-    /// @return version The current version identifier.
-    function currentVersion() external view returns (uint256 version);
-
-    /// @notice Returns the current model.
-    /// @return model The model serving the current version.
-    function current() external view returns (IDotnsPricingOld model);
-
-    /// @notice Prices a base length at the current version.
-    /// @param baseLength Digit-stripped length of the label being priced.
-    /// @return weiPrice Registration cost in wei at the current version.
-    function priceForBaseLength(uint256 baseLength) external view returns (uint256 weiPrice);
-
-    /// @notice Prices a base length at a specific version.
-    /// @dev @custom:reverts UnknownVersion when no model is registered for `version`.
-    /// @param version The version to price against.
-    /// @param baseLength Digit-stripped length of the label being priced.
-    /// @return weiPrice Registration cost in wei at that version.
-    function priceForBaseLengthAtVersion(
-        uint256 version,
-        uint256 baseLength
-    )
-        external
-        view
-        returns (uint256 weiPrice);
-}
diff --git a/contracts/pop/IDotnsPricingOld.sol b/contracts/pop/IDotnsPricingOld.sol
deleted file mode 100644
index 39b61094b..000000000
--- a/contracts/pop/IDotnsPricingOld.sol
+++ /dev/null
@@ -1,32 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-/// @title DotNS Pricing Cost Model
-/// @notice Prices a registration from the base length of its label alone.
-/// @dev The seam between name policy and the wei amount a registration costs. `PopRulesOld` and the
-///      public commit-reveal controller keep the classification, reservation, and tier rules; the
-///      model owns only the amount for a given base length, so the curve can be swapped by
-///      registering a new model under `DotnsConstantsOld.COST_MODEL` without touching either. Only
-/// the base length crosses the seam: the model reads no personhood band or `PopStatus`. The public
-///      controller prices NoStatus deposits through this same path, so the model carries no PoP
-///      name.
-/// @custom:security-contact admin@parity.io
-interface IDotnsPricingOld {
-    /// @notice Thrown when a model constructor parameter breaks a pricing invariant.
-    /// @param reason Human-readable explanation of the failed invariant.
-    error PricingError(string reason);
-
-    /// @notice Returns the registration cost in wei for a label of the given base length.
-    /// @dev Pure amount lookup: the caller supplies the digit-stripped base length and the model
-    ///      returns the curve value for it. Runs on the ERC721 transfer floor read, so it stays a
-    ///      view with no state writes.
-    /// @param baseLength Digit-stripped length of the label being priced.
-    /// @return weiPrice Registration cost in wei for that base length.
-    function priceForBaseLength(uint256 baseLength) external view returns (uint256 weiPrice);
-
-    /// @notice Returns a stable identifier for this model and its parameters.
-    /// @dev Changes when the model shape or its parameters change, so clients and telemetry can
-    ///      tell one live curve from another. Not consulted on the pricing path.
-    /// @return modelVersion Identifier derived from the model form and its parameters.
-    function version() external view returns (uint256 modelVersion);
-}
diff --git a/contracts/pop/IPopRulesOld.sol b/contracts/pop/IPopRulesOld.sol
new file mode 100644
index 000000000..cbe512ce7
--- /dev/null
+++ b/contracts/pop/IPopRulesOld.sol
@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+/// @title Proof of Personhood Rules for Dotns
+/// @notice Proof of personhood interface defining Dotns price calculation, PoP-tier requirements,
+///         and base-name reservation rules.
+/// @dev Classifies labels into the PoP tier required for registration and exposes reservation
+///      metadata. Every label is measured as written, except a gateway lite label, whose
+///      separator and allocated digits are removed first. Base length <= 5 is reserved for
+///      governance; 6-8 requires PopFull; >= 9 is open to every caller as NoStatus. PopLite is
+///      the separated form alone, so digits in an ordinary label carry no personhood meaning.
+///      Reservations are keyed by that same stem, so `joseph` and `joseph.42` share a slot while
+///      `joseph42` is an unrelated name.
+///
+///      Amounts come from the cost model registered under `DotnsConstants.COST_MODEL`, which owns
+///      the curve; only the base length crosses that seam. Every caller pays the same amount for a
+///      given length; personhood only unlocks the premium band.
+/// @custom:security-contact admin@parity.io
+interface IPopRulesOld {
+    /// @notice Proof-of-Personhood eligibility tier.
+    /// @dev `NoStatus` is the default for unverified users; `PopLite` and `PopFull` are the two
+    ///      personhood tiers; `Reserved` covers both governance-held names and base stems held by
+    ///      another user through the reservation table.
+    enum PopStatus {
+        NoStatus,
+        PopLite,
+        PopFull,
+        Reserved
+    }
+
+    /// @notice Emitted when a base name receives a reservation.
+    /// @param baseName The digit-stripped label receiving the reservation.
+    /// @param owner Address obtaining the reservation right.
+    /// @param expires UNIX timestamp when the reservation expires.
+    event BaseNameReserved(string indexed baseName, address indexed owner, uint64 expires);
+
+    /// @notice Emitted when the public market for names shorter than nine characters is opened or
+    ///         closed.
+    /// @dev Set by the Root-gated @custom:function setShortNamesEnabled.
+    /// @param enabled Whether names shorter than nine characters may now be bought.
+    event ShortNamesEnabledUpdated(bool enabled);
+
+    /// @notice Thrown when a name violates PoP-tier or reservation requirements.
+    /// @param reason Human-readable explanation of the failure condition.
+    error PopError(string reason);
+
+    /// @notice Thrown when @custom:function setShortNamesEnabled is called without a substrate
+    /// Root origin.
+    /// @dev Carries no caller parameter: a Root origin has no account to report, and reading
+    /// `msg.sender` under one traps.
+    error NotRoot();
+
+    /// @notice Thrown when a caller is not an authorised controller on the registrar.
+    error NotRegistry();
+
+    /// @notice Thrown when registering a name whose base stem is held as a live reservation by
+    /// another user.
+    /// @param label Caller-supplied label whose stem is reserved.
+    error NameReserved(string label);
+
+    /// @notice Thrown when registering a label that classifies as governance-reserved at the
+    /// protocol level.
+    /// @dev Distinct from @custom:reverts NameReserved so off-chain consumers can tell "wait for
+    /// the holder to relinquish" apart from "this label is permanently held by governance".
+    /// @param label Caller-supplied label that classifies as governance-reserved.
+    error GovernanceReserved(string label);
+
+    /// @notice Thrown on the cross-payer path when the owner's recorded PoP tier does not meet the
+    /// label's required tier. The direct path's `priceWithCheck` covers this same condition via its
+    /// own revert.
+    /// @param label Label whose tier requirement was unmet.
+    /// @param userStatus Owner's recorded tier.
+    /// @param required Required tier for the label.
+    error OwnerStatusInsufficient(string label, PopStatus userStatus, PopStatus required);
+
+    /// @notice Bundle returned from metadata-aware pricing queries.
+    /// @param price Registration cost from the current cost model for the label's base length.
+    /// @param status Required PoP tier for this name.
+    /// @param userStatus Current PoP status recorded for the querying user.
+    /// @param message Human-readable classification description.
+    struct PriceWithMeta {
+        uint256 price;
+        PopStatus status;
+        PopStatus userStatus;
+        string message;
+    }
+
+    /// @notice Reservation metadata for a base name (digits removed).
+    /// @param owner Address holding exclusive claim rights during the reservation window.
+    /// @param expires UNIX timestamp when the reservation expires.
+    /// @param controller Address that wrote the reservation; the only address permitted to release
+    /// it before expiry.
+    struct Reservation {
+        address owner;
+        uint64 expires;
+        address controller;
+    }
+
+    /// @notice Classifies a name into a required PoP tier per DotNS naming rules.
+    /// @dev Pure; inputs are the label bytes only. Callers use the returned tier to decide which
+    ///      pricing and verification branch applies. A label that is neither a single lowercase
+    ///      ASCII DNS label nor a lite label triggers @custom:reverts PopError; a trailing-digit
+    ///      suffix of any length is accepted and classified by the length it leaves.
+    /// @param name The name label being evaluated.
+    /// @return requirement Required tier for registration.
+    /// @return message Explanation of the classification result.
+    function classifyName(string calldata name)
+        external
+        pure
+        returns (PopStatus requirement, string memory message);
+
+    /// @notice Opens or closes the public market for names shorter than nine characters.
+    /// @dev Restricted to a substrate Root origin; any other caller triggers @custom:reverts
+    ///      NotRoot. Short names are otherwise issued through the PoP gateway, so this flag is the
+    ///      Root-only lever that additionally admits them on the public paid path.
+    ///      While closed, which is the deploy default, @custom:function priceWithCheck and
+    ///      @custom:function priceWithoutCheck trigger @custom:reverts PopError for a base length
+    ///      below nine, so no public caller buys a short name. The gateway free grant and the
+    ///      registrar's registerReserved path do not read this flag. Emits @custom:emits
+    ///      ShortNamesEnabledUpdated.
+    /// @param enabled Whether names shorter than nine characters may be bought.
+    function setShortNamesEnabled(bool enabled) external;
+
+    /// @notice Returns the personhood tier recorded for an account.
+    /// @dev Reads the account's dotns-scoped tier from the personhood precompile and maps it to a
+    ///      `PopStatus`. This is the direct account-tier read; the same tier otherwise surfaces
+    ///      only as the `userStatus` field of a pricing query. Never returns `Reserved`, so the
+    ///      result is one of `NoStatus`, `PopLite`, or `PopFull`.
+    /// @param account Address whose tier is read.
+    /// @return tier The account's personhood tier.
+    function personhoodOf(address account) external view returns (PopStatus tier);
+
+    /// @notice Creates or refreshes a reservation entry for a stem in the 6 to 8 band.
+    /// @dev Authorised-controller entry point: only a controller in the registrar's `controllers`
+    ///      set may call this, otherwise @custom:reverts NotRegistry. The gateway queue writes
+    ///      through @custom:function reserveBaseNameForPop and the public commit-reveal flow
+    ///      reads the slot rather than writing one, so this is the entry point for a sibling
+    ///      controller. Its length window bounds the stem and does not name a tier: PopLite is
+    ///      decided by the separated label shape. The caller passes the already-stripped stem; a
+    ///      non-canonical label, a trailing digit, or a length outside `[6, 8]` triggers
+    ///      @custom:reverts PopError. Cross-user collision on a live slot triggers @custom:reverts
+    ///      PopError so the caller cannot silently overwrite another user's reservation; same-user
+    ///      refresh and writes into an empty or expired slot emit @custom:emits BaseNameReserved.
+    /// @param stem The base label with no trailing digits.
+    /// @param user The address receiving reservation rights.
+    function reserveBaseName(string calldata stem, address user) external;
+
+    /// @notice Emitted when a base-name reservation is cleared.
+    /// @param baseName The base label whose reservation was released.
+    event BaseNameReleased(string indexed baseName);
+
+    /// @notice Writes or refreshes a reservation for a bare base-name stem.
+    /// @dev Gateway-driven reservation path used by the PoP controller. Only a controller in the
+    ///      registrar's `controllers` set may call this, otherwise @custom:reverts NotRegistry.
+    ///      Does not apply the lite-format length window that @custom:function reserveBaseName
+    ///      enforces, but does require the input to be canonical and stem-shaped (no trailing
+    ///      digits); a non-canonical or non-stem label triggers @custom:reverts PopError. If the
+    ///      slot is already live and held by a different user, @custom:reverts PopError so the
+    ///      caller's local bookkeeping and PopRulesOld state stay in lockstep; if it is live for the
+    ///      same user, expiry is refreshed to `block.timestamp + MAX_RESERVATION_TIME`. Emits
+    ///      @custom:emits BaseNameReserved on every successful write.
+    /// @param stem The base label with no trailing digits.
+    /// @param user The address receiving reservation rights.
+    function reserveBaseNameForPop(string calldata stem, address user) external;
+
+    /// @notice Clears a reservation for a base-name stem.
+    /// @dev Only a controller in the registrar's `controllers` set may call this, otherwise
+    ///      @custom:reverts NotRegistry. Non-canonical or non-stem labels trigger
+    ///      @custom:reverts PopError. Live reservations may only be cleared by the same controller
+    ///      that wrote them; another authorised controller attempting to clear a live slot triggers
+    ///      @custom:reverts PopError. Expired reservations may be cleared by any authorised
+    ///      controller as garbage collection. Used by the PoP controller when a reservation is
+    ///      claimed, relinquished, or a queue head promotion leaves the slot empty. Emits
+    ///      @custom:emits BaseNameReleased once the slot is cleared.
+    /// @param stem The base label whose reservation should be cleared (no trailing digits).
+    function releaseBaseName(string calldata stem) external;
+
+    /// @notice Clears a reservation when the slot owner matches `expectedOwner`, allowing any
+    ///         registrar-authorised controller (not only the stamping one) to release the slot.
+    /// @dev Narrower than @custom:function releaseBaseName: callers must prove they know the
+    ///      slot owner, so cross-controller release is gated on a positive match rather than on
+    ///      caller identity. Intended for the public registrar controller's reclaim path, where
+    ///      a prior occupant has handed the name back to escrow and the new registrant needs
+    ///      the cross-flow guard cleared regardless of which controller originally stamped it.
+    ///      Only a registrar-authorised controller may call this (@custom:reverts NotRegistry).
+    ///      Non-canonical or non-stem labels trigger @custom:reverts PopError. A live reservation
+    ///      whose owner does not match `expectedOwner` triggers @custom:reverts PopError; expired
+    ///      reservations are cleared regardless. Emits @custom:emits BaseNameReleased.
+    /// @param stem The base label whose reservation should be cleared (no trailing digits).
+    /// @param expectedOwner The address the caller expects to be the current reservation owner.
+    function releaseReservationForReclaim(string calldata stem, address expectedOwner) external;
+
+    /// @notice Retrieves reservation information for a base name.
+    /// @dev Raw accessor: returns the stored slot regardless of expiry. Use
+    ///      @custom:function isBaseNameReserved
+    ///      when live-window semantics are needed. Non-canonical labels trigger
+    ///      @custom:reverts PopError.
+    /// @param baseName The base label without trailing digits.
+    /// @return owner The address assigned to the reservation.
+    /// @return expires UNIX timestamp when the reservation expires.
+    function getBaseNameReservation(string calldata baseName)
+        external
+        view
+        returns (address owner, uint64 expires);
+
+    /// @notice Returns the reservation stem of a label: a lite label without its allocated
+    ///         suffix, or any other label unchanged.
+    /// @dev Mirrors the normalisation applied before a reservation is written, so callers can
+    ///      look up or release one by passing the full label. Only a lite label is shortened,
+    ///      because only the gateway allocates the digits it carries: `joseph.42` yields
+    ///      `joseph` while `joseph42` is an unrelated name and yields itself. Non-canonical
+    ///      labels trigger @custom:reverts PopError.
+    /// @param name Full label, lite or otherwise.
+    /// @return stem The reservation stem of `name`.
+    function stripDigits(string calldata name) external pure returns (string memory stem);
+
+    /// @notice Indicates whether a base name is currently reserved.
+    /// @dev Applies the live-window predicate to the stored slot so an expired reservation reads
+    ///      as free. Non-canonical labels trigger @custom:reverts PopError.
+    /// @param baseName The base label without trailing digits.
+    /// @return reservedStatus True if a live reservation is active.
+    /// @return owner The reservation holder (zero when not reserved).
+    /// @return expires UNIX timestamp when the reservation expires.
+    function isBaseNameReserved(string calldata baseName)
+        external
+        view
+        returns (bool reservedStatus, address owner, uint64 expires);
+
+    /// @notice Calculates price with PoP classification and reservation enforcement.
+    /// @dev Reverting pricing path used by the commit-reveal controller. Price is the scarcity
+    ///      curve for the label's base length and is charged to every caller, verified or not;
+    ///      personhood only unlocks the premium band. Non-canonical
+    ///      labels, a base stem held live by another user, a governance-reserved label, or a
+    ///      `userAddress` whose personhood tier does not meet the label's required tier each
+    ///      trigger @custom:reverts PopError.
+    /// @param name Domain label.
+    /// @param userAddress Registering user for the given label.
+    /// @return metadata Price with PoP requirements and classification.
+    function priceWithCheck(
+        string calldata name,
+        address userAddress
+    )
+        external
+        view
+        returns (PriceWithMeta memory metadata);
+
+    /// @notice Calculates price at a specific cost-model version with PoP classification and
+    ///         reservation enforcement.
+    /// @dev The versioned counterpart of @custom:function priceWithCheck: identical classification,
+    ///      tier gating, and reservation rules, but the amount comes from the model registered for
+    ///      `pricingVersionValue` rather than the current one. The commit-reveal controller prices
+    ///      a reveal at the version bound into its commitment, so a model change between commit and
+    ///      reveal does not move the amount. @custom:reverts UnknownVersion when the version was
+    ///      never registered.
+    /// @param name Domain label.
+    /// @param userAddress Registering user for the given label.
+    /// @param pricingVersionValue Cost-model version to price against.
+    /// @return metadata Price with PoP requirements and classification.
+    function priceWithCheckAtVersion(
+        string calldata name,
+        address userAddress,
+        uint256 pricingVersionValue
+    )
+        external
+        view
+        returns (PriceWithMeta memory metadata);
+
+    /// @notice Calculates price with PoP classification and reservation metadata, without
+    /// reverting on conflicts.
+    /// @dev Non-reverting counterpart to `priceWithCheck`: surfaces the same fields, but reports
+    ///      a `Reserved` status through `metadata` instead of reverting when the base stem is
+    ///      held by another user. Used by front-ends that need to present a price and eligibility
+    ///      preview without forcing a transaction attempt. Governance-reserved names are not
+    ///      rejected here either; the caller decides what to do. Non-canonical labels still
+    ///      trigger @custom:reverts PopError because the input is malformed rather than just
+    ///      contested.
+    /// @param name Domain label.
+    /// @param userAddress Registering user for the given label.
+    /// @return metadata Price with PoP requirements and classification.
+    function priceWithoutCheck(
+        string calldata name,
+        address userAddress
+    )
+        external
+        view
+        returns (PriceWithMeta memory metadata);
+
+    /// @notice Calculates price at a specific cost-model version with PoP classification and
+    ///         reservation metadata, without reverting on conflicts.
+    /// @dev The versioned counterpart of @custom:function priceWithoutCheck: same non-reverting
+    ///      preview behaviour, but the amount comes from the model registered for
+    ///      `pricingVersionValue`. @custom:reverts UnknownVersion when the version was never
+    ///      registered.
+    /// @param name Domain label.
+    /// @param userAddress Registering user for the given label.
+    /// @param pricingVersionValue Cost-model version to price against.
+    /// @return metadata Price with PoP requirements and classification.
+    function priceWithoutCheckAtVersion(
+        string calldata name,
+        address userAddress,
+        uint256 pricingVersionValue
+    )
+        external
+        view
+        returns (PriceWithMeta memory metadata);
+
+    /// @notice Transfer-time floor: the greater of the recipient-reach component and the
+    ///         sender-tier-downgrade component, each priced at the name's own length.
+    /// @dev Re-prices the name at its own length on every move: returns the name's curve price when
+    ///      either (i) the recipient does not meet the label's required tier, or (ii) the
+    ///      recipient's personhood tier is strictly below the sender's, and zero when neither
+    ///      holds. Passing a name to a wallet that could never have registered it therefore costs
+    ///      the name's own curve price. The two components overlap on pure
+    ///      tier mismatches, so the function takes their maximum rather than their sum to avoid
+    ///      double-charging. Consumed by @custom:function DotnsRegistrarOld.quoteTransferFee.
+    ///      A label that is neither a single lowercase ASCII DNS label nor a lite label triggers
+    ///      @custom:reverts PopError.
+    /// @param name Domain label being transferred.
+    /// @param from Current holder of the name.
+    /// @param to Incoming holder of the name.
+    /// @return floor Transfer-time floor in wei: the name's own curve price, or zero.
+    function transferFloor(
+        string calldata name,
+        address from,
+        address to
+    )
+        external
+        view
+        returns (uint256 floor);
+
+    /// @notice Returns whether `name` is a base name under PoP rules.
+    /// @dev A base name has no trailing digits, so it is what a reservation may be keyed by. A
+    ///      lite label always ends in two, so it is never a base name. Non-canonical labels
+    ///      trigger @custom:reverts PopError.
+    /// @param name The label to check.
+    /// @return isBase True when the label has no trailing digits.
+    function isBaseName(string calldata name) external pure returns (bool isBase);
+
+    /// @notice Calculates registration cost for a label.
+    /// @dev Prices the label by its base length through the cost model registered under
+    ///      `DotnsConstants.COST_MODEL`. Ignores the caller's personhood status and reservation
+    ///      state. A non-canonical label triggers @custom:reverts PopError. An ordinary label is
+    ///      priced as written; only a lite label's allocated suffix is removed first.
+    /// @param name Domain label to price.
+    /// @return cost Registration cost in wei.
+    function price(string calldata name) external view returns (uint256 cost);
+
+    /// @notice Returns the current cost-model version.
+    /// @dev The current version held by the registry under `DotnsConstants.COST_MODEL`. The
+    ///      commit-reveal controller binds it into a commitment and prices the reveal at that
+    ///      version, so a model change between commit and reveal leaves the committed amount
+    ///      unchanged. @custom:reverts PopError when no registry is configured.
+    /// @return modelVersion Identifier of the current cost model and its parameters.
+    function pricingVersion() external view returns (uint256 modelVersion);
+}
diff --git a/contracts/pop/PopRulesOld.sol b/contracts/pop/PopRulesOld.sol
index de528afd4..49bc3bfbe 100644
--- a/contracts/pop/PopRulesOld.sol
+++ b/contracts/pop/PopRulesOld.sol
@@ -9,14 +9,14 @@ import {
 import {
     ERC165Upgradeable
 } from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
-import {IPopRules} from "./IPopRules.sol";
-import {IDotnsCostModelRegistryOld} from "./IDotnsCostModelRegistryOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
+import {StringUtilsOld} from "../utils/StringUtilsOld.sol";
+import {SystemUtils} from "../utils/SystemUtils.sol";
+import {IPopRulesOld} from "./IPopRulesOld.sol";
+import {IDotnsCostModelRegistry} from "./IDotnsCostModelRegistry.sol";
+import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {IDotnsController} from "../registrars/IDotnsController.sol";
 import {DotnsRegistrarOld} from "../registrars/DotnsRegistrarOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
+import {DotnsConstants} from "../utils/DotnsConstants.sol";
 import {IPersonhood} from "../external/personhood/IPersonhood.sol";
 
 /// @title PopRulesOld
@@ -28,7 +28,7 @@ import {IPersonhood} from "../external/personhood/IPersonhood.sol";
 ///      lengths >= 9 are open to any caller as NoStatus. PopLite is the separated form alone: a
 ///      digit suffix on an ordinary label says nothing about personhood.
 ///      Every caller pays the same amount for a given base length. The amount comes from the cost
-///      model registered under `DotnsConstantsOld.COST_MODEL`, which owns the curve; this contract
+///      model registered under `DotnsConstants.COST_MODEL`, which owns the curve; this contract
 ///      passes it only the base length and keeps the classification, reservation, and tier rules.
 ///      Personhood only unlocks the premium band. Base lengths below nine are closed to the public
 ///      paid path until Root sets `shortNamesEnabled`; the gateway and registerReserved do
@@ -39,9 +39,9 @@ contract PopRulesOld is
     UUPSUpgradeable,
     OwnableUpgradeable,
     ERC165Upgradeable,
-    IPopRules
+    IPopRulesOld
 {
-    using StringUtils for *;
+    using StringUtilsOld for *;
 
     /// @notice Active reservations keyed by stem.
     mapping(string baseName => Reservation reservation) public reservations;
@@ -50,7 +50,7 @@ contract PopRulesOld is
     uint256 public constant MAX_RESERVATION_TIME = 12 weeks;
 
     /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
+    IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Whether the public paid path may register names shorter than nine characters.
     ///         Closed by default; only governance opens it.
@@ -73,25 +73,26 @@ contract PopRulesOld is
     /// @notice Initialises the oracle (public entry point).
     /// @dev Runs once behind the proxy; subsequent calls trigger @custom:reverts
     ///      InvalidInitialization via the `initializer` modifier. Amounts come from the cost model
-    ///      registered under `DotnsConstantsOld.COST_MODEL`, so no price is seeded here.
+    ///      registered under `DotnsConstants.COST_MODEL`, so no price is seeded here.
+    /// @param initialOwner Address that owns the contract once initialised.
     /// @param registry Protocol-level address registry used to resolve sibling contracts.
-    function initialize(IDotnsProtocolRegistryOld registry) public initializer {
-        __Ownable_init(msg.sender);
+    function initialize(address initialOwner, IDotnsProtocolRegistry registry) public initializer {
+        __Ownable_init(initialOwner);
         __ERC165_init();
         protocolRegistry = registry;
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function setShortNamesEnabled(bool enabled) external override {
         // Opening the short-name band to the public path is a governance decision, so it is gated
         // on a substrate Root origin rather than the owner. `msg.sender` is deliberately not read:
         // a Root origin has no account behind it, so reading it would trap.
-        require(SystemUtilsOld.originIsRoot(), NotRoot());
+        require(SystemUtils.originIsRoot(), NotRoot());
         shortNamesEnabled = enabled;
         emit ShortNamesEnabledUpdated(enabled);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function classifyName(string calldata name)
         external
         pure
@@ -102,7 +103,7 @@ contract PopRulesOld is
         (requirement, message,) = _classifyValidatedName(name);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function reserveBaseName(
         string calldata stem,
         address userAddress
@@ -120,14 +121,14 @@ contract PopRulesOld is
         _writeReservation(stem, userAddress);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function isBaseName(string calldata baseName) external pure override returns (bool isBase) {
         _requireLabel(baseName);
         uint256 digits = _countTrailingDigits(baseName);
         return digits == 0;
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function getBaseNameReservation(string calldata baseName)
         external
         view
@@ -139,7 +140,7 @@ contract PopRulesOld is
         return (reserved.owner, reserved.expires);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function isBaseNameReserved(string calldata baseName)
         external
         view
@@ -151,7 +152,7 @@ contract PopRulesOld is
         return (_isLive(reservation), reservation.owner, reservation.expires);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function priceWithCheck(
         string calldata name,
         address userAddress
@@ -164,7 +165,7 @@ contract PopRulesOld is
         return _priceWithCheck(name, userAddress, false, 0);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function priceWithCheckAtVersion(
         string calldata name,
         address userAddress,
@@ -178,7 +179,7 @@ contract PopRulesOld is
         return _priceWithCheck(name, userAddress, true, pricingVersionValue);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function priceWithoutCheck(
         string calldata name,
         address userAddress
@@ -191,7 +192,7 @@ contract PopRulesOld is
         return _priceWithoutCheck(name, userAddress, false, 0);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function priceWithoutCheckAtVersion(
         string calldata name,
         address userAddress,
@@ -273,24 +274,24 @@ contract PopRulesOld is
 
         if (_isLive(reservation) && reservation.owner != userAddress) {
             metadata.message = "Base name reserved for original Lite registrant";
-            metadata.status = IPopRules.PopStatus.Reserved;
+            metadata.status = IPopRulesOld.PopStatus.Reserved;
         }
 
         return metadata;
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function price(string calldata name) external view override returns (uint256) {
         _requireLabel(name);
         return _priceValidatedName(_validatedBaseLength(name));
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function pricingVersion() external view override returns (uint256 modelVersion) {
         return _costModelRegistry().currentVersion();
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function transferFloor(
         string calldata name,
         address from,
@@ -317,7 +318,7 @@ contract PopRulesOld is
         return reachComponent > downgradeComponent ? reachComponent : downgradeComponent;
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function personhoodOf(address account) external view override returns (PopStatus tier) {
         return _personhoodTier(account);
     }
@@ -330,8 +331,8 @@ contract PopRulesOld is
     ///      collapses to `NoStatus` so a future tier addition fails closed instead of
     ///      silently being treated as a higher level than it actually is.
     function _personhoodTier(address account) private view returns (PopStatus) {
-        IPersonhood.PersonhoodInfo memory info = IPersonhood(DotnsConstantsOld.PERSONHOOD)
-            .personhoodStatus(account, DotnsConstantsOld.PERSONHOOD_CONTEXT);
+        IPersonhood.PersonhoodInfo memory info = IPersonhood(DotnsConstants.PERSONHOOD)
+            .personhoodStatus(account, DotnsConstants.PERSONHOOD_CONTEXT);
         if (info.status == 2) return PopStatus.PopFull;
         if (info.status == 1) return PopStatus.PopLite;
         return PopStatus.NoStatus;
@@ -372,13 +373,13 @@ contract PopRulesOld is
         return _costModelRegistry().priceForBaseLengthAtVersion(pricingVersionValue, baseLength);
     }
 
-    /// @notice Resolves the cost-model registry registered under `DotnsConstantsOld.COST_MODEL`.
+    /// @notice Resolves the cost-model registry registered under `DotnsConstants.COST_MODEL`.
     /// @dev @custom:reverts PopError when no registry is configured, so a pricing read fails closed
     ///      rather than resolving through the zero address.
-    function _costModelRegistry() private view returns (IDotnsCostModelRegistryOld registry) {
-        address configured = protocolRegistry.get(DotnsConstantsOld.COST_MODEL);
+    function _costModelRegistry() private view returns (IDotnsCostModelRegistry registry) {
+        address configured = protocolRegistry.get(DotnsConstants.COST_MODEL);
         require(configured != address(0), PopError("Cost model not configured"));
-        return IDotnsCostModelRegistryOld(configured);
+        return IDotnsCostModelRegistry(configured);
     }
 
     /// @notice Reverts a public paid registration of a base length below nine while the short-name
@@ -401,7 +402,7 @@ contract PopRulesOld is
     function _stemEnd(string calldata name) private pure returns (uint256 stemEnd) {
         stemEnd = bytes(name).length;
         if (!name.isLitePersonLabel()) return stemEnd;
-        return stemEnd - StringUtils.LITE_SUFFIX_DIGITS - 1;
+        return stemEnd - StringUtilsOld.LITE_SUFFIX_DIGITS - 1;
     }
 
     /// @notice The base length that pricing and classification both use to place a name in its
@@ -525,25 +526,30 @@ contract PopRulesOld is
         override
         returns (bool supported)
     {
-        return interfaceId == type(IPopRules).interfaceId || super.supportsInterface(interfaceId);
+        return interfaceId == type(IPopRulesOld).interfaceId || super.supportsInterface(interfaceId);
     }
 
     /// @inheritdoc UUPSUpgradeable
     function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
 
-    /// @notice Returns implementation version.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
+    /// @notice Returns the release this network declares it runs, read live from the protocol
+    ///         registry so every DotNS contract reports one synchronised value.
+    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
+    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
+    ///      not this contract's build; per-contract identity is the codehash declared on the
+    ///      registry.
+    /// @return versionString Declared release as bare semver, empty when never declared.
+    function version() external view virtual returns (string memory versionString) {
+        versionString = protocolRegistry.protocolVersion();
     }
 
     /// @notice Ensures the caller is any controller authorised on the registrar.
     function _onlyRegistry() internal view {
-        DotnsRegistrarOld registrar =
-            DotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+        DotnsRegistrarOld registrar = DotnsRegistrarOld(protocolRegistry.get(DotnsConstants.REGISTRAR));
         require(registrar.controllers(IDotnsController(msg.sender)), NotRegistry());
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function reserveBaseNameForPop(
         string calldata stem,
         address userAddress
@@ -560,13 +566,13 @@ contract PopRulesOld is
         _writeReservation(stem, userAddress);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function stripDigits(string calldata name) external pure override returns (string memory stem) {
         _requireLabel(name);
         return _stripDigits(name);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function releaseBaseName(string calldata stem) external override onlyRegistry {
         _requireStem(stem);
         require(
@@ -588,7 +594,7 @@ contract PopRulesOld is
         emit BaseNameReleased(stem);
     }
 
-    /// @inheritdoc IPopRules
+    /// @inheritdoc IPopRulesOld
     function releaseReservationForReclaim(
         string calldata stem,
         address expectedOwner
diff --git a/contracts/registrars/DotnsPopControllerOld.sol b/contracts/registrars/DotnsPopControllerOld.sol
index d6bca3a2f..ff14e642c 100644
--- a/contracts/registrars/DotnsPopControllerOld.sol
+++ b/contracts/registrars/DotnsPopControllerOld.sol
@@ -13,20 +13,20 @@ import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 
 import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 
-import {IDotnsPopController} from "./IDotnsPopController.sol";
-import {IDotnsRegistrarOld} from "./IDotnsRegistrarOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {IDotnsPopResolver} from "../resolvers/IDotnsPopResolver.sol";
-import {IPopRules} from "../pop/IPopRules.sol";
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
+import {IDotnsPopControllerOld} from "./IDotnsPopControllerOld.sol";
+import {IDotnsRegistrar} from "./IDotnsRegistrar.sol";
+import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
+import {IDotnsPopResolverOld} from "../resolvers/IDotnsPopResolverOld.sol";
+import {IPopRulesOld} from "../pop/IPopRulesOld.sol";
+import {IStoreFactory} from "../store/IStoreFactory.sol";
 import {ILabelStore} from "../store/ILabelStore.sol";
 import {LabelUtils} from "../utils/LabelUtils.sol";
-import {RegistrationUtilsOld} from "../utils/RegistrationUtilsOld.sol";
+import {RegistrationUtils} from "../utils/RegistrationUtils.sol";
 import {SubnodeUtilsOld} from "../utils/SubnodeUtilsOld.sol";
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
+import {IDotnsRegistry} from "../registry/IDotnsRegistry.sol";
+import {StringUtilsOld} from "../utils/StringUtilsOld.sol";
+import {DotnsConstants} from "../utils/DotnsConstants.sol";
+import {SystemUtils} from "../utils/SystemUtils.sol";
 
 /// @title DotnsPopControllerOld
 /// @notice Dedicated PoP controller orchestrating lite-person and full-person username
@@ -38,7 +38,7 @@ import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
 /// Enforcement:
 /// Personhood is attested off-chain by the gateway before the call reaches this
 /// contract, so the on-chain personhood precompile is not re-queried on the gateway path.
-/// Every base-label mint path still calls @custom:function IPopRules.classifyName to reject
+/// Every base-label mint path still calls @custom:function IPopRulesOld.classifyName to reject
 /// governance-reserved labels (@custom:reverts InvalidBaseLabel on the base path,
 /// @custom:reverts InvalidLiteLabel on the lite path). The lite leg accepts any two-digit lite
 /// label whose stem is not governance-reserved, regardless of stem length. Native-token pricing
@@ -56,19 +56,19 @@ import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
 /// contend for the same label. This holds of labels the contracts minted, not of an arbitrary
 /// string: a subname stored under a digit-only parent reads the same way, which is why
 /// provenance is published through @custom:function isPopIssued rather than inferred.
-/// (2) Base-name reservations are synchronised into `IPopRules`. The head of this
-/// controller's reservation queue is written through `IPopRules.reserveBaseNameForPop` on
-/// every head transition; the slot is cleared through `IPopRules.releaseBaseName` when the
+/// (2) Base-name reservations are synchronised into `IPopRulesOld`. The head of this
+/// controller's reservation queue is written through `IPopRulesOld.reserveBaseNameForPop` on
+/// every head transition; the slot is cleared through `IPopRulesOld.releaseBaseName` when the
 /// queue empties (claim, final relinquish, final expiry). The public commit-reveal
-/// controller routes through `IPopRules.priceWithCheck`, which rejects any registration
+/// controller routes through `IPopRulesOld.priceWithCheck`, which rejects any registration
 /// targeting a base-name stem reserved for another user, so the public flow respects
 /// gateway reservations without ever importing this contract. PopRulesOld is the single
 /// cross-flow authority; the queue here is the intra-PoP ordering layer on top of it.
 ///
 /// Shared primitives: labelhash / namehash via @custom:contract LabelUtils; the mint +
-/// forward-registry + store-write triad via @custom:contract RegistrationUtilsOld; chat-key and
+/// forward-registry + store-write triad via @custom:contract RegistrationUtils; chat-key and
 /// lite-to-full link persistence via
-/// @custom:contract IDotnsPopResolver. Keeping per-name records on the resolver preserves the
+/// @custom:contract IDotnsPopResolverOld. Keeping per-name records on the resolver preserves the
 /// "Store = labels only" invariant.
 /// @custom:security-contact admin@parity.io
 contract DotnsPopControllerOld is
@@ -76,9 +76,9 @@ contract DotnsPopControllerOld is
     UUPSUpgradeable,
     OwnableUpgradeable,
     ERC165Upgradeable,
-    IDotnsPopController
+    IDotnsPopControllerOld
 {
-    using StringUtils for *;
+    using StringUtilsOld for *;
     using EnumerableSet for EnumerableSet.AddressSet;
 
     /// @notice Upper bound for the number of simultaneously queued reservations per label.
@@ -91,13 +91,13 @@ contract DotnsPopControllerOld is
     uint64 public constant MIN_RESERVATION_DURATION = 1 hours;
 
     /// @notice Required byte length for a non-empty chat key.
-    /// @dev Mirrors @custom:contract IDotnsPopResolver `InvalidChatKeyLength` so the controller
+    /// @dev Mirrors @custom:contract IDotnsPopResolverOld `InvalidChatKeyLength` so the controller
     /// can fail closed before the mint instead of bubbling the resolver's revert after partial
     /// state has been committed.
     uint256 private constant CHAT_KEY_LENGTH = 65;
 
     /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
+    IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Per-label queue metadata (head/tail pointers).
     mapping(bytes32 labelhash => ReservationQueueMeta meta) internal _reservationMeta;
@@ -165,8 +165,10 @@ contract DotnsPopControllerOld is
     /// call outside an active initialiser scope reverts with @custom:reverts NotInitializing.
     /// Emits @custom:emits ReservationDurationSet so indexers observe the initial value
     /// through the same event the setter uses later.
+    /// @param initialOwner Address that owns the contract once initialised.
     function initialize(
-        IDotnsProtocolRegistryOld registry,
+        address initialOwner,
+        IDotnsProtocolRegistry registry,
         uint64 reservationDuration_
     )
         external
@@ -176,26 +178,26 @@ contract DotnsPopControllerOld is
             reservationDuration_ >= MIN_RESERVATION_DURATION,
             ReservationDurationTooLow(reservationDuration_)
         );
-        __Ownable_init(msg.sender);
+        __Ownable_init(initialOwner);
         __ERC165_init();
         protocolRegistry = registry;
         reservationDuration = reservationDuration_;
         emit ReservationDurationSet(reservationDuration_);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function isPopIssued(string calldata label) external view override returns (bool issued) {
         return _popIssued[label];
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reserveLiteName(LiteRegistration calldata params) external override onlyRoot {
         _reserveLite(_popRules(), params);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reserveBaseName(BaseReservation calldata params) external override onlyRoot {
-        IPopRules rules = _popRules();
+        IPopRulesOld rules = _popRules();
         bytes32 reservedHash;
         bool hasReservation = bytes(params.reservedBaseLabel).length != 0;
         if (hasReservation) {
@@ -211,9 +213,9 @@ contract DotnsPopControllerOld is
         }
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reserveBaseNameOnly(BaseNameReservation calldata params) external override onlyRoot {
-        IPopRules rules = _popRules();
+        IPopRulesOld rules = _popRules();
         (bytes32 reservedHash,) = _validateReservableBaseLabel(rules, params.reservedBaseLabel);
         _advanceExpiredHead(reservedHash);
         _removeUserFromQueue(params.user);
@@ -231,15 +233,15 @@ contract DotnsPopControllerOld is
     /// Takes the @custom:struct LiteRegistration struct directly so both call sites pass the same
     /// payload shape: the typed entrypoint forwards its own `params`, the `reserveBaseName`
     /// entrypoint forwards `params.lite`.
-    function _reserveLite(IPopRules rules, LiteRegistration calldata params) internal {
+    function _reserveLite(IPopRulesOld rules, LiteRegistration calldata params) internal {
         require(params.liteLabel.isLitePersonLabel(), InvalidLiteLabel());
         _requireValidChatKey(params.chatKey);
 
-        (IPopRules.PopStatus required,) = rules.classifyName(params.liteLabel);
+        (IPopRulesOld.PopStatus required,) = rules.classifyName(params.liteLabel);
         // The shape check fixes the suffix, so classification lands on PopLite (stem 6-8),
         // NoStatus (stem 9 or more), or Reserved (stem 5 or fewer). Accept the first two; a
         // stem short enough to be governance-reserved is not issued from this path.
-        require(required != IPopRules.PopStatus.Reserved, InvalidLiteLabel());
+        require(required != IPopRulesOld.PopStatus.Reserved, InvalidLiteLabel());
         (bytes32 labelhash, bytes32 node) = _validateLiteLabel(params.liteLabel);
 
         _completeGatewayRegistration(
@@ -249,7 +251,7 @@ contract DotnsPopControllerOld is
         emit LiteNameReserved(labelhash, params.user, params.liteLabel);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function registerBaseName(FullRegistration calldata params) external override onlyRoot {
         Link calldata link = params.link;
         address user = params.user;
@@ -257,10 +259,10 @@ contract DotnsPopControllerOld is
 
         (bytes32 labelhash, bytes32 node) = _validateBaseLabel(label);
 
-        IPopRules rules = _popRules();
-        (IPopRules.PopStatus required,) = rules.classifyName(label);
+        IPopRulesOld rules = _popRules();
+        (IPopRulesOld.PopStatus required,) = rules.classifyName(label);
         require(
-            required != IPopRules.PopStatus.Reserved && required != IPopRules.PopStatus.PopLite,
+            required != IPopRulesOld.PopStatus.Reserved && required != IPopRulesOld.PopStatus.PopLite,
             InvalidBaseLabel()
         );
 
@@ -325,13 +327,13 @@ contract DotnsPopControllerOld is
         }
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function expireReservation(string calldata reservedBaseLabel) external override {
         (bytes32 labelhash,) = _validateBaseLabel(reservedBaseLabel);
         _advanceExpiredHead(labelhash);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function relinquishReservation() external override {
         UserReservation memory userRes = _userReservations[msg.sender];
         require(userRes.labelhash != bytes32(0), NoActiveReservation(msg.sender));
@@ -339,12 +341,12 @@ contract DotnsPopControllerOld is
         emit ReservationRelinquished(userRes.labelhash, msg.sender);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function claimLabelStore() external override returns (bool moreRemaining) {
-        (, moreRemaining) = _settlePending(msg.sender, DotnsConstantsOld.MAX_PAGE_SIZE);
+        (, moreRemaining) = _settlePending(msg.sender, DotnsConstants.MAX_PAGE_SIZE);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function settlePendingClaims(
         address user,
         uint256 limit
@@ -367,7 +369,7 @@ contract DotnsPopControllerOld is
         internal
         returns (uint256 settledCount, bool moreRemaining)
     {
-        IStoreFactoryOld factory = _storeFactory();
+        IStoreFactory factory = _storeFactory();
         address store = factory.getLabelStore(user);
 
         PendingClaim[] storage queue = _pendingClaimQueue[user];
@@ -396,7 +398,7 @@ contract DotnsPopControllerOld is
     /// empty queue never leaves a fresh store behind with nothing in it. Returns the (possibly
     /// newly deployed) store so the caller threads it through the remaining entries.
     function _settlePendingLabel(
-        IStoreFactoryOld factory,
+        IStoreFactory factory,
         address store,
         address user,
         string memory label
@@ -419,7 +421,7 @@ contract DotnsPopControllerOld is
         return store;
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function isReservedForClaim(string calldata reservedBaseLabel)
         external
         view
@@ -437,14 +439,14 @@ contract DotnsPopControllerOld is
         return (true, head.owner);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function setReservationDuration(uint64 duration) external override onlyOwner {
         require(duration >= MIN_RESERVATION_DURATION, ReservationDurationTooLow(duration));
         reservationDuration = duration;
         emit ReservationDurationSet(duration);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reservationMeta(bytes32 labelhash)
         external
         view
@@ -455,7 +457,7 @@ contract DotnsPopControllerOld is
         return (meta.head, meta.tail);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reservationEntry(
         bytes32 labelhash,
         uint64 index
@@ -469,7 +471,7 @@ contract DotnsPopControllerOld is
         return (entry.owner, entry.joinedAt);
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function userReservation(address user)
         external
         view
@@ -479,7 +481,7 @@ contract DotnsPopControllerOld is
         return _userReservations[user];
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function pendingClaims(
         address user,
         uint256 offset,
@@ -496,7 +498,7 @@ contract DotnsPopControllerOld is
 
         uint256 available = total - offset;
         uint256 count = limit < available ? limit : available;
-        if (count > DotnsConstantsOld.MAX_PAGE_SIZE) count = DotnsConstantsOld.MAX_PAGE_SIZE;
+        if (count > DotnsConstants.MAX_PAGE_SIZE) count = DotnsConstants.MAX_PAGE_SIZE;
 
         claims = new PendingClaim[](count);
         for (uint256 i; i < count; ++i) {
@@ -504,17 +506,17 @@ contract DotnsPopControllerOld is
         }
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function pendingClaimCountOf(address user) external view override returns (uint256 count) {
         return _pendingClaimQueue[user].length;
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function pendingClaimUserCount() external view override returns (uint256 count) {
         return _pendingClaimUsers.length();
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function pendingClaimUsers(
         uint256 offset,
         uint256 limit
@@ -529,7 +531,7 @@ contract DotnsPopControllerOld is
 
         uint256 available = total - offset;
         uint256 count = limit < available ? limit : available;
-        if (count > DotnsConstantsOld.MAX_PAGE_SIZE) count = DotnsConstantsOld.MAX_PAGE_SIZE;
+        if (count > DotnsConstants.MAX_PAGE_SIZE) count = DotnsConstants.MAX_PAGE_SIZE;
 
         users = new address[](count);
         for (uint256 i; i < count; ++i) {
@@ -537,7 +539,7 @@ contract DotnsPopControllerOld is
         }
     }
 
-    /// @inheritdoc IDotnsPopController
+    /// @inheritdoc IDotnsPopControllerOld
     function reservedBaseLabelOf(bytes32 labelhash)
         external
         view
@@ -554,25 +556,30 @@ contract DotnsPopControllerOld is
         override(ERC165Upgradeable, IERC165)
         returns (bool)
     {
-        return interfaceId == type(IDotnsPopController).interfaceId
+        return interfaceId == type(IDotnsPopControllerOld).interfaceId
             || super.supportsInterface(interfaceId);
     }
 
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
+    /// @notice Returns the release this network declares it runs, read live from the protocol
+    ///         registry so every DotNS contract reports one synchronised value.
+    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
+    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
+    ///      not this contract's build; per-contract identity is the codehash declared on the
+    ///      registry.
+    /// @return versionString Declared release as bare semver, empty when never declared.
+    function version() external view virtual returns (string memory versionString) {
+        versionString = protocolRegistry.protocolVersion();
     }
 
     /// @notice Mints a name, wires forward registry, persists PoP-flow records (chat key,
     /// lite link) on the PoP resolver, and either writes the label into the owner's
     /// existing `LabelStore` or stashes a pending claim when the owner has none yet.
     /// @dev The mint + forward-registry pair is delegated to
-    /// @custom:function RegistrationUtilsOld.registerAndStore so this flow and the public
+    /// @custom:function RegistrationUtils.registerAndStore so this flow and the public
     /// commit-reveal flow share exactly one implementation of that sequence. The label is
     /// passed empty so the registrar does not deploy a `LabelStore`; the mint origin cannot
     /// run the `LabelStore` constructor. PoP-flow per-name records
-    /// (chat key, lite link) are persisted eagerly on @custom:contract IDotnsPopResolver
+    /// (chat key, lite link) are persisted eagerly on @custom:contract IDotnsPopResolverOld
     /// here, before the label is written, so the resolver carries the full identity record
     /// from mint time regardless of whether the owner already has a `LabelStore`. The Store
     /// stays labels-only. Warm path emits @custom:emits NameRegistered immediately; the
@@ -613,8 +620,8 @@ contract DotnsPopControllerOld is
                 })
             );
         } else {
-            RegistrationUtilsOld.registerAndStore(
-                RegistrationUtilsOld.RegistrationContext({
+            RegistrationUtils.registerAndStore(
+                RegistrationUtils.RegistrationContext({
                     protocolRegistry: protocolRegistry,
                     user: user,
                     label: "",
@@ -625,7 +632,7 @@ contract DotnsPopControllerOld is
         }
 
         if (chatKeyBytes.length != 0 || liteLabelhash != bytes32(0)) {
-            IDotnsPopResolver resolver = _popResolver();
+            IDotnsPopResolverOld resolver = _popResolver();
             if (chatKeyBytes.length != 0) {
                 resolver.setChatKey(node, chatKeyBytes);
             }
@@ -685,7 +692,7 @@ contract DotnsPopControllerOld is
     /// its existing `priceWithCheck` guard. Subsequent waiters only live in the local queue
     /// until they are promoted.
     function _enqueueReservation(
-        IPopRules rules,
+        IPopRulesOld rules,
         bytes32 labelhash,
         string memory baseLabel,
         address user
@@ -821,7 +828,7 @@ contract DotnsPopControllerOld is
 
     /// @notice Validates a base (full-person) label and derives `(labelhash, node)`.
     /// @dev Letters only, so this is stricter than a DNS label: a hyphen or an interior digit
-    /// is rejected here even though @custom:function StringUtils.isSingleLabel would admit it.
+    /// is rejected here even though @custom:function StringUtilsOld.isSingleLabel would admit it.
     function _validateBaseLabel(string calldata baseLabel)
         internal
         view
@@ -845,7 +852,7 @@ contract DotnsPopControllerOld is
     /// on it, for the full reservation window. `exists` (owner set) mirrors exactly what makes the
     /// eventual claim's mint revert, so a label that passes here is one a claim can still register.
     function _validateReservableBaseLabel(
-        IPopRules rules,
+        IPopRulesOld rules,
         string calldata baseLabel
     )
         internal
@@ -854,9 +861,9 @@ contract DotnsPopControllerOld is
     {
         (labelhash, node) = _validateBaseLabel(baseLabel);
 
-        (IPopRules.PopStatus required,) = rules.classifyName(baseLabel);
+        (IPopRulesOld.PopStatus required,) = rules.classifyName(baseLabel);
         require(
-            required != IPopRules.PopStatus.Reserved && rules.isBaseName(baseLabel),
+            required != IPopRulesOld.PopStatus.Reserved && rules.isBaseName(baseLabel),
             InvalidBaseLabel()
         );
         require(!_registrar().exists(uint256(node)), BaseNameAlreadyRegistered());
@@ -872,28 +879,28 @@ contract DotnsPopControllerOld is
     }
 
     /// @notice Resolves the PoP resolver via the protocol registry.
-    function _popResolver() internal view returns (IDotnsPopResolver) {
-        return IDotnsPopResolver(protocolRegistry.get(DotnsConstantsOld.POP_RESOLVER));
+    function _popResolver() internal view returns (IDotnsPopResolverOld) {
+        return IDotnsPopResolverOld(protocolRegistry.get(DotnsConstants.POP_RESOLVER));
     }
 
     /// @notice Resolves the PopRulesOld contract via the protocol registry.
-    function _popRules() internal view returns (IPopRules) {
-        return IPopRules(protocolRegistry.get(DotnsConstantsOld.POP_RULES));
+    function _popRules() internal view returns (IPopRulesOld) {
+        return IPopRulesOld(protocolRegistry.get(DotnsConstants.POP_RULES));
     }
 
     /// @notice Resolves the Store factory via the protocol registry.
-    function _storeFactory() internal view returns (IStoreFactoryOld) {
-        return IStoreFactoryOld(protocolRegistry.get(DotnsConstantsOld.STORE_FACTORY));
+    function _storeFactory() internal view returns (IStoreFactory) {
+        return IStoreFactory(protocolRegistry.get(DotnsConstants.STORE_FACTORY));
     }
 
     /// @notice Resolves the registrar via the protocol registry.
-    function _registrar() internal view returns (IDotnsRegistrarOld) {
-        return IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+    function _registrar() internal view returns (IDotnsRegistrar) {
+        return IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
     }
 
     /// @notice Resolves the registry via the protocol registry.
-    function _registry() internal view returns (IDotnsRegistryOld) {
-        return IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY));
+    function _registry() internal view returns (IDotnsRegistry) {
+        return IDotnsRegistry(protocolRegistry.get(DotnsConstants.REGISTRY));
     }
 
     /// @notice Writes the new head of the queue into PopRulesOld so the public commit-reveal flow
@@ -904,7 +911,7 @@ contract DotnsPopControllerOld is
     /// `reserveBaseNameForPop`.
     function _syncPopRulesToHead(bytes32 labelhash, address newHead) internal {
         string memory baseLabel = _reservedBaseLabel[labelhash];
-        IPopRules rules = _popRules();
+        IPopRulesOld rules = _popRules();
         rules.releaseBaseName(baseLabel);
         rules.reserveBaseNameForPop(baseLabel, newHead);
         emit ReservationHeadAdvanced(labelhash, newHead);
@@ -920,7 +927,7 @@ contract DotnsPopControllerOld is
     }
 
     /// @notice Internal check enforcing a Root origin.
-    /// @dev Authorises a call when @custom:function SystemUtilsOld.originIsRoot is true, and
+    /// @dev Authorises a call when @custom:function SystemUtils.originIsRoot is true, and
     ///      reverts with NotRoot otherwise. `msg.sender` is deliberately not consulted: a
     ///      Root origin has no account behind it, so reading `msg.sender` traps. That holds
     ///      for this frame and any delegatecall sharing it; a nested call sees the calling
@@ -932,7 +939,7 @@ contract DotnsPopControllerOld is
     ///      pass. Every call out of this contract goes to a protocol contract resolved
     ///      through the registry.
     function _onlyRoot() internal view {
-        require(SystemUtilsOld.originIsRoot(), NotRoot());
+        require(SystemUtils.originIsRoot(), NotRoot());
     }
 
     /// @inheritdoc UUPSUpgradeable
diff --git a/contracts/registrars/DotnsRegistrarControllerOld.sol b/contracts/registrars/DotnsRegistrarControllerOld.sol
deleted file mode 100644
index afaeae211..000000000
--- a/contracts/registrars/DotnsRegistrarControllerOld.sol
+++ /dev/null
@@ -1,484 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
-import {ReentrancyGuardTransient} from "@openzeppelin/contracts/utils/ReentrancyGuardTransient.sol";
-
-import {IDotnsRegistrarOld} from "./IDotnsRegistrarOld.sol";
-import {IDotnsReverseResolver} from "../resolvers/IDotnsReverseResolver.sol";
-import {IPopRules} from "../pop/IPopRules.sol";
-import {IDotnsCostModelRegistryOld} from "../pop/IDotnsCostModelRegistryOld.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-import {IDotnsRegistrarController} from "./IDotnsRegistrarController.sol";
-import {IDotnsNameEscrow} from "../escrow/IDotnsNameEscrow.sol";
-import {IDotnsNameWhitelist} from "../whitelist/IDotnsNameWhitelist.sol";
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-import {LabelUtils} from "../utils/LabelUtils.sol";
-import {RegistrationUtilsOld} from "../utils/RegistrationUtilsOld.sol";
-import {StoreUtilsOld} from "../utils/StoreUtilsOld.sol";
-import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
-
-/// @title Dotns Registrar Controller
-/// @notice Allocates top-level labels using a commit reveal scheme.
-/// @dev Orchestrates allocation, PoP validation, pricing enforcement, forward registry
-/// wiring, default reverse resolution, and immutable store writing.
-///
-/// Tokenisation: the minted ERC721 tokenId is `uint256(node)`, where
-/// `node = namehash(tldNode, labelhash)`. The registry stores a sentinel owner
-/// (`address(0)`) for tokenised nodes and derives ownership from the ERC721 registrar for
-/// authorisation.
-/// @custom:security-contact admin@parity.io
-contract DotnsRegistrarControllerOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ERC165Upgradeable,
-    ReentrancyGuardTransient,
-    IDotnsRegistrarController
-{
-    using StringUtils for *;
-    using StoreUtilsOld for IStoreFactoryOld;
-
-    /// @notice One role's membership and its admin role.
-    /// @dev Member of the reserved AccessControl namespace, unused because gating is Root only.
-    /// @param hasRole Whether an account holds the role.
-    /// @param adminRole Admin role that manages the role.
-    struct RoleData {
-        mapping(address account => bool) hasRole;
-        bytes32 adminRole;
-    }
-
-    /// @notice Reserved OpenZeppelin access-control namespace held at its ERC-7201 slot.
-    /// @dev Declared and left unused so the namespace stays present in the layout. Its slot derives
-    ///      from the label, disjoint from the sequential slots below, so it consumes none of them.
-    /// @param _roles Role data keyed by role identifier.
-    /// @custom:storage-location erc7201:openzeppelin.storage.AccessControl
-    struct AccessControlStorage {
-        mapping(bytes32 role => RoleData) _roles;
-    }
-
-    /// @notice Upper bound for commitment validity to cap storage griefing risk.
-    uint256 public constant MAX_ALLOWED_COMMITMENT_AGE = 7 days;
-
-    /// @notice Minimum age a commitment must reach before reveal.
-    uint256 public minCommitmentAge;
-
-    /// @notice Maximum age after which a commitment expires.
-    uint256 public maxCommitmentAge;
-
-    /// @notice Stores Mapping of commitment hashes to timestamp committed.
-    mapping(bytes32 hash => uint256 timestamp) public commitments;
-
-    /// @notice Cost-model version stamped on a commitment at commit time.
-    /// @dev Recorded from the registry's current version when `commit` runs, so the reveal can bind
-    ///      a registration to the version that was current then. A caller cannot commit against an
-    ///      arbitrary earlier, cheaper version: the reveal rejects a `pricingVersion` that differs
-    ///      from this stamp.
-    mapping(bytes32 hash => uint256 version) public committedPricingVersion;
-
-    /// @dev Reserved slot held so the sequential storage layout stays fixed across the in-place
-    ///      upgrade. Unused: name eligibility lives in @custom:contract DotnsNameWhitelistOld.
-    /// @custom:oz-renamed-from whiteList
-    mapping(address account => bool retained) private __whiteListSlot;
-
-    /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @dev Reserved storage space to allow for layout changes in the future. The retained
-    ///      whitelist slot above holds one slot, so the gap holds 49 to keep the footprint fixed.
-    uint256[49] private __gap;
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the registrar controller.
-    /// @dev Callable once through the UUPS proxy; direct calls on the implementation revert
-    /// with @custom:reverts InvalidInitialization, and any nested call outside an active
-    /// initialiser scope reverts with @custom:reverts NotInitializing. Validates the
-    /// commitment window bounds: `minAge` must be strictly positive (otherwise
-    /// @custom:reverts MinCommitmentAgeZero) so a reveal cannot land in the same block as
-    /// its commit; `maxAge` must exceed `minAge` (otherwise
-    /// @custom:reverts MaxCommitmentAgeTooLow) and must stay within
-    /// `MAX_ALLOWED_COMMITMENT_AGE` (otherwise @custom:reverts MaxCommitmentAgeTooHigh) before
-    /// wiring the protocol registry.
-    function initialize(
-        IDotnsProtocolRegistryOld registry,
-        uint256 minAge,
-        uint256 maxAge
-    )
-        external
-        initializer
-    {
-        __ERC165_init();
-        __Ownable_init(msg.sender);
-
-        require(minAge > 0, MinCommitmentAgeZero());
-        require(maxAge > minAge, MaxCommitmentAgeTooLow());
-        require(maxAge <= MAX_ALLOWED_COMMITMENT_AGE, MaxCommitmentAgeTooHigh());
-
-        protocolRegistry = registry;
-
-        minCommitmentAge = minAge;
-        maxCommitmentAge = maxAge;
-    }
-
-    /// @inheritdoc IDotnsRegistrarController
-    function available(string calldata label) public view override returns (bool) {
-        bytes32 node;
-        (, node) = _validatedLabelNode(label);
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
-        return registrar.available(uint256(node));
-    }
-
-    /// @inheritdoc IDotnsRegistrarController
-    function makeCommitment(Registration calldata registration)
-        public
-        pure
-        override
-        returns (bytes32 commitment)
-    {
-        commitment = keccak256(
-            abi.encode(
-                registration.label,
-                registration.owner,
-                registration.secret,
-                registration.reserved,
-                registration.maxPrice,
-                registration.pricingVersion
-            )
-        );
-    }
-
-    /// @inheritdoc IDotnsRegistrarController
-    function commit(bytes32 commitment) external override {
-        uint256 prior = commitments[commitment];
-        require(
-            prior == 0 || prior + maxCommitmentAge <= block.timestamp,
-            UnexpiredCommitmentExists(commitment)
-        );
-
-        commitments[commitment] = block.timestamp;
-        committedPricingVersion[commitment] = _currentPricingVersion();
-        emit NameCommitted(commitment);
-    }
-
-    /// @notice Reads the cost model's current version through the protocol registry.
-    /// @dev Resolved at commit time so the stamp binds the version live then, not at reveal.
-    /// @return pricingVersion The current cost-model version.
-    function _currentPricingVersion() internal view returns (uint256 pricingVersion) {
-        return IDotnsCostModelRegistryOld(protocolRegistry.get(DotnsConstantsOld.COST_MODEL))
-            .currentVersion();
-    }
-
-    /// @inheritdoc IDotnsRegistrarController
-    function register(Registration calldata registration) external payable override nonReentrant {
-        (IDotnsRegistrarOld registrar, bytes32 labelhash, bytes32 node) =
-            _requireAvailableLabel(registration.label);
-        _consumeCommitment(registration);
-
-        address escrow = _escrow();
-        IPopRules rules = IPopRules(protocolRegistry.get(DotnsConstantsOld.POP_RULES));
-
-        uint256 tokenId = uint256(node);
-        bool isReclaim = registrar.exists(tokenId);
-
-        string memory stem = rules.stripDigits(registration.label);
-        bool stemCanonical = stem.isSingleLabelMemory();
-        // Reclaim hands the name back from a prior occupant who may hold a sibling-controller's
-        // stem reservation, which is garbage once the name moves on, so clear it. Non-reclaim
-        // paths intentionally leave an existing reservation in place: the slot belongs to the
-        // sibling controller that wrote it (e.g. the PoP queue head stamp), and clearing it from
-        // here would brick that controller's release and advance paths.
-        if (stemCanonical && isReclaim) {
-            (address reservationOwner,) = rules.getBaseNameReservation(stem);
-            address expectedOwner =
-                IDotnsNameEscrow(payable(escrow)).getReleasePosition(tokenId).recipient;
-            if (reservationOwner != address(0) && reservationOwner == expectedOwner) {
-                rules.releaseReservationForReclaim(stem, expectedOwner);
-            }
-        }
-
-        bool isDirect = msg.sender == registration.owner;
-        IPopRules.PriceWithMeta memory priced;
-        if (isDirect) {
-            priced = rules.priceWithCheckAtVersion(
-                registration.label, registration.owner, registration.pricingVersion
-            );
-        } else {
-            priced = rules.priceWithoutCheckAtVersion(
-                registration.label, registration.owner, registration.pricingVersion
-            );
-            if (priced.status == IPopRules.PopStatus.Reserved) {
-                (IPopRules.PopStatus required,) = rules.classifyName(registration.label);
-                if (required == IPopRules.PopStatus.Reserved) {
-                    revert IPopRules.GovernanceReserved(registration.label);
-                }
-                revert IPopRules.NameReserved(registration.label);
-            }
-            require(
-                priced.userStatus >= priced.status,
-                IPopRules.OwnerStatusInsufficient(
-                    registration.label, priced.userStatus, priced.status
-                )
-            );
-        }
-
-        uint256 totalCharged = priced.price;
-        require(
-            totalCharged <= registration.maxPrice,
-            PriceExceedsMax(registration.label, totalCharged, registration.maxPrice)
-        );
-        require(msg.value >= totalCharged, InsufficientValue());
-
-        IDotnsReverseResolver reverse;
-        bool setReverseRecord;
-        if (registration.reserved && isDirect) {
-            reverse =
-                IDotnsReverseResolver(protocolRegistry.get(DotnsConstantsOld.REVERSE_RESOLVER));
-            setReverseRecord = bytes(reverse.nameOf(registration.owner)).length == 0;
-        }
-
-        _completeRegistration(
-            registration, labelhash, node, priced.price, setReverseRecord, reverse, isReclaim
-        );
-
-        if (isReclaim) {
-            IDotnsNameEscrow(payable(escrow)).reclaim(tokenId, registration.owner);
-            // Reclaim hands the NFT to the new holder; rewrite the registry record so the prior
-            // owner's resolver pointer cannot follow the name. Must run after `escrow.reclaim`
-            // so the registry's `ownerOf` check sees the new holder, not the escrow.
-            IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY))
-                .setOwner(node, registration.owner);
-        }
-
-        _settleEscrow(escrow, tokenId, registration.owner, isDirect, totalCharged);
-
-        if (msg.value > totalCharged) {
-            uint256 refund = msg.value - totalCharged;
-            (bool ok,) = payable(msg.sender).call{value: refund}("");
-            if (ok) {
-                emit OverpaymentRefunded(msg.sender, refund);
-            } else {
-                IDotnsNameEscrow(payable(escrow)).creditOverpayment{value: refund}(msg.sender);
-            }
-        }
-    }
-
-    /// @notice Settles every escrow side-effect of a successful registration.
-    /// @dev Extracted to keep `register` under the stack-depth ceiling. On a direct
-    ///      registration the full `chargeAmount` lands in the refundable deposit position
-    ///      keyed to `nameOwner`. On a cross-payer registration the deposit position is
-    ///      seeded with a zero amount so the release lifecycle stays reachable, and the same
-    ///      `chargeAmount` routes to the protocol fee pot via `depositProtocolFee` keyed to
-    ///      `msg.sender` as the payer.
-    function _settleEscrow(
-        address escrow,
-        uint256 tokenId,
-        address nameOwner,
-        bool isDirect,
-        uint256 chargeAmount
-    )
-        internal
-    {
-        uint256 depositAmount = isDirect ? chargeAmount : 0;
-        IDotnsNameEscrow(payable(escrow)).deposit{value: depositAmount}(
-            IDotnsNameEscrow.DepositParams({
-                tokenId: tokenId, asset: address(0), amount: depositAmount, recipient: nameOwner
-            })
-        );
-
-        if (!isDirect && chargeAmount > 0) {
-            IDotnsNameEscrow(payable(escrow)).depositProtocolFee{value: chargeAmount}(
-                IDotnsNameEscrow.ProtocolFeeDepositParams({
-                    tokenId: tokenId, payer: msg.sender, recipient: nameOwner
-                })
-            );
-        }
-    }
-
-    /// @inheritdoc IDotnsRegistrarController
-    function registerReserved(Registration calldata registration) external override nonReentrant {
-        // Read Root once, up front. Everything below must stay callable under a substrate Root
-        // origin, which has no account, so no branch may read `msg.sender`: the grant is checked
-        // against `registration.owner`, the commitment is keyed on its own hash, and the mint
-        // targets the owner.
-        bool isRoot = SystemUtilsOld.originIsRoot();
-        IDotnsNameWhitelist whitelist;
-        if (!isRoot) {
-            whitelist = _nameWhitelist();
-            require(
-                whitelist.isGrantedTo(registration.label, registration.owner),
-                NameNotGranted(registration.label, registration.owner)
-            );
-        }
-
-        (, bytes32 labelhash, bytes32 node) = _requireAvailableLabel(registration.label);
-        _consumeCommitment(registration);
-
-        // Spend the grant before minting so a grant in the wrong state fails before any name is
-        // issued. Root skips it: a governance mint must not consume a grant held by someone else.
-        //
-        // A consequence worth knowing: if Root mints a label that is `Claimed` or `Reserved` on
-        // the whitelist, that record survives the mint. The beneficiary's own `registerReserved`
-        // then fails `NameNotAvailable`, and the node stays in the whitelist's active set until
-        // governance calls `revokeName`. Nothing is lost, but the grant is stranded.
-        if (!isRoot) {
-            whitelist.consume(registration.label, registration.owner);
-        }
-
-        // No reverse record. `setReverseName` overwrites unconditionally, and the gate above lets
-        // anyone submit for the beneficiary, so writing here would let a third party relabel
-        // another address. The owner claims their own record through `claimReverseRecord`, which
-        // checks ownership and writes only their own key.
-        _completeRegistration(
-            registration, labelhash, node, 0, false, IDotnsReverseResolver(address(0)), false
-        );
-    }
-
-    /// @inheritdoc IERC165
-    function supportsInterface(bytes4 interfaceId)
-        public
-        view
-        override(ERC165Upgradeable, IERC165)
-        returns (bool)
-    {
-        return interfaceId == type(IDotnsRegistrarController).interfaceId
-            || super.supportsInterface(interfaceId);
-    }
-
-    /// @notice Validates label shape and derives `(labelhash, node)`.
-    /// @dev Delegates hashing to @custom:contract LabelUtils so the assembly sequence lives in
-    /// exactly one place across the codebase. Error ownership stays on this interface: shape
-    /// violations revert with `InvalidLabel()`; labels below the minimum length revert with
-    /// `LabelTooShort(label)` so off-chain consumers can distinguish "shape-valid but below
-    /// the policy minimum" from "shape-valid but already minted".
-    function _validatedLabelNode(string calldata label)
-        internal
-        view
-        returns (bytes32 labelhash, bytes32 node)
-    {
-        require(label.isSingleLabel(), InvalidLabel());
-        require(bytes(label).length >= 3, LabelTooShort(label));
-        (labelhash, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), label);
-    }
-
-    function _requireAvailableLabel(string calldata label)
-        internal
-        view
-        returns (IDotnsRegistrarOld registrar, bytes32 labelhash, bytes32 node)
-    {
-        (labelhash, node) = _validatedLabelNode(label);
-        registrar = IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
-        require(registrar.available(uint256(node)), NameNotAvailable(label));
-    }
-
-    function _consumeCommitment(Registration calldata registration) internal {
-        bytes32 commitment = makeCommitment(registration);
-        uint256 committedAt = commitments[commitment];
-
-        require(committedAt != 0, CommitmentNotFound(commitment));
-        require(
-            committedAt + minCommitmentAge <= block.timestamp,
-            CommitmentTooNew(commitment, committedAt + minCommitmentAge, block.timestamp)
-        );
-        require(
-            committedAt + maxCommitmentAge > block.timestamp,
-            CommitmentTooOld(commitment, committedAt + maxCommitmentAge, block.timestamp)
-        );
-
-        uint256 stamped = committedPricingVersion[commitment];
-        require(
-            registration.pricingVersion == stamped,
-            IDotnsCostModelRegistryOld.PricingVersionMismatch(stamped, registration.pricingVersion)
-        );
-
-        delete commitments[commitment];
-        delete committedPricingVersion[commitment];
-    }
-
-    /// @notice Completes a commit-reveal registration: mints (or skips when reclaiming),
-    /// wires forward registry, optionally sets the reverse record, and writes the owner's
-    /// Store.
-    /// @dev On a fresh mint the triad of mint + forward-registry + store-write is delegated
-    /// to @custom:function RegistrationUtilsOld.registerAndStore, the single canonical
-    /// implementation shared across every DotNS registration flow. On a reclaim the mint step is
-    /// skipped (the
-    /// escrow has already moved custody) and only the registry wiring and store write run.
-    /// Reverse-record setting and the priced-registration event stay here because they are
-    /// commit-reveal-specific policy.
-    function _completeRegistration(
-        Registration calldata registration,
-        bytes32 labelhash,
-        bytes32 node,
-        uint256 baseCost,
-        bool setReverseRecord,
-        IDotnsReverseResolver reverse,
-        bool isReclaim
-    )
-        internal
-    {
-        address labelStore;
-        if (!isReclaim) {
-            labelStore = RegistrationUtilsOld.registerAndStore(
-                RegistrationUtilsOld.RegistrationContext({
-                    protocolRegistry: protocolRegistry,
-                    user: registration.owner,
-                    label: registration.label,
-                    labelhash: labelhash,
-                    node: node
-                })
-            );
-        } else {
-            // Registry reset on reclaim is deferred until after `escrow.reclaim` runs (see
-            // @custom:function register) so the registry's `ownerOf` check sees the new holder.
-            IStoreFactoryOld factory =
-                IStoreFactoryOld(protocolRegistry.get(DotnsConstantsOld.STORE_FACTORY));
-            string memory fullName = string.concat(registration.label, protocolRegistry.tld());
-            labelStore = factory.writeLabel(registration.owner, node, fullName);
-        }
-
-        if (setReverseRecord) {
-            reverse.setReverseName(
-                registration.owner, string.concat(registration.label, protocolRegistry.tld())
-            );
-        }
-
-        emit NameRegistered(registration.label, labelhash, registration.owner, baseCost, labelStore);
-    }
-
-    /// @notice Returns the configured name escrow from the protocol registry.
-    function _escrow() internal view returns (address escrow) {
-        escrow = protocolRegistry.get(DotnsConstantsOld.NAME_ESCROW);
-        require(escrow != address(0), EscrowNotConfigured());
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @notice Returns the configured name whitelist from the protocol registry.
-    function _nameWhitelist() internal view returns (IDotnsNameWhitelist whitelist) {
-        address configured = protocolRegistry.get(DotnsConstantsOld.NAME_WHITELIST);
-        require(configured != address(0), WhitelistNotConfigured());
-        whitelist = IDotnsNameWhitelist(configured);
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/registrars/DotnsRegistrarOld.sol b/contracts/registrars/DotnsRegistrarOld.sol
index d0391ca7d..3b35a888a 100644
--- a/contracts/registrars/DotnsRegistrarOld.sol
+++ b/contracts/registrars/DotnsRegistrarOld.sol
@@ -10,23 +10,23 @@ import {
     ERC721Upgradeable
 } from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
 
-import {IDotnsRegistrarOld} from "./IDotnsRegistrarOld.sol";
+import {IDotnsRegistrar} from "./IDotnsRegistrar.sol";
 import {IDotnsController} from "./IDotnsController.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
+import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
+import {IStoreFactory} from "../store/IStoreFactory.sol";
 import {ILabelStore} from "../store/ILabelStore.sol";
-import {StoreUtilsOld} from "../utils/StoreUtilsOld.sol";
+import {StoreUtils} from "../utils/StoreUtils.sol";
 import {LabelUtils} from "../utils/LabelUtils.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
+import {StringUtilsOld} from "../utils/StringUtilsOld.sol";
 import {IDotnsNameEscrow} from "../escrow/IDotnsNameEscrow.sol";
-import {IPopRules} from "../pop/IPopRules.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
+import {IPopRulesOld} from "../pop/IPopRulesOld.sol";
+import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
 /// @title Dotns Registrar
 /// @notice ERC721-backed registrar implementing permanent name ownership.
 /// @dev Deliberately policy-free on pricing, reservations, and PoP gating; those live in the
-/// controllers and @custom:contract IPopRules. The registrar owns transferability itself: publicly
+/// controllers and @custom:contract IPopRulesOld. The registrar owns transferability itself: publicly
 /// registered names transfer freely, while names minted through the PoP gateway are soulbound and
 /// revert on transfer. The `_update` hook enforces both the soulbound gate and the fee-on-transfer
 /// settlement that consults the escrow.
@@ -36,10 +36,10 @@ contract DotnsRegistrarOld is
     UUPSUpgradeable,
     OwnableUpgradeable,
     ERC721Upgradeable,
-    IDotnsRegistrarOld
+    IDotnsRegistrar
 {
-    using StoreUtilsOld for IStoreFactoryOld;
-    using StringUtils for *;
+    using StoreUtils for IStoreFactory;
+    using StringUtilsOld for *;
 
     /// @notice Mapping of authorised controllers.
     /// @dev Controllers may call `register`. Keyed by the shared baseline @custom:contract
@@ -52,11 +52,11 @@ contract DotnsRegistrarOld is
     /// @notice Protocol-level address registry for all DotNS contracts.
     /// @dev Used to resolve sibling contract addresses (store factory, controller, registry)
     /// without storing individual references.
-    IDotnsProtocolRegistryOld public protocolRegistry;
+    IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Marks a token as soulbound: minted through the PoP gateway and non-transferable.
     /// @dev Set at mint by @custom:function register when the caller is the address registered
-    /// under `DotnsConstantsOld.POP_CONTROLLER`. Write-once and never cleared: a name's soulbound
+    /// under `DotnsConstants.POP_CONTROLLER`. Write-once and never cleared: a name's soulbound
     /// state is fixed at registration. Read by the `_update` transfer gate and by
     /// @custom:function quoteTransferFee.
     mapping(uint256 tokenId => bool soulbound) private _soulbound;
@@ -82,38 +82,40 @@ contract DotnsRegistrarOld is
     /// proxy; direct calls on the implementation revert with @custom:reverts InvalidInitialization
     /// because `_disableInitializers` runs in the constructor, and any nested call outside an
     /// active initialiser scope reverts with @custom:reverts NotInitializing.
+    /// @param initialOwner Address that owns the contract once initialised.
     function initialize(
+        address initialOwner,
         string calldata name,
         string calldata symbol,
-        IDotnsProtocolRegistryOld registry
+        IDotnsProtocolRegistry registry
     )
         external
         initializer
     {
         require(address(registry) != address(0), ProtocolRegistryRequired());
-        __Ownable_init(msg.sender);
+        __Ownable_init(initialOwner);
         __ERC721_init(name, symbol);
         protocolRegistry = registry;
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function addController(IDotnsController controller) external onlyOwner {
         controllers[controller] = true;
         emit ControllerAdded(controller);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function removeController(IDotnsController controller) external onlyOwner {
         controllers[controller] = false;
         emit ControllerRemoved(controller);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function available(uint256 id) public view override returns (bool isAvailable) {
         address holder = _ownerOf(id);
         if (holder == address(0)) return true;
 
-        address escrow = protocolRegistry.get(DotnsConstantsOld.NAME_ESCROW);
+        address escrow = protocolRegistry.get(DotnsConstants.NAME_ESCROW);
         if (holder != escrow) return false;
 
         // Escrow custody on its own does not mean registrable: a released name inside its redeem
@@ -123,7 +125,7 @@ contract DotnsRegistrarOld is
         return IDotnsNameEscrow(payable(escrow)).isReclaimable(id);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function register(
         uint256 id,
         address owner,
@@ -138,10 +140,10 @@ contract DotnsRegistrarOld is
         // fresh-mint branch; the escrow-held branch must use the reclaim path and is rejected
         // here with the typed error so callers do not see OZ's `ERC721InvalidSender(0)`.
         require(!_exists(id), NameNotAvailable(id));
-        require(owner != protocolRegistry.get(DotnsConstantsOld.NAME_ESCROW), InvalidOwner());
+        require(owner != protocolRegistry.get(DotnsConstants.NAME_ESCROW), InvalidOwner());
         // Empty labels are an intentional gateway-cold path (substrate Root cannot deploy a
         // `LabelStore` under `pallet-revive`, so the controller stashes a pending claim and the
-        // user settles via @custom:function IDotnsPopController.claimLabelStore later). Non-empty
+        // user settles via @custom:function IDotnsPopControllerOld.claimLabelStore later). Non-empty
         // labels must still be canonical so the transfer-floor lookup in `_quoteTransferFee`
         // cannot brick the token by reverting on a malformed stem.
         require(bytes(label).length == 0 || label.isSingleLabel(), InvalidLabel());
@@ -150,20 +152,20 @@ contract DotnsRegistrarOld is
         // canonical PoP controller mints soulbound names, so a compromised or buggy peer controller
         // cannot lock a public name and the PoP controller cannot mint an unlocked one. Written
         // only on the true branch to leave the public path free of a redundant zero write.
-        bool soulbound = msg.sender == protocolRegistry.get(DotnsConstantsOld.POP_CONTROLLER);
+        bool soulbound = msg.sender == protocolRegistry.get(DotnsConstants.POP_CONTROLLER);
         if (soulbound) _soulbound[id] = true;
         if (bytes(label).length != 0) _writeOwnerLabel(owner, id, label);
         emit NameRegistered(id, owner, soulbound);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function labelOf(uint256 tokenId) external view override returns (string memory) {
         address holder = _ownerOf(tokenId);
         if (holder == address(0)) return "";
         return LabelUtils.stripTld(protocolRegistry.tld(), _readLabel(tokenId, holder));
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function quoteTransferFee(
         uint256 tokenId,
         address to
@@ -183,7 +185,7 @@ contract DotnsRegistrarOld is
         (,, requiredFee) = _quoteTransferFee(from, to, tokenId);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function transferFrom(
         address from,
         address to,
@@ -191,12 +193,12 @@ contract DotnsRegistrarOld is
     )
         public
         payable
-        override(ERC721Upgradeable, IDotnsRegistrarOld)
+        override(ERC721Upgradeable, IDotnsRegistrar)
     {
         super.transferFrom(from, to, tokenId);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function safeTransferFrom(
         address from,
         address to,
@@ -204,12 +206,12 @@ contract DotnsRegistrarOld is
     )
         public
         payable
-        override(ERC721Upgradeable, IDotnsRegistrarOld)
+        override(ERC721Upgradeable, IDotnsRegistrar)
     {
         super.safeTransferFrom(from, to, tokenId, "");
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function safeTransferFrom(
         address from,
         address to,
@@ -218,23 +220,28 @@ contract DotnsRegistrarOld is
     )
         public
         payable
-        override(ERC721Upgradeable, IDotnsRegistrarOld)
+        override(ERC721Upgradeable, IDotnsRegistrar)
     {
         super.safeTransferFrom(from, to, tokenId, data);
     }
 
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
+    /// @notice Returns the release this network declares it runs, read live from the protocol
+    ///         registry so every DotNS contract reports one synchronised value.
+    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
+    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
+    ///      not this contract's build; per-contract identity is the codehash declared on the
+    ///      registry.
+    /// @return versionString Declared release as bare semver, empty when never declared.
+    function version() external view virtual returns (string memory versionString) {
+        versionString = protocolRegistry.protocolVersion();
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function exists(uint256 tokenId) external view override returns (bool tokenExists) {
         tokenExists = _exists(tokenId);
     }
 
-    /// @inheritdoc IDotnsRegistrarOld
+    /// @inheritdoc IDotnsRegistrar
     function isSoulbound(uint256 tokenId) external view override returns (bool soulbound) {
         soulbound = _soulbound[tokenId];
     }
@@ -286,10 +293,13 @@ contract DotnsRegistrarOld is
 
         // Resolve every registry-sourced dependency once and thread it into the helpers so a
         // single transfer pays one external lookup per key rather than three.
-        IDotnsProtocolRegistryOld registry = protocolRegistry;
-        address escrow = registry.get(DotnsConstantsOld.NAME_ESCROW);
+        IDotnsProtocolRegistry registry = protocolRegistry;
+        address escrow = registry.get(DotnsConstants.NAME_ESCROW);
         require(escrow != address(0), EscrowNotConfigured());
-        IStoreFactoryOld factory = IStoreFactoryOld(registry.get(DotnsConstantsOld.STORE_FACTORY));
+        // `release` is the only caller that moves a name into custody, so any other sender is a
+        // deposit the escrow holds no position for.
+        require(to != escrow || msg.sender == escrow, UnsolicitedEscrowDeposit(tokenId));
+        IStoreFactory factory = IStoreFactory(registry.get(DotnsConstants.STORE_FACTORY));
 
         bool isEscrowTouching = to == escrow || from == escrow;
         // Skip mirroring on escrow-touching paths: release deposits the NFT into custody where
@@ -333,7 +343,7 @@ contract DotnsRegistrarOld is
 
     /// @notice Mirrors the sender's label entry into the recipient's `LabelStore`.
     function _syncRecipientStore(
-        IStoreFactoryOld factory,
+        IStoreFactory factory,
         address to,
         address from,
         uint256 tokenId
@@ -345,16 +355,20 @@ contract DotnsRegistrarOld is
             // Defensive: the sender holds no label entry for the token. Gateway mints reach this
             // only at mint time, and a gateway name is soulbound so it never transfers; a public
             // name always carries a label. Nothing to mirror, so do not deploy a recipient store;
-            // downstream writes are demand-deploy through `StoreUtilsOld.ensureLabelStore`.
+            // downstream writes are demand-deploy through `StoreUtils.ensureLabelStore`.
             return;
         }
-        factory.writeLabel(to, bytes32(tokenId), fullName);
+        // A slot holding a different string was written by someone else, and `storeLabel` has no
+        // delete, so mirroring nothing would hand over a name `_quoteTransferFeeFor` rejects on
+        // every onward transfer. A matching entry is still a no-op, so a transfer back to a prior
+        // owner passes.
+        factory.writeNewLabel(to, bytes32(tokenId), fullName);
     }
 
     /// @notice Reads the full name (`label.tld`) for `tokenId` from `holder`'s `LabelStore` using
     /// a caller-supplied factory.
     function _readLabelFor(
-        IStoreFactoryOld factory,
+        IStoreFactory factory,
         uint256 tokenId,
         address holder
     )
@@ -383,17 +397,17 @@ contract DotnsRegistrarOld is
 
     /// @notice Resolves the configured name escrow address from the protocol registry.
     function _escrow() private view returns (address escrow) {
-        escrow = protocolRegistry.get(DotnsConstantsOld.NAME_ESCROW);
+        escrow = protocolRegistry.get(DotnsConstants.NAME_ESCROW);
     }
 
     /// @notice Resolves the configured PoP rules contract from the protocol registry.
-    function _popRules() private view returns (IPopRules rules) {
-        rules = IPopRules(protocolRegistry.get(DotnsConstantsOld.POP_RULES));
+    function _popRules() private view returns (IPopRulesOld rules) {
+        rules = IPopRulesOld(protocolRegistry.get(DotnsConstants.POP_RULES));
     }
 
     /// @notice Resolves the configured store factory from the protocol registry.
-    function _storeFactory() private view returns (IStoreFactoryOld factory) {
-        factory = IStoreFactoryOld(protocolRegistry.get(DotnsConstantsOld.STORE_FACTORY));
+    function _storeFactory() private view returns (IStoreFactory factory) {
+        factory = IStoreFactory(protocolRegistry.get(DotnsConstants.STORE_FACTORY));
     }
 
     /// @notice Writes the canonical full name into `owner`'s `LabelStore` keyed by
@@ -403,13 +417,13 @@ contract DotnsRegistrarOld is
     /// the registry would have already broken every other call site).
     function _writeOwnerLabel(address owner, uint256 tokenId, string calldata label) private {
         _storeFactory()
-            .writeLabel(owner, bytes32(tokenId), string.concat(label, protocolRegistry.tld()));
+            .writeNewLabel(owner, bytes32(tokenId), string.concat(label, protocolRegistry.tld()));
     }
 
     /// @notice Quotes the friction fee required for a transfer.
     /// @dev Required fee is the name's own price returned by @custom:function
-    /// PopRulesOld.transferFloor. It is paid by the sender on every downward or cross-reach
-    /// transfer and settles to the
+    /// PopRulesOld.transferFloor. It is paid by the sender on every downward or cross-reach transfer
+    /// and settles to the
     /// protocol fee pot. Any prior deposit travels with the NFT: the escrow rebinds the position to
     /// the new holder rather than refunding the sender, so transferring a funded name forfeits the
     /// locked deposit to the recipient. Self-transfers and escrow-touching transfers return zero.
@@ -424,12 +438,12 @@ contract DotnsRegistrarOld is
     {
         if (from == to) return (address(0), 0, 0);
 
-        IDotnsProtocolRegistryOld registry = protocolRegistry;
-        escrow = registry.get(DotnsConstantsOld.NAME_ESCROW);
+        IDotnsProtocolRegistry registry = protocolRegistry;
+        escrow = registry.get(DotnsConstants.NAME_ESCROW);
         require(escrow != address(0), EscrowNotConfigured());
 
         bool isEscrowTouching = to == escrow || from == escrow;
-        IStoreFactoryOld factory = IStoreFactoryOld(registry.get(DotnsConstantsOld.STORE_FACTORY));
+        IStoreFactory factory = IStoreFactory(registry.get(DotnsConstants.STORE_FACTORY));
         (transferFee, requiredFee) =
             _quoteTransferFeeFor(registry, factory, isEscrowTouching, from, to, tokenId);
     }
@@ -439,8 +453,8 @@ contract DotnsRegistrarOld is
     /// escrow-touching move or when the sender holds no label entry; otherwise reads the canonical
     /// label and delegates to @custom:function PopRulesOld.transferFloor.
     function _quoteTransferFeeFor(
-        IDotnsProtocolRegistryOld registry,
-        IStoreFactoryOld factory,
+        IDotnsProtocolRegistry registry,
+        IStoreFactory factory,
         bool isEscrowTouching,
         address from,
         address to,
@@ -464,7 +478,7 @@ contract DotnsRegistrarOld is
         require(bytes(label).length != 0, InvalidLabel());
 
         transferFee =
-            IPopRules(registry.get(DotnsConstantsOld.POP_RULES)).transferFloor(label, from, to);
+            IPopRulesOld(registry.get(DotnsConstants.POP_RULES)).transferFloor(label, from, to);
         requiredFee = transferFee;
     }
 
diff --git a/contracts/registrars/IDotnsPopControllerOld.sol b/contracts/registrars/IDotnsPopControllerOld.sol
new file mode 100644
index 000000000..418ff0ea9
--- /dev/null
+++ b/contracts/registrars/IDotnsPopControllerOld.sol
@@ -0,0 +1,528 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {IDotnsController} from "./IDotnsController.sol";
+
+/// @title IDotnsPopControllerOld
+/// @notice Interface for the dedicated PoP controller orchestrating lite-person and full-person
+/// username issuance on behalf of the PoP gateway.
+/// @dev Deliberately disjoint from @custom:contract IDotnsRegistrarController. The two
+/// controllers coexist on @custom:contract DotnsRegistrarOld via its multi-controller affordance
+/// and neither imports the other. A full-person username collides through the registrar's ERC721
+/// availability check (first-to-mint wins); a lite username is not a token, so it collides through
+/// @custom:function IDotnsRegistry.recordExists at its stem-under-container node
+/// (@custom:reverts LiteNameAlreadyIssued). Reservation queuing for `reservedBaseLabel`
+/// mirrors its live head into PopRulesOld, so a queued stem also blocks the public
+/// commit-reveal flow, which reads that slot when it prices a name.
+///
+/// Label formats:
+/// Lite-person usernames (first argument to @custom:function reserveBaseName and the
+/// `liteLabel` of a `LinkKind.LiteUsername` link) are a stem of lowercase ASCII letters, a
+/// separator, then exactly two digits (e.g. `joseph.42`) per
+/// @custom:function StringUtilsOld.isLitePersonLabel. The stem is stricter than a DNS label
+/// because the name a person chooses is restricted to letters; a stem short enough to
+/// be governance-reserved is rejected by classification, not by the shape. The label is stored in
+/// the form the gateway sends, which is the canonical form of the name, so nothing here
+/// normalises it.
+/// Full-person usernames (the `label` of @custom:function registerBaseName and the
+/// optional `reservedBaseLabel` of @custom:function reserveBaseName) are lowercase ASCII
+/// letters only, per @custom:function StringUtilsOld.isPersonLabel (e.g. `alice`). That is the
+/// same rule a lite stem follows and is stricter than a DNS label: no hyphens and no interior
+/// digits, because a full-person name is also a name a person chose. A separator marks a lite
+/// label and is rejected everywhere else, so only the gateway can create a dotted name; a
+/// digit suffix on its own is not exclusive, since a public label may carry one directly.
+/// Cross-flow priority on the base stem is arbitrated by
+/// @custom:function IPopRulesOld.reserveBaseNameForPop.
+/// @custom:security-contact admin@parity.io
+interface IDotnsPopControllerOld is IDotnsController {
+    /// @notice Discriminant for the `Link` union supplied to `registerBaseName`.
+    /// @dev Selects the chat-key source for the full-person username. Orthogonal to whether
+    /// the registration is a claim or standalone; that is derived from on-chain reservation
+    /// state. `None` means the caller supplies a fresh chat key in `link.chatKey`.
+    /// `LiteUsername` means the full-person username is linked to a prior lite-person
+    /// username (`link.liteLabel`) and inherits its chat key.
+    enum LinkKind {
+        None,
+        LiteUsername
+    }
+
+    /// @notice Tagged union selecting the chat-key source for a full-person registration.
+    /// @param liteLabel Lite-person `stem.NN` label (only read when `kind == LiteUsername`).
+    /// @param chatKey Chat key bytes (only read when `kind == None`).
+    struct Link {
+        LinkKind kind;
+        string liteLabel;
+        bytes chatKey;
+    }
+
+    /// @notice Per-user reservation pointer: which queue the user sits in and where.
+    /// @param labelhash Non-zero when the user holds a live reservation; zero otherwise.
+    /// @param index Monotonic queue index, meaningful only when `labelhash` is non-zero.
+    struct UserReservation {
+        bytes32 labelhash;
+        uint64 index;
+    }
+
+    /// @notice Reservation queue entry: a user and the timestamp they joined the queue.
+    /// @dev Packs into a single storage slot (20 + 8 bytes).
+    struct ReservationEntry {
+        address owner;
+        uint64 joinedAt;
+    }
+
+    /// @notice Metadata describing the occupied range of a reservation queue.
+    /// @dev Uses monotonically increasing indices. Active entries occupy `[head, tail)`;
+    /// `length = tail - head`. Slots past `head` are deleted as the head advances so
+    /// garbage never accumulates.
+    struct ReservationQueueMeta {
+        uint64 head;
+        uint64 tail;
+    }
+
+    /// @notice Deferred per-user binding of a freshly minted name to its `LabelStore`.
+    /// @dev Recorded by the gateway path when the user has no `LabelStore`. The binding later
+    /// settles via @custom:function settlePendingClaims, which deploys the store from a signed
+    /// origin and writes the stashed label. PoP-resolver records (chat key, lite link) are
+    /// persisted eagerly at mint time on @custom:contract IDotnsPopResolverOld, not at settlement,
+    /// so the resolver carries the full identity record regardless of whether the user has
+    /// settled their Store. A user accumulates one entry per deferred name: the Root gateway path
+    /// cannot deploy a `LabelStore` (contract creation is forbidden from the Root origin), so it
+    /// keeps stashing entries until a signed-origin @custom:function settlePendingClaims deploys
+    /// the store and settles the entries. Each entry's deadline is measured from its own
+    /// `mintedAt` against `reservationDuration`.
+    /// @param label Bare label without the TLD, which is appended at settlement time. A lite
+    /// claim carries its separator, so this is not always a single DNS label.
+    /// @param mintedAt Timestamp of the originating mint.
+    struct PendingClaim {
+        string label;
+        uint64 mintedAt;
+    }
+
+    /// @notice Lite-person registration payload.
+    /// @dev Single struct so the gateway can ABI-encode one tuple as the cross-chain payload
+    /// and the contract decodes it directly out of `msg.data`. All fields are required;
+    /// `chatKey` may be empty bytes to skip the resolver write.
+    /// @param liteLabel Lite-person `stem.NN` label being minted.
+    /// @param user Beneficiary account on this chain.
+    /// @param chatKey Chat-key bytes persisted on the PoP resolver. Empty leaves the slot unset.
+    struct LiteRegistration {
+        string liteLabel;
+        address user;
+        bytes chatKey;
+    }
+
+    /// @notice Lite-person registration combined with an optional base-name reservation.
+    /// @dev `BaseReservation` is a @custom:struct LiteRegistration plus a base-label reservation
+    /// slot, expressed as composition rather than duplicated fields so internal helpers can
+    /// consume the lite leg via `params.lite` without unpacking. The lite leg always runs;
+    /// the reservation leg only runs when `reservedBaseLabel` is non-empty.
+    /// @param lite Lite-person registration request; see LiteRegistration.
+    /// @param reservedBaseLabel Base label to enqueue for a later full-person claim. Empty
+    /// string skips the reservation leg.
+    struct BaseReservation {
+        LiteRegistration lite;
+        string reservedBaseLabel;
+    }
+
+    /// @notice Base-name reservation payload for the split gateway flow.
+    /// @dev This is the reservation-only primitive. The lite username mint is handled by
+    /// @custom:function reserveLiteName, and LabelStore settlement is handled by
+    /// @custom:function settlePendingClaims.
+    /// @param user Beneficiary account that will hold the reservation.
+    /// @param reservedBaseLabel Base label to enqueue for a later full-person claim.
+    struct BaseNameReservation {
+        address user;
+        string reservedBaseLabel;
+    }
+
+    /// @notice Full-person registration payload.
+    /// @param label Base DNS label being minted.
+    /// @param user Beneficiary account on this chain.
+    /// @param link Chat-key source for the new entry; see @custom:struct Link.
+    struct FullRegistration {
+        string label;
+        address user;
+        Link link;
+    }
+
+    /// @notice Emitted when a lite-person username is registered via the PoP gateway.
+    event LiteNameReserved(bytes32 indexed labelhash, address indexed user, string label);
+
+    /// @notice Emitted when a full-person username is claimed out of an existing reservation.
+    event BaseNameClaimed(bytes32 indexed labelhash, address indexed user, string label);
+
+    /// @notice Emitted when a standalone full-person username is registered via the PoP gateway.
+    event StandaloneNameRegistered(bytes32 indexed labelhash, address indexed user, string label);
+
+    /// @notice Emitted when a reservation entry is added to the queue for a base name.
+    /// @param position Position in the queue at the time of joining (0 = active holder).
+    event ReservationQueued(
+        bytes32 indexed reservedLabelhash, address indexed user, uint64 position
+    );
+
+    /// @notice Emitted when a reservation entry is removed due to expiry.
+    event ReservationExpired(bytes32 indexed reservedLabelhash, address indexed user);
+
+    /// @notice Emitted when a user voluntarily relinquishes their reservation.
+    event ReservationRelinquished(bytes32 indexed reservedLabelhash, address indexed user);
+
+    /// @notice Emitted when a full-person username is linked to a lite-person username.
+    event LiteToFullLinked(bytes32 indexed fullLabelhash, bytes32 indexed liteLabelhash);
+
+    /// @notice Emitted when the reservation duration is updated.
+    event ReservationDurationSet(uint64 duration);
+
+    /// @notice Emitted when a name is successfully registered via the PoP controller.
+    /// @param store The Store instance used to persist the immutable registration record.
+    event NameRegistered(
+        string indexed label, bytes32 indexed labelhash, address indexed owner, address store
+    );
+
+    /// @notice Emitted when a gateway-path mint defers its `LabelStore` write into the
+    /// pending-claim mapping because the user has no store yet.
+    event PendingClaimStashed(address indexed user, bytes32 indexed labelhash, string label);
+
+    /// @notice Emitted when a pending claim is written into a `LabelStore`.
+    /// @dev Fires once per settled entry from @custom:function settlePendingClaims. `settledBy`
+    /// is the caller: it equals `user` for a self-settlement and is any other address for a
+    /// third-party settlement, so consumers can tell the two apart from the log alone.
+    /// @param user Account the settled name belongs to.
+    /// @param labelhash Labelhash of the settled name.
+    /// @param store The `LabelStore` the label was written into.
+    /// @param settledBy Caller that performed and paid for the settlement.
+    event PendingClaimSettled(
+        address indexed user, bytes32 indexed labelhash, address store, address indexed settledBy
+    );
+
+    /// @notice Emitted when a reservation queue's head transitions to a new user, either via
+    /// expiry of the prior head or via the explicit relinquish path.
+    /// @param labelhash Base-label hash whose queue head changed.
+    /// @param newHead Address now holding the head slot.
+    event ReservationHeadAdvanced(bytes32 indexed labelhash, address indexed newHead);
+
+    /// @notice Thrown when a gated entrypoint is reached without a Root origin.
+    /// @dev Carries no caller parameter: a Root origin has no account to report,
+    ///      and reading `msg.sender` under one traps.
+    error NotRoot();
+
+    /// @notice Thrown when a supplied lite-person label does not match `stem.NN`.
+    error InvalidLiteLabel();
+
+    /// @notice Thrown when a supplied base label is not a canonical DNS label.
+    error InvalidBaseLabel();
+
+    /// @notice Thrown when a reserved base label already has an owner on the registrar, so the
+    /// queued reservation could never be redeemed at mint time.
+    error BaseNameAlreadyRegistered();
+
+    /// @notice Thrown when a lite username is issued again while its subname already exists.
+    /// @dev A lite name is issued once; re-issuing it would rehome the identity to a new owner and
+    ///      overwrite its records, so an existing subname is rejected rather than reassigned.
+    error LiteNameAlreadyIssued();
+
+    /// @notice Thrown when a supplied chat key is non-empty and not exactly 65 bytes long.
+    /// @dev Mirrors the resolver's `InvalidChatKeyLength` so the controller surfaces a
+    /// controller-local error before the mint runs.
+    /// @param length Caller-supplied chat key length, in bytes.
+    error InvalidChatKey(uint256 length);
+
+    /// @notice Thrown when a user tries to claim or relinquish a reservation that they do not hold.
+    error NoActiveReservation(address user);
+
+    /// @notice Thrown when a reservation queue has reached its capacity.
+    error QueueFull(bytes32 labelhash);
+
+    /// @notice Thrown when attempting to enqueue a user who already has an active reservation.
+    error AlreadyReserved(address user, bytes32 labelhash);
+
+    /// @notice Thrown when someone tries to mint a base label in standalone mode while another user
+    /// holds the live head-of-queue reservation.
+    error NotHolder(address user, bytes32 labelhash);
+
+    /// @notice Thrown when a lite-link inheritance does not match the registrar-side owner
+    /// of the lite label.
+    /// @dev Prevents identity hijack by ensuring the registrant on the full-name leg actually
+    /// holds the prior lite identity whose chat key is being inherited.
+    /// @param user Registrant supplied by the gateway.
+    /// @param liteLabelhash Lite label whose ownership did not match.
+    error LiteLabelNotOwnedByUser(address user, bytes32 liteLabelhash);
+
+    /// @notice Thrown when @custom:function setReservationDuration is called with a value below
+    /// the protocol minimum.
+    /// @param duration Caller-supplied duration, in seconds.
+    error ReservationDurationTooLow(uint64 duration);
+
+    /// @notice Registers a lite-person username on behalf of the supplied user
+    /// and optionally enqueues a reservation for a base name they intend to
+    /// claim as a full person later.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
+    /// lite leg validates the `stem.NN` shape and requires the label to classify outside the
+    /// governance-reserved tier (otherwise @custom:reverts InvalidLiteLabel), and rejects a
+    /// supplied chat key whose length is neither zero nor `CHAT_KEY_LENGTH`
+    /// (otherwise @custom:reverts InvalidChatKey). On a warm-path mint (user already has a
+    /// `LabelStore`) it @custom:emits LiteNameReserved and @custom:emits NameRegistered;
+    /// on a cold-path mint it @custom:emits LiteNameReserved and
+    /// @custom:emits PendingClaimStashed, with @custom:emits NameRegistered deferred to
+    /// @custom:function settlePendingClaims when the claim settles. The base-name leg only runs
+    /// when `reservedBaseLabel` is non-empty: it requires a letters-only person label, which is
+    /// therefore also a true base label (otherwise @custom:reverts InvalidBaseLabel), and
+    /// with no owner on the registrar (otherwise @custom:reverts BaseNameAlreadyRegistered),
+    /// since a name that already has an owner could never be claimed. This validation runs
+    /// before both the lite mint and any queue mutation, so an already-registered
+    /// `reservedBaseLabel` aborts the whole call and the candidate receives no lite username
+    /// either; callers should validate the reserved label before attesting rather than relying
+    /// on this revert. It then advances the
+    /// head past expired entries (@custom:emits ReservationExpired for each one),
+    /// removes the user from any prior queue position so a single user holds at most one live
+    /// reservation across all labels, and enqueues a fresh entry
+    /// (@custom:emits ReservationQueued). The enqueue rejects with @custom:reverts
+    /// AlreadyReserved when the user already holds a reservation that was not cleared by the
+    /// prior removal and with @custom:reverts QueueFull when the per-label queue has reached
+    /// `MAX_RESERVATION_QUEUE`. Cross-chain callers pass the ABI-encoded reservation tuple as
+    /// the call's payload, which Solidity decodes directly.
+    /// @param params Reservation request; see @custom:struct BaseReservation.
+    function reserveBaseName(BaseReservation calldata params) external;
+
+    /// @notice Enqueues only the full/base-name reservation for a user.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot).
+    /// This is the second step of the split
+    /// gateway flow: @custom:function reserveLiteName mints the lite username first, then this
+    /// function reserves the full/base label in a separate transaction so proof-size stays below
+    /// per-call limits. Reverts with @custom:reverts InvalidBaseLabel when the label is empty,
+    /// is not lowercase ASCII letters (so a hyphen or any digit rejects it), or is
+    /// governance-reserved, and with
+    /// @custom:reverts BaseNameAlreadyRegistered when the label already has an owner on the
+    /// registrar and so could never be claimed. The caller remains agnostic about
+    /// backend batching; it simply exposes a small retryable primitive.
+    /// @param params Reservation request; see @custom:struct BaseNameReservation.
+    function reserveBaseNameOnly(BaseNameReservation calldata params) external;
+
+    /// @notice Registers a lite-person username on behalf of the supplied
+    /// user without touching the base-name reservation queue.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
+    /// supplied label must satisfy the `stem.NN` shape and must classify outside the
+    /// governance-reserved tier (otherwise @custom:reverts InvalidLiteLabel); a supplied chat
+    /// key whose length is neither zero nor `CHAT_KEY_LENGTH` reverts
+    /// @custom:reverts InvalidChatKey before mint and resolver writes run. A username that has
+    /// already been issued reverts @custom:reverts LiteNameAlreadyIssued. On a warm-path mint
+    /// @custom:emits LiteNameReserved and @custom:emits NameRegistered. On a cold-path
+    /// mint @custom:emits LiteNameReserved and @custom:emits PendingClaimStashed, with
+    /// @custom:emits NameRegistered deferred to @custom:function settlePendingClaims when the
+    /// claim settles. Cross-chain callers pass the ABI-encoded lite-registration tuple as the
+    /// call's payload, which Solidity decodes directly.
+    /// @param params Registration request; see @custom:struct LiteRegistration.
+    function reserveLiteName(LiteRegistration calldata params) external;
+
+    /// @notice Whether this controller issued `label` as a PoP identity.
+    /// @dev Keyed by text, so it answers about a name rather than about a node. A lite label is
+    /// issued as a subname (`joseph` beneath its numeric container `42`) and a full-person label as
+    /// a second-level name, so a caller holding a node must check that the node is the one `label`
+    /// resolves to under those rules before reading this answer as being about what it holds; node
+    /// identity is what names the object. Set at mint and never cleared, so it is unaffected by a
+    /// name later becoming transferable; the soulbound flag is a transfer rule and cannot stand in
+    /// for it.
+    /// @param label Bare label without the TLD, for example `joseph.42`.
+    /// @return issued True when this controller issued `label`.
+    function isPopIssued(string calldata label) external view returns (bool issued);
+
+    /// @notice Registers a full-person username on behalf of the supplied user.
+    /// @dev Callable only under a Root origin (otherwise @custom:reverts NotRoot). The
+    /// base label must be a letters-only person label, and therefore a true base label,
+    /// (otherwise @custom:reverts InvalidBaseLabel), and the label must not
+    /// classify as governance-reserved (otherwise @custom:reverts InvalidBaseLabel). The
+    /// gateway also defers to PopRulesOld as the single cross-flow authority: when PopRulesOld
+    /// carries a live base-name slot held by another user (this controller's prior queue head,
+    /// or a sibling controller's write), the call reverts @custom:reverts NotHolder before any
+    /// queue mutation. Two orthogonal axes drive the state machine. The reservation
+    /// axis treats the user as claiming if and only if they hold the live head-of-queue
+    /// reservation on the base label: a claim wipes the entire queue, releases the PopRulesOld
+    /// slot, and @custom:emits BaseNameClaimed; a non-claim silently relinquishes any
+    /// pending entry the user holds and @custom:emits StandaloneNameRegistered. Advancing
+    /// the queue head past expired entries @custom:emits ReservationExpired for each
+    /// one. The chat-key axis selects whether a fresh key is persisted on the resolver or the
+    /// new entry inherits its key from a prior lite-person username. The fresh-key branch
+    /// rejects a chat key whose length is neither zero nor `CHAT_KEY_LENGTH` (otherwise
+    /// @custom:reverts InvalidChatKey). The `LiteUsername` branch validates the lite label's
+    /// `stem.NN` shape (otherwise @custom:reverts InvalidLiteLabel), requires the registrant to
+    /// own the lite token (otherwise @custom:reverts LiteLabelNotOwnedByUser), reads the lite
+    /// node's chat key from the resolver and copies it across; if the lite node carries no chat
+    /// key the inherited value is empty and the full node's chat-key write is silently skipped
+    /// (the `LiteToFullLinked` event still fires). @custom:emits LiteToFullLinked
+    /// alongside the registration event. On a warm-path mint the event order is
+    /// @custom:emits NameRegistered first (from the inner mint), then
+    /// @custom:emits BaseNameClaimed or @custom:emits StandaloneNameRegistered, then
+    /// @custom:emits LiteToFullLinked when applicable. On a cold-path mint
+    /// @custom:emits PendingClaimStashed replaces the initial @custom:emits NameRegistered;
+    /// the deferred @custom:emits NameRegistered fires later from @custom:function
+    /// settlePendingClaims. Cross-chain callers pass the ABI-encoded full-registration tuple as
+    /// the call's payload, which Solidity decodes directly.
+    /// @param params Registration request; see @custom:struct FullRegistration.
+    function registerBaseName(FullRegistration calldata params) external;
+
+    /// @notice Permissionlessly removes expired entries from the head of a reservation queue.
+    /// @dev Permissionless on purpose: anyone (typically a UI or a bot) can poke a stale queue
+    /// so the next live head takes over without waiting for the next gateway call. Validates
+    /// `reservedBaseLabel` as a letters-only person label (otherwise
+    /// @custom:reverts InvalidBaseLabel)
+    /// and @custom:emits ReservationExpired for every expired entry reaped from the
+    /// head. A label carrying a digit or a hyphen is not a person label and
+    /// @custom:reverts InvalidBaseLabel, as does a lite label, since a separator is not one
+    /// either. Only a letters-only label reaches the queue, and one that was never reserved
+    /// resolves to an empty queue so the call is a no-op.
+    function expireReservation(string calldata reservedBaseLabel) external;
+
+    /// @notice Lets the caller voluntarily drop their own active reservation.
+    /// @dev Reverts with @custom:reverts NoActiveReservation when the caller holds no live
+    /// reservation. On success the caller's entry is removed from its queue and
+    /// @custom:emits ReservationRelinquished is emitted; if the removed entry was the queue
+    /// head, head advancement may additionally @custom:emits ReservationExpired for any
+    /// stale entries reaped behind it.
+    function relinquishReservation() external;
+
+    /// @notice Returns whether a label currently has a live reservation at the queue head.
+    /// @dev Validates `reservedBaseLabel` as a letters-only person label (otherwise
+    /// @custom:reverts InvalidBaseLabel) before inspecting the queue.
+    function isReservedForClaim(string calldata reservedBaseLabel)
+        external
+        view
+        returns (bool reserved, address holder);
+
+    /// @notice Updates the reservation duration used to decide when queue entries expire.
+    /// @dev Owner-gated (otherwise @custom:reverts OwnableUnauthorizedAccount); emits
+    /// @custom:emits ReservationDurationSet on success.
+    function setReservationDuration(uint64 duration) external;
+
+    /// @notice Returns the queue metadata (`head`, `tail`) for `labelhash`.
+    /// @dev Read-only accessor over the per-label reservation queue. `head == tail` means
+    /// the queue is empty; active entries occupy `[head, tail)`. Exposed on the interface
+    /// because invariant tests and off-chain consumers use it to enumerate
+    /// live queue state without scanning storage.
+    /// @param labelhash Keccak-256 of the base label whose queue is being read.
+    /// @return head Index of the live queue head.
+    /// @return tail Index one past the last queued entry.
+    function reservationMeta(bytes32 labelhash) external view returns (uint64 head, uint64 tail);
+
+    /// @notice Returns the queue entry at `index` for `labelhash`.
+    /// @dev Sparse storage: a zero `entryOwner` means the slot was relinquished, expired and
+    /// reaped, or never written. Callers pair this with @custom:function reservationMeta to walk
+    /// the live window `[head, tail)`.
+    /// @param labelhash Keccak-256 of the base label whose queue is being read.
+    /// @param index Queue index to look up.
+    /// @return entryOwner Owner of the slot (zero if empty/relinquished).
+    /// @return joinedAt Timestamp the entry was enqueued (only meaningful when
+    /// `entryOwner != address(0)`).
+    function reservationEntry(
+        bytes32 labelhash,
+        uint64 index
+    )
+        external
+        view
+        returns (address entryOwner, uint64 joinedAt);
+
+    /// @notice Returns `user`'s current reservation pointer.
+    /// @dev A zero `labelhash` on the returned struct means the user holds no reservation;
+    /// `index` is meaningful only when `labelhash` is non-zero.
+    /// @param user Account whose reservation pointer is being read.
+    /// @return reservation Per-user reservation pointer; see @custom:struct UserReservation.
+    function userReservation(address user)
+        external
+        view
+        returns (UserReservation memory reservation);
+
+    /// @notice Returns the base label a reservation queue is keyed under.
+    /// @dev Reverse lookup from the `bytes32` queue key to its label string, so a consumer that
+    /// observed a queue by labelhash (for example from a reservation event) can recover the
+    /// human-readable label without holding its preimage. Returns an empty string when no
+    /// reservation was ever enqueued under `labelhash`.
+    /// @param labelhash Keccak-256 of the base label.
+    /// @return baseLabel The base label string, or empty when unknown.
+    function reservedBaseLabelOf(bytes32 labelhash) external view returns (string memory baseLabel);
+
+    /// @notice Returns the window, in seconds, after which a queue or pending-claim entry lapses.
+    /// @dev Governance-configurable via @custom:function setReservationDuration. Read by the lens
+    /// to compute each pending claim's settlement deadline.
+    /// @return duration Reservation duration in seconds.
+    function reservationDuration() external view returns (uint64 duration);
+
+    /// @notice Settles up to `limit` of a user's pending claims, writing each stashed label into
+    /// the user's `LabelStore` and deploying that store when the user has none yet.
+    /// @dev Permissionless: any caller may settle any user's claims and bears the full cost,
+    /// including the `LabelStore` storage deposit, which is charged to the
+    /// transaction signer. Settlement is never destructive: the name is already minted, so this
+    /// only completes the deferred label write. Each settled entry is removed from the queue and
+    /// the user leaves the pending-claim enumeration set once their queue empties. At most
+    /// `limit` entries are processed so a large queue cannot exceed the block gas limit;
+    /// `moreRemaining` reports whether entries are left for a follow-up call, and a `limit` of
+    /// zero settles nothing. Writes are idempotent on an already-locked store slot, so a claim
+    /// whose label was independently written settles harmlessly. Emits
+    /// @custom:emits PendingClaimSettled and @custom:emits NameRegistered per settled entry, with
+    /// `settledBy` set to the caller so a third-party settlement is distinguishable from a
+    /// self-settlement.
+    /// @param user Account whose pending claims are settled.
+    /// @param limit Maximum number of entries to settle in this call.
+    /// @return settledCount Number of entries settled.
+    /// @return moreRemaining Whether the user still holds unsettled entries.
+    function settlePendingClaims(
+        address user,
+        uint256 limit
+    )
+        external
+        returns (uint256 settledCount, bool moreRemaining);
+
+    /// @notice Settles the caller's own pending claims into their `LabelStore`.
+    /// @dev Convenience for a user settling their own store: equivalent to
+    /// @custom:function settlePendingClaims with `msg.sender` and a bounded batch. The caller
+    /// deploys and pays for their store on the first write. Settles at most one bounded batch so
+    /// the call cannot exceed the block gas limit; `moreRemaining` reports whether the caller
+    /// still holds unsettled entries, in which case they call again. Emits the same
+    /// @custom:emits PendingClaimSettled and @custom:emits NameRegistered as
+    /// @custom:function settlePendingClaims.
+    /// @return moreRemaining Whether the caller still holds unsettled entries.
+    function claimLabelStore() external returns (bool moreRemaining);
+
+    /// @notice Returns a paginated slice of a user's pending claims in queue order.
+    /// @dev An empty array means the user has no pending claims at `offset`. Each entry carries
+    /// its `mintedAt`; the settlement deadline is `mintedAt + reservationDuration`. An `offset`
+    /// past the end returns an empty array rather than reverting, and a page holds at most
+    /// `DotnsConstants.MAX_PAGE_SIZE` entries.
+    /// @param user Account whose pending claims are read.
+    /// @param offset Start index into the queue.
+    /// @param limit Maximum entries to return.
+    /// @return claims Page of the user's pending claims; see @custom:struct PendingClaim.
+    function pendingClaims(
+        address user,
+        uint256 offset,
+        uint256 limit
+    )
+        external
+        view
+        returns (PendingClaim[] memory claims);
+
+    /// @notice Returns the number of pending claims currently staged for `user`.
+    /// @param user Account whose pending claims are counted.
+    /// @return count Number of staged pending claims.
+    function pendingClaimCountOf(address user) external view returns (uint256 count);
+
+    /// @notice Returns the number of users with at least one live pending claim.
+    /// @dev Exact live count, not an all-time tally: fully settled users are removed from the
+    /// enumeration set so off-chain consumers can page through every stalled user without
+    /// filtering.
+    /// @return count Number of users currently holding a pending claim.
+    function pendingClaimUserCount() external view returns (uint256 count);
+
+    /// @notice Returns a paginated slice of users with at least one live pending claim.
+    /// @dev Pair with @custom:function pendingClaims to read each user's stashed entries.
+    /// Ordering is not chronological; callers MUST NOT assume `mintedAt` is monotonic
+    /// across the slice. Returns an empty array when `offset` is past the live count, and a page
+    /// holds at most `DotnsConstants.MAX_PAGE_SIZE` entries.
+    /// @param offset Start index.
+    /// @param limit Maximum entries to return.
+    /// @return users Slice of users currently holding a pending claim.
+    function pendingClaimUsers(
+        uint256 offset,
+        uint256 limit
+    )
+        external
+        view
+        returns (address[] memory users);
+}
diff --git a/contracts/registrars/IDotnsRegistrarOld.sol b/contracts/registrars/IDotnsRegistrarOld.sol
deleted file mode 100644
index d6b120146..000000000
--- a/contracts/registrars/IDotnsRegistrarOld.sol
+++ /dev/null
@@ -1,190 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {IERC721} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
-import {IDotnsController} from "./IDotnsController.sol";
-
-/// @title Dotns Registrar
-/// @notice ERC721-backed ownership for DotNS names with controller-gated registration.
-/// @dev Intentionally minimal and policy-free. Provides ERC721 ownership for registered name
-/// token IDs and controller-gated registration; pricing, PoP enforcement, and flow-specific
-/// policy live in the controllers.
-/// @custom:security-contact admin@parity.io
-interface IDotnsRegistrarOld is IERC721 {
-    /// @notice Thrown when a name is already registered.
-    error NameNotAvailable(uint256 tokenId);
-
-    /// @notice Thrown when the caller is not an authorised controller.
-    error NotController(address caller);
-
-    /// @notice Thrown when the protocol registry has no escrow address configured.
-    error EscrowNotConfigured();
-
-    /// @notice Thrown when a standard ERC721 transfer is attempted but the recipient
-    /// tier requires a non-zero transfer fee and the caller forwarded no `msg.value`.
-    error TransferFeeRequired(uint256 tokenId, address to, uint256 requiredFee);
-
-    /// @notice Thrown when @custom:function initialize is called with the zero address as
-    /// the protocol registry.
-    error ProtocolRegistryRequired();
-
-    /// @notice Thrown when a mint, burn, or self-transfer carries `msg.value`. None of those
-    /// paths forward value onward, so attached value would be permanently trapped.
-    error UnexpectedValue();
-
-    /// @notice Thrown when @custom:function register is called with the escrow address as
-    /// `owner`, which would mint directly into escrow custody with no @custom:struct
-    /// ReleasePosition recorded.
-    error InvalidOwner();
-
-    /// @notice Thrown when @custom:function register receives an empty or non-canonical
-    /// label.
-    error InvalidLabel();
-
-    /// @notice Thrown when a transfer or a transfer-fee quote targets a soulbound name.
-    /// @dev Soulbound names are minted through the PoP gateway and are permanently
-    /// non-transferable. Raised by the `_update` transfer gate and by
-    /// @custom:function quoteTransferFee.
-    error NameSoulbound(uint256 tokenId);
-
-    /// @notice Emitted when a name is registered.
-    /// @param id The token id (namehash node) that was minted.
-    /// @param owner The address that received the name.
-    /// @param soulbound True when the name is soulbound: PoP-gateway minted and non-transferable.
-    /// Lets indexers classify registrations without a per-token @custom:function isSoulbound read.
-    event NameRegistered(uint256 indexed id, address indexed owner, bool soulbound);
-
-    /// @notice Emitted when a controller is added.
-    /// @dev Typed as the shared baseline @custom:contract IDotnsController so the commit-reveal
-    /// controller and the PoP controller (and any future controller) all fit the same signature
-    /// without
-    /// the registrar depending on any specific controller interface.
-    event ControllerAdded(IDotnsController indexed controller);
-
-    /// @notice Emitted when a controller is removed.
-    event ControllerRemoved(IDotnsController indexed controller);
-
-    /// @notice Returns whether a registration call may proceed for `id`.
-    /// @dev Signals two distinct paths to the controller. Returns `true` when the owner slot is
-    /// empty (a fresh @custom:function register call may mint) OR when the current owner is
-    /// the configured escrow and the released position's redeem window has elapsed (the
-    /// controller must then route through @custom:function IDotnsNameEscrow.reclaim instead of
-    /// @custom:function register, because `register` calls `_mint` which rejects existing
-    /// tokens). All other holders return `false`. The controller distinguishes the two `true`
-    /// cases via @custom:function exists.
-    /// Escrow custody inside the redeem window returns `false`: that window belongs to the
-    /// previous holder, who may still @custom:function IDotnsNameEscrow.redeem the name, and
-    /// reclaim would revert until it elapses. Clients wanting the exact moment a released name
-    /// becomes registrable should read `redeemableUntil` from
-    /// @custom:function IDotnsNameEscrow.getReleasePosition.
-    function available(uint256 id) external view returns (bool isAvailable);
-
-    /// @notice Registers a name permanently.
-    /// @dev Permanence is by construction: there is no `expire`, `renew`, or `release` path on
-    /// the registrar. Custody only moves via ERC721 transfers (which the registrar polices via
-    /// the fee-on-transfer hook) or via escrow reclaim. Restricted to authorised controllers
-    /// (otherwise @custom:reverts NotController) and rejects ids that are not available
-    /// (otherwise @custom:reverts NameNotAvailable). Emits @custom:emits NameRegistered on
-    /// success.
-    /// @dev When the caller is the address registered under `DotnsConstantsOld.POP_CONTROLLER`, the
-    /// name is marked soulbound and becomes permanently non-transferable (see
-    /// @custom:function isSoulbound). Provenance is read from the protocol registry at mint time,
-    /// so no other authorised controller can mint a soulbound name and the PoP controller cannot
-    /// mint an unlocked one. Public registrations from any other controller stay transferable.
-    /// @param label The human-readable label string (e.g. "alice").
-    function register(uint256 id, address owner, string calldata label) external;
-
-    /// @notice Returns whether a token is soulbound (PoP-gateway minted and non-transferable).
-    /// @dev Durable on-chain marker set once at mint by @custom:function register and never
-    /// cleared. A `true` result means every transfer overload reverts with
-    /// @custom:reverts NameSoulbound and @custom:function quoteTransferFee reverts likewise.
-    /// @param tokenId The name's token id.
-    /// @return soulbound True when the name was minted through the PoP gateway.
-    function isSoulbound(uint256 tokenId) external view returns (bool soulbound);
-
-    /// @notice Returns whether a given token id has been minted.
-    function exists(uint256 tokenId) external view returns (bool tokenExists);
-
-    /// @notice Adds an authorised controller.
-    /// @dev Typed against the baseline `IDotnsController` (not a concrete subtype) so a single
-    /// authorisation surface accepts every controller flavour (commit-reveal, PoP gateway,
-    /// future variants) without per-flavour setters. Owner-gated (otherwise
-    /// @custom:reverts OwnableUnauthorizedAccount); emits @custom:emits ControllerAdded on
-    /// success.
-    function addController(IDotnsController controller) external;
-
-    /// @notice Removes an authorised controller.
-    /// @dev Mirrors the @custom:function addController baseline-typed signature so any registered
-    /// controller can
-    /// be revoked through the same entry point. Owner-gated (otherwise
-    /// @custom:reverts OwnableUnauthorizedAccount); emits @custom:emits ControllerRemoved on
-    /// success.
-    function removeController(IDotnsController controller) external;
-
-    /// @notice Returns whether `controller` is currently authorised to call
-    /// @custom:function register.
-    /// @param controller Candidate controller.
-    /// @return authorised True when `controller` was added via @custom:function addController and
-    /// has not been removed.
-    function controllers(IDotnsController controller) external view returns (bool authorised);
-
-    /// @notice Returns the human-readable label a token was registered with.
-    /// @dev Canonical state source for the label string; any client that holds a node or
-    /// tokenId can resolve the original label in one view call without scanning registration
-    /// events. Returns the empty string when the token does not exist.
-    function labelOf(uint256 tokenId) external view returns (string memory label);
-
-    /// @notice Quotes the additional native fee required to transfer a token to `to`.
-    /// @dev Returns the fee from @custom:function PopRulesOld.transferFloor: the name's own price
-    /// as the maximum of (i) the reach component charged when the recipient does not meet
-    /// the label's required tier and (ii) the downgrade component charged when the
-    /// recipient tier is strictly below the sender tier. Self-transfers and
-    /// escrow-touching transfers (release into escrow, reclaim out of escrow) return
-    /// zero. A token whose sender has no stored label also returns zero because there
-    /// is no label-derived price to charge against. Soulbound names are non-transferable
-    /// and have no transfer price, so a soulbound `tokenId` reverts with
-    /// @custom:reverts NameSoulbound rather than returning zero. Rejects a zero `to` with
-    /// @custom:reverts ERC721InvalidReceiver, an unminted `tokenId` with
-    /// @custom:reverts ERC721NonexistentToken via the underlying `ownerOf`, and requires
-    /// the protocol registry to have an escrow configured (otherwise
-    /// @custom:reverts EscrowNotConfigured). Returns zero when the protocol registry
-    /// has no `STORE_FACTORY` configured because no label-derived price is reachable.
-    function quoteTransferFee(
-        uint256 tokenId,
-        address to
-    )
-        external
-        view
-        returns (uint256 requiredFee);
-
-    /// @inheritdoc IERC721
-    /// @dev The registrar's `_update` hook consults @custom:function PopRulesOld.transferFloor
-    /// to compute the required transfer fee; if the caller does not forward at least that
-    /// amount as `msg.value`, the transfer reverts with @custom:reverts TransferFeeRequired.
-    /// A soulbound name is non-transferable and reverts with @custom:reverts NameSoulbound.
-    /// The `payable` modifier on every transfer overload exists so the fee can be forwarded
-    /// in the same call.
-    function safeTransferFrom(
-        address from,
-        address to,
-        uint256 tokenId,
-        bytes calldata data
-    )
-        external
-        payable
-        override;
-
-    /// @inheritdoc IERC721
-    /// @dev Subject to the same fee-on-transfer gate as the four-argument overload; reverts with
-    /// @custom:reverts TransferFeeRequired when the recipient owes a non-zero transfer fee and
-    /// the caller has not forwarded it as `msg.value`, and with @custom:reverts NameSoulbound when
-    /// the token is soulbound.
-    function safeTransferFrom(address from, address to, uint256 tokenId) external payable override;
-
-    /// @inheritdoc IERC721
-    /// @dev Subject to the same fee-on-transfer gate as the safe overloads; reverts with
-    /// @custom:reverts TransferFeeRequired when the recipient owes a non-zero transfer fee and
-    /// the caller has not forwarded it as `msg.value`, and with @custom:reverts NameSoulbound when
-    /// the token is soulbound.
-    function transferFrom(address from, address to, uint256 tokenId) external payable override;
-}
diff --git a/contracts/registry/DotnsProtocolRegistryOld.sol b/contracts/registry/DotnsProtocolRegistryOld.sol
deleted file mode 100644
index 35f91d2ee..000000000
--- a/contracts/registry/DotnsProtocolRegistryOld.sol
+++ /dev/null
@@ -1,112 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-import {IDotnsProtocolRegistryOld} from "./IDotnsProtocolRegistryOld.sol";
-import {LabelUtils} from "../utils/LabelUtils.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-
-/// @title Dotns Protocol Registry
-/// @author Parity
-/// @notice Upgradeable address registry for all DotNS protocol contracts, and the authority for
-///         the network's top-level domain.
-/// @dev Single source of truth for sibling-contract lookups. All siblings resolve each other via
-///      well-known `bytes32` constants in `DotnsConstantsOld` rather than holding direct addresses,
-///      so an upgrade or rewire only mutates this contract. The TLD node and suffix are set once
-///      at initialisation and read live by every consumer, so a network runs one TLD without
-///      recompiling its contracts.
-/// @custom:security-contact admin@parity.io
-contract DotnsProtocolRegistryOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    IDotnsProtocolRegistryOld
-{
-    using StringUtils for string;
-
-    /// @notice Address stored for each well-known protocol key.
-    mapping(bytes32 key => address addr) private _addresses;
-
-    /// @notice Reference count per address, incremented for every key it is registered under.
-    /// @dev Lets `isRegisteredAddress` answer in O(1) and survive a contract being mapped to
-    ///      multiple keys without being treated as deregistered when only one key is rewired.
-    mapping(address addr => uint256 refcount) private _registeredRefcount;
-
-    /// @notice Namehash of the TLD node, `namehash(0, keccak256(bytes(tldLabel)))`.
-    bytes32 private _tldNode;
-
-    /// @notice TLD suffix including the leading dot, e.g. `.dot`.
-    string private _tld;
-
-    uint256[50] private __gap;
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the protocol registry and fixes the network's TLD.
-    /// @dev Callable exactly once via `Initializable`, otherwise
-    ///      @custom:reverts InvalidInitialization. Sets the deployer as owner. `tldLabel` is the
-    ///      bare label without a dot (e.g. `dot`, `paseo`); it must be a single DNS label,
-    ///      otherwise @custom:reverts InvalidTld. The TLD is fixed here because changing it after
-    ///      names exist would reroot every node.
-    /// @param tldLabel Bare TLD label, without the leading dot.
-    function initialize(string calldata tldLabel) external initializer {
-        __Ownable_init(msg.sender);
-
-        require(tldLabel.isSingleLabel(), InvalidTld());
-        _tldNode = LabelUtils.namehashUnder(bytes32(0), LabelUtils.labelhash(tldLabel));
-        _tld = string.concat(".", tldLabel);
-    }
-
-    /// @inheritdoc IDotnsProtocolRegistryOld
-    function get(bytes32 key) external view override returns (address addr) {
-        return _addresses[key];
-    }
-
-    /// @inheritdoc IDotnsProtocolRegistryOld
-    function set(bytes32 key, address addr) external override onlyOwner {
-        require(addr != address(0), ZeroAddress());
-
-        address previousAddress = _addresses[key];
-        if (previousAddress == addr) return;
-
-        if (previousAddress != address(0)) {
-            --_registeredRefcount[previousAddress];
-        }
-        ++_registeredRefcount[addr];
-
-        _addresses[key] = addr;
-        emit AddressUpdated(key, addr);
-    }
-
-    /// @inheritdoc IDotnsProtocolRegistryOld
-    function isRegisteredAddress(address addr) external view override returns (bool registered) {
-        return addr != address(0) && _registeredRefcount[addr] > 0;
-    }
-
-    /// @inheritdoc IDotnsProtocolRegistryOld
-    function tldNode() external view override returns (bytes32 node) {
-        return _tldNode;
-    }
-
-    /// @inheritdoc IDotnsProtocolRegistryOld
-    function tld() external view override returns (string memory suffix) {
-        return _tld;
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/registry/DotnsRegistryOld.sol b/contracts/registry/DotnsRegistryOld.sol
index 0acef37cc..0d4d7fd5b 100644
--- a/contracts/registry/DotnsRegistryOld.sol
+++ b/contracts/registry/DotnsRegistryOld.sol
@@ -6,31 +6,31 @@ import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/U
 import {
     OwnableUpgradeable
 } from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {IDotnsRegistryOld} from "./IDotnsRegistryOld.sol";
+import {IDotnsRegistry} from "./IDotnsRegistry.sol";
 import {IDotnsController} from "../registrars/IDotnsController.sol";
-import {IDotnsRegistrarOld} from "../registrars/IDotnsRegistrarOld.sol";
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
-import {StoreUtilsOld} from "../utils/StoreUtilsOld.sol";
+import {IDotnsRegistrar} from "../registrars/IDotnsRegistrar.sol";
+import {IStoreFactory} from "../store/IStoreFactory.sol";
+import {StoreUtils} from "../utils/StoreUtils.sol";
 import {LabelUtils} from "../utils/LabelUtils.sol";
-import {IDotnsProtocolRegistryOld} from "./IDotnsProtocolRegistryOld.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
+import {IDotnsProtocolRegistry} from "./IDotnsProtocolRegistry.sol";
+import {StringUtilsOld} from "../utils/StringUtilsOld.sol";
+import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
 /// @title Dotns Registry
 /// @author Parity
 /// @notice Upgradeable on-chain registry for hierarchical name ownership and resolution.
 /// @dev Tokenised second-level nodes store `owner == address(0)` as a sentinel and defer to
-///      `IDotnsRegistrarOld.ownerOf`; subnodes carry an explicit owner address in `records`.
+///      `IDotnsRegistrar.ownerOf`; subnodes carry an explicit owner address in `records`.
 /// @custom:security-contact admin@parity.io
-contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable, IDotnsRegistryOld {
-    using StoreUtilsOld for IStoreFactoryOld;
-    using StringUtils for *;
+contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable, IDotnsRegistry {
+    using StoreUtils for IStoreFactory;
+    using StringUtilsOld for *;
 
     /// @notice Mapping of node identifiers to records.
     mapping(bytes32 node => Record record) private records;
 
     /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
+    IDotnsProtocolRegistry public protocolRegistry;
 
     uint256[50] private __gap;
 
@@ -55,15 +55,22 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
     /// @dev Callable exactly once via `Initializable`, otherwise
     ///      @custom:reverts InvalidInitialization. `registry` must be non-zero, otherwise
     ///      @custom:reverts NotAllowed.
+    /// @param initialOwner Address that owns the contract once initialised.
     /// @param registry Protocol-level address registry used to resolve sibling contracts.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __Ownable_init(msg.sender);
+    function initialize(
+        address initialOwner,
+        IDotnsProtocolRegistry registry
+    )
+        external
+        initializer
+    {
+        __Ownable_init(initialOwner);
 
         require(address(registry) != address(0), NotAllowed());
         protocolRegistry = registry;
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function setSubnodeOwner(SubnodeRecord calldata record)
         external
         override
@@ -73,6 +80,13 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         address newOwner = record.owner;
         require(newOwner != address(0), NotAllowed());
 
+        // Deferring the store write (persist == false) is a controller workflow: the deferred label
+        // is backfilled later by an authorised writer, and only a registered controller drives that
+        // path. Every other caller must persist eagerly rather than strand an unindexed label.
+        if (!record.persist) {
+            _onlyRegistrarController();
+        }
+
         bytes32 parentNode = record.parentNode;
         string calldata subLabel = record.subLabel;
         string calldata parentLabel = record.parentLabel;
@@ -84,7 +98,7 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         subnode = LabelUtils.namehashUnder(parentNode, labelhash);
 
         Record storage existing = records[subnode];
-        address reverseResolver = protocolRegistry.get(DotnsConstantsOld.REVERSE_RESOLVER);
+        address reverseResolver = protocolRegistry.get(DotnsConstants.REVERSE_RESOLVER);
         if (existing.exists) {
             address previousOwner = existing.owner;
             // Reset the resolver pointer on reassignment so the prior subnode owner's resolver
@@ -116,11 +130,10 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         emit NewOwner(parentNode, labelhash, newOwner);
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function setOwner(bytes32 node, address newOwner) external override onlyRegistrarController {
         require(newOwner != address(0), NotAllowed());
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+        IDotnsRegistrar registrar = IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
         require(registrar.ownerOf(uint256(node)) == newOwner, NotAuthorised());
 
         // The resolver pointer is reset to the default reverse resolver on every call to this
@@ -131,20 +144,20 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         // Owner remains the zero sentinel so reads delegate to the registrar's ERC-721 holder.
         records[node] = Record({
             owner: address(0),
-            resolver: protocolRegistry.get(DotnsConstantsOld.REVERSE_RESOLVER),
+            resolver: protocolRegistry.get(DotnsConstants.REVERSE_RESOLVER),
             exists: true
         });
 
         emit NodeTransferred(node, newOwner);
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function setResolver(bytes32 node, address newResolver) external override authorised(node) {
         records[node].resolver = newResolver;
         emit NewResolver(node, newResolver);
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function setSubnodeResolver(SubnodeResolverRecord calldata record)
         external
         override
@@ -165,7 +178,7 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         emit NewResolver(subnode, record.resolver);
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function owner(bytes32 node) external view override returns (address) {
         Record storage record = records[node];
         // Read `owner` first: a non-zero stored owner proves the record exists and is a subnode,
@@ -174,22 +187,21 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
         address storedOwner = record.owner;
         if (storedOwner != address(0)) return storedOwner;
         if (!record.exists) return address(0);
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+        IDotnsRegistrar registrar = IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
         return registrar.ownerOf(uint256(node));
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function resolver(bytes32 node) external view override returns (address) {
         return records[node].resolver;
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function recordExists(bytes32 node) external view override returns (bool) {
         return records[node].exists;
     }
 
-    /// @inheritdoc IDotnsRegistryOld
+    /// @inheritdoc IDotnsRegistry
     function isAuthorised(
         bytes32 node,
         address account
@@ -212,9 +224,8 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
     )
         internal
     {
-        IStoreFactoryOld factory =
-            IStoreFactoryOld(protocolRegistry.get(DotnsConstantsOld.STORE_FACTORY));
-        factory.writeLabel(storeOwner, node, fullName);
+        IStoreFactory factory = IStoreFactory(protocolRegistry.get(DotnsConstants.STORE_FACTORY));
+        factory.writeNewLabel(storeOwner, node, fullName);
     }
 
     /// @notice Computes the namehash of `parentLabel` rooted at the network's TLD node.
@@ -277,8 +288,7 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
 
         if (!record.exists) return false;
 
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+        IDotnsRegistrar registrar = IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
         uint256 tokenId = uint256(node);
         address tokenOwner = registrar.ownerOf(tokenId);
         if (account == tokenOwner) return true;
@@ -294,17 +304,20 @@ contract DotnsRegistryOld is Initializable, UUPSUpgradeable, OwnableUpgradeable,
     ///      in one place and lets commit-reveal and PoP controllers coexist without registry
     ///      reconfiguration on each addition.
     function _onlyRegistrarController() internal view {
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
+        IDotnsRegistrar registrar = IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
         require(registrar.controllers(IDotnsController(msg.sender)), NotAuthorised());
     }
 
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
+    /// @notice Returns the release this network declares it runs, read live from the protocol
+    ///         registry so every DotNS contract reports one synchronised value.
+    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
+    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
+    ///      not this contract's build; per-contract identity is the codehash declared on the
+    ///      registry.
+    /// @return versionString Declared release as bare semver, empty when never declared.
+    function version() external view virtual returns (string memory versionString) {
+        versionString = protocolRegistry.protocolVersion();
     }
-
     /// @inheritdoc UUPSUpgradeable
     function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
 }
diff --git a/contracts/registry/IDotnsProtocolRegistryOld.sol b/contracts/registry/IDotnsProtocolRegistryOld.sol
deleted file mode 100644
index 16c4eb847..000000000
--- a/contracts/registry/IDotnsProtocolRegistryOld.sol
+++ /dev/null
@@ -1,51 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-/// @title IDotnsProtocolRegistryOld
-/// @author Parity
-/// @notice Interface for the DotNS protocol-level address registry.
-/// @dev Single source of truth for sibling lookups. Contracts resolve each other via well-known
-///      `bytes32` constants in `DotnsConstantsOld` so an upgrade or rewire only mutates the
-///      registry, never the consumers. The registry also holds the network's top-level domain,
-///      so every consumer reads one TLD rather than compiling its own.
-/// @custom:security-contact admin@parity.io
-interface IDotnsProtocolRegistryOld {
-    /// @notice Emitted when a protocol address is set or updated.
-    event AddressUpdated(bytes32 indexed key, address indexed addr);
-
-    /// @notice Thrown when a zero address is provided where one is not allowed.
-    error ZeroAddress();
-
-    /// @notice Thrown when the TLD label supplied at initialisation is not a single DNS label.
-    error InvalidTld();
-
-    /// @notice Returns the address stored for a given key.
-    /// @dev Returns `address(0)` when the key is unset; callers must validate when non-zero is
-    ///      required.
-    function get(bytes32 key) external view returns (address addr);
-
-    /// @notice Sets or updates the address for a given key.
-    /// @dev Owner-restricted, otherwise @custom:reverts OwnableUnauthorizedAccount. `addr`
-    ///      must be non-zero, otherwise @custom:reverts ZeroAddress. Idempotent when the new
-    ///      value matches the stored one (no event emitted in that case). Maintains a
-    ///      per-address refcount so the same contract can occupy multiple keys without losing
-    ///      its registered status until every key is rewired. Emits
-    ///      @custom:emits AddressUpdated on each effective change.
-    function set(bytes32 key, address addr) external;
-
-    /// @notice Returns true iff `addr` is currently registered under at least one well-known key.
-    /// @dev O(1) refcount-backed lookup. Canonical peer-trust check consumed by `LabelStore`
-    ///      writes and `StoreFactory` deploys; only addresses governance has actively
-    ///      registered return true. Treats `address(0)` as never registered regardless of
-    ///      refcount.
-    function isRegisteredAddress(address addr) external view returns (bool registered);
-
-    /// @notice Returns the namehash of the network's TLD node.
-    /// @dev `namehash(0, keccak256(bytes(tldLabel)))`, fixed at initialisation. Consumers use it
-    ///      as the root parent when deriving a name's node.
-    function tldNode() external view returns (bytes32 node);
-
-    /// @notice Returns the network's TLD suffix, including the leading dot (e.g. `.dot`).
-    /// @dev Fixed at initialisation. Consumers append it when rendering a label as a full name.
-    function tld() external view returns (string memory suffix);
-}
diff --git a/contracts/registry/IDotnsRegistryOld.sol b/contracts/registry/IDotnsRegistryOld.sol
deleted file mode 100644
index 892ae3edb..000000000
--- a/contracts/registry/IDotnsRegistryOld.sol
+++ /dev/null
@@ -1,164 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-/// @title IDotnsRegistryOld
-/// @author Parity
-/// @notice Minimal on-chain registry for hierarchical name ownership and resolution.
-/// @dev Tokenised second-level nodes are owned through the registrar (ERC-721); subnodes are
-///      owned directly by the address stored in `Record.owner`.
-/// @custom:security-contact admin@parity.io
-interface IDotnsRegistryOld {
-    /// @notice Record describing a subnode creation request.
-    /// @param subLabel Human readable subnode label e.g "alice".
-    /// @param parentLabel Canonical parent name without the TLD suffix e.g. bob or child.bob.
-    /// @param owner Address to assign as owner of the created subnode.
-    /// @param persist Whether to index the subnode into the owner's `LabelStore`, deploying it on
-    ///        demand. When false the ownership and resolver record is still written, but the store
-    ///        is left untouched. The store write is gated to protocol store writers (the registrar
-    ///        and its controllers), not the name owner, so a deferring writer indexes the label
-    ///        itself by deploying the owner's store and writing to it. The registry writes the
-    /// store only on creation or on a reassignment to a new owner, so a later same-owner re-call
-    ///        with `persist` true does not backfill it; the authorised writer backfills it
-    /// directly.
-    struct SubnodeRecord {
-        bytes32 parentNode;
-        string subLabel;
-        string parentLabel;
-        address owner;
-        bool persist;
-    }
-
-    /// @notice Record describing the state of a node.
-    /// @param owner Address that owns the node, or address(0) sentinel for tokenised nodes.
-    /// @param resolver Address of the resolver associated with the node.
-    /// @param exists Whether the node has been explicitly created.
-    struct Record {
-        address owner;
-        address resolver;
-        bool exists;
-    }
-
-    /// @notice Emitted when a new subnode owner is set.
-    /// @param node Parent node.
-    /// @param label Labelhash of the created subnode.
-    event NewOwner(bytes32 indexed node, bytes32 indexed label, address owner);
-
-    /// @notice Emitted when ownership of a node is transferred.
-    event NodeTransferred(bytes32 indexed node, address owner);
-
-    /// @notice Emitted when a resolver is set or updated.
-    event NewResolver(bytes32 indexed node, address resolver);
-
-    /// @notice Thrown when an invalid (zero) address is provided.
-    error NotAllowed();
-
-    /// @notice Thrown when the caller is not authorised.
-    error NotAuthorised();
-
-    /// @notice Thrown when the caller is not the registry controller.
-    error NotRegistryController();
-
-    /// @notice Thrown when attempting to create a node that already exists.
-    error NodeAlreadyOwned(bytes32 node);
-
-    /// @notice Thrown when a sublabel is not a canonical lowercase ASCII DNS label.
-    error InvalidLabel();
-
-    /// @notice Thrown when the supplied parent label does not match the parent node.
-    error ParentLabelMismatch();
-
-    /// @notice Record describing a subnode resolver update request.
-    /// @param subLabel Human-readable subnode label e.g "alice".
-    /// @param parentLabel Canonical parent name without the TLD suffix e.g bob or child.bob.
-    /// @param resolver Resolver contract address (zero clears).
-    struct SubnodeResolverRecord {
-        bytes32 parentNode;
-        string subLabel;
-        string parentLabel;
-        address resolver;
-    }
-
-    /// @notice Creates or reassigns a subnode and assigns its owner.
-    /// @dev Callable only by the current owner of `record.parentNode`, otherwise
-    ///      @custom:reverts NotAuthorised. The new owner address must be non-zero, otherwise
-    ///      @custom:reverts NotAllowed. `record.subLabel` must be a single canonical DNS label
-    ///      (otherwise @custom:reverts InvalidLabel) and `record.parentLabel` must be a name
-    ///      path whose namehash matches `record.parentNode` (otherwise
-    ///      @custom:reverts ParentLabelMismatch). Subnodes are parent-sovereign: the current
-    ///      `record.parentNode` owner may reassign or rotate a subnode's resolver at any time
-    ///      without the prior subnode owner's consent. On reassignment the resolver pointer is
-    ///      reset to the protocol-registered default reverse resolver so a prior subnode
-    ///      owner's resolver cannot be inherited by the next holder (records on other resolver
-    ///      contracts are keyed by node and are not cleared by this function; downstream
-    ///      consumers should gate resolver reads on current ownership). Indexes the subnode
-    ///      under the new owner's `LabelStore` keyed by the namehashed `subnode` so off-chain
-    ///      consumers can enumerate names per address. Indexing into the owner's `LabelStore` is
-    ///      governed by `record.persist` (see @custom:struct SubnodeRecord); the ownership and
-    ///      resolver record is written either way. Emits @custom:emits NewOwner on each successful
-    ///      assignment.
-    function setSubnodeOwner(SubnodeRecord calldata record) external returns (bytes32 subnode);
-
-    /// @notice Sets the resolver for an existing subnode.
-    /// @dev Callable only by the current owner of `record.parentNode`, otherwise
-    ///      @custom:reverts NotAuthorised. The subnode owner can still update the resolver
-    ///      directly via `setResolver`. Both entry points emit the same `NewResolver(subnode,
-    ///      ...)` event, so the parent can silently override a subnode owner's chosen resolver:
-    ///      this is the parent-sovereign hierarchy applied to resolution. Off-chain consumers
-    ///      that surface trust signals to subnode owners should treat any resolver rotation as
-    ///      a re-attestation prompt. `record.subLabel` must be a single canonical DNS label
-    ///      (otherwise @custom:reverts InvalidLabel) and `record.parentLabel` must be a name
-    ///      path whose namehash matches `record.parentNode` (otherwise
-    ///      @custom:reverts ParentLabelMismatch). The resulting subnode must already exist,
-    ///      otherwise @custom:reverts NotAuthorised. Emits @custom:emits NewResolver on
-    ///      success.
-    function setSubnodeResolver(SubnodeResolverRecord calldata record) external;
-
-    /// @notice Creates or resets a node record for a tokenised base registration.
-    /// @dev Restricted to the registrar's controllers, otherwise @custom:reverts NotAuthorised.
-    ///      `newOwner` must be non-zero (otherwise @custom:reverts NotAllowed) and must match
-    ///      the ERC-721 owner reported by the registrar (otherwise
-    ///      @custom:reverts NotAuthorised). The function is callable both on a fresh
-    ///      registration and on every reclaim from escrow: each call rewrites
-    ///      `records[node].resolver` to the protocol-registered default reverse resolver so a
-    ///      prior owner's resolver pointer (and the records keyed under it) cannot be inherited
-    ///      by the next holder across that recycle. A secondary-market ERC-721 `transferFrom` does
-    ///      not call the registry, so a name sold directly keeps the seller's resolver pointer
-    ///      until the buyer overwrites it. Stores `owner = address(0)` as a sentinel so reads
-    ///      delegate to `IDotnsRegistrarOld.ownerOf` and ERC-721 transfers remain authoritative.
-    /// Emits
-    ///      @custom:emits NodeTransferred on success.
-    function setOwner(bytes32 node, address newOwner) external;
-
-    /// @notice Sets or clears the resolver for a node.
-    /// @dev Callable only by the current node owner, otherwise @custom:reverts NotAuthorised.
-    ///      For tokenised nodes, authorisation falls back to ERC-721 owner / approved /
-    ///      operator-for-all via the registrar. The registry does not validate
-    ///      `resolverAddr` against any interface or code presence; off-chain consumers must
-    ///      verify resolver shape before trusting reads. Emits @custom:emits NewResolver on
-    ///      success.
-    /// @param resolverAddr Resolver contract address (zero clears).
-    function setResolver(bytes32 node, address resolverAddr) external;
-
-    /// @notice Returns the owner of a node.
-    /// @dev For tokenised nodes the stored owner is the zero sentinel; the implementation falls
-    ///      back to `IDotnsRegistrarOld.ownerOf(uint256(node))`.
-    function owner(bytes32 node) external view returns (address);
-
-    /// @notice Returns the resolver of a node.
-    function resolver(bytes32 node) external view returns (address);
-
-    /// @notice Returns whether a node exists.
-    function recordExists(bytes32 node) external view returns (bool);
-
-    /// @notice Returns whether `account` is authorised to manage `node`.
-    /// @dev For subnodes, authority is the explicit stored owner. For tokenised nodes it is the
-    ///      ERC-721 owner, an address approved for the token, or an operator approved for all of
-    ///      the owner's tokens via the registrar. This is the canonical authorisation check the
-    ///      registry enforces on owner-gated entry points; sibling contracts may consult it so a
-    ///      single registrar-level approval delegates management across the protocol. Returns
-    ///      false for a node that does not exist.
-    /// @param node Node identifier.
-    /// @param account Address whose authority is being checked.
-    /// @return authorisedFlag True when `account` may manage `node`.
-    function isAuthorised(bytes32 node, address account) external view returns (bool authorisedFlag);
-}
diff --git a/contracts/resolvers/DotnsContentResolverOld.sol b/contracts/resolvers/DotnsContentResolverOld.sol
deleted file mode 100644
index 2a59ba308..000000000
--- a/contracts/resolvers/DotnsContentResolverOld.sol
+++ /dev/null
@@ -1,152 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {IDotnsContentResolver} from "./IDotnsContentResolver.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-
-/// @title Dotns Content Resolver
-/// @notice Implements `IDotnsContentResolver` interface with content hash, text records, and
-/// operator approvals.
-/// @dev Writes are gated on the registry's authorisation for the node (owner or registrar-level
-///      approval) or on a resolver-local operator the owner has approved, rather than on a
-///      privileged writer address. Content records are user-managed metadata, so write authority
-///      follows the node owner across transfers and honours the same delegates the registry
-///      recognises.
-/// @custom:security-contact admin@parity.io
-contract DotnsContentResolverOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ERC165Upgradeable,
-    IDotnsContentResolver
-{
-    /// @notice Stores all content hash mappings
-    mapping(bytes32 node => bytes contentHash) private contenthashes;
-
-    /// @notice Stores all text records
-    mapping(bytes32 node => mapping(string key => string value)) private textRecords;
-
-    /// @notice Store all approval mapping
-    mapping(address owner => mapping(address operator => bool approved)) private operators;
-
-    /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @dev Reserved storage space to allow for layout changes in the future.
-    // forge-lint: disable-next-line(mixed-case-variable)
-    uint256[50] private __gap;
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the content resolver.
-    /// @dev Runs once through the UUPS proxy; a repeat call reverts with
-    ///      @custom:reverts InvalidInitialization. Emits @custom:emits OwnershipTransferred when
-    ///      `msg.sender` is recorded as the initial owner and @custom:emits Initialized once
-    ///      setup completes.
-    /// @param registry Protocol-level address registry used to resolve sibling contracts.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __Ownable_init(msg.sender);
-        __ERC165_init();
-        protocolRegistry = registry;
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function setContenthash(bytes32 node, bytes calldata hash) external override {
-        _requireNodeOwnerOrOperator(node);
-        contenthashes[node] = hash;
-        emit ContentHashUpdated(node, hash);
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function contenthash(bytes32 node) external view override returns (bytes memory hash) {
-        return contenthashes[node];
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function setText(bytes32 node, string calldata key, string calldata value) external override {
-        _requireNodeOwnerOrOperator(node);
-        textRecords[node][key] = value;
-        emit TextUpdated(node, key, value);
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function text(
-        bytes32 node,
-        string calldata key
-    )
-        external
-        view
-        override
-        returns (string memory value)
-    {
-        return textRecords[node][key];
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function setApprovalForAll(address operator, bool approved) external override {
-        operators[msg.sender][operator] = approved;
-        emit ApprovalForAll(msg.sender, operator, approved);
-    }
-
-    /// @inheritdoc IDotnsContentResolver
-    function isApprovedForAll(
-        address owner,
-        address operator
-    )
-        external
-        view
-        override
-        returns (bool)
-    {
-        return operators[owner][operator];
-    }
-
-    /// @notice Ensures the caller may write records for `node`.
-    /// @dev Authority is granted to the node owner, to a resolver-local operator the owner has
-    ///      approved for all of their records, or to any address the registry deems authorised
-    ///      for the node. Delegating through the registry means a single registrar-level
-    ///      approval (ERC-721 owner / approved / operator-for-all) also confers record-write
-    ///      authority, while the resolver-local operator mapping remains a narrower record-only
-    ///      delegation that grants no power over ownership or transfers. The cheap owner and
-    ///      local-operator checks run before the cross-contract registry call.
-    /// @param node Node identifier.
-    function _requireNodeOwnerOrOperator(bytes32 node) internal view {
-        IDotnsRegistryOld _registry =
-            IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY));
-        address nodeOwner = _registry.owner(node);
-        require(
-            msg.sender == nodeOwner || operators[nodeOwner][msg.sender]
-                || _registry.isAuthorised(node, msg.sender),
-            NotAuthorised(node, msg.sender)
-        );
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @inheritdoc ERC165Upgradeable
-    function supportsInterface(bytes4 interfaceId) public view override returns (bool) {
-        return interfaceId == type(IDotnsContentResolver).interfaceId
-            || super.supportsInterface(interfaceId);
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/resolvers/DotnsPopResolverOld.sol b/contracts/resolvers/DotnsPopResolverOld.sol
index 490a92472..21b92fbf8 100644
--- a/contracts/resolvers/DotnsPopResolverOld.sol
+++ b/contracts/resolvers/DotnsPopResolverOld.sol
@@ -10,9 +10,9 @@ import {
     ERC165Upgradeable
 } from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
 
-import {IDotnsPopResolver} from "./IDotnsPopResolver.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
+import {IDotnsPopResolverOld} from "./IDotnsPopResolverOld.sol";
+import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
+import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
 /// @title DotnsPopResolverOld
 /// @notice Per-node resolver holding records produced by the PoP username flow.
@@ -26,10 +26,10 @@ contract DotnsPopResolverOld is
     UUPSUpgradeable,
     OwnableUpgradeable,
     ERC165Upgradeable,
-    IDotnsPopResolver
+    IDotnsPopResolverOld
 {
     /// @notice Protocol-level address registry used to resolve the authorised writer.
-    IDotnsProtocolRegistryOld public protocolRegistry;
+    IDotnsProtocolRegistry public protocolRegistry;
 
     /// @notice Stored chat-key bytes keyed by node.
     mapping(bytes32 node => bytes chatKey) private _chatKeys;
@@ -67,14 +67,21 @@ contract DotnsPopResolverOld is
     ///      setup needs because the authorised writer is resolved dynamically through
     ///      `POP_CONTROLLER`. Emits @custom:emits OwnershipTransferred when `msg.sender` is
     ///      recorded as the initial owner and @custom:emits Initialized once setup completes.
+    /// @param initialOwner Address that owns the contract once initialised.
     /// @param registry Protocol-level address registry used for writer resolution.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __Ownable_init(msg.sender);
+    function initialize(
+        address initialOwner,
+        IDotnsProtocolRegistry registry
+    )
+        external
+        initializer
+    {
+        __Ownable_init(initialOwner);
         __ERC165_init();
         protocolRegistry = registry;
     }
 
-    /// @inheritdoc IDotnsPopResolver
+    /// @inheritdoc IDotnsPopResolverOld
     function setChatKey(
         bytes32 node,
         bytes calldata chatKeyBytes
@@ -88,7 +95,7 @@ contract DotnsPopResolverOld is
         emit ChatKeyUpdated(node, chatKeyBytes);
     }
 
-    /// @inheritdoc IDotnsPopResolver
+    /// @inheritdoc IDotnsPopResolverOld
     function setLiteLink(
         bytes32 fullNode,
         bytes32 liteLabelhash
@@ -110,39 +117,42 @@ contract DotnsPopResolverOld is
         emit LiteLinkUpdated(fullNode, liteLabelhash);
     }
 
-    /// @inheritdoc IDotnsPopResolver
+    /// @inheritdoc IDotnsPopResolverOld
     function chatKey(bytes32 node) external view override returns (bytes memory) {
         return _chatKeys[node];
     }
 
-    /// @inheritdoc IDotnsPopResolver
+    /// @inheritdoc IDotnsPopResolverOld
     function liteLink(bytes32 fullNode) external view override returns (bytes32) {
         return _liteLinks[fullNode];
     }
 
-    /// @inheritdoc IDotnsPopResolver
+    /// @inheritdoc IDotnsPopResolverOld
     function fullClaim(bytes32 liteLabelhash) external view override returns (bytes32) {
         return _fullClaims[liteLabelhash];
     }
 
-    /// @notice Returns implementation version.
-    /// @dev Bumped on every upgrade. Used by deployment scripts as a
-    ///      post-upgrade assertion target.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
+    /// @notice Returns the release this network declares it runs, read live from the protocol
+    ///         registry so every DotNS contract reports one synchronised value.
+    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
+    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
+    ///      not this contract's build; per-contract identity is the codehash declared on the
+    ///      registry.
+    /// @return versionString Declared release as bare semver, empty when never declared.
+    function version() external view virtual returns (string memory versionString) {
+        versionString = protocolRegistry.protocolVersion();
     }
 
     /// @inheritdoc ERC165Upgradeable
     function supportsInterface(bytes4 interfaceId) public view override returns (bool) {
         return
-            interfaceId == type(IDotnsPopResolver).interfaceId
+            interfaceId == type(IDotnsPopResolverOld).interfaceId
                 || super.supportsInterface(interfaceId);
     }
 
     /// @notice Internal check enforcing PoP-controller-only access.
     function _onlyPopController() internal view {
-        address popController = protocolRegistry.get(DotnsConstantsOld.POP_CONTROLLER);
+        address popController = protocolRegistry.get(DotnsConstants.POP_CONTROLLER);
         require(msg.sender == popController, NotPopController(msg.sender));
     }
 
diff --git a/contracts/resolvers/DotnsResolverOld.sol b/contracts/resolvers/DotnsResolverOld.sol
deleted file mode 100644
index 59661989e..000000000
--- a/contracts/resolvers/DotnsResolverOld.sol
+++ /dev/null
@@ -1,100 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-
-import {IDotnsResolver} from "./IDotnsResolver.sol";
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-
-/// @title Dotns Resolver
-/// @notice Stores forward-resolution address records for DotNS nodes
-/// @dev Writes are gated on node ownership in the forward registry, not on a
-///      privileged writer address. Address records describe where a name points
-///      and only the current node owner has the authority to set that target.
-/// @custom:security-contact admin@parity.io
-contract DotnsResolverOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ERC165Upgradeable,
-    IDotnsResolver
-{
-    /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @dev Reserved storage space to allow for layout changes in the future.
-    // forge-lint: disable-next-line(mixed-case-variable)
-    uint256[50] private __gap;
-
-    /// @notice Node => resolved address.
-    mapping(bytes32 node => address owner) private addresses;
-
-    /// @notice Restricts access to the owner of `node` as recorded in the registry.
-    /// @param node Node identifier.
-    modifier onlyNodeOwner(bytes32 node) {
-        _onlyNodeOwner(node);
-        _;
-    }
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the resolver.
-    /// @dev Runs once through the UUPS proxy; a repeat call reverts with
-    ///      @custom:reverts InvalidInitialization. Emits @custom:emits OwnershipTransferred when
-    ///      `msg.sender` is recorded as the initial owner and @custom:emits Initialized once
-    ///      setup completes.
-    /// @param registry Protocol-level address registry used to resolve sibling contracts.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __Ownable_init(msg.sender);
-        __ERC165_init();
-        protocolRegistry = registry;
-    }
-
-    /// @inheritdoc IDotnsResolver
-    function setAddress(bytes32 node, address value) external override onlyNodeOwner(node) {
-        addresses[node] = value;
-        emit AddressSet(node, value);
-    }
-
-    /// @inheritdoc IDotnsResolver
-    function addressOf(bytes32 node) external view override returns (address value) {
-        return addresses[node];
-    }
-
-    /// @inheritdoc ERC165Upgradeable
-    function supportsInterface(bytes4 interfaceId) public view override returns (bool) {
-        return
-            interfaceId == type(IDotnsResolver).interfaceId || super.supportsInterface(interfaceId);
-    }
-
-    /// @notice Internal ownership check for a registry node.
-    /// @dev Resolves the registry lazily through `protocolRegistry` so a registry
-    ///      upgrade or rewire is picked up automatically without a resolver upgrade.
-    /// @param node Node identifier.
-    function _onlyNodeOwner(bytes32 node) internal view {
-        IDotnsRegistryOld _registry =
-            IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY));
-        require(_registry.owner(node) == msg.sender, NotAuthorised(node, msg.sender));
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/resolvers/DotnsReverseResolverOld.sol b/contracts/resolvers/DotnsReverseResolverOld.sol
deleted file mode 100644
index 11fbeb698..000000000
--- a/contracts/resolvers/DotnsReverseResolverOld.sol
+++ /dev/null
@@ -1,146 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-import {IDotnsReverseResolver} from "./IDotnsReverseResolver.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-import {LabelUtils} from "../utils/LabelUtils.sol";
-import {SubnodeUtilsOld} from "../utils/SubnodeUtilsOld.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-
-/// @title Dotns Reverse Resolver
-/// @notice Resolves an address to its associated name under the network TLD.
-/// @dev Writes are gated on a fixed writer address resolved from the protocol
-///      registry (the registrar or its controller), not on node ownership.
-///      Reverse records bind to an EOA rather than a registry node, so authority
-///      is delegated to the contract that mints names on the user's behalf.
-/// @custom:security-contact admin@parity.io
-contract DotnsReverseResolverOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ERC165Upgradeable,
-    IDotnsReverseResolver
-{
-    /// @dev Mapping from address to its reverse name. An empty string indicates
-    ///      that no reverse name is set.
-    mapping(address owner => string name) private reverseNames;
-
-    /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @dev Reserved storage space to allow for layout changes in the future.
-    // forge-lint: disable-next-line(mixed-case-variable)
-    uint256[50] private __gap;
-
-    /// @notice Restricts access to the configured registrar.
-    modifier onlyRegistrar() {
-        _onlyRegistrar();
-        _;
-    }
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the reverse resolver.
-    /// @dev May only be called once per proxy; a repeat call reverts with
-    ///      @custom:reverts InvalidInitialization. Emits @custom:emits OwnershipTransferred when
-    ///      `msg.sender` is recorded as the initial owner and @custom:emits Initialized once
-    ///      setup completes.
-    /// @param registry Protocol-level address registry used to resolve sibling contracts.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __Ownable_init(msg.sender);
-        __ERC165_init();
-        protocolRegistry = registry;
-    }
-
-    /// @inheritdoc IDotnsReverseResolver
-    function setReverseName(address addr, string calldata name) external override onlyRegistrar {
-        reverseNames[addr] = name;
-        emit ReverseNameSet(addr, name);
-    }
-
-    /// @inheritdoc IDotnsReverseResolver
-    function claimReverseRecord(string calldata label) external override {
-        bytes32 node = _nodeOf(label);
-        require(_registry().owner(node) == msg.sender, NotNameOwner(msg.sender, uint256(node)));
-
-        string memory fullName = string.concat(label, protocolRegistry.tld());
-        reverseNames[msg.sender] = fullName;
-        emit ReverseNameSet(msg.sender, fullName);
-    }
-
-    /// @inheritdoc IDotnsReverseResolver
-    function nameOf(address addr) external view override returns (string memory name) {
-        string memory stored = reverseNames[addr];
-        if (bytes(stored).length == 0) return "";
-
-        // Strip the TLD suffix and validate against current ownership so a transferred-away
-        // name never resolves under a stale reverse record.
-        string memory label = LabelUtils.stripTld(protocolRegistry.tld(), stored);
-        if (bytes(label).length == 0) return "";
-
-        if (_registry().owner(_nodeOf(label)) != addr) return "";
-        return stored;
-    }
-
-    /// @notice Resolves the node a name maps to, whether tokenised or a lite subname.
-    /// @dev A lite name is `stem` beneath its numeric container, so it hashes as a subnode; any
-    ///      other name hashes as a second-level label under the TLD. Ownership of either is read
-    ///      through the registry, which delegates a tokenised name to the registrar and holds a
-    ///      subname directly.
-    /// @param label Bare label without the TLD, e.g. `alice` or `alice.01`.
-    /// @return node The node the name resolves to.
-    function _nodeOf(string memory label) internal view returns (bytes32 node) {
-        bytes32 tldNode = protocolRegistry.tldNode();
-        if (StringUtils.isLitePersonLabelMemory(label)) {
-            return SubnodeUtilsOld.liteSubnodeOf(tldNode, label);
-        }
-        node = LabelUtils.namehashUnder(tldNode, LabelUtils.labelhashMemory(label));
-    }
-
-    /// @notice Resolves the registry via the protocol registry.
-    function _registry() internal view returns (IDotnsRegistryOld) {
-        return IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY));
-    }
-
-    /// @inheritdoc ERC165Upgradeable
-    function supportsInterface(bytes4 interfaceId)
-        public
-        view
-        override(ERC165Upgradeable)
-        returns (bool supported)
-    {
-        return interfaceId == type(IDotnsReverseResolver).interfaceId
-            || super.supportsInterface(interfaceId);
-    }
-
-    /// @notice Internal check enforcing registrar-only access.
-    function _onlyRegistrar() internal view {
-        address controller = protocolRegistry.get(DotnsConstantsOld.CONTROLLER);
-        address registrar = protocolRegistry.get(DotnsConstantsOld.REGISTRAR);
-        require(
-            msg.sender == controller || msg.sender == registrar, NotRegistrarController(msg.sender)
-        );
-    }
-
-    /// @notice Returns implementation version.
-    /// @return versionString Current version string.
-    function version() external pure virtual returns (string memory versionString) {
-        versionString = "1.0.0";
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/contracts/resolvers/IDotnsPopResolverOld.sol b/contracts/resolvers/IDotnsPopResolverOld.sol
new file mode 100644
index 000000000..f75aaa025
--- /dev/null
+++ b/contracts/resolvers/IDotnsPopResolverOld.sol
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+/// @title IDotnsPopResolverOld
+/// @notice Resolver for per-name records produced by the PoP username flow.
+/// @dev Holds three record kinds:
+///      - Chat key: ECDH public-key bytes used for end-to-end encrypted messaging.
+///      - Lite link: for a full-person node, the labelhash of the lite-person
+///        username it was minted from (when the link was made).
+///      - Full claim: reverse index mapping a lite labelhash to the full-person
+///        node it was promoted to. Mirrors `liteLink` on every write so a
+///        caller that holds a lite labelhash can resolve the full-person node
+///        without scanning events.
+///
+///      Lives separately from the per-user `LabelStore` so that the store can remain
+///      a labels-only, protocol-write / user-read surface, and follows the project's
+///      resolver-per-record-category convention used by @custom:contract IDotnsContentResolver and
+///      @custom:contract IDotnsReverseResolver.
+///
+///      Write authorisation is delegated to the address registered as
+///      `DotnsProtocolRegistry.POP_CONTROLLER` at call time, so rotating the PoP
+///      controller is a single `set` on the protocol registry with no resolver
+///      upgrade required.
+/// @custom:security-contact admin@parity.io
+interface IDotnsPopResolverOld {
+    /// @notice Emitted when a node's chat key is set or updated.
+    /// @param node The node whose chat key was written.
+    /// @param chatKey The new chat key bytes.
+    event ChatKeyUpdated(bytes32 indexed node, bytes chatKey);
+
+    /// @notice Emitted when a full-person node's lite link is set or updated.
+    /// @param fullNode The full-person node carrying the link.
+    /// @param liteLabelhash The labelhash of the linked lite-person username.
+    event LiteLinkUpdated(bytes32 indexed fullNode, bytes32 indexed liteLabelhash);
+
+    /// @notice Thrown when the caller is not the authorised PoP controller.
+    /// @param caller The address that attempted the write.
+    error NotPopController(address caller);
+
+    /// @notice Thrown when the provided chat key does not match the expected 65-byte length.
+    /// @param length The length of the payload that was rejected.
+    error InvalidChatKeyLength(uint256 length);
+
+    /// @notice Sets the chat key for `node`.
+    /// @dev Callable only by the address registered under `DotnsProtocolRegistry.POP_CONTROLLER`,
+    ///      otherwise @custom:reverts NotPopController. Overwrites any previous value. The payload
+    ///      must be exactly 65 bytes: the uncompressed secp256k1 public key encoding (1 prefix
+    ///      byte followed by the 32-byte X and 32-byte Y affine coordinates); any other length
+    ///      reverts with @custom:reverts InvalidChatKeyLength. Emits @custom:emits ChatKeyUpdated
+    ///      on every successful write.
+    /// @param node The node whose chat key is being written.
+    /// @param chatKey ECDH public key bytes (pallet-side type is `[u8; 65]`).
+    function setChatKey(bytes32 node, bytes calldata chatKey) external;
+
+    /// @notice Sets the lite-person link for a full-person `node`.
+    /// @dev Callable only by the authorised PoP controller, otherwise
+    ///      @custom:reverts NotPopController. Overwrites any previous link. When overwriting, the
+    ///      stale inverse entry is nulled so both the forward (`liteLink`) and reverse
+    ///      (`fullClaim`) indices remain consistent: re-linking the same `fullNode` to a new
+    ///      `liteLabelhash` clears `fullClaim(oldLite)`, and re-linking the same `liteLabelhash`
+    ///      to a new `fullNode` clears `liteLink(oldFull)`. The invariant
+    ///      `fullClaim(liteLink(node)) == node` always holds after the call. Emits
+    ///      @custom:emits LiteLinkUpdated on every successful write.
+    /// @param fullNode The full-person node carrying the link.
+    /// @param liteLabelhash The labelhash of the linked lite-person username.
+    function setLiteLink(bytes32 fullNode, bytes32 liteLabelhash) external;
+
+    /// @notice Returns the chat key associated with a node.
+    /// @param node The node to query.
+    /// @return chatKey The stored chat key bytes, or empty if unset.
+    function chatKey(bytes32 node) external view returns (bytes memory chatKey);
+
+    /// @notice Returns the lite-person labelhash linked to a full-person node.
+    /// @param fullNode The full-person node to query.
+    /// @return liteLabelhash The linked lite-person labelhash, or zero if unset.
+    function liteLink(bytes32 fullNode) external view returns (bytes32 liteLabelhash);
+
+    /// @notice Returns the full-person node a given lite label has claimed.
+    /// @dev Reverse of @custom:function liteLink. Written by the same `setLiteLink` call so the
+    ///      two directions stay in lockstep. Returns zero when the lite label
+    ///      has never been linked to a full claim.
+    /// @param liteLabelhash The labelhash of the lite-person username to query.
+    /// @return fullNode The full-person node claimed from this lite label, or
+    ///         zero if unset.
+    function fullClaim(bytes32 liteLabelhash) external view returns (bytes32 fullNode);
+}
diff --git a/contracts/store/IStoreFactoryOld.sol b/contracts/store/IStoreFactoryOld.sol
deleted file mode 100644
index 690925391..000000000
--- a/contracts/store/IStoreFactoryOld.sol
+++ /dev/null
@@ -1,157 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-/// @title IStoreFactoryOld
-/// @notice Interface for the DotNS per-user store factory.
-/// @dev Owns two `UpgradeableBeacon` instances; one for `LabelStore` (protocol-managed),
-///      one for `UserStore` (user-claimed). Each user may acquire at most one of each,
-///      forever. There is no transfer, no redeploy, no additional store type.
-/// @custom:security-contact admin@parity.io
-interface IStoreFactoryOld {
-    /// @notice Emitted when a `LabelStore` beacon-proxy is deployed for `user`.
-    /// @param user The user the store is bound to.
-    /// @param store The deployed store address.
-    event LabelStoreDeployed(address indexed user, address indexed store);
-
-    /// @notice Emitted when `user` claims their `UserStore` beacon-proxy.
-    /// @param user The user the store is bound to.
-    /// @param store The deployed store address.
-    event UserStoreClaimed(address indexed user, address indexed store);
-
-    /// @notice Emitted when the `LabelStore` implementation behind the label beacon is upgraded.
-    /// @param newImplementation The new implementation address.
-    event LabelStoreImplementationUpgraded(address indexed newImplementation);
-
-    /// @notice Emitted when the `UserStore` implementation behind the user beacon is upgraded.
-    /// @param newImplementation The new implementation address.
-    event UserStoreImplementationUpgraded(address indexed newImplementation);
-
-    /// @notice Thrown when attempting to deploy or claim a store that already exists.
-    /// @param user The user for whom the store exists.
-    /// @param existingStore The already-deployed store address.
-    error AlreadyDeployed(address user, address existingStore);
-
-    /// @notice Thrown when a zero user address is supplied.
-    /// @param user The invalid user argument.
-    error InvalidUser(address user);
-
-    /// @notice Thrown when a zero protocol registry address is supplied to the constructor.
-    /// @param protocolRegistry The invalid registry argument.
-    error InvalidProtocolRegistry(address protocolRegistry);
-
-    /// @notice Thrown when a zero implementation address is supplied to the constructor or an
-    /// upgrade. @param implementation The invalid implementation argument.
-    error InvalidImplementation(address implementation);
-
-    /// @notice Thrown when an unauthorised address attempts to deploy a label store.
-    /// @param caller The unauthorised msg.sender.
-    error NotAuthorised(address caller);
-
-    /// @notice Thrown when a freshly deployed proxy does not report the expected owner.
-    error ImplementationBindingMismatch();
-
-    /// @notice Returns the `UpgradeableBeacon` address backing all `LabelStore` proxies.
-    /// @return beacon Address of the beacon contract.
-    function labelStoreBeacon() external view returns (address beacon);
-
-    /// @notice Returns the `UpgradeableBeacon` address backing all `UserStore` proxies.
-    /// @return beacon Address of the beacon contract.
-    function userStoreBeacon() external view returns (address beacon);
-
-    /// @notice Returns the protocol registry address used for writer authorisation.
-    /// @return registry Address of the protocol registry.
-    function protocolRegistry() external view returns (address registry);
-
-    /// @notice Deploys a `LabelStore` beacon-proxy bound to `user`.
-    /// @dev Callable by the factory owner or a component named in
-    ///      @custom:function StoreAuth.isStoreWriter; any other caller
-    ///      @custom:reverts NotAuthorised. `user` must be non-zero,
-    ///      otherwise @custom:reverts InvalidUser. The user must not already have a
-    ///      `LabelStore`, otherwise @custom:reverts AlreadyDeployed. After deployment the
-    ///      freshly initialised proxy must report `user` as its owner, otherwise
-    ///      @custom:reverts ImplementationBindingMismatch. Emits
-    ///      @custom:emits LabelStoreDeployed on success.
-    /// @param user The user the store is bound to forever.
-    /// @return store The deployed store address.
-    function deployLabelStoreFor(address user) external returns (address store);
-
-    /// @notice Returns the `LabelStore` address bound to `user`, or the zero address if none.
-    /// @param user The user to look up.
-    /// @return store The bound store address, or zero.
-    function getLabelStore(address user) external view returns (address store);
-
-    /// @notice Returns the total number of `LabelStore` proxies ever deployed.
-    /// @return count Length of the deployment list.
-    function getLabelStoreCount() external view returns (uint256 count);
-
-    /// @notice Paginated enumeration over every `LabelStore` proxy ever deployed.
-    /// @dev Insertion order of `deployLabelStoreFor` calls. `offset >= getLabelStoreCount()`
-    ///      returns an empty array; result length is `min(limit, count - offset)`.
-    /// @param offset Start index.
-    /// @param limit Maximum entries to return.
-    /// @return stores Slice of label-store addresses.
-    function getLabelStores(
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        returns (address[] memory stores);
-
-    /// @notice Upgrades the `LabelStore` implementation for every existing and future proxy.
-    /// @dev Callable by the factory owner only, otherwise
-    ///      @custom:reverts OwnableUnauthorizedAccount. `newImplementation` must be non-zero,
-    ///      otherwise @custom:reverts InvalidImplementation. The candidate is sentinel-probed by
-    ///      calling `ILabelStore.protocolRegistry` on it before the beacon is rotated; if the
-    ///      address does not implement that selector the probe reverts and the upgrade does not
-    ///      land (deliberate fail-fast guard, no named error). Delegates to
-    ///      `UpgradeableBeacon.upgradeTo` and emits
-    ///      @custom:emits LabelStoreImplementationUpgraded on success.
-    /// @param newImplementation The new implementation address.
-    function upgradeLabelStoreImplementation(address newImplementation) external;
-
-    /// @notice Caller claims their `UserStore` beacon-proxy.
-    /// @dev Self-claim only; `_owner` on the resulting store is always `msg.sender`,
-    ///      regardless of who pays gas. One store per caller, forever: a caller who already
-    ///      has a `UserStore` @custom:reverts AlreadyDeployed. After deployment the freshly
-    ///      initialised proxy must report `msg.sender` as its owner, otherwise
-    ///      @custom:reverts ImplementationBindingMismatch. Emits
-    ///      @custom:emits UserStoreClaimed on success.
-    /// @return store The deployed store address.
-    function claimUserStore() external returns (address store);
-
-    /// @notice Returns the `UserStore` address bound to `user`, or the zero address if none.
-    /// @param user The user to look up.
-    /// @return store The bound store address, or zero.
-    function getUserStore(address user) external view returns (address store);
-
-    /// @notice Returns the total number of `UserStore` proxies ever claimed.
-    /// @return count Length of the claim list.
-    function getUserStoreCount() external view returns (uint256 count);
-
-    /// @notice Paginated enumeration over every `UserStore` proxy ever claimed.
-    /// @dev Insertion order of `claimUserStore` calls. `offset >= getUserStoreCount()`
-    ///      returns an empty array; result length is `min(limit, count - offset)`.
-    /// @param offset Start index.
-    /// @param limit Maximum entries to return.
-    /// @return stores Slice of user-store addresses.
-    function getUserStores(
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        returns (address[] memory stores);
-
-    /// @notice Upgrades the `UserStore` implementation for every existing and future proxy.
-    /// @dev Callable by the factory owner only, otherwise
-    ///      @custom:reverts OwnableUnauthorizedAccount. `newImplementation` must be non-zero,
-    ///      otherwise @custom:reverts InvalidImplementation. The candidate is sentinel-probed by
-    ///      calling `IUserStore.getKeyCount` on it before the beacon is rotated; if the address
-    ///      does not implement that selector the probe reverts and the upgrade does not land
-    ///      (deliberate fail-fast guard, no named error). Delegates to
-    ///      `UpgradeableBeacon.upgradeTo` and emits
-    ///      @custom:emits UserStoreImplementationUpgraded on success.
-    /// @param newImplementation The new implementation address.
-    function upgradeUserStoreImplementation(address newImplementation) external;
-}
diff --git a/contracts/store/StoreFactoryMigrator.sol b/contracts/store/StoreFactoryMigrator.sol
deleted file mode 100644
index d3e0e8123..000000000
--- a/contracts/store/StoreFactoryMigrator.sol
+++ /dev/null
@@ -1,366 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {BeaconProxy} from "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";
-import {UpgradeableBeacon} from "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
-
-import {IStoreFactory} from "./IStoreFactory.sol";
-import {IDotnsStore} from "./IDotnsStore.sol";
-import {ILabelStore} from "./ILabelStore.sol";
-import {IUserStore} from "./IUserStore.sol";
-import {LabelStore} from "./LabelStore.sol";
-import {UserStore} from "./UserStore.sol";
-import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
-import {StoreAuth} from "../utils/StoreAuth.sol";
-
-/// @title StoreFactoryMigrator
-/// @notice The shipped `StoreFactory`, with the per-user bindings reachable and a paged import
-///         that copies them from the factory a network used before this one.
-/// @dev PR-scoped migration tooling, upgraded into the proxy for the import transactions and
-///      upgraded straight back out. It exists because a `StoreFactory` cannot be moved: the
-///      bindings are proxy storage and the shipped contract offers no way to write one except by
-///      deploying a new store, so a network that re-points `STORE_FACTORY` at a fresh factory
-///      starts with an empty directory and hands every existing user a second, empty store the
-///      next time one is needed.
-///
-///      The contract body is the shipped factory verbatim, with four fields widened from
-///      `private` to `internal` and `importStores` added. Keeping it a copy rather than a
-///      subclass or a set of raw slot writes is what makes the layout identical by construction:
-///      the upgrade in and the upgrade back both diff against a layout that cannot have drifted.
-///
-///      What it does not do: the imported stores stay on the beacons the old factory minted, and
-///      those beacons answer to the old factory. Their implementations remain upgradeable there,
-///      by the same owner, and are not reachable from this factory's beacons. A `BeaconProxy`
-///      holds its beacon address in an immutable, so no migration can change that.
-/// @custom:security-contact admin@parity.io
-contract StoreFactoryMigrator is Initializable, UUPSUpgradeable, OwnableUpgradeable, IStoreFactory {
-    /// @notice Beacon backing every `LabelStore` proxy.
-    /// @dev Public getter name is interface-constrained by @custom:contract IStoreFactory.
-    address public override labelStoreBeacon;
-
-    /// @notice Beacon backing every `UserStore` proxy.
-    /// @dev Public getter name is interface-constrained by @custom:contract IStoreFactory.
-    address public override userStoreBeacon;
-
-    /// @notice Protocol registry used to authorise `deployLabelStoreFor` callers.
-    /// @dev Public getter name is interface-constrained by @custom:contract IStoreFactory.
-    address public override protocolRegistry;
-
-    /// @dev user => their permanent `LabelStore`. Set once per user, forever.
-    mapping(address user => address store) internal _labelStores;
-
-    /// @dev user => their permanent `UserStore`. Set once per user, forever.
-    mapping(address user => address store) internal _userStores;
-
-    /// @dev Insertion-order list of every `LabelStore` proxy ever deployed. Append-only.
-    address[] internal _labelStoreList;
-
-    /// @dev Insertion-order list of every `UserStore` proxy ever claimed. Append-only.
-    address[] internal _userStoreList;
-
-    /// @dev Reserved storage space to allow for layout changes in future upgrades.
-    uint256[50] private __gap;
-
-    /// @notice A binding was adopted from the previous factory.
-    /// @param user Address the store belongs to.
-    /// @param store The `LabelStore` now bound to `user` on this factory.
-    event StoresImported(address indexed user, address indexed store);
-
-    /// @notice The old factory's store list does not have the length the factory reports.
-    /// @dev Reading the count and the list are two calls, so they can disagree: a truncated
-    ///      enumeration would import a prefix and leave the rest unbound, and unbound users are
-    ///      handed an empty store on their next registration rather than the one they have.
-    /// @param expected Count the old factory reports.
-    /// @param actual Number of entries actually seen.
-    error ImportCountMismatch(uint256 expected, uint256 actual);
-
-    /// @notice A store's owner is not the user the old factory has it bound to.
-    /// @dev The store list and the per-user mapping are separate state. Importing on the store's
-    ///      word alone would let a store whose owner no longer matches the mapping bind a user
-    ///      the old factory does not consider its holder.
-    /// @param user Owner the store reports.
-    /// @param store The store in the old factory's list.
-    error ImportBindingMismatch(address user, address store);
-
-    /// @notice A page of zero bindings was requested.
-    /// @dev A zero limit would import nothing while looking like progress, so it is a caller bug
-    ///      worth naming rather than a no-op worth allowing.
-    error ImportPageEmpty();
-
-    /// @notice Restricts `deployLabelStoreFor` to the owner or a component named in
-    /// @custom:function StoreAuth.isStoreWriter.
-    modifier onlyOwnerOrProtocol() {
-        _onlyOwnerOrProtocol();
-        _;
-    }
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the factory together with both store implementations and beacons.
-    /// @dev Callable exactly once via `Initializable`, otherwise
-    ///      @custom:reverts InvalidInitialization. A single initialiser call wires everything:
-    ///      - Deploys a fresh `LabelStore` implementation.
-    ///      - Deploys a fresh `UserStore` implementation.
-    ///      - Constructs both `UpgradeableBeacon` instances, owned by `address(this)`, which
-    ///        under the proxy is the proxy itself, so `upgrade*Implementation` can delegate to
-    ///        `beacon.upgradeTo` and the beacons outlive any implementation swap.
-    ///      The implementations are deployed here rather than accepted as parameters, so the call
-    ///      carries no ordering dependency on a prior deploy and exposes no argument through which
-    ///      a mismatched implementation could reach a beacon. `protocolRegistry_` must be
-    ///      non-zero, otherwise @custom:reverts InvalidProtocolRegistry.
-    /// @param initialOwner Account that owns this factory and can upgrade it and the store
-    ///        implementations.
-    /// @param protocolRegistry_ The protocol registry for writer auth on label stores.
-    function initialize(address initialOwner, address protocolRegistry_) external initializer {
-        __Ownable_init(initialOwner);
-
-        require(protocolRegistry_ != address(0), InvalidProtocolRegistry(protocolRegistry_));
-        // Probing the registry rejects a wrong address here rather than at the first store deploy,
-        // and is what catches the two address arguments being passed the wrong way round.
-        IDotnsProtocolRegistry(protocolRegistry_).isRegisteredAddress(address(0));
-
-        protocolRegistry = protocolRegistry_;
-        labelStoreBeacon = address(new UpgradeableBeacon(address(new LabelStore()), address(this)));
-        userStoreBeacon = address(new UpgradeableBeacon(address(new UserStore()), address(this)));
-    }
-
-    /// @inheritdoc IStoreFactory
-    function deployLabelStoreFor(address user)
-        external
-        override
-        onlyOwnerOrProtocol
-        returns (address store)
-    {
-        require(user != address(0), InvalidUser(user));
-        require(_labelStores[user] == address(0), AlreadyDeployed(user, _labelStores[user]));
-
-        bytes memory initData = abi.encodeCall(ILabelStore.initialize, (user, protocolRegistry));
-        store = address(new BeaconProxy(labelStoreBeacon, initData));
-        require(IDotnsStore(store).owner() == user, ImplementationBindingMismatch());
-        _labelStores[user] = store;
-        _labelStoreList.push(store);
-
-        emit LabelStoreDeployed(user, store);
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getLabelStore(address user) external view override returns (address store) {
-        return _labelStores[user];
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getLabelStoreCount() external view override returns (uint256 count) {
-        return _labelStoreList.length;
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getLabelStores(
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (address[] memory stores)
-    {
-        stores = _paginateAddresses(_labelStoreList, offset, limit);
-    }
-
-    /// @inheritdoc IStoreFactory
-    function upgradeLabelStoreImplementation(address newImplementation)
-        external
-        override
-        onlyOwner
-    {
-        require(newImplementation != address(0), InvalidImplementation(newImplementation));
-        ILabelStore(newImplementation).protocolRegistry();
-        UpgradeableBeacon(labelStoreBeacon).upgradeTo(newImplementation);
-        emit LabelStoreImplementationUpgraded(newImplementation);
-    }
-
-    /// @inheritdoc IStoreFactory
-    function claimUserStore() external override returns (address store) {
-        require(
-            _userStores[msg.sender] == address(0),
-            AlreadyDeployed(msg.sender, _userStores[msg.sender])
-        );
-
-        bytes memory initData =
-            abi.encodeCall(IUserStore.initialize, (msg.sender, protocolRegistry));
-        store = address(new BeaconProxy(userStoreBeacon, initData));
-        require(IDotnsStore(store).owner() == msg.sender, ImplementationBindingMismatch());
-        _userStores[msg.sender] = store;
-        _userStoreList.push(store);
-
-        emit UserStoreClaimed(msg.sender, store);
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getUserStore(address user) external view override returns (address store) {
-        return _userStores[user];
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getUserStoreCount() external view override returns (uint256 count) {
-        return _userStoreList.length;
-    }
-
-    /// @inheritdoc IStoreFactory
-    function getUserStores(
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (address[] memory stores)
-    {
-        stores = _paginateAddresses(_userStoreList, offset, limit);
-    }
-
-    /// @inheritdoc IStoreFactory
-    function upgradeUserStoreImplementation(address newImplementation) external override onlyOwner {
-        require(newImplementation != address(0), InvalidImplementation(newImplementation));
-        IUserStore(newImplementation).protocolRegistry();
-        UpgradeableBeacon(userStoreBeacon).upgradeTo(newImplementation);
-        emit UserStoreImplementationUpgraded(newImplementation);
-    }
-
-    /// @notice Returns the release this network declares it runs, read live from the protocol
-    ///         registry so every DotNS contract reports one synchronised value.
-    /// @dev Mirror of `IDotnsProtocolRegistry.protocolVersion`, kept under the historical
-    ///      `version()` selector for ABI compatibility. It reports the network's declaration,
-    ///      not this contract's build; per-contract identity is the codehash declared on the
-    ///      registry.
-    /// @return versionString Declared release as bare semver, empty when never declared.
-    function version() external view virtual returns (string memory versionString) {
-        versionString = IDotnsProtocolRegistry(protocolRegistry).protocolVersion();
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-
-    /// @notice Internal authorisation check deferred from the `onlyOwnerOrProtocol` modifier.
-    function _onlyOwnerOrProtocol() internal view {
-        if (msg.sender == owner()) return;
-        require(StoreAuth.isStoreWriter(protocolRegistry, msg.sender), NotAuthorised(msg.sender));
-    }
-
-    /// @notice Copies one page of `oldFactory`'s per-user `LabelStore` bindings into this factory.
-    /// @dev Owner-only, and reads everything it needs from `oldFactory` itself: the count, the
-    ///      store list, and each store's owner. Nothing is supplied by the caller but the page
-    ///      bounds, so there is no window between an operator reading the set and this executing.
-    ///      That window is not hypothetical: the count on the network being migrated moved while
-    ///      this was being written, and a list captured a moment early imports every entry it
-    ///      holds, rewires, and leaves the newest holder to be handed a second empty store on
-    ///      their next registration.
-    ///
-    ///      Paged because of where this runs. pallet-revive meters transactions in more
-    ///      dimensions than gas, and a single call importing all 63 live bindings exceeded what
-    ///      one block admits on Paseo Asset Hub Next: estimation died mid-loop around the 44th
-    ///      store, at any gas limit, with the weight exhaustion surfacing as an empty revert.
-    ///      Nothing off-chain models that ceiling, so the import is sized to stay far under it
-    ///      instead of proven against it.
-    ///
-    ///      Each binding is checked back through `getLabelStore` before it is written. A store's
-    ///      `owner` is the user it was deployed for, and the factory's mapping is the authority
-    ///      on that pairing; requiring the two to agree rejects a store whose owner has been
-    ///      changed out from under the mapping, which is the one shape that would bind a user to
-    ///      a store the old factory does not consider theirs.
-    ///
-    ///      A pair this factory already holds is skipped, so an interrupted import is finished by
-    ///      running the same pages again and a page replayed whole is a no-op. Rebinding stays
-    ///      impossible: a user bound to a DIFFERENT store is rejected, because bindings are
-    ///      permanent here as everywhere else in the factory.
-    ///
-    ///      The page that reaches the end of the list asserts the count equality; until then the
-    ///      factory legitimately holds a prefix and no key points at it.
-    ///
-    ///      `UserStore` bindings are deliberately not imported. They are claimed by users
-    ///      themselves and the network being migrated from has none; a migration that does have
-    ///      them needs this extended, not reused.
-    /// @param oldFactory Factory whose bindings are being adopted.
-    /// @param offset Index into the old factory's store list where this page starts.
-    /// @param limit Maximum number of bindings this page carries. Must be non-zero.
-    function importStores(address oldFactory, uint256 offset, uint256 limit) external onlyOwner {
-        require(oldFactory != address(0), InvalidUser(oldFactory));
-        require(limit != 0, ImportPageEmpty());
-
-        uint256 total = IStoreFactory(oldFactory).getLabelStoreCount();
-        address[] memory stores = IStoreFactory(oldFactory).getLabelStores(offset, limit);
-        // The shipped pagination truncates at the end of the list, so a short page is only legal
-        // on the last one. Anything else is a truncated read, and importing it would leave a gap
-        // the closing count check could not attribute.
-        uint256 expected = offset >= total ? 0 : (total - offset < limit ? total - offset : limit);
-        require(stores.length == expected, ImportCountMismatch(expected, stores.length));
-
-        for (uint256 i; i < stores.length; ++i) {
-            address store = stores[i];
-            require(store != address(0), InvalidImplementation(store));
-
-            address user = IDotnsStore(store).owner();
-            require(user != address(0), InvalidUser(user));
-            require(
-                IStoreFactory(oldFactory).getLabelStore(user) == store,
-                ImportBindingMismatch(user, store)
-            );
-
-            address existing = _labelStores[user];
-            if (existing == store) {
-                // Carried by an earlier run of this same page. Skipping it is what makes an
-                // interrupted import finishable by replaying pages.
-                continue;
-            }
-            require(existing == address(0), AlreadyDeployed(user, existing));
-
-            _labelStores[user] = store;
-            _labelStoreList.push(store);
-
-            emit StoresImported(user, store);
-        }
-
-        // The page that reaches the end of the list closes the books: every binding the old
-        // factory reports must now be held here, once. A mismatch means a store appeared in the
-        // list twice, or the list disagreed with the mapping.
-        if (offset + stores.length == total) {
-            require(
-                _labelStoreList.length == total, ImportCountMismatch(total, _labelStoreList.length)
-            );
-        }
-    }
-
-    /// @notice Shared pagination helper used by `getLabelStores` and `getUserStores`.
-    /// @dev Single canonical slicer so both enumerations bound-check and copy identically.
-    /// @param source Storage array to slice.
-    /// @param offset Start index.
-    /// @param limit Maximum entries to return.
-    /// @return slice Result slice; empty when `offset >= source.length`.
-    function _paginateAddresses(
-        address[] storage source,
-        uint256 offset,
-        uint256 limit
-    )
-        internal
-        view
-        returns (address[] memory slice)
-    {
-        uint256 total = source.length;
-        if (offset >= total) return new address[](0);
-
-        uint256 available = total - offset;
-        uint256 count = limit < available ? limit : available;
-
-        slice = new address[](count);
-        for (uint256 i; i < count; ++i) {
-            slice[i] = source[offset + i];
-        }
-    }
-}
diff --git a/contracts/utils/DotnsConstantsOld.sol b/contracts/utils/DotnsConstantsOld.sol
deleted file mode 100644
index e6bd98606..000000000
--- a/contracts/utils/DotnsConstantsOld.sol
+++ /dev/null
@@ -1,192 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-/// @title DotNS Constants
-/// @notice Protocol-level invariants shared across DotNS contracts.
-/// @dev Centralises the well-known protocol-registry keys that every contract uses to discover
-///      its siblings (registrar, controller, registry, resolvers, etc.). Each key is a
-///      role address resolved at call time, so rotating an implementation is a
-///      single `set` on the protocol registry without redeploying consumers. The TLD is not a
-///      constant here: it is set per network on the protocol registry and read by every consumer.
-/// @custom:security-contact admin@parity.io
-library DotnsConstantsOld {
-    /// @notice Address of revive's System precompile, exposed by every revive runtime
-    ///         that opts the precompile in.
-    /// @dev Mirrors the upstream `SYSTEM_ADDR` constant in
-    ///      `substrate/frame/revive/uapi/sol/ISystem.sol`. Consumed by
-    ///      `DotnsPopControllerOld` and `DotnsNameWhitelistOld` to authenticate
-    ///      Root-origin dispatches via `ISystem.originIsRoot()`.
-    address internal constant REVIVE_SYSTEM = address(0x0900);
-
-    /// @notice Address of the Proof-of-Personhood precompile backed by the
-    ///         alias-accounts pallet on Asset Hub.
-    /// @dev Consumed by `PopRulesOld` to read each account's personhood tier
-    ///      (`None` / `Lite` / `Full`) and the dotns-scoped `contextAlias`.
-    address internal constant PERSONHOOD = address(0x000000000000000000000000000000000a010000);
-
-    /// @notice Application identifier passed to @custom:function IPersonhood.personhoodStatus.
-    /// @dev Fixed per project so the same person receives a stable, dotns-only
-    ///      `contextAlias` and no cross-application linkability is exposed.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant PERSONHOOD_CONTEXT = bytes32("dotns");
-
-    /// @notice Launch deposit passed into the `DotnsFlatPricing` constructor.
-    /// @dev 10 DOT under revive's 18-decimal Asset Hub convention. A new amount is a fresh model
-    ///      deployment registered under @custom:constant COST_MODEL, so this constant seeds the
-    ///      model rather than being read afterwards. Single source of truth for deploy scripts and
-    ///      tests so the seed cannot drift between call sites.
-    uint256 internal constant BASE_DEPOSIT = 10 ether;
-
-    /// @notice Price floor F passed into the `DotnsScarcityPricing` candidate's constructor.
-    /// @dev Below `BASE_DEPOSIT` so that curve falls above nine characters. Seeds the candidate
-    ///      constructor; a new floor is a fresh model deployment.
-    uint256 internal constant MIN_PRICE = 0.1 ether;
-
-    /// @notice Well-known key for the cost model pricing registrations by base length.
-    /// @dev Role: single authority for the wei amount a registration costs. `PopRulesOld` resolves
-    ///      it here on every pricing read, so swapping the model is one `set` on the protocol
-    ///      registry without redeploying `PopRulesOld` or its consumers.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant COST_MODEL = bytes32("costModel");
-
-    /// @notice Default release cooldown seeded on `DotnsNameEscrowOld.initialize`.
-    /// @dev Single source of truth for deploy scripts and tests so the value cannot drift between
-    ///      call sites. Bounded on-chain by `DotnsNameEscrowOld.MAX_COOLDOWN`. Live deployments
-    /// rotate the runtime value via `updateCooldown` rather than rebuilding consumers.
-    uint256 internal constant ESCROW_COOLDOWN = 15 minutes;
-
-    /// @notice Default redeem window seeded on `DotnsNameEscrowOld.initialize`.
-    /// @dev Single source of truth for deploy scripts and tests. Bounded on-chain by
-    ///      `DotnsNameEscrowOld.MAX_REDEEM_WINDOW`. Live deployments rotate the runtime value via
-    ///      `updateRedeemWindow`.
-    uint256 internal constant ESCROW_REDEEM_WINDOW = 1 days;
-    /// @notice Maximum entries a paginated view returns in a single page.
-    /// @dev Shared ceiling for paginated reads: a view clamps its returned array to this figure,
-    ///      and callers page through larger sets with `offset`.
-    uint256 internal constant MAX_PAGE_SIZE = 200;
-
-    /// @notice Default per-name live-claim cap the name whitelist starts with.
-    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_CLAIMANTS_LIMIT`.
-    uint16 internal constant WHITELIST_DEFAULT_MAX_CLAIMANTS = 64;
-
-    /// @notice Default claim-reason byte cap the name whitelist starts with.
-    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_REASON_LIMIT`.
-    uint256 internal constant WHITELIST_DEFAULT_MAX_REASON_BYTES = 256;
-
-    /// @notice Upper bound on the whitelist live-claim cap. Caps the claim clear-loop below the
-    ///         block gas limit.
-    uint16 internal constant WHITELIST_MAX_CLAIMANTS_LIMIT = 128;
-
-    /// @notice Upper bound on the whitelist reason byte cap.
-    uint256 internal constant WHITELIST_MAX_REASON_LIMIT = 256;
-
-    /// @notice Default cap on labels granted in one `grantNames` call.
-    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_GRANT_BATCH_LIMIT`.
-    uint16 internal constant WHITELIST_DEFAULT_MAX_GRANT_BATCH = 100;
-
-    /// @notice Upper bound on the `grantNames` batch cap. Bounds one call below the block gas
-    /// limit.
-    uint16 internal constant WHITELIST_MAX_GRANT_BATCH_LIMIT = 256;
-
-    /// @notice Well-known key for the ERC721 registrar backing name ownership.
-    /// @dev Role: token-of-record for registered names. Mints, burns, and tracks the
-    ///      `tokenId => label` mapping consumed by the forward registry on
-    ///      transfer.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant REGISTRAR = bytes32("registrar");
-
-    /// @notice Well-known key for the registrar controller orchestrating commit-reveal
-    /// registration. @dev Role: commit-reveal entry point for the public registration flow.
-    ///      Calls `register` on the registrar after pricing and validation.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant CONTROLLER = bytes32("controller");
-
-    /// @notice Well-known key for the forward registry storing node ownership and resolver.
-    /// @dev Role: source of truth for `(node => owner, resolver)`. Read by every
-    ///      resolver gate that defers authority to the node owner.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant REGISTRY = bytes32("registry");
-
-    /// @notice Well-known key for the reverse resolver for address-to-name mapping.
-    /// @dev Role: stores `address => name` reverse records. Writer is the
-    ///      registrar/controller, not the address holder.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant REVERSE_RESOLVER = bytes32("reverseResolver");
-
-    /// @notice Well-known key for the PoP oracle enforcing eligibility and pricing.
-    /// @dev Role: arbiter of PoP cross-flow priority and pricing. Consulted by
-    ///      both the public commit-reveal controller and the PoP controller.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant POP_RULES = bytes32("popRules");
-
-    /// @notice Well-known key for the factory deploying per-user Store instances.
-    /// @dev Role: deploy-on-demand provisioning of user `LabelStore` proxies and
-    ///      authorisation gate for protocol writes into them.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant STORE_FACTORY = bytes32("storeFactory");
-
-    /// @notice Well-known key for the forward resolver storing address records.
-    /// @dev Role: `node => address` records. Writes gated on node ownership.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant RESOLVER = bytes32("resolver");
-
-    /// @notice Well-known key for the content resolver storing content hashes and text records.
-    /// @dev Role: `node => contenthash`/`text` records and ERC721-style operator
-    ///      approvals. Writes gated on node ownership or operator approval.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant CONTENT_RESOLVER = bytes32("contentResolver");
-
-    /// @notice Well-known key for the dedicated PoP controller orchestrating lite/full-person
-    ///         username issuance on behalf of the PoP gateway.
-    /// @dev Kept distinct from `CONTROLLER` (commit-reveal public controller) so the
-    ///      two can coexist per `DotnsRegistrarOld`'s multi-controller affordance.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant POP_CONTROLLER = bytes32("popController");
-
-    /// @notice Well-known key for the PoP resolver holding per-name records produced
-    ///         by the PoP username flow (chat keys, lite => full links).
-    /// @dev Role: `node => chatKey` and bidirectional `lite <=> full` link index.
-    ///      Writer is the `POP_CONTROLLER`, not the node owner.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant POP_RESOLVER = bytes32("popResolver");
-
-    /// @notice Well-known key for the read-only lens over PoP identity data.
-    /// @dev Role: off-chain query surface. Composes the account name listings, the per-name
-    ///      record, and the account summary from the controller, registrar, store factory, PoP
-    ///      resolver, and PopRulesOld. Holds no authority and is consumed by clients, not by other
-    ///      contracts.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant POP_LENS = bytes32("popLens");
-
-    /// @notice Well-known key for the name escrow holding refundable deposits and
-    ///         driving the release lifecycle for registered names.
-    /// @dev Role: custodial vault for registration deposits and the state machine
-    ///      that drives the name release lifecycle.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant NAME_ESCROW = bytes32("nameEscrow");
-
-    /// @notice Well-known key for the generic Multicall3 batching helper.
-    /// @dev Role: unauthorised arbitrary-target multicall utility used by
-    ///      clients and tooling. Target contracts still enforce their own
-    ///      permissions and observe Multicall3 as `msg.sender`.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant MULTICALL3 = bytes32("multicall3");
-
-    /// @notice Well-known key for the CREATE3 factory backing the deterministic
-    ///         deploy pipeline.
-    /// @dev Role: permissionless CREATE3 deployer. The first deploy stage
-    ///      bootstraps the factory, records it under this key, and every later
-    ///      stage resolves it from here, so deterministic addresses never depend
-    ///      on an environment variable.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant CREATE3_FACTORY = bytes32("create3Factory");
-
-    /// @notice Well-known key for the pre-launch name whitelist that binds a label to the
-    ///         one address permitted to register it.
-    /// @dev Role: authority for label-bound registration grants. The public controller resolves
-    ///      it here and reads it on the reserved path, requiring a grant naming the intended owner
-    ///      unless the dispatch is Root, and consuming the grant on a successful mint. The PoP
-    ///      controller does not consult it.
-    /// forge-lint: disable-next-line(unsafe-typecast)
-    bytes32 internal constant NAME_WHITELIST = bytes32("nameWhitelist");
-}
diff --git a/contracts/utils/RegistrationUtilsOld.sol b/contracts/utils/RegistrationUtilsOld.sol
deleted file mode 100644
index cd9760192..000000000
--- a/contracts/utils/RegistrationUtilsOld.sol
+++ /dev/null
@@ -1,97 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {IDotnsRegistrarOld} from "../registrars/IDotnsRegistrarOld.sol";
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
-import {StoreUtilsOld} from "./StoreUtilsOld.sol";
-import {DotnsConstantsOld} from "./DotnsConstantsOld.sol";
-
-/// @title DotNS Registration Utilities Library
-/// @notice Single canonical implementation of the "mint + forward-registry + store-write"
-///         triad used by every DotNS registration flow.
-/// @dev Exists so that every controller (public commit-reveal, PoP gateway, future
-///      privileged flows) calls the same sequence. Without this library each controller
-///      re-implements the sequence, and the implementations drift.
-/// @dev Scope: this library is deliberately minimal. It only performs the steps
-///      that every registration flow needs regardless of policy:
-///        1. Mint the ERC721 name token on the base registrar.
-///        2. Write the forward registry entry (node => owner + default resolver).
-///        3. Resolve the per-user `LabelStore` (deploying on demand) so the caller
-///           can pass it back. The registrar writes the labels-only store entry
-///           internally.
-///      Flow-specific concerns (pricing, reverse-record setting, chat-key persistence,
-///      reservation queue mutation) stay inside the calling controller.
-/// @custom:security-contact admin@parity.io
-library RegistrationUtilsOld {
-    using StoreUtilsOld for IStoreFactoryOld;
-
-    /// @notice Inputs describing a single name registration.
-    /// @dev Passed as a struct so callers do not have to thread a growing positional
-    ///      argument list, and so future additions (e.g. a subname parent node) can
-    ///      be made additively without breaking call sites.
-    /// @param protocolRegistry The protocol-level address registry for sibling lookups.
-    /// @param user Address receiving the name.
-    /// @param label Human-readable label (without the TLD).
-    /// @param labelhash `keccak256(bytes(label))`.
-    /// @param node `namehash(tldNode, labelhash)`.
-    struct RegistrationContext {
-        IDotnsProtocolRegistryOld protocolRegistry;
-        address user;
-        string label;
-        bytes32 labelhash;
-        bytes32 node;
-    }
-
-    /// @notice Resolved sibling contracts for a registration call.
-    /// @dev Held as a struct internally so the helper can pass a single value to the
-    ///      downstream steps rather than three separate locals. Never returned to
-    ///      callers; kept in memory for the lifetime of one `registerAndStore`.
-    struct Siblings {
-        IDotnsRegistrarOld registrar;
-        IDotnsRegistryOld registry;
-        IStoreFactoryOld storeFactory;
-    }
-
-    /// @notice Performs the canonical mint + forward-registry + store-write sequence.
-    /// @dev Callable by any authorised controller. Emits no events; each controller
-    ///      emits its own flow-level event after this returns, so behavioural drift
-    ///      between flows stays contained at the emission layer rather than at the
-    ///      underlying state-transition layer. Store authorisation is resolved against the
-    ///      protocol registry on every write (@custom:function StoreAuth.isStoreWriter), so no
-    ///      per-store allowlist bookkeeping is needed here.
-    /// @dev The registrar writes the `LabelStore` entry directly inside `register`
-    ///      so this helper deliberately does not call `StoreUtilsOld.writeLabel`.
-    ///      Doing it twice would deploy or touch the store on every flow and
-    ///      could conflict with the registrar's locked-entry semantics.
-    /// @param context Registration inputs. See @custom:struct RegistrationContext.
-    /// @return labelStore The resolved or newly deployed `LabelStore` address for `context.user`.
-    function registerAndStore(RegistrationContext memory context)
-        internal
-        returns (address labelStore)
-    {
-        Siblings memory siblings = _resolveSiblings(context.protocolRegistry);
-
-        siblings.registrar.register(uint256(context.node), context.user, context.label);
-        siblings.registry.setOwner(context.node, context.user);
-
-        labelStore = siblings.storeFactory.getLabelStore(context.user);
-    }
-
-    /// @notice Resolves sibling contracts via the protocol registry.
-    /// @dev Exists so that resolution is one round-trip through a single helper and
-    ///      not duplicated inline at every call site. If protocol-registry key
-    ///      conventions change, the change lands here.
-    function _resolveSiblings(IDotnsProtocolRegistryOld protocolRegistry)
-        private
-        view
-        returns (Siblings memory siblings)
-    {
-        siblings = Siblings({
-            registrar: IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR)),
-            registry: IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY)),
-            storeFactory: IStoreFactoryOld(protocolRegistry.get(DotnsConstantsOld.STORE_FACTORY))
-        });
-    }
-}
diff --git a/contracts/utils/StoreUtilsOld.sol b/contracts/utils/StoreUtilsOld.sol
deleted file mode 100644
index 2e1bbb3b1..000000000
--- a/contracts/utils/StoreUtilsOld.sol
+++ /dev/null
@@ -1,60 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {ILabelStore} from "../store/ILabelStore.sol";
-import {IStoreFactoryOld} from "../store/IStoreFactoryOld.sol";
-
-/// @title DotNS Store Utilities Library
-/// @notice Canonical helpers for protocol writes into per-user `LabelStore` instances.
-/// @dev One auth rule, one write path. Every DotNS consumer (controller, registrar,
-///      registry, PoP controller) funnels label writes through `writeLabel` so
-///      authorisation and deploy-on-first-use semantics are identical across flows.
-/// @custom:security-contact admin@parity.io
-library StoreUtilsOld {
-    /// @notice Returns the `LabelStore` for `user`, deploying one via the factory if absent.
-    /// @dev Deploy-on-demand: a user's store is created on their first protocol write so
-    ///      unused accounts never pay the deployment cost. The deploy path is gated by the
-    ///      factory, so callers that are not the factory owner and not a store writer
-    ///      @custom:reverts NotAuthorised when a deployment is required.
-    /// @param factory The store factory.
-    /// @param user The user whose label store is being resolved.
-    /// @return store The resolved or newly deployed store address.
-    function ensureLabelStore(
-        IStoreFactoryOld factory,
-        address user
-    )
-        internal
-        returns (address store)
-    {
-        store = factory.getLabelStore(user);
-        if (store == address(0)) {
-            store = factory.deployLabelStoreFor(user);
-        }
-    }
-
-    /// @notice Writes `label` under `labelhash` for `user`, deploying their `LabelStore` if needed.
-    /// @dev Idempotent on locked entries: once a label is locked the call is a no-op rather
-    ///      than a revert, so retried protocol flows (e.g. an ERC721 transfer back to a prior
-    ///      owner) pass through without failing on the existing lock. Inherits the factory's
-    ///      writer authorisation: callers that are not the factory owner and not
-    ///      a store writer @custom:reverts NotAuthorised when the user has no store yet.
-    /// @param factory The store factory.
-    /// @param user The label store owner.
-    /// @param labelhash The labelhash key.
-    /// @param label The label string (typically the full name, e.g. "alice.dot").
-    /// @return store The resolved or newly deployed store address.
-    function writeLabel(
-        IStoreFactoryOld factory,
-        address user,
-        bytes32 labelhash,
-        string memory label
-    )
-        internal
-        returns (address store)
-    {
-        store = ensureLabelStore(factory, user);
-        if (!ILabelStore(store).isLocked(labelhash)) {
-            ILabelStore(store).storeLabel(labelhash, label);
-        }
-    }
-}
diff --git a/contracts/utils/StringUtilsOld.sol b/contracts/utils/StringUtilsOld.sol
new file mode 100644
index 000000000..1ffafbe2e
--- /dev/null
+++ b/contracts/utils/StringUtilsOld.sol
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
+
+/// @title String Utilities Library
+/// @notice Provides string manipulation utilities for DotNS contracts.
+/// @dev Extends OpenZeppelin's Strings library with additional UTF-8 and conversion helpers.
+/// @custom:security-contact admin@parity.io
+library StringUtilsOld {
+    using Strings for uint256;
+    using Strings for int256;
+    using Strings for address;
+
+    /// @notice Number of digits in a lite-person PoP label's suffix.
+    /// @dev The count the gateway emits, and an exact requirement here: the separator sits at a
+    ///      fixed offset from the end, so a one or three digit suffix is rejected. The gateway
+    /// reads its own minimum, so widening it there does not widen this.
+    uint256 internal constant LITE_SUFFIX_DIGITS = 2;
+
+    /// @notice Maximum number of octets in a single DNS label.
+    /// @dev RFC 1035 caps each label at 63 octets. Enforced inside @custom:function _isDnsLabel so
+    ///      every public validator (@custom:function isSingleLabel, @custom:function isNamePath,
+    ///      @custom:function isLitePersonLabel) inherits the bound and oversized labels never
+    ///      reach the registrar. A lite label bounds its stem rather than the whole string, so
+    ///      it reaches `MAX_DNS_LABEL_OCTETS + LITE_SUFFIX_DIGITS + 1` octets. Its stem is
+    ///      bounded here but checked in @custom:function _isLitePersonLabel, which is stricter
+    ///      on charset than a DNS label: letters only.
+    uint256 internal constant MAX_DNS_LABEL_OCTETS = 63;
+
+    /// @notice ASCII full stop separating a lite label's stem from its digit suffix.
+    /// @dev A lite label is the only label shape in DotNS that carries a separator;
+    ///      @custom:function _isDnsLabel rejects it everywhere else.
+    bytes1 internal constant LABEL_SEPARATOR = 0x2e;
+
+    /// @notice Computes the character length of a UTF-8 encoded string.
+    /// @dev Counts Unicode code points, not bytes. Handles multi-byte UTF-8 sequences:
+    ///      - 1 byte:  0x00-0x7F (ASCII)
+    ///      - 2 bytes: 0xC0-0xDF
+    ///      - 3 bytes: 0xE0-0xEF
+    ///      - 4 bytes: 0xF0-0xF7
+    ///      - 5 bytes: 0xF8-0xFB (rare, outside Unicode standard)
+    ///      - 6 bytes: 0xFC-0xFD (rare, outside Unicode standard)
+    /// @param value The UTF-8 encoded string to measure.
+    /// @return len The number of Unicode characters in the string.
+    function strlen(string memory value) internal pure returns (uint256 len) {
+        uint256 i = 0;
+        uint256 bytelength = bytes(value).length;
+        for (len = 0; i < bytelength; len++) {
+            bytes1 byteValue = bytes(value)[i];
+            if (byteValue < 0x80) i += 1;
+            else if (byteValue < 0xE0) i += 2;
+            else if (byteValue < 0xF0) i += 3;
+            else if (byteValue < 0xF8) i += 4;
+            else if (byteValue < 0xFC) i += 5;
+            else i += 6;
+        }
+    }
+
+    /// @notice Validates that `s` is a single canonical DNS label.
+    /// @dev Lowercase ASCII letters, digits, and hyphen only; hyphen may not be the first or last
+    ///      character; length must be in `(0, MAX_DNS_LABEL_OCTETS]`. No dots allowed; use
+    ///      @custom:function isNamePath for dotted forms. Mirrors the label rules enforced at the
+    ///      registrar.
+    /// @param value Candidate label.
+    /// @return isValid True if `value` is a canonical DNS label.
+    function isSingleLabel(string calldata value) internal pure returns (bool isValid) {
+        bytes memory label = bytes(value);
+        return _isDnsLabel(label, 0, label.length);
+    }
+
+    /// @notice Memory-location helper for @custom:function isSingleLabel, used where the
+    /// candidate label is produced by an upstream string transformation (e.g. the output of
+    /// @custom:function stripDigits) so callers do not need a calldata round-trip.
+    /// @param value Candidate label held in memory.
+    /// @return isValid True if `value` is a canonical DNS label.
+    function isSingleLabelMemory(string memory value) internal pure returns (bool isValid) {
+        bytes memory label = bytes(value);
+        return _isDnsLabel(label, 0, label.length);
+    }
+
+    /// @notice Validates the lite-person PoP label format: `<stem>.<digits>`.
+    /// @dev A lite-person label is a stem of lowercase ASCII letters, one
+    ///      @custom:constant LABEL_SEPARATOR, then exactly
+    ///      @custom:constant LITE_SUFFIX_DIGITS digits (e.g. `joseph.42`). Letters only,
+    ///      because the stem is the name a person chose, which is restricted to letters. How short
+    /// a stem may be is policy rather than format, so it is left to the governance-reserved band in
+    /// @custom:function IPopRulesOld.classifyName.
+    ///      It is the only label shape in DotNS permitted to carry a separator, which is what
+    ///      reserves the dotted space to the gateway. A digit suffix is not exclusive: an
+    ///      ordinary label may end in digits, but it is measured as written and so classifies by
+    ///      its full length.
+    ///      Cross-flow priority is arbitrated on the stem, not on the whole label: a lite
+    ///      label's stem is reserved as a base name through
+    ///      @custom:function IPopRulesOld.reserveBaseNameForPop, so `joseph.42` contends with
+    ///      `joseph`. There is no flat spelling of a lite label for it to contend with.
+    /// @param value Candidate label.
+    /// @return isValid True if `value` is a stem of lowercase ASCII letters followed by a
+    ///         separator and exactly @custom:constant LITE_SUFFIX_DIGITS digits.
+    function isLitePersonLabel(string calldata value) internal pure returns (bool isValid) {
+        return _isLitePersonLabel(bytes(value));
+    }
+
+    /// @notice Memory-location helper for @custom:function isLitePersonLabel.
+    /// @dev For callers holding the label in memory rather than calldata: the controller reads
+    ///      it back from a struct before deriving the node, and the lens reads it out of a
+    ///      store. Same predicate, different data location.
+    /// @param value Candidate label held in memory.
+    /// @return isValid True if `value` is a stem of lowercase ASCII letters followed by a
+    ///         separator and exactly @custom:constant LITE_SUFFIX_DIGITS digits.
+    function isLitePersonLabelMemory(string memory value) internal pure returns (bool isValid) {
+        return _isLitePersonLabel(bytes(value));
+    }
+
+    function _isLitePersonLabel(bytes memory raw) private pure returns (bool isValid) {
+        uint256 length = raw.length;
+        // One stem letter, the separator, then the digits is the shortest accepted shape. The
+        // stem is not bounded below here: how short a name may be is policy, and PopRulesOld
+        // already holds it as the governance-reserved band. Enforcing a minimum here would
+        // duplicate the governance-reserved band and drift from it.
+        if (length < LITE_SUFFIX_DIGITS + 2) return false;
+
+        // Fixing the separator's position is what enforces the exact digit count: a third
+        // digit, a missing separator and a trailing separator all land a non-separator byte
+        // here. The letters-only stem then admits no second separator, so exactly one is
+        // possible without scanning for it.
+        uint256 separator = length - LITE_SUFFIX_DIGITS - 1;
+        if (raw[separator] != LABEL_SEPARATOR) return false;
+
+        // The stem is a name a person chose, so it follows the same letters-only rule as a
+        // full-person label. Uppercase is excluded for the reason it is everywhere else here:
+        // a single name must have a single spelling, and so a single node.
+        if (!_isPersonLabel(raw, 0, separator)) return false;
+
+        for (uint256 i = separator + 1; i < length; ++i) {
+            bytes1 char = raw[i];
+            if (char < bytes1(0x30) || char > bytes1(0x39)) return false;
+        }
+
+        return true;
+    }
+
+    /// @notice Validates that `value` is a name a person chose: lowercase ASCII letters only.
+    /// @dev Matches the gateway's full-person label rule, which admits no digits
+    ///      and no hyphens, so a label outside this shape cannot have been issued. Stricter
+    ///      than @custom:function isSingleLabel, and it is the same rule
+    ///      @custom:function isLitePersonLabel applies to a lite stem. How short a name may be
+    ///      is policy rather than format, so no floor is applied here.
+    /// @param value Candidate label.
+    /// @return isValid True if every octet of `value` is a lowercase ASCII letter.
+    function isPersonLabel(string calldata value) internal pure returns (bool isValid) {
+        bytes memory raw = bytes(value);
+        return _isPersonLabel(raw, 0, raw.length);
+    }
+
+    function _isPersonLabel(
+        bytes memory raw,
+        uint256 start,
+        uint256 end
+    )
+        private
+        pure
+        returns (bool isValid)
+    {
+        if (end <= start) return false;
+        if (end - start > MAX_DNS_LABEL_OCTETS) return false;
+
+        for (uint256 i = start; i < end; ++i) {
+            bytes1 char = raw[i];
+            if (char < bytes1(0x61) || char > bytes1(0x7a)) return false;
+        }
+
+        return true;
+    }
+
+    /// @notice Splits a lite-person label `<stem>.<digits>` into its stem and digit suffix.
+    /// @dev Splits at the first @custom:constant LABEL_SEPARATOR. A lite label carries exactly one
+    ///      separator, so the caller is expected to have run @custom:function
+    /// isLitePersonLabelMemory first; a label with no separator returns the whole input as the stem
+    /// and an empty
+    ///      suffix, which the caller's later label checks reject.
+    /// @param value Lite label held in memory, for example `alice.01`.
+    /// @return stem The label before the separator, for example `alice`.
+    /// @return suffix The digit suffix after the separator, for example `01`.
+    function splitLiteLabel(string memory value)
+        internal
+        pure
+        returns (string memory stem, string memory suffix)
+    {
+        bytes memory raw = bytes(value);
+        uint256 length = raw.length;
+
+        uint256 separator = length;
+        for (uint256 i; i < length; ++i) {
+            if (raw[i] == LABEL_SEPARATOR) {
+                separator = i;
+                break;
+            }
+        }
+
+        bytes memory stemBytes = new bytes(separator);
+        for (uint256 i; i < separator; ++i) {
+            stemBytes[i] = raw[i];
+        }
+
+        uint256 suffixLength = separator == length ? 0 : length - separator - 1;
+        bytes memory suffixBytes = new bytes(suffixLength);
+        for (uint256 i; i < suffixLength; ++i) {
+            suffixBytes[i] = raw[separator + 1 + i];
+        }
+
+        stem = string(stemBytes);
+        suffix = string(suffixBytes);
+    }
+
+    /// @notice Validates that `s` is a dot-separated path of canonical DNS labels.
+    /// @dev Each segment between dots must satisfy @custom:function isSingleLabel. Empty
+    ///      segments (leading, trailing, or consecutive dots) fail. Used when
+    ///      callers submit multi-label paths (e.g. `alice.dot`) rather than
+    ///      bare labels.
+    /// @param value Candidate name path.
+    /// @return isValid True if every dot-separated segment is a canonical DNS label.
+    function isNamePath(string calldata value) internal pure returns (bool isValid) {
+        bytes memory path = bytes(value);
+        uint256 length = path.length;
+        if (length == 0) return false;
+
+        uint256 start;
+        for (uint256 i = 0; i < length; ++i) {
+            if (path[i] != bytes1(0x2e)) continue;
+            if (!_isDnsLabel(path, start, i)) return false;
+            start = i + 1;
+        }
+
+        return _isDnsLabel(path, start, length);
+    }
+
+    function _isDnsLabel(
+        bytes memory label,
+        uint256 start,
+        uint256 end
+    )
+        private
+        pure
+        returns (bool isValid)
+    {
+        if (end <= start) return false;
+        if (end - start > MAX_DNS_LABEL_OCTETS) return false;
+        if (label[start] == bytes1(0x2d) || label[end - 1] == bytes1(0x2d)) {
+            return false;
+        }
+
+        for (uint256 i = start; i < end; ++i) {
+            bytes1 char = label[i];
+            bool isLowercase = char >= 0x61 && char <= 0x7a;
+            bool isDigit = char >= 0x30 && char <= 0x39;
+            if (!(isLowercase || isDigit || char == bytes1(0x2d))) return false;
+        }
+
+        return true;
+    }
+
+    /// @notice Converts a uint256 to its decimal string representation.
+    /// @dev Wraps OpenZeppelin's Strings.toString().
+    /// @param value The unsigned integer to convert.
+    /// @return The decimal string representation.
+    function uintToString(uint256 value) internal pure returns (string memory) {
+        return value.toString();
+    }
+
+    /// @notice Converts an address to its checksummed hexadecimal string representation.
+    /// @dev Wraps OpenZeppelin's Strings.toHexString(). Returns lowercase hex with "0x" prefix.
+    /// @param account The address to convert.
+    /// @return The hexadecimal string representation (42 characters including "0x").
+    function addressToHex(address account) internal pure returns (string memory) {
+        return account.toHexString();
+    }
+
+    /// @notice Converts a bytes32 value to a string, treating it as a null-terminated ASCII string.
+    /// @dev Reads bytes until the first null byte (0x00) or end of bytes32.
+    ///      Useful for converting short strings stored in bytes32 back to string type.
+    /// @param _bytes32 The bytes32 value containing a null-terminated ASCII string.
+    /// @return The extracted string (up to 32 characters).
+    function bytes32ToString(bytes32 _bytes32) internal pure returns (string memory) {
+        uint8 i = 0;
+        while (i < 32 && _bytes32[i] != 0) {
+            i++;
+        }
+        bytes memory bytesArray = new bytes(i);
+        for (uint8 j = 0; j < i; j++) {
+            bytesArray[j] = _bytes32[j];
+        }
+        return string(bytesArray);
+    }
+}
diff --git a/contracts/utils/SubnodeUtilsOld.sol b/contracts/utils/SubnodeUtilsOld.sol
index 2f380731d..73a9a9394 100644
--- a/contracts/utils/SubnodeUtilsOld.sol
+++ b/contracts/utils/SubnodeUtilsOld.sol
@@ -1,25 +1,24 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.34;
 
-import {IDotnsRegistryOld} from "../registry/IDotnsRegistryOld.sol";
-import {IDotnsRegistrarOld} from "../registrars/IDotnsRegistrarOld.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
+import {IDotnsRegistry} from "../registry/IDotnsRegistry.sol";
+import {IDotnsRegistrar} from "../registrars/IDotnsRegistrar.sol";
+import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {LabelUtils} from "./LabelUtils.sol";
-import {StringUtils} from "./StringUtils.sol";
-import {DotnsConstantsOld} from "./DotnsConstantsOld.sol";
+import {StringUtilsOld} from "./StringUtilsOld.sol";
+import {DotnsConstants} from "./DotnsConstants.sol";
 
 /// @title DotNS Subnode Utilities Library
 /// @notice General-purpose helpers for registering names that live as subnodes of another name,
 ///         rather than as tokenised second-level registrations.
 /// @dev A subname has no token: its ownership lives in the registry record, not in the registrar's
-///      ERC-721 ledger. So it is registered through @custom:function
-/// IDotnsRegistryOld.setSubnodeOwner here, rather than through the tokenised mint triad of
-/// @custom:contract RegistrationUtilsOld.
+///      ERC-721 ledger. So it is registered through @custom:function IDotnsRegistry.setSubnodeOwner
+///      here, rather than through the tokenised mint triad of @custom:contract RegistrationUtils.
 /// @custom:security-contact admin@parity.io
 library SubnodeUtilsOld {
     /// @notice Inputs describing a single subname registration.
     /// @dev Passed as a struct so call sites name each field rather than thread a positional
-    ///      argument list, mirroring @custom:struct RegistrationUtilsOld.RegistrationContext.
+    ///      argument list, mirroring @custom:struct RegistrationUtils.RegistrationContext.
     /// @param protocolRegistry Protocol-level address registry used to resolve the registry and
     /// TLD.
     /// @param parentLabel Second-level parent label, e.g. `01`.
@@ -27,7 +26,7 @@ library SubnodeUtilsOld {
     /// @param owner Address to record as the subname owner.
     /// @param persist Whether the registry should index the subnode into the owner's `LabelStore`.
     struct SubnameContext {
-        IDotnsProtocolRegistryOld protocolRegistry;
+        IDotnsProtocolRegistry protocolRegistry;
         string parentLabel;
         string subLabel;
         address owner;
@@ -60,7 +59,7 @@ library SubnodeUtilsOld {
     /// separator first.
     /// @dev The single place a lite label is turned into a node, shared by the write path and every
     ///      reader of a lite name so the issuer and its readers agree on where a lite name lives.
-    ///      Callers gate on @custom:function StringUtils.isLitePersonLabelMemory beforehand, so the
+    ///      Callers gate on @custom:function StringUtilsOld.isLitePersonLabelMemory beforehand, so the
     ///      label is known to carry the separator this splits on.
     /// @param tldNode The TLD node.
     /// @param liteLabel Lite label, e.g. `alice.01`.
@@ -73,7 +72,7 @@ library SubnodeUtilsOld {
         pure
         returns (bytes32 subnode)
     {
-        (string memory stem, string memory suffix) = StringUtils.splitLiteLabel(liteLabel);
+        (string memory stem, string memory suffix) = StringUtilsOld.splitLiteLabel(liteLabel);
         subnode = subnodeOf(tldNode, suffix, stem);
     }
 
@@ -81,13 +80,13 @@ library SubnodeUtilsOld {
     ///         if it does not exist yet.
     /// @dev Derives the parent node `parentLabel.tld`; when no name is registered there yet it is
     ///      minted through the registrar with the calling contract as owner, so the caller holds
-    ///      the parent authority @custom:function IDotnsRegistryOld.setSubnodeOwner requires. The
+    ///      the parent authority @custom:function IDotnsRegistry.setSubnodeOwner requires. The
     ///      calling contract must therefore be a registrar controller, otherwise the registrar
     ///      @custom:reverts NotController. When a name already exists at the parent it must be
     /// owned by the caller, otherwise @custom:reverts NotAuthorised, so a name someone else holds
     /// is
     ///      never treated as the caller's parent. Ownership of the subname is then recorded through
-    ///      @custom:function IDotnsRegistryOld.setSubnodeOwner. `persist` is forwarded to the
+    ///      @custom:function IDotnsRegistry.setSubnodeOwner. `persist` is forwarded to the
     /// registry: when false the ownership and resolver record is written but the owner's
     /// `LabelStore` is
     ///      not, and the caller writes the label into the store separately.
@@ -101,16 +100,14 @@ library SubnodeUtilsOld {
     /// @param context Subname registration inputs. See @custom:struct SubnameContext.
     /// @return subnode Namehash of the registered subname.
     function registerSubname(SubnameContext memory context) internal returns (bytes32 subnode) {
-        IDotnsProtocolRegistryOld protocolRegistry = context.protocolRegistry;
+        IDotnsProtocolRegistry protocolRegistry = context.protocolRegistry;
 
         bytes32 parentNode = LabelUtils.namehashUnder(
             protocolRegistry.tldNode(), LabelUtils.labelhashMemory(context.parentLabel)
         );
 
-        IDotnsRegistrarOld registrar =
-            IDotnsRegistrarOld(protocolRegistry.get(DotnsConstantsOld.REGISTRAR));
-        IDotnsRegistryOld registry =
-            IDotnsRegistryOld(protocolRegistry.get(DotnsConstantsOld.REGISTRY));
+        IDotnsRegistrar registrar = IDotnsRegistrar(protocolRegistry.get(DotnsConstants.REGISTRAR));
+        IDotnsRegistry registry = IDotnsRegistry(protocolRegistry.get(DotnsConstants.REGISTRY));
 
         // Mint the parent on first use, owned by the caller, and pass an empty label so no
         // `LabelStore` is written for it. When it already exists it must belong to the caller,
@@ -121,11 +118,11 @@ library SubnodeUtilsOld {
             registrar.register(uint256(parentNode), address(this), "");
             registry.setOwner(parentNode, address(this));
         } else {
-            require(registry.owner(parentNode) == address(this), IDotnsRegistryOld.NotAuthorised());
+            require(registry.owner(parentNode) == address(this), IDotnsRegistry.NotAuthorised());
         }
 
         subnode = registry.setSubnodeOwner(
-            IDotnsRegistryOld.SubnodeRecord({
+            IDotnsRegistry.SubnodeRecord({
                 parentNode: parentNode,
                 subLabel: context.subLabel,
                 parentLabel: context.parentLabel,
diff --git a/contracts/utils/SystemUtilsOld.sol b/contracts/utils/SystemUtilsOld.sol
deleted file mode 100644
index 131e6d3ff..000000000
--- a/contracts/utils/SystemUtilsOld.sol
+++ /dev/null
@@ -1,21 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {ISystem} from "../external/revive/ISystem.sol";
-import {DotnsConstantsOld} from "./DotnsConstantsOld.sol";
-
-/// @title SystemUtilsOld
-/// @notice Shared access to revive's System precompile for DotNS contracts.
-/// @dev Canonical wrapper around `ISystem` at `DotnsConstantsOld.REVIVE_SYSTEM`, so the precompile
-///      address and interface are wired in one place rather than duplicated per consumer.
-/// @custom:security-contact admin@parity.io
-library SystemUtilsOld {
-    /// @notice Returns whether the transaction-level origin is substrate Root.
-    /// @dev Reads the stack origin through `ISystem.originIsRoot`, which holds through a UUPS
-    ///      proxy's delegatecall frame where `callerIsRoot` returns false, and returns false
-    ///      rather than reverting on a non-Root origin.
-    /// @return root True when the transaction origin is Root.
-    function originIsRoot() internal view returns (bool root) {
-        return ISystem(DotnsConstantsOld.REVIVE_SYSTEM).originIsRoot();
-    }
-}
diff --git a/contracts/whitelist/DotnsNameWhitelistOld.sol b/contracts/whitelist/DotnsNameWhitelistOld.sol
deleted file mode 100644
index 3bcfa248d..000000000
--- a/contracts/whitelist/DotnsNameWhitelistOld.sol
+++ /dev/null
@@ -1,512 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {
-    ERC165Upgradeable
-} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol";
-import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
-
-import {IDotnsNameWhitelist} from "./IDotnsNameWhitelist.sol";
-import {IDotnsProtocolRegistryOld} from "../registry/IDotnsProtocolRegistryOld.sol";
-import {LabelUtils} from "../utils/LabelUtils.sol";
-import {StringUtils} from "../utils/StringUtils.sol";
-import {DotnsConstantsOld} from "../utils/DotnsConstantsOld.sol";
-import {SystemUtilsOld} from "../utils/SystemUtilsOld.sol";
-
-/// @title DotnsNameWhitelistOld
-/// @notice Pre-launch name whitelist. A name is Open until governance reserves it or a claim is
-///         accepted for it. Several beneficiaries may claim the same Open name, each with a
-///         reason, and governance accepts one as the winner.
-/// @dev Lives behind its own UUPS proxy with its own storage. Callers pass bare labels only; the
-///      contract derives the node from the label and the TLD in the protocol registry, so a
-///      caller cannot supply a mismatched hash. Claims are keyed by the beneficiary `user`, not
-///      the submitter, so a relayer or a cross-chain sovereign account can submit on a user's
-///      behalf and the name binds to that user. All state is on-chain and queryable through views;
-///      no event indexing is required. A name holds at most `maxClaimants` live claims, which
-///      bounds the loop that clears them on resolution. Resolving a name deletes its claims,
-///      refunding their storage deposit, so only reserved or won names persist. The entire admin
-///      surface is substrate Root: `SystemUtilsOld.originIsRoot` is true through the proxy's
-///      delegatecall frame, and no gate reads `msg.sender`, so Root's lack of an address is not a
-///      problem. No signed account grants, revokes, reserves, or retunes a cap; the owner's
-///      authority is upgrade only. The public and PoP controllers hold only the `consume` hook.
-///      Entries are keyed by the node under the active TLD, which the deployment holds immutable
-///      for the whitelist's lifetime.
-/// @custom:security-contact admin@parity.io
-contract DotnsNameWhitelistOld is
-    Initializable,
-    UUPSUpgradeable,
-    OwnableUpgradeable,
-    ERC165Upgradeable,
-    IDotnsNameWhitelist
-{
-    using StringUtils for string;
-    using EnumerableSet for EnumerableSet.AddressSet;
-    using EnumerableSet for EnumerableSet.Bytes32Set;
-
-    /// @notice One role's membership and its admin role.
-    /// @dev Member of the reserved AccessControl namespace, unused because gating is Root only.
-    /// @param hasRole Whether an account holds the role.
-    /// @param adminRole Admin role that manages the role.
-    struct RoleData {
-        mapping(address account => bool) hasRole;
-        bytes32 adminRole;
-    }
-
-    /// @notice Reserved OpenZeppelin access-control namespace held at its ERC-7201 slot.
-    /// @dev Declared and left unused so the namespace stays present in the layout. Its slot derives
-    ///      from the label, disjoint from the sequential slots below, so it consumes none of them.
-    /// @param _roles Role data keyed by role identifier.
-    /// @custom:storage-location erc7201:openzeppelin.storage.AccessControl
-    struct AccessControlStorage {
-        mapping(bytes32 role => RoleData) _roles;
-    }
-
-    /// @notice Protocol-level address registry for all DotNS contracts.
-    IDotnsProtocolRegistryOld public protocolRegistry;
-
-    /// @notice Live-claim cap per name, tunable by governance within
-    ///         `DotnsConstantsOld.WHITELIST_MAX_CLAIMANTS_LIMIT`.
-    uint16 public maxClaimants;
-
-    /// @notice Cap on labels per `grantNames` call, tunable by governance within
-    ///         `DotnsConstantsOld.WHITELIST_MAX_GRANT_BATCH_LIMIT`.
-    uint16 public maxGrantBatch;
-
-    /// @notice Reason byte cap, tunable by governance within
-    ///         `DotnsConstantsOld.WHITELIST_MAX_REASON_LIMIT`.
-    uint256 public maxReasonBytes;
-
-    /// @notice Resolved state per name.
-    mapping(bytes32 node => NameRecord record) private _names;
-
-    /// @notice Claims per name, keyed by beneficiary.
-    mapping(bytes32 node => mapping(address user => Claim claim)) private _claims;
-
-    /// @notice Beneficiaries with a live claim per name.
-    mapping(bytes32 node => EnumerableSet.AddressSet claimants) private _claimants;
-
-    /// @notice Names holding reserved, claimed or claim-holding state, kept enumerable for review.
-    EnumerableSet.Bytes32Set private _activeNodes;
-
-    /// @notice Timestamp requests start being accepted.
-    uint64 private _requestOpen;
-
-    /// @notice Timestamp requests stop being accepted.
-    uint64 private _requestClose;
-
-    /// @dev Reserved storage space to allow for layout changes in the future.
-    uint256[50] private __gap;
-
-    /// @notice Restricts a call to a substrate Root dispatch.
-    /// @dev The whole admin surface is governance-only: no key grants, revokes, reserves, or
-    ///      retunes a cap. The owner's authority is deployment and upgrade, not allocation, so no
-    ///      signed account can hand out a name. `msg.sender` is never read here, which is also what
-    ///      keeps every gated entry point callable under a Root origin, since Root has no account.
-    modifier onlyGovernance() {
-        _onlyGovernance();
-        _;
-    }
-
-    /// @notice Restricts a call to a registrar controller resolved through the registry.
-    modifier onlyController() {
-        require(
-            msg.sender == protocolRegistry.get(DotnsConstantsOld.CONTROLLER)
-                || msg.sender == protocolRegistry.get(DotnsConstantsOld.POP_CONTROLLER),
-            NotController(msg.sender)
-        );
-        _;
-    }
-
-    /// @notice Internal check enforcing the substrate Root gate.
-    function _onlyGovernance() internal view {
-        require(SystemUtilsOld.originIsRoot(), NotGovernance());
-    }
-
-    /// @custom:oz-upgrades-unsafe-allow constructor
-    constructor() {
-        _disableInitializers();
-    }
-
-    /// @notice Initialises the whitelist.
-    /// @dev Callable once through the UUPS proxy; direct calls on the implementation
-    ///      @custom:reverts InvalidInitialization. Sets the deployer as owner and wires the
-    ///      protocol registry the node derivation reads the TLD from.
-    /// @param registry Protocol registry all DotNS contracts resolve through.
-    function initialize(IDotnsProtocolRegistryOld registry) external initializer {
-        __ERC165_init();
-        __Ownable_init(msg.sender);
-        protocolRegistry = registry;
-        maxClaimants = DotnsConstantsOld.WHITELIST_DEFAULT_MAX_CLAIMANTS;
-        maxGrantBatch = DotnsConstantsOld.WHITELIST_DEFAULT_MAX_GRANT_BATCH;
-        maxReasonBytes = DotnsConstantsOld.WHITELIST_DEFAULT_MAX_REASON_BYTES;
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function setMaxClaimants(uint16 newMax) external override onlyGovernance {
-        require(
-            newMax > 0 && newMax <= DotnsConstantsOld.WHITELIST_MAX_CLAIMANTS_LIMIT,
-            MaxClaimantsOutOfRange()
-        );
-        maxClaimants = newMax;
-        emit MaxClaimantsSet(newMax);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function setMaxReasonBytes(uint256 newMax) external override onlyGovernance {
-        require(
-            newMax > 0 && newMax <= DotnsConstantsOld.WHITELIST_MAX_REASON_LIMIT,
-            MaxReasonBytesOutOfRange()
-        );
-        maxReasonBytes = newMax;
-        emit MaxReasonBytesSet(newMax);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function setMaxGrantBatch(uint16 newMax) external override onlyGovernance {
-        require(
-            newMax > 0 && newMax <= DotnsConstantsOld.WHITELIST_MAX_GRANT_BATCH_LIMIT,
-            MaxGrantBatchOutOfRange()
-        );
-        maxGrantBatch = newMax;
-        emit MaxGrantBatchSet(newMax);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function requestName(
-        string calldata label,
-        string calldata reason,
-        address user
-    )
-        external
-        override
-    {
-        require(_isWindowOpen(), WindowClosed());
-        require(user != address(0), ZeroUser());
-        require(bytes(reason).length <= maxReasonBytes, ReasonTooLong());
-        require(label.isSingleLabel(), InvalidLabel());
-
-        bytes32 node = _nodeOf(label);
-        require(_names[node].status == NameStatus.Open, NameNotOpen(node));
-        require(_claims[node][user].status == ClaimStatus.None, AlreadyClaimed(node, user));
-        require(_claimants[node].length() < maxClaimants, TooManyClaimants(node));
-
-        _claims[node][user] = Claim({
-            user: user,
-            status: ClaimStatus.Requested,
-            requestedAt: uint64(block.timestamp),
-            submitter: msg.sender,
-            reason: reason
-        });
-        _claimants[node].add(user);
-        _activate(node, label);
-        emit NameRequested(node, user, label, reason);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function accept(string calldata label, address user) external override onlyGovernance {
-        bytes32 node = _nodeOf(label);
-        require(_claims[node][user].status == ClaimStatus.Requested, NotRequested(node, user));
-        emit NameAccepted(node, user, label);
-        _settle(node, user, label);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function reject(string calldata label, address user) external override onlyGovernance {
-        bytes32 node = _nodeOf(label);
-        Claim storage claim = _claims[node][user];
-        require(claim.status == ClaimStatus.Requested, NotRequested(node, user));
-        // Free the claimant slot either way. Keep a sticky Rejected record only for a self-filed
-        // claim, so the beneficiary cannot re-request; a claim filed on their behalf is
-        // deleted and never binds them.
-        _claimants[node].remove(user);
-        if (claim.submitter == user) {
-            claim.status = ClaimStatus.Rejected;
-        } else {
-            delete _claims[node][user];
-        }
-        emit NameRejected(node, user, label);
-        _deactivate(node);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function grantName(string calldata label, address user) external override onlyGovernance {
-        _grant(label, user);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function grantNames(string[] calldata labels, address user) external override onlyGovernance {
-        require(labels.length <= maxGrantBatch, TooManyLabels());
-        for (uint256 i = 0; i < labels.length; i++) {
-            _grant(labels[i], user);
-        }
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function revokeName(string calldata label) external override onlyGovernance {
-        bytes32 node = _nodeOf(label);
-        NameRecord storage record = _names[node];
-        require(
-            record.status == NameStatus.Claimed || _claimants[node].length() != 0,
-            NothingToRevoke(node)
-        );
-        address winner = record.winner;
-        _clearClaimants(node, address(0), label);
-        record.status = NameStatus.Open;
-        record.winner = address(0);
-        emit NameRevoked(node, winner, label);
-        _deactivate(node);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function setReserved(string calldata label, bool reserved) external override onlyGovernance {
-        require(label.isSingleLabel(), InvalidLabel());
-        bytes32 node = _nodeOf(label);
-        NameRecord storage record = _names[node];
-        if (reserved) {
-            require(record.status == NameStatus.Open, NameNotOpen(node));
-            // Clear any pending claims the way a grant does, so a permissionless requestName
-            // cannot force governance to revokeName before it can reserve.
-            _clearClaimants(node, address(0), label);
-            record.status = NameStatus.Reserved;
-            _activate(node, label);
-            emit NameReserved(node, label);
-        } else {
-            require(record.status == NameStatus.Reserved, NotReserved(node));
-            record.status = NameStatus.Open;
-            emit NameUnreserved(node, label);
-            _deactivate(node);
-        }
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function consume(string calldata label, address registrant) external override onlyController {
-        bytes32 node = _nodeOf(label);
-        NameRecord storage record = _names[node];
-        require(
-            record.status == NameStatus.Claimed && record.winner == registrant,
-            NotWinner(registrant, node)
-        );
-        record.status = NameStatus.Open;
-        record.winner = address(0);
-        emit NameConsumed(node, registrant, label);
-        _deactivate(node);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function setWindow(uint64 startsIn, uint64 duration) external override onlyGovernance {
-        require(duration > 0, BadWindow());
-        uint64 openAt = uint64(block.timestamp) + startsIn;
-        uint64 closeAt = openAt + duration;
-        _requestOpen = openAt;
-        _requestClose = closeAt;
-        emit WindowSet(openAt, closeAt);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function statusOf(string calldata label) external view override returns (NameStatus status) {
-        return _names[_nodeOf(label)].status;
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function isReserved(string calldata label) external view override returns (bool reserved) {
-        return _names[_nodeOf(label)].status == NameStatus.Reserved;
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function granteeOf(string calldata label) external view override returns (address winner) {
-        NameRecord storage record = _names[_nodeOf(label)];
-        return record.status == NameStatus.Claimed ? record.winner : address(0);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function isGrantedTo(
-        string calldata label,
-        address account
-    )
-        external
-        view
-        override
-        returns (bool granted)
-    {
-        NameRecord storage record = _names[_nodeOf(label)];
-        return
-            account != address(0) && record.status == NameStatus.Claimed && record.winner == account;
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function claimOf(
-        string calldata label,
-        address user
-    )
-        external
-        view
-        override
-        returns (Claim memory claim)
-    {
-        return _claims[_nodeOf(label)][user];
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function claimantCount(string calldata label) external view override returns (uint256 count) {
-        return _claimants[_nodeOf(label)].length();
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function claims(
-        string calldata label,
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (Claim[] memory page)
-    {
-        bytes32 node = _nodeOf(label);
-        EnumerableSet.AddressSet storage set = _claimants[node];
-        uint256 total = set.length();
-        if (offset >= total) {
-            return new Claim[](0);
-        }
-        uint256 available = total - offset;
-        uint256 count = limit < available ? limit : available;
-        page = new Claim[](count);
-        for (uint256 i; i < count; ++i) {
-            page[i] = _claims[node][set.at(offset + i)];
-        }
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function nameCount() external view override returns (uint256 count) {
-        return _activeNodes.length();
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function names(
-        uint256 offset,
-        uint256 limit
-    )
-        external
-        view
-        override
-        returns (NameView[] memory page)
-    {
-        uint256 total = _activeNodes.length();
-        if (offset >= total) {
-            return new NameView[](0);
-        }
-        uint256 available = total - offset;
-        uint256 count = limit < available ? limit : available;
-        page = new NameView[](count);
-        for (uint256 i; i < count; ++i) {
-            bytes32 node = _activeNodes.at(offset + i);
-            NameRecord storage record = _names[node];
-            page[i] = NameView({
-                node: node, label: record.label, status: record.status, winner: record.winner
-            });
-        }
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function window() external view override returns (uint64 openAt, uint64 closeAt) {
-        return (_requestOpen, _requestClose);
-    }
-
-    /// @inheritdoc IDotnsNameWhitelist
-    function isWindowOpen() external view override returns (bool open) {
-        return _isWindowOpen();
-    }
-
-    /// @inheritdoc ERC165Upgradeable
-    function supportsInterface(bytes4 interfaceId)
-        public
-        view
-        override(ERC165Upgradeable)
-        returns (bool supported)
-    {
-        return interfaceId == type(IDotnsNameWhitelist).interfaceId
-            || super.supportsInterface(interfaceId);
-    }
-
-    /// @notice Grants `label` to `user` directly, clearing any pending claims.
-    /// @param label Bare label to grant.
-    /// @param user Beneficiary the name binds to.
-    function _grant(string calldata label, address user) internal {
-        require(user != address(0), ZeroUser());
-        require(label.isSingleLabel(), InvalidLabel());
-        bytes32 node = _nodeOf(label);
-        require(_names[node].status == NameStatus.Open, NameNotOpen(node));
-        emit NameAccepted(node, user, label);
-        _settle(node, user, label);
-    }
-
-    /// @notice Marks a name claimed for `winner` and clears its claims, rejecting the losers.
-    /// @param node Namehash of the label under the active TLD.
-    /// @param winner Beneficiary the name binds to.
-    /// @param label Bare label, stored for review.
-    function _settle(bytes32 node, address winner, string calldata label) internal {
-        NameRecord storage record = _names[node];
-        record.status = NameStatus.Claimed;
-        record.winner = winner;
-        _activate(node, label);
-        _clearClaimants(node, winner, label);
-    }
-
-    /// @notice Deletes every claim on a name, rejecting each claimant that is not `winner`.
-    /// @param node Namehash of the label under the active TLD.
-    /// @param winner Claimant spared a rejection event; the zero address rejects every claimant.
-    /// @param label Bare label emitted with each rejection.
-    function _clearClaimants(bytes32 node, address winner, string calldata label) internal {
-        address[] memory current = _claimants[node].values();
-        for (uint256 i; i < current.length; ++i) {
-            address claimant = current[i];
-            delete _claims[node][claimant];
-            _claimants[node].remove(claimant);
-            if (claimant != winner) {
-                emit NameRejected(node, claimant, label);
-            }
-        }
-    }
-
-    /// @notice Records a name as active and stores its label the first time it is seen.
-    /// @param node Namehash of the label under the active TLD.
-    /// @param label Bare label stored on first activation.
-    function _activate(bytes32 node, string calldata label) internal {
-        NameRecord storage record = _names[node];
-        if (bytes(record.label).length == 0) {
-            record.label = label;
-        }
-        _activeNodes.add(node);
-    }
-
-    /// @notice Drops a name from the active set once it is Open with no claims.
-    /// @param node Namehash of the label under the active TLD.
-    function _deactivate(bytes32 node) internal {
-        NameRecord storage record = _names[node];
-        if (record.status == NameStatus.Open && _claimants[node].length() == 0) {
-            _activeNodes.remove(node);
-            delete record.label;
-        }
-    }
-
-    /// @notice Derives the namehash of `label` under the active TLD read from the registry.
-    /// @param label Bare label to hash.
-    /// @return node Namehash of the label under the active TLD.
-    function _nodeOf(string calldata label) internal view returns (bytes32 node) {
-        (, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), label);
-    }
-
-    /// @notice Returns whether the current time is within the open window.
-    /// @return open True when the current time is within the window.
-    function _isWindowOpen() internal view returns (bool open) {
-        return block.timestamp >= _requestOpen && block.timestamp < _requestClose;
-    }
-
-    /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
-}
diff --git a/docs/PASEO-V080-RUNBOOK.md b/docs/PASEO-V080-RUNBOOK.md
deleted file mode 100644
index b106b21a7..000000000
--- a/docs/PASEO-V080-RUNBOOK.md
+++ /dev/null
@@ -1,287 +0,0 @@
-# Paseo Asset Hub Next: broadcast order for the v0.8.0 in-place upgrade
-
-Every step is one `scripts/deploy/upgrade.sh` invocation under the deployment owner, and the
-order is not a preference. Broadcasts run through CI, one label per step; see "Broadcasting
-through the review PR" below. Running locally instead needs the key material, which nobody
-holds, so the label path is not a convenience but the mechanism. Three dependencies make it the only order that works:
-
-- **The protocol registry goes first.** Every upgraded contract's `version()` reads
-  `protocolRegistry.protocolVersion()`, and `MigrateStoreFactory` calls `setExpectedCodehash`.
-  Neither entrypoint exists on the implementation the network starts on, so anything that runs
-  before the registry swap either reverts or reads a contract that cannot answer.
-- **The store migration goes after the registry and before the declaration.** It rewires the
-  `storeFactory` key, and the declaration records the codehash of whatever that key resolves to.
-  Declaring first would record the old factory and then quietly stop being true.
-- **The declaration goes last.** It is a claim about the whole deployment. Made early, an
-  abandoned run leaves a false claim standing; made last, the same abandoned run leaves the
-  previous declaration, which clients read as an older network.
-
-Nothing in the scripts enforces this. Each is independently runnable by design, so the ordering
-lives here and in the fork tests that reproduce it.
-
-## Before anything is broadcast
-
-```bash
-RPC_URL=https://eth-rpc-paseo-next.polkadot.io scripts/shell/verify-snapshots.sh
-
-PASEO_FORK_RPC=https://eth-rpc-paseo-next.polkadot.io \
-  RPC_URL=https://eth-rpc-paseo-next.polkadot.io scripts/shell/fork-tests.sh
-```
-
-The second form needs no Docker. `bun run test:fork` brings up the local ETH-RPC adapter, which
-only translates for the same node the hosted endpoint already fronts, so both exercise the same
-state. Use whichever is available; the suite is 15 tests and takes under a minute either way.
-
-The first is the check that matters most and takes seconds. Every `*Old.sol` snapshot must
-reproduce the implementation currently deployed; a snapshot that has drifted makes every layout
-diff meaningless while leaving the build green. Re-run it on the day, not from an earlier run:
-these proxies are upgraded in place, so a swap landing in between changes the answer.
-
-Confirm the broadcaster owns the proxies. All of them, and the deployed store factory, answer to
-the same account; each script asserts this before it swaps anything, so a wrong signer fails fast
-instead of reverting inside an upgrade call.
-
-## Order
-
-| # | Script | Why here |
-| --- | --- | --- |
-| 0 | `RotateOwnership` | Moves every contract to a fresh key before anything else is broadcast. |
-| 1 | `UpgradeProtocolRegistry` | Adds `protocolVersion` and `setExpectedCodehash`, which steps 2 to 14 depend on. |
-| 2 | `UpgradeRegistry` | Adds the deferred-write gate. Reads `registrar.controllers` live. |
-| 3 | `UpgradeRegistrar` | Holds the controller authorisations the gate reads. |
-| 4 | `UpgradeRegistrarController` | Carries the retained slot that keeps `protocolRegistry` readable. |
-| 5 | `UpgradePopController` | |
-| 6 | `UpgradePopRules` | |
-| 7 | `UpgradeNameEscrow` | Custodies deposits; check `redeemWindow()` is non-zero afterwards. |
-| 8 | `UpgradeNameWhitelist` | |
-| 9 | `UpgradeResolver` | |
-| 10 | `UpgradeReverseResolver` | |
-| 11 | `UpgradeContentResolver` | |
-| 12 | `UpgradePopResolver` | |
-| 13 | `MigrateStoreFactory` | Deploys the replacement, imports the bindings, rewires the key. |
-| 14 | `DeclareRelease` | Declares every codehash, then the release. Last, always. |
-
-Steps 5 to 12 have no dependency on each other and can go in any order among themselves.
-
-## Broadcasting through the review PR
-
-The workflow (`.github/workflows/paseo-upgrade-step.yml`) lives only on this branch and is
-triggered by labels on the open review PR into master, because a dispatch button only exists for
-workflows on the default branch and nothing that signs with the owner key goes there. One step:
-
-1. Add the label `run:<Script>` to the review PR, for example `run:UpgradeProtocolRegistry`.
-2. The run starts and immediately pauses on the `testnet-upgrades` environment. Approve it there.
-   The run is pinned to the PR's head commit at label time, so a push after labelling does not
-   change what an approval executes.
-3. The job starts the local ETH-RPC adapter, broadcasts the one script, uploads the broadcast
-   record and the manifest as artifacts, comments the outcome on the PR, and removes the label.
-   Known cosmetic quirk: when the label validation step itself fails, the comment renders the
-   step name as `****`, because the name was never resolved and the masking hits the empty
-   output. The run page has the real error either way.
-4. Retry by re-adding the label. Manual work between steps (funding the fresh account, swapping
-   the environment secret after step 0, committing the step 13 manifest from the artifact,
-   since the runner cannot produce the signed commit this branch requires) happens with no label
-   applied, which is what makes the pauses real.
-
-One-time setup, in the repository UI plus one shell loop:
-
-- Environment `testnet-upgrades`: required reviewer(s), variables `DOTNS_NEW_OWNER` and
-  `DOTNS_RELEASE_TAG` (`0.8.0`), optionally `DOTNS_OLD_STORE_FACTORY`. No secret yet: step 0
-  signs with the repository-level `DOTNS_ADMIN_KEY`, which nobody can read and therefore nobody
-  can move. After step 0, add the fresh key as the environment secret `DOTNS_ADMIN_KEY`, which
-  shadows the repository one for gated jobs, and delete the repository copy.
-- The labels:
-
-```bash
-for s in RotateOwnership UpgradeProtocolRegistry UpgradeRegistry UpgradeRegistrar \
-  UpgradeRegistrarController UpgradePopController UpgradePopRules UpgradeNameEscrow \
-  UpgradeNameWhitelist UpgradeResolver UpgradeReverseResolver UpgradeContentResolver \
-  UpgradePopResolver MigrateStoreFactory DeclareRelease; do
-  gh label create "run:$s" --repo paritytech/dotns --color 4FEF0F \
-    --description "Broadcast $s on Paseo (gated)" --force
-done
-```
-
-Setup order matters, twice:
-
-- **Create the environment, with its required reviewers, before any workflow referencing it is
-  pushed.** A workflow that names an environment which does not exist yet makes GitHub create it
-  on the spot, unprotected, and the first labelled run broadcasts with no gate at all.
-- **Leave the environment's deployment branch policy unrestricted.** A `pull_request` run
-  deploys from `refs/pull/N/merge`, which no branch-name pattern ever matches, so any
-  restriction blocks every gated run with a misleading error. The protection is the required
-  reviewer, not the branch list.
-
-Ephemeral working branches for experiments around the campaign go under `chore/`, never under
-`dev/`: that prefix is protected, and a throwaway branch created there cannot be deleted without
-lifting the protection.
-
-## Step 0, and why it is first
-
-Copies of the deployment key have spread across sources the project does not control, so the
-key is treated as leaked. Rotation is one broadcast, individually verifiable, and doing it first means
-the long upgrade window is not spent hoping an exposed key stays unused. Addresses do not move:
-ownership is a storage field, so hosts, manifests, the SDK pins and the codehash declarations are
-all untouched. Redeployment would buy nothing rotation does not.
-
-The step is the old key's last act, and everything after it is broadcast by the new one:
-
-1. Generate the new key with clean custody. No funding is needed: the sweep below is the
-   funding, and sending anything to a mapped address by hand risks the wrong sibling chain,
-   where a mapped account has no revive and therefore no key that can ever spend it.
-2. Run `RotateOwnership` as the old key, with `DOTNS_NEW_OWNER` set to the new account. The
-   script hard-fails if any expected contract answers to a surprise owner, refuses to rotate to
-   the broadcaster itself, verifies every transfer by readback, scans the whole manifest for
-   anything owner-answering that its inventory missed, and finally sweeps the old account's
-   balance to the new owner, keeping a two-unit gas buffer. Ownership and money leave the leaked
-   key in the same approved run; a later manual sweep would be a race offered to whoever else
-   holds it.
-3. Swap the signer: enter the new key as the environment secret. Until this happens, steps 1 to
-   14 fail their owner assertions, loudly and harmlessly.
-4. Delete every stored copy of the old key: `DOTNS_ADMIN_KEY` on this repository, and the
-   organisation-level `DEPLOYER_KEY`, which the deployment records show controls the same
-   account. An org owner has to do the second.
-
-A partial failure is finished by running the script again with the same inputs: contracts that
-already moved are skipped, so the old key can complete an interrupted rotation. Once everything
-has moved, a re-run is a loud no-op. `test/fork/RotateOwnership.t.sol` proves the rotation, the
-old key's lockout, the new key's ability to upgrade, and the no-op re-run, against live state.
-
-One thing rotation does not cover: the CREATE3 factory deployer key cannot be rotated in any
-meaningful sense, since the factory address is a historical function of it. On this chain the
-slots are spent and it grants nothing; on future chains the deploy pipeline's occupancy checks
-are the protection.
-
-## After each swap
-
-```bash
-cast implementation <proxy> --rpc-url <rpc>
-```
-
-The new implementation's masked bytecode should equal this branch's build. `verify-snapshots.sh`
-compares snapshots against the chain, so it is not the tool for this; the check here is that the
-swap put the implementation you built where you expected it.
-
-## After step 13
-
-The migration is the only step that moves user state rather than swapping code. Confirm, for a
-holder the old factory had:
-
-```
-protocolRegistry.get(storeFactory)        -> the replacement proxy
-replacement.getLabelStore(<holder>)       -> the store they already had
-replacement.getLabelStoreCount()          -> the old factory's count
-```
-
-`test_after_rewire_a_live_holder_resolves_to_their_existing_store` asserts exactly this on a
-fork, so a surprise here means the fork and the chain have diverged since it last ran.
-
-The old factory keeps its beacons, and the imported stores still point at them. **Do not discard
-the old factory**: it is the only contract that can upgrade the implementations behind those
-stores, and it answers to the same owner. A `BeaconProxy` holds its beacon in an immutable, so no
-migration can move them.
-
-The replacement takes the `StoreFactory` label and mints its own beacons, so after this step the
-manifest's usual three entries all describe the new deployment. The outgoing addresses are
-written first, under keys that do not move:
-
-| Key | What it is |
-| --- | --- |
-| `StoreFactoryLegacy` | The factory the imported stores were created by. |
-| `LabelStoreBeaconLegacy` | Beacon behind every imported `LabelStore`. |
-| `UserStoreBeaconLegacy` | Its user-store counterpart. |
-
-A `LabelStore` implementation rotation for the existing holders goes through
-`StoreFactoryLegacy`, not through the new factory. The new factory's beacons serve only stores
-created after this migration.
-
-## After step 14
-
-```bash
-verify --network paseo-assethub --rpc https://eth-rpc-paseo-next.polkadot.io --tag v0.8.0
-```
-
-This comes back clean: `paseo-assethub matches the chain` (verified 2026-09-22). It is clean
-because the check compares the on-chain code-identity declarations against the code actually
-executing, and both are the branch build. The `registrarController` divergence from the v0.8.0
-tag still exists, it just cannot appear here: the deployed controller carries the retained slot
-that keeps `protocolRegistry` where the live proxy has it, and no release tag describes that
-build. A tag build reads the field as the zero address and bricks the contract, so the branch
-build is the only deployable one. The divergence surfaces only when comparing artifacts BUILT
-from the tag against this chain; `DEPLOYMENTS.md` has the detail. Any key this verify reports
-as a problem is a real finding.
-
-Close-out, once the verify is green: disable the broadcast console with
-`gh workflow disable "Paseo Upgrade Step"` (done 2026-09-22), close the review PR, and tag the
-branch head so the campaign's exact code stays addressable.
-
-## If a step fails
-
-Stop. The upgrades are independent, so a failure leaves the contracts already swapped on the new
-code and the rest on the old, which is a running network: `version()` answers from the registry
-for the swapped ones, and the declaration has not been made, so nothing on chain over-claims.
-
-Fix the cause and resume from the failed step. Do not skip ahead to `DeclareRelease` to tidy up;
-declaring a release the deployment does not fully run is the one state the declarations cannot
-represent.
-
-Step 0 is re-runnable by design, see its section.
-
-**Step 13 is the exception: inspect before re-running it.** The other twelve are idempotent, and
-re-running one that failed is safe. The migration is re-runnable only from some states. Read the
-proxy's implementation slot and its `getLabelStoreCount` first, and place the failure:
-
-- **Died before or during the deploy leg, or between the deploy and the first import page**
-  (proxy absent, or present and delegating to the shipped `StoreFactory` with a count of zero):
-  re-adding the label is safe. The deploy leg adopts the proxy, the import starts over.
-- **Died between import pages** (proxy delegating to the migrator, count below the old factory's):
-  the label does NOT work, because the deploy leg refuses to adopt a proxy parked on the
-  migrator. Continue by hand instead: call `importStores(oldFactory, offset, page)` on the proxy
-  as the owner until the count matches, replaying from offset 0 if in doubt, because pages skip
-  bindings that already landed. Then upgrade back to the shipped implementation, rewire the key
-  with `setExpectedCodehash`, and commit the manifest. The fork test
-  `test_a_death_between_pages_is_finished_by_replaying_them` is the executable version of this
-  recipe.
-- **Died after the import** (proxy back on the shipped implementation, counts equal): re-adding
-  the label completes the remaining legs; the pages replay as no-ops.
-
-The import is paged because the first attempt (2026-09-22, run 35692062453) proved a single
-transaction importing all 63 bindings does not fit in a pallet-revive block: gas estimation died
-mid-loop around the 44th store at any gas limit, the multi-dimensional weight exhaustion
-surfacing as OpenZeppelin's `FailedCall`. No off-chain simulation models that ceiling; the
-default page of 15 stays at roughly a third of the measured capacity, and `DOTNS_IMPORT_CHUNK`
-overrides it if the ceiling moves.
-
-## Running the next campaign on this branch
-
-This runbook is written for the v0.8.0 upgrade, but the branch and its tooling are permanent.
-The next in-place upgrade reuses everything here; what changes is the step list. In order:
-
-1. Merge `master` into `dev/testnet-upgrades`. Nothing ever merges back.
-2. Take fresh `*Old.sol` snapshots **from the code the chain is running**, not from the last
-   tag: read each proxy's implementation and let `scripts/shell/verify-snapshots.sh` prove every
-   snapshot reproduces the deployed bytecode before anything else is written. The snapshot
-   closure rules are in CONTRIBUTING's Upgrade-PR workflow section.
-3. Write one upgrade script and one fork test per contract that changes, same pairing as this
-   campaign. Any script leg that loops over live state is paged from day one; see "Limits the
-   simulator cannot see" in CONTRIBUTING.
-4. Extend the allowlist in `.github/workflows/paseo-upgrade-step.yml` with the new script names
-   and create any missing `run:<Script>` labels (the loop above, color `4FEF0F`). The
-   `testnet-upgrades` environment, its reviewers and variables already exist; update
-   `DOTNS_RELEASE_TAG` to the new version.
-5. Re-enable the console: `gh workflow enable "Paseo Upgrade Step"`. It was disabled at the end
-   of the previous campaign so a stray label cannot broadcast between campaigns.
-6. Open a fresh draft review PR into `master` titled as review-only, and broadcast one label at
-   a time: registry-affecting steps in their required order first, independent swaps in any
-   order, migrations and the release declaration last, manifest committed by the operator
-   between the two.
-7. Verify every step from an independent client before the next label: implementation slot
-   moved, masked runtime bytecode equals the branch build, owner unchanged, and one state read
-   that the specific contract's storage survived. The workflow's green check means the
-   transactions landed; it does not read the chain back.
-8. Close out: run the release verify until it is clean, disable the workflow, close the PR, tag
-   the branch head.
-
-The mid-campaign CI shape is expected to be red: `verify-snapshots` fails by design from the
-first swap until the campaign's snapshots are retired, because the chain no longer matches the
-pre-upgrade snapshots. That red is the guard working, not a failure to fix.
diff --git a/scripts/deploy/MigrateStoreFactory.s.sol b/scripts/deploy/MigrateStoreFactory.s.sol
deleted file mode 100644
index 41a97e8c3..000000000
--- a/scripts/deploy/MigrateStoreFactory.s.sol
+++ /dev/null
@@ -1,273 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
-import {IStoreFactory} from "../../contracts/store/IStoreFactory.sol";
-import {StoreFactory} from "../../contracts/store/StoreFactory.sol";
-import {StoreFactoryMigrator} from "../../contracts/store/StoreFactoryMigrator.sol";
-import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title MigrateStoreFactory
-/// @notice Deploys the current `StoreFactory` behind its own proxy, carries the per-user
-///         `LabelStore` bindings over from the factory the network runs today, and points the
-///         `storeFactory` key at the result.
-/// @dev The one contract in the upgrade that cannot be swapped in place. What is deployed is a
-///      plain contract from an earlier release, so there is no proxy to upgrade; the current
-///      release puts the factory behind one at a different address. Every store lookup goes
-///      through whatever `STORE_FACTORY` resolves to, so re-pointing the key at an empty factory
-///      would hand each existing holder a second, empty store the next time one was needed and
-///      drop their labels out of per-address enumeration. Names are untouched either way:
-///      ownership lives in the registry, not here.
-///
-///      Self-contained on purpose. The manifest's `StoreFactory` entry is the factory the network
-///      is running, which is the truth before this script and the thing being migrated from; the
-///      replacement does not exist until this deploys it. An earlier draft read the destination
-///      from that same entry, which meant the script could only run after some other step had
-///      already deployed the proxy and rewritten the manifest, and no such step existed.
-///
-///      Sequence, all under the proxy owner:
-///
-///        1. deploy the replacement through the pipeline's CREATE3 helper, which lands it on its
-///           deterministic address and adopts it if a previous run got that far;
-///        2. upgrade it to `StoreFactoryMigrator` and import the bindings in pages, one
-///           transaction each, because a single import of every binding does not fit in a
-///           pallet-revive block (the first attempt proved it);
-///        3. upgrade it back to the shipped `StoreFactory`;
-///        4. re-point the `storeFactory` key and declare the new codehash together, because the
-///           checklist treats an unpaired rewire as drift;
-///        5. write the new factory and its beacons into the manifest.
-///
-///      Run it after the protocol registry swap. Step 4 calls `setExpectedCodehash`, which does
-///      not exist on the registry implementation the network starts on.
-///
-///      What this does not do: the imported stores keep the beacons the old factory minted, and
-///      those beacons answer to the old factory. Their code stays upgradeable there, by the same
-///      owner, which is why the old factory must not be discarded. A `BeaconProxy` holds its
-///      beacon in an immutable, so no migration can move them.
-/// @custom:security-contact admin@parity.io
-contract MigrateStoreFactory is BaseDeployer {
-    /// @notice Manifest label the store factory is recorded under, before and after.
-    string internal constant STORE_FACTORY_LABEL = "StoreFactory";
-
-    /// @notice Manifest label the protocol registry is recorded under.
-    string internal constant PROTOCOL_REGISTRY_LABEL = "DotnsProtocolRegistry";
-
-    /// @notice Deploys the replacement, imports the bindings, rewires the key, saves the manifest.
-    /// @dev `DOTNS_OLD_STORE_FACTORY` is optional. When set it is asserted against the manifest,
-    ///      so an operator who believes they are migrating from a particular factory finds out
-    ///      here if the manifest disagrees, before anything is broadcast.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address oldFactory = _readAddress(STORE_FACTORY_LABEL);
-        address protocolRegistry = _readAddress(PROTOCOL_REGISTRY_LABEL);
-
-        address expected = vm.envOr("DOTNS_OLD_STORE_FACTORY", address(0));
-        require(
-            expected == address(0) || expected == oldFactory,
-            "MigrateStoreFactory: DOTNS_OLD_STORE_FACTORY does not match the manifest"
-        );
-        require(
-            owner == OwnableUpgradeable(oldFactory).owner(),
-            "MigrateStoreFactory: broadcaster does not own the deployed factory"
-        );
-
-        console.log("  migrating from", oldFactory);
-        console.log("  bindings to carry", IStoreFactory(oldFactory).getLabelStoreCount());
-
-        // Written before the deploy, which reuses the `StoreFactory` label and would otherwise
-        // leave nothing pointing at the factory being replaced.
-        _recordOutgoing(oldFactory);
-
-        address replacement = _deployReplacement(owner, protocolRegistry);
-        require(
-            replacement != oldFactory,
-            "MigrateStoreFactory: replacement resolved to the deployed factory"
-        );
-
-        _importBindings(owner, replacement, oldFactory);
-        _restoreShippedImplementation(owner, replacement);
-        _rewireKey(owner, replacement, protocolRegistry);
-        _recordManifest(replacement);
-
-        saveDeployments();
-
-        console.log("=== MigrateStoreFactory complete ===");
-    }
-
-    /// @notice Deploys the replacement proxy, or adopts one a previous run left behind.
-    /// @dev The pipeline's own helper, so the replacement lands on the same deterministic address
-    ///      a fresh deploy would give it and is checked the same way. Adoption covers one case
-    ///      only: a run that died after this step and before the first import page. It does not
-    ///      make the script re-runnable in general. If the proxy is still on the migrator the
-    ///      adopt is refused, because the helper requires the occupant to delegate to the
-    ///      implementation this run deployed; a death between import pages is therefore continued
-    ///      by hand, replaying the pages against the parked migrator, which skips what already
-    ///      landed. The runbook's step section carries the recipe. A failure after this point is
-    ///      inspected and continued from, never restarted.
-    /// @param owner Account that owns the deployment and broadcasts.
-    /// @param protocolRegistry Registry the new factory is initialised against.
-    /// @return replacement Address of the replacement proxy.
-    function _deployReplacement(
-        address owner,
-        address protocolRegistry
-    )
-        internal
-        returns (address replacement)
-    {
-        // Adopt the CREATE3 factory from the registry that was passed in. Left unset, the
-        // deployer falls back to resolving it out of the manifest, which only works once
-        // `initDeployment` has been called: that makes this leg unreachable from anything but
-        // `run`, including the fork test that is supposed to be exercising the same path.
-        _setCreate3Factory(
-            IDotnsProtocolRegistry(protocolRegistry).get(DotnsConstants.CREATE3_FACTORY)
-        );
-
-        replacement = _broadcastDeployUups(
-            owner,
-            "StoreFactory.sol:StoreFactory",
-            abi.encodeCall(StoreFactory.initialize, (owner, protocolRegistry)),
-            STORE_FACTORY_LABEL
-        );
-
-        // The beacons are minted by the initialiser, so they exist only once the proxy does.
-        // Asserted here because everything downstream reads through them.
-        _verifyStoreImplementations(replacement, protocolRegistry);
-        console.log("  replacement factory at", replacement);
-    }
-
-    /// @notice Swaps in the migrator and imports the bindings, one page per transaction.
-    /// @dev Paged because pallet-revive meters transactions in more dimensions than gas, and the
-    ///      first attempt at this step proved a single import of all 63 live bindings does not
-    ///      fit in a block: estimation died mid-loop around the 44th store at any gas limit, and
-    ///      no off-chain simulation models that ceiling. The default page of 15 keeps each
-    ///      transaction to roughly a third of the measured capacity; `DOTNS_IMPORT_CHUNK`
-    ///      overrides it should the ceiling move.
-    ///
-    ///      Between the page transactions the proxy runs the migrator. That is safe to leave for
-    ///      a few blocks because nothing resolves to the proxy until `_rewireKey`, and every
-    ///      mutating surface the migrator carries is owner-gated; it is also unavoidable, since
-    ///      the pages have to be separate transactions to fit. `importStores` skips bindings it
-    ///      already holds, so a death between pages is finished by replaying the pages, though
-    ///      not by re-running the whole script: the deploy leg's adopt check refuses a proxy left
-    ///      on the migrator, and the runbook's step section says how to continue by hand.
-    ///
-    ///      Every page is `onlyOwner` and the broadcaster is the owner, on the first page through
-    ///      `upgradeToAndCall`'s preserved sender and on the rest as the direct caller.
-    /// @param owner Account that owns the proxy and broadcasts.
-    /// @param replacement The proxy being migrated into.
-    /// @param oldFactory Factory whose bindings are adopted.
-    function _importBindings(address owner, address replacement, address oldFactory) internal {
-        Options memory opts;
-        opts.referenceContract = "StoreFactory.sol:StoreFactory";
-
-        uint256 total = IStoreFactory(oldFactory).getLabelStoreCount();
-        uint256 page = vm.envOr("DOTNS_IMPORT_CHUNK", uint256(15));
-        require(page != 0, "MigrateStoreFactory: DOTNS_IMPORT_CHUNK must be positive");
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(
-            replacement,
-            "StoreFactoryMigrator.sol:StoreFactoryMigrator",
-            total == 0
-                ? bytes("")
-                : abi.encodeCall(
-                    StoreFactoryMigrator.importStores, (oldFactory, 0, page < total ? page : total)
-                ),
-            opts
-        );
-        for (uint256 offset = page; offset < total; offset += page) {
-            uint256 remaining = total - offset;
-            StoreFactoryMigrator(replacement)
-                .importStores(oldFactory, offset, page < remaining ? page : remaining);
-        }
-        vm.stopBroadcast();
-
-        require(
-            IStoreFactory(replacement).getLabelStoreCount()
-                == IStoreFactory(oldFactory).getLabelStoreCount(),
-            "MigrateStoreFactory: binding counts disagree after the import"
-        );
-        console.log("  imported bindings into", replacement);
-    }
-
-    /// @notice Returns the proxy to the shipped implementation.
-    /// @dev Left on the migrator, the deployment would be running tooling that no release
-    ///      describes, and the codehash declared below would be the tooling's.
-    /// @param owner Account that owns the proxy and broadcasts.
-    /// @param replacement The proxy to restore.
-    function _restoreShippedImplementation(address owner, address replacement) internal {
-        Options memory opts;
-        opts.referenceContract = "StoreFactoryMigrator.sol:StoreFactoryMigrator";
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(replacement, "StoreFactory.sol:StoreFactory", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  restored the shipped StoreFactory implementation");
-    }
-
-    /// @notice Points the `storeFactory` key at the replacement and declares its codehash.
-    /// @dev Paired on purpose. `DEPLOYMENT_CHECKLIST.md` treats a rewire without a matching
-    ///      declaration as drift, indistinguishable from an unauthorised swap.
-    /// @param owner Account that owns the protocol registry and broadcasts.
-    /// @param replacement The proxy the key should resolve to.
-    /// @param protocolRegistry The protocol registry holding the key.
-    function _rewireKey(address owner, address replacement, address protocolRegistry) internal {
-        IDotnsProtocolRegistry registry = IDotnsProtocolRegistry(protocolRegistry);
-        address implementation =
-            address(uint160(uint256(vm.load(replacement, ERC1967_IMPLEMENTATION_SLOT))));
-
-        vm.startBroadcast(owner);
-        registry.set(DotnsConstants.STORE_FACTORY, replacement);
-        registry.setExpectedCodehash(DotnsConstants.STORE_FACTORY, implementation.codehash);
-        vm.stopBroadcast();
-
-        require(
-            registry.get(DotnsConstants.STORE_FACTORY) == replacement,
-            "MigrateStoreFactory: storeFactory key did not take"
-        );
-        console.log("  storeFactory key now resolves to", replacement);
-    }
-
-    /// @notice Records the outgoing factory and its beacons under their own manifest keys.
-    /// @dev The replacement takes the `StoreFactory` label and mints its own beacons, so after
-    ///      this migration the manifest's usual three entries all name the new deployment. The
-    ///      old factory cannot simply be forgotten: the stores it created hold their beacon
-    ///      address in an immutable, so those 58 proxies stay on its beacons, and it is the only
-    ///      contract that can ever rotate their implementation. Losing its address from the
-    ///      manifest would leave that upgrade path reachable only by reading an old commit.
-    /// @param oldFactory The factory being migrated away from.
-    function _recordOutgoing(address oldFactory) internal {
-        logDeployment("StoreFactoryLegacy", oldFactory);
-        logDeployment("LabelStoreBeaconLegacy", IStoreFactory(oldFactory).labelStoreBeacon());
-        logDeployment("UserStoreBeaconLegacy", IStoreFactory(oldFactory).userStoreBeacon());
-        console.log("  recorded the outgoing factory as StoreFactoryLegacy");
-    }
-
-    /// @notice Records the replacement and its beacons in the manifest.
-    /// @dev The beacons move with the factory: the replacement's initialiser mints its own, and
-    ///      the old ones stay behind owned by the old factory. Leaving the old beacon addresses
-    ///      in the manifest would point every later tool at beacons this factory cannot upgrade.
-    /// @param replacement The proxy now serving the `storeFactory` key.
-    function _recordManifest(address replacement) internal {
-        address labelBeacon = IStoreFactory(replacement).labelStoreBeacon();
-        address userBeacon = IStoreFactory(replacement).userStoreBeacon();
-
-        vm.label(labelBeacon, "LabelStoreBeacon");
-        vm.label(userBeacon, "UserStoreBeacon");
-        logDeployment("LabelStoreBeacon", labelBeacon);
-        logDeployment("UserStoreBeacon", userBeacon);
-    }
-}
diff --git a/scripts/deploy/RotateOwnership.s.sol b/scripts/deploy/RotateOwnership.s.sol
deleted file mode 100644
index 758f8cbbe..000000000
--- a/scripts/deploy/RotateOwnership.s.sol
+++ /dev/null
@@ -1,286 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-
-/// @notice The one slice of Ownable this script needs, so it works identically on the UUPS
-///         proxies and on the plain contracts without importing either hierarchy.
-interface IOwnable {
-    function owner() external view returns (address);
-    function transferOwnership(address newOwner) external;
-}
-
-/// @title RotateOwnership
-/// @notice Transfers ownership of every DotNS contract to a fresh key. Step 0 of the upgrade
-///         runbook, and the step that exists because key custody, not code, is the current risk:
-///         copies of the deployment key have spread across sources the project does not control,
-///         so it is treated as leaked.
-/// @dev Addresses do not move. Ownership is a storage field on each contract, so consumers,
-///      hosts, manifests and the codehash declarations are all untouched; the only thing that
-///      changes is which key the `onlyOwner` gates answer to. This is the property that makes
-///      rotation sufficient and a redeploy unnecessary.
-///
-///      Broadcast by the current owner, its last act. Everything that follows in the runbook is
-///      broadcast by the new key, so after this lands, the CI environment secret is replaced and
-///      the old secret deleted, wherever copies exist. Rotation does nothing retroactive: until
-///      it executes, the old key can do everything, and afterwards it can do nothing but be
-///      recognised.
-///
-///      The inventory is checked from both ends, because a rotation that silently misses a
-///      contract leaves a door open behind a report that says all doors are closed. Contracts
-///      that must be owned by the broadcaster hard-fail on any surprise, contracts known to
-///      carry no owner or someone else's are named as such, and every remaining manifest entry
-///      is probed: one that answers `owner()` with the broadcaster fails the run, because it
-///      belongs on a list and is not there.
-///
-///      Re-runnable after a partial failure: a contract already answering to the new owner is
-///      skipped, so the old key can finish what an interrupted run started. Once every contract
-///      has moved, the old key can no longer run this at all, which is the point.
-///
-///      The old account's balance moves in the same run, once every owner has. Rotation strips
-///      `onlyOwner` powers and cannot strip the right to spend a balance, and a leaked key's
-///      balance is exactly as leaked as its authority was, so leaving the sweep for a later
-///      manual step is a race offered to whoever else holds the key. It is also what funds the
-///      new owner: nobody can extract the old key to sign a transfer by hand, so the gated run
-///      is the one signer the balance has.
-///
-///      One thing this deliberately does not cover: `Create3Factory` is left alone. Its owner is
-///      the factory deployer, a different account, and its deploy surface is permissionless
-///      anyway, so there is nothing an owner rotation would protect.
-/// @custom:security-contact admin@parity.io
-contract RotateOwnership is BaseDeployer {
-    /// @notice Reads the new owner, resolves the inventory, and rotates as `msg.sender`.
-    /// @dev `DOTNS_NEW_OWNER` is the fresh key's address. Refused when zero or when equal to the
-    ///      broadcaster, because rotating to the compromised key is the one outcome worse than
-    ///      not rotating.
-    function run() external {
-        address current = msg.sender;
-        vm.label(current, "CURRENT_OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address newOwner = vm.envAddress("DOTNS_NEW_OWNER");
-        require(newOwner != address(0), "RotateOwnership: DOTNS_NEW_OWNER is unset or zero");
-        require(
-            newOwner != current,
-            "RotateOwnership: new owner equals the current one; nothing would rotate"
-        );
-
-        _rotateEverything(current, newOwner);
-        _sweep(current, newOwner);
-
-        console.log("=== RotateOwnership complete ===");
-    }
-
-    /// @notice Labels whose owner MUST be the broadcaster. Any surprise here aborts the run.
-    /// @dev Everything the live chain answers `owner()` for with the deployment key, probed on
-    ///      2026-09-21: the twelve owned proxies, the cost-model registry, and the store factory
-    ///      the manifest names. Before the store migration that label is the deployed plain
-    ///      factory; after it, the replacement proxy, with the outgoing factory recorded as
-    ///      `StoreFactoryLegacy` and picked up by the conditional below.
-    function _mustRotate() internal pure returns (string[14] memory labels) {
-        labels = [
-            "DotnsProtocolRegistry",
-            "DotnsRegistry",
-            "DotnsRegistrar",
-            "DotnsRegistrarController",
-            "DotnsPopController",
-            "PopRules",
-            "DotnsNameEscrow",
-            "DotnsNameWhitelist",
-            "DotnsResolver",
-            "DotnsReverseResolver",
-            "DotnsContentResolver",
-            "DotnsPopResolver",
-            "DotnsCostModelRegistry",
-            "StoreFactory"
-        ];
-    }
-
-    /// @notice Labels that are expected to answer to someone else, or to no one.
-    /// @dev `Create3Factory` answers to the factory deployer, a different key. `Multicall3`,
-    ///      the lens and the pricing helper expose no `owner()` in the deployed release, and
-    ///      `_seed` is a manifest placeholder. Named so the completeness scan can insist that
-    ///      everything else is accounted for explicitly, and so a later release that gives one
-    ///      of these an owner fails the scan instead of slipping through.
-    function _leaveAlone() internal pure returns (string[5] memory labels) {
-        labels = ["Create3Factory", "Multicall3", "_seed", "DotnsPopLens", "DotnsFlatPricing"];
-    }
-
-    /// @notice Rotates the inventory and then proves the manifest holds nothing unaccounted for.
-    /// @param current The broadcaster, owner of everything being rotated.
-    /// @param newOwner The fresh key taking over.
-    function _rotateEverything(address current, address newOwner) internal {
-        string memory manifest = vm.readFile(
-            string.concat("deployments/", networkFolder(), "/", vm.toString(block.chainid), ".json")
-        );
-
-        string[14] memory must = _mustRotate();
-        for (uint256 i; i < must.length; ++i) {
-            // Parsed from the file read above, not through the deployer's manifest field: that
-            // field is only populated by `initDeployment`, and this internal is also driven by
-            // the fork harness, which calls it directly. Ambient state is how the migration's
-            // deploy leg was unreachable from its own test; not again.
-            _rotateOne(
-                must[i],
-                vm.parseJsonAddress(manifest, string.concat(".", must[i])),
-                current,
-                newOwner,
-                true
-            );
-        }
-
-        // The outgoing factory exists in the manifest only once the store migration has run.
-        // It keeps answering to the owner because it is the only contract able to rotate the
-        // beacons behind the pre-migration stores, so it moves with everything else.
-        if (vm.keyExistsJson(manifest, ".StoreFactoryLegacy")) {
-            _rotateOne(
-                "StoreFactoryLegacy",
-                vm.parseJsonAddress(manifest, ".StoreFactoryLegacy"),
-                current,
-                newOwner,
-                true
-            );
-        }
-
-        _requireNothingLeftBehind(manifest, current);
-    }
-
-    /// @notice Rotates one contract, or explains precisely why it did not.
-    /// @dev A contract already answering to `newOwner` is a completed step of an earlier run and
-    ///      is skipped, which is what makes the script re-runnable after a partial failure. The
-    ///      readback after the transfer is not decoration: `transferOwnership` here is the
-    ///      one-step variant, so a wrong destination is permanent, and the require is the last
-    ///      moment a mistake is a revert instead of a fact.
-    /// @param label Manifest name, for the logs and the failure messages.
-    /// @param target The contract.
-    /// @param current The broadcaster.
-    /// @param newOwner The fresh key.
-    /// @param mustOwn Whether a surprise owner aborts the run.
-    function _rotateOne(
-        string memory label,
-        address target,
-        address current,
-        address newOwner,
-        bool mustOwn
-    )
-        internal
-    {
-        (bool answers, address owner) = _tryOwner(target);
-
-        if (!answers) {
-            require(!mustOwn, string.concat("RotateOwnership: ", label, " does not answer owner()"));
-            console.log("  skipped (no owner surface)", label, target);
-            return;
-        }
-        if (owner == newOwner) {
-            console.log("  already rotated", label, target);
-            return;
-        }
-        if (owner != current) {
-            require(
-                !mustOwn,
-                string.concat("RotateOwnership: ", label, " is owned by neither key involved")
-            );
-            console.log("  skipped (owned elsewhere)", label, target);
-            return;
-        }
-
-        vm.broadcast(current);
-        IOwnable(target).transferOwnership(newOwner);
-
-        require(
-            IOwnable(target).owner() == newOwner,
-            string.concat("RotateOwnership: ", label, " readback does not show the new owner")
-        );
-        console.log("  rotated", label, target);
-    }
-
-    /// @notice Sends the old account's balance to the new owner, keeping a gas buffer.
-    /// @dev Last, after every transfer has been verified, so a sweep failure never strands a
-    ///      half-rotated deployment: ownership is already across, and re-running retries only
-    ///      this. The buffer exists because this same account just paid for fifteen broadcasts
-    ///      and a re-run must not die on fees; whatever the buffer leaves behind is dust on a
-    ///      powerless account, priced accordingly.
-    /// @param current The old owner, whose balance moves.
-    /// @param newOwner Where it goes, the same address every contract now answers to.
-    function _sweep(address current, address newOwner) internal {
-        uint256 keep = 2 ether;
-        uint256 balance = current.balance;
-        if (balance <= keep) {
-            console.log("  sweep skipped, balance is within the gas buffer", balance);
-            return;
-        }
-
-        uint256 amount = balance - keep;
-        vm.broadcast(current);
-        (bool ok,) = payable(newOwner).call{value: amount}("");
-        require(ok, "RotateOwnership: sweep transfer failed");
-        require(
-            newOwner.balance >= amount, "RotateOwnership: sweep readback shows less than was sent"
-        );
-        console.log("  swept to the new owner", amount);
-    }
-
-    /// @notice Fails the run if any manifest entry outside the three lists answers to the owner.
-    /// @dev The lists above are a claim about the deployment's shape. This is the check that the
-    ///      claim is complete: a contract added to the manifest by a later release, owned by the
-    ///      deployment key and missing from the lists, stops the rotation here instead of
-    ///      surviving it silently.
-    /// @param manifest Raw manifest JSON.
-    /// @param current The broadcaster.
-    function _requireNothingLeftBehind(string memory manifest, address current) internal view {
-        string[] memory names = vm.parseJsonKeys(manifest, "$");
-        for (uint256 i; i < names.length; ++i) {
-            if (_handled(names[i])) continue;
-
-            (bool answers, address owner) =
-                _tryOwner(vm.parseJsonAddress(manifest, string.concat(".", names[i])));
-            require(
-                !answers || owner != current,
-                string.concat(
-                    "RotateOwnership: ",
-                    names[i],
-                    " is owned by the key being rotated away from but is in no inventory list"
-                )
-            );
-        }
-    }
-
-    /// @notice Whether `name` is covered by one of the three lists.
-    function _handled(string memory name) internal pure returns (bool covered) {
-        bytes32 h = keccak256(bytes(name));
-        string[14] memory must = _mustRotate();
-        for (uint256 i; i < must.length; ++i) {
-            if (keccak256(bytes(must[i])) == h) return true;
-        }
-        string[5] memory alone = _leaveAlone();
-        for (uint256 i; i < alone.length; ++i) {
-            if (keccak256(bytes(alone[i])) == h) return true;
-        }
-        if (h == keccak256(bytes("StoreFactoryLegacy"))) return true;
-        if (h == keccak256(bytes("LabelStoreBeacon")) || h == keccak256(bytes("UserStoreBeacon"))) {
-            // Owned by their factory, which rotates above; a beacon answering to an EOA would be
-            // drift, and the factory checks in the deploy pipeline are where that is caught.
-            return true;
-        }
-        if (
-            h == keccak256(bytes("LabelStoreBeaconLegacy"))
-                || h == keccak256(bytes("UserStoreBeaconLegacy"))
-        ) return true;
-    }
-
-    /// @notice `owner()` as a probe that cannot revert the caller.
-    /// @param target Contract to ask.
-    /// @return answers Whether the call returned a decodable address.
-    /// @return owner The owner when it did.
-    function _tryOwner(address target) internal view returns (bool answers, address owner) {
-        (bool ok, bytes memory data) =
-            target.staticcall(abi.encodeWithSelector(IOwnable.owner.selector));
-        if (!ok || data.length != 32) return (false, address(0));
-        owner = abi.decode(data, (address));
-        answers = true;
-    }
-}
diff --git a/scripts/deploy/UpgradeContentResolver.s.sol b/scripts/deploy/UpgradeContentResolver.s.sol
deleted file mode 100644
index 3434c4d3a..000000000
--- a/scripts/deploy/UpgradeContentResolver.s.sol
+++ /dev/null
@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeContentResolver
-/// @notice Upgrades the deployed DotnsContentResolver proxy to the current implementation. Resolves
-/// the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsContentResolverOld snapshot, and swaps the implementation only
-/// when the diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeContentResolver is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT =
-        "DotnsContentResolverOld.sol:DotnsContentResolverOld";
-
-    /// @notice Manifest label the DotnsContentResolver proxy is recorded under.
-    string internal constant CONTENT_RESOLVER_LABEL = "DotnsContentResolver";
-
-    /// @notice Reads the manifest, resolves the DotnsContentResolver proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(CONTENT_RESOLVER_LABEL);
-        _upgradeContentResolver(owner, proxy);
-
-        console.log("=== UpgradeContentResolver complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsContentResolver` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsContentResolver proxy address resolved from the manifest.
-    function _upgradeContentResolver(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeContentResolver: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsContentResolver.sol:DotnsContentResolver", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsContentResolver proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeNameEscrow.s.sol b/scripts/deploy/UpgradeNameEscrow.s.sol
deleted file mode 100644
index 5c413f58c..000000000
--- a/scripts/deploy/UpgradeNameEscrow.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeNameEscrow
-/// @notice Upgrades the deployed DotnsNameEscrow proxy to the current implementation. Resolves the
-///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsNameEscrowOld snapshot, and swaps the implementation only when the
-///         diff and every unsafe-pattern check pass.
-/// @dev The swap splits the cooldown and redeem-window setters into an internal and an owner-gated
-/// external half, so the initialiser seeds them without passing through the owner gate.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeNameEscrow is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsNameEscrowOld.sol:DotnsNameEscrowOld";
-
-    /// @notice Manifest label the DotnsNameEscrow proxy is recorded under.
-    string internal constant NAME_ESCROW_LABEL = "DotnsNameEscrow";
-
-    /// @notice Reads the manifest, resolves the DotnsNameEscrow proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(NAME_ESCROW_LABEL);
-        _upgradeNameEscrow(owner, proxy);
-
-        console.log("=== UpgradeNameEscrow complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsNameEscrow` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsNameEscrow proxy address resolved from the manifest.
-    function _upgradeNameEscrow(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeNameEscrow: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsNameEscrow.sol:DotnsNameEscrow", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsNameEscrow proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeNameWhitelist.s.sol b/scripts/deploy/UpgradeNameWhitelist.s.sol
deleted file mode 100644
index 16b6b1b87..000000000
--- a/scripts/deploy/UpgradeNameWhitelist.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeNameWhitelist
-/// @notice Upgrades the deployed DotnsNameWhitelist proxy to the current implementation. Resolves
-/// the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsNameWhitelistOld snapshot, and swaps the implementation only when
-/// the diff and every unsafe-pattern check pass.
-/// @dev The swap changes only `initialize`, which does not run on an upgrade. It is swapped for
-/// parity, so the deployment is one release throughout rather than one contract behind.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeNameWhitelist is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsNameWhitelistOld.sol:DotnsNameWhitelistOld";
-
-    /// @notice Manifest label the DotnsNameWhitelist proxy is recorded under.
-    string internal constant NAME_WHITELIST_LABEL = "DotnsNameWhitelist";
-
-    /// @notice Reads the manifest, resolves the DotnsNameWhitelist proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(NAME_WHITELIST_LABEL);
-        _upgradeNameWhitelist(owner, proxy);
-
-        console.log("=== UpgradeNameWhitelist complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsNameWhitelist` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsNameWhitelist proxy address resolved from the manifest.
-    function _upgradeNameWhitelist(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeNameWhitelist: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsNameWhitelist.sol:DotnsNameWhitelist", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsNameWhitelist proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradePopController.s.sol b/scripts/deploy/UpgradePopController.s.sol
deleted file mode 100644
index 36c24bb14..000000000
--- a/scripts/deploy/UpgradePopController.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradePopController
-/// @notice Upgrades the deployed DotnsPopController proxy to the current implementation. Resolves
-/// the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsPopControllerOld snapshot, and swaps the implementation only when
-/// the diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradePopController is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsPopControllerOld.sol:DotnsPopControllerOld";
-
-    /// @notice Manifest label the DotnsPopController proxy is recorded under.
-    string internal constant POP_CONTROLLER_LABEL = "DotnsPopController";
-
-    /// @notice Reads the manifest, resolves the DotnsPopController proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(POP_CONTROLLER_LABEL);
-        _upgradePopController(owner, proxy);
-
-        console.log("=== UpgradePopController complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsPopController` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsPopController proxy address resolved from the manifest.
-    function _upgradePopController(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradePopController: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsPopController.sol:DotnsPopController", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsPopController proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradePopResolver.s.sol b/scripts/deploy/UpgradePopResolver.s.sol
deleted file mode 100644
index 0c721a439..000000000
--- a/scripts/deploy/UpgradePopResolver.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradePopResolver
-/// @notice Upgrades the deployed DotnsPopResolver proxy to the current implementation. Resolves the
-///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsPopResolverOld snapshot, and swaps the implementation only when
-/// the diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradePopResolver is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsPopResolverOld.sol:DotnsPopResolverOld";
-
-    /// @notice Manifest label the DotnsPopResolver proxy is recorded under.
-    string internal constant POP_RESOLVER_LABEL = "DotnsPopResolver";
-
-    /// @notice Reads the manifest, resolves the DotnsPopResolver proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(POP_RESOLVER_LABEL);
-        _upgradePopResolver(owner, proxy);
-
-        console.log("=== UpgradePopResolver complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsPopResolver` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsPopResolver proxy address resolved from the manifest.
-    function _upgradePopResolver(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradePopResolver: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsPopResolver.sol:DotnsPopResolver", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsPopResolver proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeProtocolRegistry.s.sol b/scripts/deploy/UpgradeProtocolRegistry.s.sol
deleted file mode 100644
index dada4cd0a..000000000
--- a/scripts/deploy/UpgradeProtocolRegistry.s.sol
+++ /dev/null
@@ -1,77 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeProtocolRegistry
-/// @notice Upgrades the deployed DotnsProtocolRegistry proxy to the current implementation.
-/// Resolves the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsProtocolRegistryOld snapshot, and swaps the implementation only
-/// when the diff and every unsafe-pattern check pass.
-/// @dev The swap adds the on-chain declarations: `protocolVersion`, `expectedCodehash` and their
-/// owner-only setters, which every other contract's `version()` then reads through.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeProtocolRegistry is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT =
-        "DotnsProtocolRegistryOld.sol:DotnsProtocolRegistryOld";
-
-    /// @notice Manifest label the DotnsProtocolRegistry proxy is recorded under.
-    string internal constant PROTOCOL_REGISTRY_LABEL = "DotnsProtocolRegistry";
-
-    /// @notice Reads the manifest, resolves the DotnsProtocolRegistry proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(PROTOCOL_REGISTRY_LABEL);
-        _upgradeProtocolRegistry(owner, proxy);
-
-        console.log("=== UpgradeProtocolRegistry complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsProtocolRegistry` implementation under
-    /// `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsProtocolRegistry proxy address resolved from the manifest.
-    function _upgradeProtocolRegistry(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeProtocolRegistry: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsProtocolRegistry.sol:DotnsProtocolRegistry", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsProtocolRegistry proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeRegistrar.s.sol b/scripts/deploy/UpgradeRegistrar.s.sol
deleted file mode 100644
index 5742f0f69..000000000
--- a/scripts/deploy/UpgradeRegistrar.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeRegistrar
-/// @notice Upgrades the deployed DotnsRegistrar proxy to the current implementation. Resolves the
-///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsRegistrarOld snapshot, and swaps the implementation only when the
-///         diff and every unsafe-pattern check pass.
-/// @dev The swap rejects an unsolicited transfer into the escrow, and moves the label write to
-///      `StoreUtils.writeNewLabel`.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeRegistrar is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsRegistrarOld.sol:DotnsRegistrarOld";
-
-    /// @notice Manifest label the DotnsRegistrar proxy is recorded under.
-    string internal constant REGISTRAR_LABEL = "DotnsRegistrar";
-
-    /// @notice Reads the manifest, resolves the DotnsRegistrar proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(REGISTRAR_LABEL);
-        _upgradeRegistrar(owner, proxy);
-
-        console.log("=== UpgradeRegistrar complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsRegistrar` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsRegistrar proxy address resolved from the manifest.
-    function _upgradeRegistrar(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeRegistrar: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsRegistrar.sol:DotnsRegistrar", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsRegistrar proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeRegistrarController.s.sol b/scripts/deploy/UpgradeRegistrarController.s.sol
deleted file mode 100644
index 42c2aaf34..000000000
--- a/scripts/deploy/UpgradeRegistrarController.s.sol
+++ /dev/null
@@ -1,78 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeRegistrarController
-/// @notice Upgrades the deployed DotnsRegistrarController proxy to the current implementation.
-/// Resolves the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsRegistrarControllerOld snapshot, and swaps the implementation only
-/// when the diff and every unsafe-pattern check pass.
-/// @dev The swap moves the label write to `StoreUtils.writeNewLabel`.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeRegistrarController is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT =
-        "DotnsRegistrarControllerOld.sol:DotnsRegistrarControllerOld";
-
-    /// @notice Manifest label the DotnsRegistrarController proxy is recorded under.
-    string internal constant REGISTRAR_CONTROLLER_LABEL = "DotnsRegistrarController";
-
-    /// @notice Reads the manifest, resolves the DotnsRegistrarController proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(REGISTRAR_CONTROLLER_LABEL);
-        _upgradeRegistrarController(owner, proxy);
-
-        console.log("=== UpgradeRegistrarController complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsRegistrarController` implementation under
-    /// `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsRegistrarController proxy address resolved from the manifest.
-    function _upgradeRegistrarController(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeRegistrarController: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(
-            proxy, "DotnsRegistrarController.sol:DotnsRegistrarController", "", opts
-        );
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsRegistrarController proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeResolver.s.sol b/scripts/deploy/UpgradeResolver.s.sol
deleted file mode 100644
index a14907dc0..000000000
--- a/scripts/deploy/UpgradeResolver.s.sol
+++ /dev/null
@@ -1,75 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeResolver
-/// @notice Upgrades the deployed DotnsResolver proxy to the current implementation. Resolves the
-///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsResolverOld snapshot, and swaps the implementation only when the
-///         diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeResolver is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT = "DotnsResolverOld.sol:DotnsResolverOld";
-
-    /// @notice Manifest label the DotnsResolver proxy is recorded under.
-    string internal constant RESOLVER_LABEL = "DotnsResolver";
-
-    /// @notice Reads the manifest, resolves the DotnsResolver proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(RESOLVER_LABEL);
-        _upgradeResolver(owner, proxy);
-
-        console.log("=== UpgradeResolver complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsResolver` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsResolver proxy address resolved from the manifest.
-    function _upgradeResolver(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeResolver: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsResolver.sol:DotnsResolver", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsResolver proxy", proxy);
-    }
-}
diff --git a/scripts/deploy/UpgradeReverseResolver.s.sol b/scripts/deploy/UpgradeReverseResolver.s.sol
deleted file mode 100644
index 1edcd7e8c..000000000
--- a/scripts/deploy/UpgradeReverseResolver.s.sol
+++ /dev/null
@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {console} from "forge-std/Script.sol";
-import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
-import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
-
-import {BaseDeployer} from "./BaseDeployer.s.sol";
-import {
-    OwnableUpgradeable
-} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-
-/// @title UpgradeReverseResolver
-/// @notice Upgrades the deployed DotnsReverseResolver proxy to the current implementation. Resolves
-/// the proxy from the on-disk manifest, diffs the new storage layout against the pinned
-///         @custom:contract DotnsReverseResolverOld snapshot, and swaps the implementation only
-/// when the diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
-///
-///      The snapshot is the implementation deployed on chain, not the previous release: these
-///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
-///      would describe code that has not run on this network for months.
-///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building the snapshot
-///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
-///      is given, and is blind to a change that lives in calldata.
-/// @custom:security-contact admin@parity.io
-contract UpgradeReverseResolver is BaseDeployer {
-    /// @notice Pre-upgrade snapshot the layout diff compares the new implementation against.
-    /// @dev Source-file route, not a stored build-info directory, so the snapshot is versioned
-    ///      beside the implementation and rebuilt by `forge build`.
-    string internal constant REFERENCE_CONTRACT =
-        "DotnsReverseResolverOld.sol:DotnsReverseResolverOld";
-
-    /// @notice Manifest label the DotnsReverseResolver proxy is recorded under.
-    string internal constant REVERSE_RESOLVER_LABEL = "DotnsReverseResolver";
-
-    /// @notice Reads the manifest, resolves the DotnsReverseResolver proxy, and upgrades it as
-    /// `msg.sender`.
-    /// @dev `msg.sender` must own the proxy, otherwise the `_authorizeUpgrade` owner gate reverts.
-    function run() external {
-        address owner = msg.sender;
-        vm.label(owner, "OWNER");
-
-        initDeployment(networkFolder(), vm.toString(block.chainid));
-
-        address proxy = _readAddress(REVERSE_RESOLVER_LABEL);
-        _upgradeReverseResolver(owner, proxy);
-
-        console.log("=== UpgradeReverseResolver complete ===");
-    }
-
-    /// @notice Upgrades `proxy` to the current `DotnsReverseResolver` implementation under `owner`.
-    /// @dev The layout diff runs inside `Upgrades.upgradeProxy` before the implementation swap. No
-    ///      `unsafeSkipAllChecks` or `unsafeAllow` override is set, so an incompatible layout
-    ///      aborts the run rather than corrupting state. An empty upgrade call is passed because
-    ///      the new implementation seeds no storage of its own; where a release declares anything
-    ///      on chain, `DeclareRelease.s.sol` does it once, after every swap has verified.
-    /// @param owner Account that owns the proxy and broadcasts the upgrade.
-    /// @param proxy DotnsReverseResolver proxy address resolved from the manifest.
-    function _upgradeReverseResolver(address owner, address proxy) internal {
-        require(
-            owner == OwnableUpgradeable(proxy).owner(),
-            "UpgradeReverseResolver: broadcaster is not the proxy owner"
-        );
-
-        Options memory opts;
-        opts.referenceContract = REFERENCE_CONTRACT;
-
-        vm.startBroadcast(owner);
-        Upgrades.upgradeProxy(proxy, "DotnsReverseResolver.sol:DotnsReverseResolver", "", opts);
-        vm.stopBroadcast();
-
-        console.log("  upgraded DotnsReverseResolver proxy", proxy);
-    }
-}
diff --git a/test/fork/MigrateStoreFactory.t.sol b/test/fork/MigrateStoreFactory.t.sol
deleted file mode 100644
index 2796cd00d..000000000
--- a/test/fork/MigrateStoreFactory.t.sol
+++ /dev/null
@@ -1,211 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {MigrateStoreFactory} from "../../scripts/deploy/MigrateStoreFactory.s.sol";
-import {UpgradeProtocolRegistryHarness} from "./UpgradeProtocolRegistry.t.sol";
-import {StoreFactory} from "../../contracts/store/StoreFactory.sol";
-import {StoreFactoryMigrator} from "../../contracts/store/StoreFactoryMigrator.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {IStoreFactory} from "../../contracts/store/IStoreFactory.sol";
-import {IDotnsStore} from "../../contracts/store/IDotnsStore.sol";
-import {StoreUtils} from "../../contracts/utils/StoreUtils.sol";
-import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
-import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
-
-/// @title MigrateStoreFactoryHarness
-/// @notice Exposes the migration script's legs so the test drives the production path.
-/// @dev The script's `run` reads the network folder and writes the manifest, neither of which a
-///      fork should do. The legs underneath take their addresses directly, so the test runs the
-///      same code in the same order without touching the working tree.
-contract MigrateStoreFactoryHarness is MigrateStoreFactory {
-    /// @notice Deploys the replacement proxy, as the script's first step does.
-    function deployReplacement(
-        address owner,
-        address protocolRegistry
-    )
-        external
-        returns (address replacement)
-    {
-        replacement = _deployReplacement(owner, protocolRegistry);
-    }
-
-    /// @notice Imports the bindings from `oldFactory` into `replacement`.
-    function importInto(address owner, address replacement, address oldFactory) external {
-        _importBindings(owner, replacement, oldFactory);
-    }
-
-    /// @notice Returns the proxy to the shipped implementation.
-    function restore(address owner, address replacement) external {
-        _restoreShippedImplementation(owner, replacement);
-    }
-
-    /// @notice Points the `storeFactory` key at the replacement and declares its codehash.
-    function rewire(address owner, address replacement, address protocolRegistry) external {
-        _rewireKey(owner, replacement, protocolRegistry);
-    }
-}
-
-/// @title MigrateStoreFactoryForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/MigrateStoreFactory.s.sol`. Runs the migration
-///         against live state and checks the condition that actually matters: after the rewire,
-///         the path every registration takes returns the store a holder already has.
-/// @dev The only part of the upgrade that moves user state between contracts instead of swapping
-///      code underneath it, so it is where a mistake is least reversible. Holders are read from
-///      the chain, never invented: a fixture would show the import copies a fixture, and what
-///      needs showing is that it copies what the network holds.
-///
-///      The protocol registry is upgraded first, because the rewire declares a codehash and that
-///      entrypoint does not exist on the implementation the network starts on. That is also the
-///      production ordering, so running it here keeps the two honest.
-/// @custom:security-contact admin@parity.io
-contract MigrateStoreFactoryForkTest is BaseUpgradeFork {
-    /// @notice The factory the network runs today, which the manifest still names.
-    IStoreFactory internal oldFactory;
-
-    /// @notice The live protocol registry, rewired to the replacement by the migration.
-    IDotnsProtocolRegistry internal protocolRegistry;
-
-    /// @notice Owner of the deployment, impersonated to authorise every step.
-    address internal factoryOwner;
-
-    /// @notice Drives the script's own migration path.
-    MigrateStoreFactoryHarness internal migrator;
-
-    function setUp() public override {
-        super.setUp();
-
-        oldFactory = IStoreFactory(_live("StoreFactory"));
-        protocolRegistry = IDotnsProtocolRegistry(_live("DotnsProtocolRegistry"));
-        factoryOwner = _ownerOf(address(oldFactory));
-        migrator = new MigrateStoreFactoryHarness();
-
-        // `_rewireKey` declares a codehash, which the deployed registry cannot do until it is
-        // swapped. Production runs the registry first for the same reason.
-        UpgradeProtocolRegistryHarness registryUpgrade = new UpgradeProtocolRegistryHarness();
-        registryUpgrade.upgrade(_ownerOf(address(protocolRegistry)), address(protocolRegistry));
-    }
-
-    /// @notice After the migration, a lookup through the registry returns the holder's own store.
-    /// @dev The success condition for the whole exercise, and the one an earlier version of this
-    ///      test never reached. Every mint and transfer resolves `STORE_FACTORY` through the
-    ///      protocol registry and calls `ensureLabelStore`, which deploys a store when the caller
-    ///      has none. Had the bindings not come across, this call would quietly deploy a second,
-    ///      empty store for a user who already has one, and their labels would stop being
-    ///      enumerable against their address.
-    function test_after_rewire_a_live_holder_resolves_to_their_existing_store() public {
-        uint256 total = oldFactory.getLabelStoreCount();
-        assertTrue(total != 0, "fork precondition: the network has stores to migrate");
-
-        address[] memory stores = oldFactory.getLabelStores(0, total);
-        address holderStore = stores[0];
-        address holder = IDotnsStore(holderStore).owner();
-        assertEq(oldFactory.getLabelStore(holder), holderStore, "fork precondition: binding agrees");
-
-        address replacement = migrator.deployReplacement(factoryOwner, address(protocolRegistry));
-        migrator.importInto(factoryOwner, replacement, address(oldFactory));
-        migrator.restore(factoryOwner, replacement);
-        migrator.rewire(factoryOwner, replacement, address(protocolRegistry));
-
-        assertEq(
-            protocolRegistry.get(DotnsConstants.STORE_FACTORY),
-            replacement,
-            "the key resolves to the replacement"
-        );
-
-        // The production path, reached the way registration reaches it.
-        IStoreFactory resolved = IStoreFactory(protocolRegistry.get(DotnsConstants.STORE_FACTORY));
-        vm.prank(factoryOwner);
-        address ensured = StoreUtils.ensureLabelStore(resolved, holder);
-
-        assertEq(ensured, holderStore, "the holder resolves to the store they already had");
-        assertEq(resolved.getLabelStoreCount(), total, "no extra store was deployed for anyone");
-    }
-
-    /// @notice Every holder the old factory reports comes across, not only the first.
-    /// @dev The count is the cheap end-to-end check. A partial import would satisfy any
-    ///      single-holder assertion while leaving the rest to be handed empty stores later.
-    function test_every_live_holder_is_carried() public {
-        uint256 total = oldFactory.getLabelStoreCount();
-        address[] memory stores = oldFactory.getLabelStores(0, total);
-
-        address replacement = migrator.deployReplacement(factoryOwner, address(protocolRegistry));
-        migrator.importInto(factoryOwner, replacement, address(oldFactory));
-        migrator.restore(factoryOwner, replacement);
-
-        StoreFactory migrated = StoreFactory(replacement);
-        assertEq(migrated.getLabelStoreCount(), total, "every binding landed");
-
-        for (uint256 i; i < total; ++i) {
-            address holder = IDotnsStore(stores[i]).owner();
-            assertEq(migrated.getLabelStore(holder), stores[i], "holder keeps their existing store");
-        }
-    }
-
-    /// @notice A death between import pages is finished by replaying the pages.
-    /// @dev The import is paged because the whole list does not fit in one pallet-revive block,
-    ///      and pages are separate transactions, so the run can die with a prefix imported and
-    ///      the proxy parked on the migrator. This drills the recovery the runbook prescribes
-    ///      against live state: replay the import from the top, and the pages that already landed
-    ///      skip themselves. The count assertions are the proof nothing was carried twice.
-    function test_a_death_between_pages_is_finished_by_replaying_them() public {
-        uint256 total = oldFactory.getLabelStoreCount();
-        assertTrue(total > 1, "fork precondition: enough stores for more than one page");
-
-        address replacement = migrator.deployReplacement(factoryOwner, address(protocolRegistry));
-
-        // Park the proxy exactly where a mid-run death leaves it: on the migrator, holding a
-        // prefix of the bindings.
-        uint256 firstPage = total / 2;
-        StoreFactoryMigrator parked = new StoreFactoryMigrator();
-        vm.prank(factoryOwner);
-        UUPSUpgradeable(replacement)
-            .upgradeToAndCall(
-                address(parked),
-                abi.encodeCall(
-                    StoreFactoryMigrator.importStores, (address(oldFactory), 0, firstPage)
-                )
-            );
-        assertEq(
-            IStoreFactory(replacement).getLabelStoreCount(),
-            firstPage,
-            "the interrupted state holds exactly the prefix"
-        );
-
-        // The continuation: the import leg again, whole. Its first pages overlap what landed.
-        migrator.importInto(factoryOwner, replacement, address(oldFactory));
-        migrator.restore(factoryOwner, replacement);
-
-        StoreFactory migrated = StoreFactory(replacement);
-        assertEq(migrated.getLabelStoreCount(), total, "the replay finished the import");
-
-        address[] memory stores = oldFactory.getLabelStores(0, total);
-        for (uint256 i; i < total; ++i) {
-            address holder = IDotnsStore(stores[i]).owner();
-            assertEq(
-                migrated.getLabelStore(holder), stores[i], "no holder was rebound or duplicated"
-            );
-        }
-    }
-
-    /// @notice A user the old factory never held is still unbound afterwards.
-    /// @dev The import writes bindings directly, so it is worth showing it writes only what the
-    ///      old factory holds. A spurious binding is worse than a missing one: it consumes the
-    ///      user's single permanent slot, and the factory then refuses them a real store forever.
-    function test_import_binds_nobody_the_old_factory_did_not_hold() public {
-        address stranger = makeAddr("stranger");
-        assertEq(
-            oldFactory.getLabelStore(stranger), address(0), "fork precondition: stranger is unbound"
-        );
-
-        address replacement = migrator.deployReplacement(factoryOwner, address(protocolRegistry));
-        migrator.importInto(factoryOwner, replacement, address(oldFactory));
-        migrator.restore(factoryOwner, replacement);
-
-        assertEq(
-            StoreFactory(replacement).getLabelStore(stranger),
-            address(0),
-            "a user the old factory never held stays unbound"
-        );
-    }
-}
diff --git a/test/fork/RotateOwnership.t.sol b/test/fork/RotateOwnership.t.sol
deleted file mode 100644
index a55f25cf9..000000000
--- a/test/fork/RotateOwnership.t.sol
+++ /dev/null
@@ -1,153 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {RotateOwnership, IOwnable} from "../../scripts/deploy/RotateOwnership.s.sol";
-import {UpgradeRegistryHarness} from "./UpgradeRegistry.t.sol";
-
-/// @title RotateOwnershipHarness
-/// @notice Exposes the rotation script's internal path so the test drives the code the
-///         production run executes, inventory checks included.
-contract RotateOwnershipHarness is RotateOwnership {
-    /// @notice Rotates everything from `current` to `newOwner` through the script's own internal.
-    function rotate(address current, address newOwner) external {
-        _rotateEverything(current, newOwner);
-    }
-
-    /// @notice Runs the sweep leg through the script's own internal.
-    function sweep(address current, address newOwner) external {
-        _sweep(current, newOwner);
-    }
-}
-
-/// @title RotateOwnershipForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/RotateOwnership.s.sol`. Rotates the live
-///         deployment's ownership on a fork and proves the property the step exists for: the old
-///         key loses the ability to act, the new key gains it, and no address moves.
-/// @dev Step 0 of the runbook, so this runs against the pre-upgrade chain state on purpose:
-///      rotation is broadcast before any implementation is swapped.
-/// @custom:security-contact admin@parity.io
-contract RotateOwnershipForkTest is BaseUpgradeFork {
-    /// @notice The contracts the script must rotate, resolved from the manifest in setUp.
-    /// @dev Kept as labels so a mismatch against the script's own list fails by name.
-    string[14] internal labels = [
-        "DotnsProtocolRegistry",
-        "DotnsRegistry",
-        "DotnsRegistrar",
-        "DotnsRegistrarController",
-        "DotnsPopController",
-        "PopRules",
-        "DotnsNameEscrow",
-        "DotnsNameWhitelist",
-        "DotnsResolver",
-        "DotnsReverseResolver",
-        "DotnsContentResolver",
-        "DotnsPopResolver",
-        "DotnsCostModelRegistry",
-        "StoreFactory"
-    ];
-
-    /// @notice The deployment key, read from the chain, not assumed.
-    address internal currentOwner;
-
-    /// @notice The fresh key ownership moves to.
-    address internal freshOwner;
-
-    /// @notice Drives the script's own rotation path.
-    RotateOwnershipHarness internal rotator;
-
-    function setUp() public override {
-        super.setUp();
-        currentOwner = _ownerOf(_live("DotnsRegistry"));
-        freshOwner = makeAddr("fresh-owner");
-        rotator = new RotateOwnershipHarness();
-    }
-
-    /// @notice Every inventoried contract answers to the new key afterwards, at its old address.
-    /// @dev The address assertions look redundant and are not: "rotation moves no addresses" is
-    ///      the claim that makes rotation preferable to redeployment, so the test states it
-    ///      against the manifest instead of leaving it as prose.
-    function test_rotation_moves_every_owner_and_no_address() public {
-        address[] memory targets = new address[](labels.length);
-        for (uint256 i; i < labels.length; ++i) {
-            targets[i] = _live(labels[i]);
-            assertEq(
-                IOwnable(targets[i]).owner(),
-                currentOwner,
-                string.concat("fork precondition: ", labels[i], " answers to the deployment key")
-            );
-        }
-
-        rotator.rotate(currentOwner, freshOwner);
-
-        for (uint256 i; i < labels.length; ++i) {
-            assertEq(
-                IOwnable(targets[i]).owner(),
-                freshOwner,
-                string.concat(labels[i], " answers to the fresh key")
-            );
-            assertEq(
-                _live(labels[i]),
-                targets[i],
-                string.concat(labels[i], " is still at the address the manifest names")
-            );
-        }
-    }
-
-    /// @notice After rotation the old key cannot upgrade, and the new key can.
-    /// @dev The lockout is the security property the step exists for, and the new key working is
-    ///      what makes the runbook's steps 1 to 14 possible afterwards. Both are shown through
-    ///      the registry upgrade script's own path, so what is proven is the exact pair of facts
-    ///      the deployment relies on next.
-    function test_old_key_is_locked_out_and_new_key_can_upgrade() public {
-        address registry = _live("DotnsRegistry");
-        rotator.rotate(currentOwner, freshOwner);
-
-        UpgradeRegistryHarness upgrader = new UpgradeRegistryHarness();
-
-        vm.expectRevert(bytes("UpgradeRegistry: broadcaster is not the proxy owner"));
-        upgrader.upgrade(currentOwner, registry);
-
-        upgrader.upgrade(freshOwner, registry);
-        assertTrue(
-            _implementationOf(registry) != address(0), "the fresh key performed a real upgrade"
-        );
-    }
-
-    /// @notice The sweep funds the new owner from the old account, leaving only the gas buffer.
-    /// @dev The sweep is the new owner's funding: the old key cannot be extracted for a manual
-    ///      transfer, so this leg is the one signer its balance has. Asserted against the live
-    ///      balance, whatever it is on the day, because the amount is not the property; the
-    ///      transfer of nearly all of it is.
-    function test_sweep_funds_the_new_owner_and_leaves_only_the_buffer() public {
-        uint256 before = currentOwner.balance;
-        assertTrue(
-            before > 2 ether, "fork precondition: the old account holds more than the buffer"
-        );
-
-        rotator.rotate(currentOwner, freshOwner);
-        rotator.sweep(currentOwner, freshOwner);
-
-        assertEq(
-            freshOwner.balance, before - 2 ether, "the new owner received everything but the buffer"
-        );
-        assertEq(currentOwner.balance, 2 ether, "the old account keeps exactly the buffer");
-    }
-
-    /// @notice A second run from the old key completes as a no-op instead of failing.
-    /// @dev Partial-failure recovery: an interrupted rotation is finished by running again, and
-    ///      contracts that already moved are skipped. A full re-run therefore has nothing to do,
-    ///      and proving it does nothing loudly is what makes re-running safe to recommend.
-    function test_rerun_after_completion_is_a_noop() public {
-        rotator.rotate(currentOwner, freshOwner);
-        rotator.rotate(currentOwner, freshOwner);
-
-        for (uint256 i; i < labels.length; ++i) {
-            assertEq(
-                IOwnable(_live(labels[i])).owner(),
-                freshOwner,
-                string.concat(labels[i], " unchanged by the re-run")
-            );
-        }
-    }
-}
diff --git a/test/fork/UpgradeContentResolver.t.sol b/test/fork/UpgradeContentResolver.t.sol
deleted file mode 100644
index 9335d0ace..000000000
--- a/test/fork/UpgradeContentResolver.t.sol
+++ /dev/null
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeContentResolver} from "../../scripts/deploy/UpgradeContentResolver.s.sol";
-import {DotnsContentResolver} from "../../contracts/resolvers/DotnsContentResolver.sol";
-
-/// @title UpgradeContentResolverHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeContentResolverHarness is UpgradeContentResolver {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeContentResolver(owner, proxy);
-    }
-}
-
-/// @title UpgradeContentResolverForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeContentResolver.s.sol`. Upgrades the
-/// deployed DotnsContentResolver and proves the content and text records it serves stay readable
-/// through the new implementation.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeContentResolverForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeContentResolverHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsContentResolver");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeContentResolverHarness();
-    }
-
-    /// @notice The protocol registry pointer survives, so every record stays resolvable.
-    /// @dev This swap carries no behavioural change: `version()` reads the protocol registry's
-    ///      declaration instead of a hardcoded string. The pointer is what every record lookup
-    ///      goes through, so it is both the state most worth asserting and the one a layout
-    ///      mistake would take out first, turning every read into a call to the zero address.
-    function test_upgrade_keeps_records_resolvable() public {
-        DotnsContentResolver resolver = DotnsContentResolver(proxy);
-
-        address registryBefore = address(resolver.protocolRegistry());
-        address implementationBefore = _implementationOf(proxy);
-
-        assertEq(
-            registryBefore, _live("DotnsProtocolRegistry"), "fork precondition: pointer is correct"
-        );
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            address(resolver.protocolRegistry()), registryBefore, "protocol registry preserved"
-        );
-    }
-}
diff --git a/test/fork/UpgradeNameEscrow.t.sol b/test/fork/UpgradeNameEscrow.t.sol
deleted file mode 100644
index 82069d7ee..000000000
--- a/test/fork/UpgradeNameEscrow.t.sol
+++ /dev/null
@@ -1,71 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeNameEscrow} from "../../scripts/deploy/UpgradeNameEscrow.s.sol";
-import {IDotnsNameEscrow} from "../../contracts/escrow/IDotnsNameEscrow.sol";
-
-/// @title UpgradeNameEscrowHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeNameEscrowHarness is UpgradeNameEscrow {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeNameEscrow(owner, proxy);
-    }
-}
-
-/// @title UpgradeNameEscrowForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeNameEscrow.s.sol`. Upgrades the deployed
-/// escrow and proves the balances it custodies and the windows governing them survive.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeNameEscrowForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeNameEscrowHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsNameEscrow");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeNameEscrowHarness();
-    }
-
-    /// @notice Custodied balances and the configured windows survive the swap.
-    /// @dev The escrow holds real deposits, so this is the one upgrade where a layout mistake
-    ///      loses money rather than state. `redeemWindow` is asserted non-zero as well as
-    ///      unchanged: a zero there leaves every release reverting, and `DEPLOYMENTS.md` records
-    ///      it as the field an upgrade has historically dropped.
-    function test_upgrade_preserves_balances_and_windows() public {
-        IDotnsNameEscrow escrow = IDotnsNameEscrow(proxy);
-
-        uint256 feesBefore = escrow.protocolFees();
-        uint256 releasedBefore = escrow.releasedTokenCount();
-        uint256 cooldownBefore = escrow.cooldown();
-        uint256 redeemBefore = escrow.redeemWindow();
-        address implementationBefore = _implementationOf(proxy);
-
-        assertTrue(redeemBefore != 0, "fork precondition: redeem window is seeded");
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(escrow.protocolFees(), feesBefore, "protocol fees preserved");
-        assertEq(escrow.releasedTokenCount(), releasedBefore, "released token count preserved");
-        assertEq(escrow.cooldown(), cooldownBefore, "cooldown preserved");
-        assertEq(escrow.redeemWindow(), redeemBefore, "redeem window preserved and still non-zero");
-    }
-}
diff --git a/test/fork/UpgradeNameWhitelist.t.sol b/test/fork/UpgradeNameWhitelist.t.sol
deleted file mode 100644
index e4a5a1f52..000000000
--- a/test/fork/UpgradeNameWhitelist.t.sol
+++ /dev/null
@@ -1,67 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeNameWhitelist} from "../../scripts/deploy/UpgradeNameWhitelist.s.sol";
-import {IDotnsNameWhitelist} from "../../contracts/whitelist/IDotnsNameWhitelist.sol";
-
-/// @title UpgradeNameWhitelistHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeNameWhitelistHarness is UpgradeNameWhitelist {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeNameWhitelist(owner, proxy);
-    }
-}
-
-/// @title UpgradeNameWhitelistForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeNameWhitelist.s.sol`. Upgrades the deployed
-/// whitelist and proves its caps and allocations survive.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeNameWhitelistForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeNameWhitelistHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsNameWhitelist");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeNameWhitelistHarness();
-    }
-
-    /// @notice Caps survive the swap.
-    /// @dev This implementation changes only `initialize`, which does not run on an upgrade, so
-    ///      the swap should be observationally inert. Asserting that explicitly is the point: it
-    ///      is the contract where an unexpected difference would be most surprising, and the
-    ///      cheapest place to notice one.
-    function test_upgrade_is_observationally_inert() public {
-        IDotnsNameWhitelist whitelist = IDotnsNameWhitelist(proxy);
-
-        uint16 claimantsBefore = whitelist.maxClaimants();
-        uint16 grantBatchBefore = whitelist.maxGrantBatch();
-        uint256 reasonBytesBefore = whitelist.maxReasonBytes();
-        address implementationBefore = _implementationOf(proxy);
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(whitelist.maxClaimants(), claimantsBefore, "claimant cap preserved");
-        assertEq(whitelist.maxGrantBatch(), grantBatchBefore, "grant batch cap preserved");
-        assertEq(whitelist.maxReasonBytes(), reasonBytesBefore, "reason byte cap preserved");
-    }
-}
diff --git a/test/fork/UpgradePopController.t.sol b/test/fork/UpgradePopController.t.sol
deleted file mode 100644
index 56a70be9b..000000000
--- a/test/fork/UpgradePopController.t.sol
+++ /dev/null
@@ -1,66 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradePopController} from "../../scripts/deploy/UpgradePopController.s.sol";
-import {IDotnsPopController} from "../../contracts/registrars/IDotnsPopController.sol";
-
-/// @title UpgradePopControllerHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradePopControllerHarness is UpgradePopController {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradePopController(owner, proxy);
-    }
-}
-
-/// @title UpgradePopControllerForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradePopController.s.sol`. Upgrades the deployed
-/// PoP controller and proves the reservation queues and issuance records survive.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradePopControllerForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradePopControllerHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsPopController");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradePopControllerHarness();
-    }
-
-    /// @notice Reservation and claim state survive the swap.
-    /// @dev The controller holds the queues real users are waiting in, so these counts are the
-    ///      state worth asserting. They are read rather than seeded: a fixture would prove the
-    ///      upgrade preserves a fixture, which is not the question.
-    function test_upgrade_preserves_reservation_and_claim_state() public {
-        IDotnsPopController controller = IDotnsPopController(proxy);
-
-        uint256 pendingUsersBefore = controller.pendingClaimUserCount();
-        uint64 durationBefore = controller.reservationDuration();
-        address implementationBefore = _implementationOf(proxy);
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            controller.pendingClaimUserCount(), pendingUsersBefore, "pending claim users preserved"
-        );
-        assertEq(controller.reservationDuration(), durationBefore, "reservation window preserved");
-    }
-}
diff --git a/test/fork/UpgradePopResolver.t.sol b/test/fork/UpgradePopResolver.t.sol
deleted file mode 100644
index 547783fe4..000000000
--- a/test/fork/UpgradePopResolver.t.sol
+++ /dev/null
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradePopResolver} from "../../scripts/deploy/UpgradePopResolver.s.sol";
-import {DotnsPopResolver} from "../../contracts/resolvers/DotnsPopResolver.sol";
-
-/// @title UpgradePopResolverHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradePopResolverHarness is UpgradePopResolver {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradePopResolver(owner, proxy);
-    }
-}
-
-/// @title UpgradePopResolverForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradePopResolver.s.sol`. Upgrades the deployed
-/// DotnsPopResolver and proves the chat keys and lite links it serves stay readable through the new
-/// implementation.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradePopResolverForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradePopResolverHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsPopResolver");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradePopResolverHarness();
-    }
-
-    /// @notice The protocol registry pointer survives, so every record stays resolvable.
-    /// @dev This swap carries no behavioural change: `version()` reads the protocol registry's
-    ///      declaration instead of a hardcoded string. The pointer is what every record lookup
-    ///      goes through, so it is both the state most worth asserting and the one a layout
-    ///      mistake would take out first, turning every read into a call to the zero address.
-    function test_upgrade_keeps_records_resolvable() public {
-        DotnsPopResolver resolver = DotnsPopResolver(proxy);
-
-        address registryBefore = address(resolver.protocolRegistry());
-        address implementationBefore = _implementationOf(proxy);
-
-        assertEq(
-            registryBefore, _live("DotnsProtocolRegistry"), "fork precondition: pointer is correct"
-        );
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            address(resolver.protocolRegistry()), registryBefore, "protocol registry preserved"
-        );
-    }
-}
diff --git a/test/fork/UpgradeProtocolRegistry.t.sol b/test/fork/UpgradeProtocolRegistry.t.sol
deleted file mode 100644
index 05dfa710e..000000000
--- a/test/fork/UpgradeProtocolRegistry.t.sol
+++ /dev/null
@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeProtocolRegistry} from "../../scripts/deploy/UpgradeProtocolRegistry.s.sol";
-import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
-import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
-
-/// @title UpgradeProtocolRegistryHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeProtocolRegistryHarness is UpgradeProtocolRegistry {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeProtocolRegistry(owner, proxy);
-    }
-}
-
-/// @title UpgradeProtocolRegistryForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeProtocolRegistry.s.sol`. Upgrades the
-/// deployed protocol registry and proves every key still resolves to the same address, then that
-/// the declaration surface the release adds is live.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeProtocolRegistryForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeProtocolRegistryHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsProtocolRegistry");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeProtocolRegistryHarness();
-    }
-
-    /// @notice Key resolution and the TLD survive the swap, and the declarations become callable.
-    /// @dev The protocol registry is upgraded first in the production order because every other
-    ///      contract's `version()` reads through it. If this swap lost a key, every later swap
-    ///      would be pointed at the zero address, so the resolution assertions here are what make
-    ///      the rest of the sequence safe to run.
-    function test_upgrade_preserves_every_key_and_adds_the_declarations() public {
-        IDotnsProtocolRegistry registry = IDotnsProtocolRegistry(proxy);
-
-        bytes32[6] memory keys = [
-            DotnsConstants.REGISTRY,
-            DotnsConstants.REGISTRAR,
-            DotnsConstants.CONTROLLER,
-            DotnsConstants.POP_CONTROLLER,
-            DotnsConstants.RESOLVER,
-            DotnsConstants.STORE_FACTORY
-        ];
-
-        address[6] memory before;
-        for (uint256 i; i < keys.length; ++i) {
-            before[i] = registry.get(keys[i]);
-        }
-        string memory tldBefore = registry.tld();
-        bytes32 tldNodeBefore = registry.tldNode();
-        address implementationBefore = _implementationOf(proxy);
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        for (uint256 i; i < keys.length; ++i) {
-            assertEq(registry.get(keys[i]), before[i], "key still resolves to the same address");
-        }
-        assertEq(registry.tld(), tldBefore, "TLD preserved");
-        assertEq(registry.tldNode(), tldNodeBefore, "TLD node preserved");
-
-        // Undeclared until `DeclareRelease` runs, which is deliberate: the release is declared
-        // once, after every swap has verified, so an abandoned upgrade cannot leave a false claim.
-        assertEq(registry.protocolVersion(), "", "version starts undeclared after the swap");
-    }
-}
diff --git a/test/fork/UpgradeRegistrar.t.sol b/test/fork/UpgradeRegistrar.t.sol
deleted file mode 100644
index 1c63ca03c..000000000
--- a/test/fork/UpgradeRegistrar.t.sol
+++ /dev/null
@@ -1,73 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeRegistrar} from "../../scripts/deploy/UpgradeRegistrar.s.sol";
-import {IDotnsRegistrar} from "../../contracts/registrars/IDotnsRegistrar.sol";
-import {IDotnsController} from "../../contracts/registrars/IDotnsController.sol";
-
-/// @title UpgradeRegistrarHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeRegistrarHarness is UpgradeRegistrar {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeRegistrar(owner, proxy);
-    }
-}
-
-/// @title UpgradeRegistrarForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeRegistrar.s.sol`. Upgrades the deployed
-/// registrar and proves the live controller authorisations and token state survive.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeRegistrarForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeRegistrarHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsRegistrar");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeRegistrarHarness();
-    }
-
-    /// @notice Controller authorisations survive the swap.
-    /// @dev These are what the registry's new deferral gate reads, and what every minting path
-    ///      goes through. Losing them would leave the network unable to issue a name, so this is
-    ///      the registrar's P0 state rather than any individual token.
-    function test_upgrade_preserves_controller_authorisations() public {
-        IDotnsRegistrar registrar = IDotnsRegistrar(proxy);
-
-        IDotnsController popController = IDotnsController(_live("DotnsPopController"));
-        IDotnsController registrarController = IDotnsController(_live("DotnsRegistrarController"));
-
-        bool popBefore = registrar.controllers(popController);
-        bool controllerBefore = registrar.controllers(registrarController);
-        address implementationBefore = _implementationOf(proxy);
-
-        assertTrue(popBefore, "fork precondition: the PoP controller is authorised");
-        assertTrue(controllerBefore, "fork precondition: the registrar controller is authorised");
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertTrue(registrar.controllers(popController), "PoP controller still authorised");
-        assertTrue(
-            registrar.controllers(registrarController), "registrar controller still authorised"
-        );
-    }
-}
diff --git a/test/fork/UpgradeRegistrarController.t.sol b/test/fork/UpgradeRegistrarController.t.sol
deleted file mode 100644
index fd0193922..000000000
--- a/test/fork/UpgradeRegistrarController.t.sol
+++ /dev/null
@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeRegistrarController} from "../../scripts/deploy/UpgradeRegistrarController.s.sol";
-import {IDotnsRegistrarController} from "../../contracts/registrars/IDotnsRegistrarController.sol";
-import {DotnsRegistrarController} from "../../contracts/registrars/DotnsRegistrarController.sol";
-
-/// @title UpgradeRegistrarControllerHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeRegistrarControllerHarness is UpgradeRegistrarController {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeRegistrarController(owner, proxy);
-    }
-}
-
-/// @title UpgradeRegistrarControllerForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeRegistrarController.s.sol`. Upgrades the
-/// deployed registrar controller and proves the storage-layout fix keeps its protocol registry
-/// pointer readable.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeRegistrarControllerForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeRegistrarControllerHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsRegistrarController");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeRegistrarControllerHarness();
-    }
-
-    /// @notice The protocol registry pointer survives, which is the whole point of the retained
-    /// slot.
-    /// @dev This proxy is the reason the branch carries a `__whiteListSlot` placeholder. The
-    ///      release removed the `whiteList` field, which moved `protocolRegistry` up one slot; an
-    ///      implementation built without the placeholder reads it as the zero address and every
-    ///      lookup through it fails. Reading it back non-zero after the swap is what shows the
-    ///      placeholder did its job against real storage rather than against a fresh deployment.
-    function test_upgrade_keeps_the_protocol_registry_pointer_readable() public {
-        DotnsRegistrarController controller = DotnsRegistrarController(proxy);
-
-        address registryBefore = address(controller.protocolRegistry());
-        address implementationBefore = _implementationOf(proxy);
-
-        assertTrue(registryBefore != address(0), "fork precondition: pointer is set");
-        assertEq(
-            registryBefore, _live("DotnsProtocolRegistry"), "fork precondition: pointer is correct"
-        );
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            address(controller.protocolRegistry()),
-            registryBefore,
-            "protocol registry pointer still on the slot the live proxy uses"
-        );
-    }
-}
diff --git a/test/fork/UpgradeResolver.t.sol b/test/fork/UpgradeResolver.t.sol
deleted file mode 100644
index bd8f12953..000000000
--- a/test/fork/UpgradeResolver.t.sol
+++ /dev/null
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeResolver} from "../../scripts/deploy/UpgradeResolver.s.sol";
-import {DotnsResolver} from "../../contracts/resolvers/DotnsResolver.sol";
-
-/// @title UpgradeResolverHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeResolverHarness is UpgradeResolver {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeResolver(owner, proxy);
-    }
-}
-
-/// @title UpgradeResolverForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeResolver.s.sol`. Upgrades the deployed
-/// DotnsResolver and proves the forward address records it serves stay readable through the new
-/// implementation.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeResolverForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeResolverHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsResolver");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeResolverHarness();
-    }
-
-    /// @notice The protocol registry pointer survives, so every record stays resolvable.
-    /// @dev This swap carries no behavioural change: `version()` reads the protocol registry's
-    ///      declaration instead of a hardcoded string. The pointer is what every record lookup
-    ///      goes through, so it is both the state most worth asserting and the one a layout
-    ///      mistake would take out first, turning every read into a call to the zero address.
-    function test_upgrade_keeps_records_resolvable() public {
-        DotnsResolver resolver = DotnsResolver(proxy);
-
-        address registryBefore = address(resolver.protocolRegistry());
-        address implementationBefore = _implementationOf(proxy);
-
-        assertEq(
-            registryBefore, _live("DotnsProtocolRegistry"), "fork precondition: pointer is correct"
-        );
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            address(resolver.protocolRegistry()), registryBefore, "protocol registry preserved"
-        );
-    }
-}
diff --git a/test/fork/UpgradeReverseResolver.t.sol b/test/fork/UpgradeReverseResolver.t.sol
deleted file mode 100644
index 88aa84f07..000000000
--- a/test/fork/UpgradeReverseResolver.t.sol
+++ /dev/null
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
-import {UpgradeReverseResolver} from "../../scripts/deploy/UpgradeReverseResolver.s.sol";
-import {DotnsReverseResolver} from "../../contracts/resolvers/DotnsReverseResolver.sol";
-
-/// @title UpgradeReverseResolverHarness
-/// @notice Exposes the upgrade script's internal path so the test drives the code the production
-///         run executes, including the fail-closed storage-layout diff.
-/// @dev Forwarding to the script internal rather than re-implementing the upgrade is what keeps
-///      the test honest: a test that called `Upgrades.upgradeProxy` itself would keep passing
-///      after the script stopped doing the same thing.
-contract UpgradeReverseResolverHarness is UpgradeReverseResolver {
-    /// @notice Upgrades `proxy` under `owner` through the script's own internal.
-    function upgrade(address owner, address proxy) external {
-        _upgradeReverseResolver(owner, proxy);
-    }
-}
-
-/// @title UpgradeReverseResolverForkTest
-/// @notice Pairs one-to-one with `scripts/deploy/UpgradeReverseResolver.s.sol`. Upgrades the
-/// deployed DotnsReverseResolver and proves the reverse name records it serves stay readable
-/// through the new implementation.
-/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
-///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
-///      before the first test runs.
-/// @custom:security-contact admin@parity.io
-contract UpgradeReverseResolverForkTest is BaseUpgradeFork {
-    /// @notice The deployed proxy under upgrade.
-    address internal proxy;
-
-    /// @notice Proxy owner, impersonated to authorise the upgrade.
-    address internal proxyOwner;
-
-    /// @notice Drives the script's upgrade path against the live proxy.
-    UpgradeReverseResolverHarness internal upgrader;
-
-    function setUp() public override {
-        super.setUp();
-        proxy = _live("DotnsReverseResolver");
-        proxyOwner = _ownerOf(proxy);
-        upgrader = new UpgradeReverseResolverHarness();
-    }
-
-    /// @notice The protocol registry pointer survives, so every record stays resolvable.
-    /// @dev This swap carries no behavioural change: `version()` reads the protocol registry's
-    ///      declaration instead of a hardcoded string. The pointer is what every record lookup
-    ///      goes through, so it is both the state most worth asserting and the one a layout
-    ///      mistake would take out first, turning every read into a call to the zero address.
-    function test_upgrade_keeps_records_resolvable() public {
-        DotnsReverseResolver resolver = DotnsReverseResolver(proxy);
-
-        address registryBefore = address(resolver.protocolRegistry());
-        address implementationBefore = _implementationOf(proxy);
-
-        assertEq(
-            registryBefore, _live("DotnsProtocolRegistry"), "fork precondition: pointer is correct"
-        );
-
-        upgrader.upgrade(proxyOwner, proxy);
-
-        assertTrue(
-            _implementationOf(proxy) != implementationBefore, "the implementation actually changed"
-        );
-        assertEq(
-            address(resolver.protocolRegistry()), registryBefore, "protocol registry preserved"
-        );
-    }
-}
diff --git a/test/unit/store/StoreFactoryMigrator.t.sol b/test/unit/store/StoreFactoryMigrator.t.sol
deleted file mode 100644
index 788373c29..000000000
--- a/test/unit/store/StoreFactoryMigrator.t.sol
+++ /dev/null
@@ -1,203 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.34;
-
-import {BaseDotns} from "../../base/BaseDotns.t.sol";
-import {StoreFactory} from "../../../contracts/store/StoreFactory.sol";
-import {StoreFactoryMigrator} from "../../../contracts/store/StoreFactoryMigrator.sol";
-import {IStoreFactory} from "../../../contracts/store/IStoreFactory.sol";
-import {IDotnsStore} from "../../../contracts/store/IDotnsStore.sol";
-import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
-import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
-
-/// @title StoreFactoryMigratorTests
-/// @notice Covers the paged import that carries per-user `LabelStore` bindings onto a new
-///         factory, which is the only part of the store migration with behaviour of its own.
-/// @dev `storeFactory` from `BaseDotns` stands in for the factory being migrated from, and a
-///      fresh proxy for the one being migrated to. What is asserted is what reading the diff
-///      cannot show: that a binding is adopted instead of re-deployed, that the guards close, and
-///      that the proxy comes back out of the migrator with the imported state intact.
-/// @custom:security-contact admin@parity.io
-contract StoreFactoryMigratorTests is BaseDotns {
-    /// @notice The proxy the bindings are imported into.
-    StoreFactoryMigrator internal target;
-
-    function setUp() public override {
-        super.setUp();
-
-        // Two bindings on the old factory, created the ordinary way so they are real stores.
-        vm.startPrank(owner);
-        storeFactory.deployLabelStoreFor(ed);
-        storeFactory.deployLabelStoreFor(tiago);
-        vm.stopPrank();
-
-        target = StoreFactoryMigrator(
-            address(
-                new ERC1967Proxy(
-                    address(new StoreFactoryMigrator()),
-                    abi.encodeCall(StoreFactory.initialize, (owner, address(protocolRegistry)))
-                )
-            )
-        );
-    }
-
-    /// @notice Imported users keep the stores they already had.
-    /// @dev The whole point of the migration: the binding is adopted, not re-created. A fresh
-    ///      factory would hand them a new empty store instead, and their labels would drop out of
-    ///      per-address enumeration while their names stayed put.
-    function test_import_adopts_the_existing_stores() public {
-        address edStore = storeFactory.getLabelStore(ed);
-        address tiagoStore = storeFactory.getLabelStore(tiago);
-
-        vm.prank(owner);
-        target.importStores(address(storeFactory), 0, 10);
-
-        assertEq(target.getLabelStore(ed), edStore, "ed keeps the store he already had");
-        assertEq(target.getLabelStore(tiago), tiagoStore, "tiago keeps the store he already had");
-        assertEq(target.getLabelStoreCount(), 2, "both bindings land in the enumeration");
-    }
-
-    /// @notice The holder set is read from the old factory, not supplied by the caller.
-    /// @dev An earlier version took the list as an argument, which left a window between an
-    ///      operator reading the set and the import running. A store created in that window is
-    ///      silently left unbound, and its holder is handed an empty store on their next
-    ///      registration. Reading inside the call closes the window, so a binding created right up
-    ///      to the transaction is still carried.
-    function test_import_sees_a_binding_created_after_the_decision_to_migrate() public {
-        address latecomer = makeAddr("latecomer");
-
-        vm.prank(owner);
-        storeFactory.deployLabelStoreFor(latecomer);
-        address lateStore = storeFactory.getLabelStore(latecomer);
-
-        vm.prank(owner);
-        target.importStores(address(storeFactory), 0, 10);
-
-        assertEq(target.getLabelStore(latecomer), lateStore, "the late binding is carried too");
-        assertEq(target.getLabelStoreCount(), 3, "and is counted");
-    }
-
-    /// @notice A store whose owner disagrees with the old factory's mapping is rejected.
-    /// @dev The store list and the per-user mapping are separate state. Trusting a store's own
-    ///      `owner` alone would bind a user the old factory does not hold that store for, and
-    ///      bindings here are permanent, so that user could never be given their real one.
-    function test_import_reverts_when_a_store_owner_disagrees_with_the_mapping() public {
-        address edStore = storeFactory.getLabelStore(ed);
-        address impostor = makeAddr("impostor");
-
-        // Only the store's answer is changed; the factory still has it bound to ed.
-        vm.mockCall(
-            edStore, abi.encodeWithSelector(IDotnsStore.owner.selector), abi.encode(impostor)
-        );
-
-        vm.prank(owner);
-        vm.expectRevert(
-            abi.encodeWithSelector(
-                StoreFactoryMigrator.ImportBindingMismatch.selector, impostor, edStore
-            )
-        );
-        target.importStores(address(storeFactory), 0, 10);
-    }
-
-    /// @notice The import lands identically when carried one binding per page.
-    /// @dev The pages exist because a whole-list import does not fit in a pallet-revive block,
-    ///      so the property that matters is that page boundaries are invisible in the result:
-    ///      same bindings, same count, no matter how the list was sliced.
-    function test_import_is_the_same_result_page_by_page() public {
-        address edStore = storeFactory.getLabelStore(ed);
-        address tiagoStore = storeFactory.getLabelStore(tiago);
-
-        vm.startPrank(owner);
-        target.importStores(address(storeFactory), 0, 1);
-        target.importStores(address(storeFactory), 1, 1);
-        vm.stopPrank();
-
-        assertEq(target.getLabelStore(ed), edStore, "ed keeps his store across a page boundary");
-        assertEq(target.getLabelStore(tiago), tiagoStore, "tiago keeps his on the later page");
-        assertEq(target.getLabelStoreCount(), 2, "both pages land, neither twice");
-    }
-
-    /// @notice Replaying pages already carried is a no-op instead of a failure.
-    /// @dev Partial-failure recovery: a death between pages is finished by running the same pages
-    ///      again, so a page that already landed must skip its bindings silently. Loud rejection
-    ///      here would make the interrupted import unfinishable.
-    function test_replaying_an_imported_page_is_a_noop() public {
-        vm.startPrank(owner);
-        target.importStores(address(storeFactory), 0, 10);
-        target.importStores(address(storeFactory), 0, 10);
-        vm.stopPrank();
-
-        assertEq(target.getLabelStoreCount(), 2, "the replay carried nothing twice");
-        assertEq(
-            target.getLabelStore(ed),
-            storeFactory.getLabelStore(ed),
-            "the binding is the one the old factory holds"
-        );
-    }
-
-    /// @notice A user already bound to a DIFFERENT store is rejected, not repointed.
-    /// @dev The skip above is strictly for identical pairs. Bindings are permanent everywhere
-    ///      else in the factory, and the migration does not get to be the exception: a
-    ///      conflicting pair fails loudly instead of rewriting history.
-    function test_import_reverts_on_a_conflicting_binding() public {
-        address edStore = storeFactory.getLabelStore(ed);
-        address tiagoStore = storeFactory.getLabelStore(tiago);
-
-        vm.prank(owner);
-        target.importStores(address(storeFactory), 0, 10);
-
-        // The old factory now claims ed holds tiago's store: list slot, store owner and mapping
-        // all agree with each other, and disagree only with the binding already imported.
-        address[] memory page = new address[](1);
-        page[0] = tiagoStore;
-        vm.mockCall(
-            address(storeFactory),
-            abi.encodeWithSelector(IStoreFactory.getLabelStores.selector, 0, 1),
-            abi.encode(page)
-        );
-        vm.mockCall(tiagoStore, abi.encodeWithSelector(IDotnsStore.owner.selector), abi.encode(ed));
-        vm.mockCall(
-            address(storeFactory),
-            abi.encodeWithSelector(IStoreFactory.getLabelStore.selector, ed),
-            abi.encode(tiagoStore)
-        );
-
-        vm.prank(owner);
-        vm.expectRevert(abi.encodeWithSelector(IStoreFactory.AlreadyDeployed.selector, ed, edStore));
-        target.importStores(address(storeFactory), 0, 1);
-    }
-
-    /// @notice A zero-sized page is a caller bug, named as such.
-    /// @dev Importing nothing while looking like progress is how a wrong pagination loop would
-    ///      hide; the guard turns it into a revert at the first page.
-    function test_import_rejects_an_empty_page() public {
-        vm.prank(owner);
-        vm.expectRevert(StoreFactoryMigrator.ImportPageEmpty.selector);
-        target.importStores(address(storeFactory), 0, 0);
-    }
-
-    /// @notice Only the owner may import.
-    /// @dev The import writes bindings directly, bypassing every check `deployLabelStoreFor`
-    ///      applies, so it is the most privileged entrypoint the factory has ever carried.
-    function test_import_is_owner_only() public {
-        vm.prank(ed);
-        vm.expectRevert(abi.encodeWithSelector(Ownable.OwnableUnauthorizedAccount.selector, ed));
-        target.importStores(address(storeFactory), 0, 10);
-    }
-
-    /// @notice The imported bindings survive the upgrade back to the shipped implementation.
-    /// @dev The migrator is meant to be transient. This is the assertion that the round trip
-    ///      leaves an ordinary factory holding the imported state, instead of a deployment parked
-    ///      on migration tooling.
-    function test_bindings_survive_the_return_to_the_shipped_implementation() public {
-        address edStore = storeFactory.getLabelStore(ed);
-
-        vm.startPrank(owner);
-        target.importStores(address(storeFactory), 0, 10);
-        target.upgradeToAndCall(address(new StoreFactory()), "");
-        vm.stopPrank();
-
-        StoreFactory restored = StoreFactory(address(target));
-        assertEq(restored.getLabelStore(ed), edStore, "binding survives the swap back");
-        assertEq(restored.getLabelStoreCount(), 2, "enumeration survives the swap back");
-    }
-}
diff --git a/test/unit/upgrade/LayoutCompatibility.t.sol b/test/unit/upgrade/LayoutCompatibility.t.sol
index 3f379ecf9..8b2e5e346 100644
--- a/test/unit/upgrade/LayoutCompatibility.t.sol
+++ b/test/unit/upgrade/LayoutCompatibility.t.sol
@@ -32,40 +32,26 @@ contract LayoutCompatibilityTests is Test {
         Upgrades.validateUpgrade(newContract, opts);
     }
 
-    function test_registry_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsRegistry.sol:DotnsRegistry", "DotnsRegistryOld.sol:DotnsRegistryOld"
-        );
-    }
-
-    function test_protocolRegistry_layout_is_compatible() public {
-        // The one proxy that genuinely adds storage: #304 appends `_protocolVersion` and
-        // `_expectedCodehash` and shrinks the gap to match, which is an append, not a move.
-        _assertCompatible(
-            "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            "DotnsProtocolRegistryOld.sol:DotnsProtocolRegistryOld"
-        );
-    }
-
-    function test_registrar_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsRegistrar.sol:DotnsRegistrar", "DotnsRegistrarOld.sol:DotnsRegistrarOld"
-        );
-    }
-
-    function test_registrarController_layout_is_compatible() public {
-        // The retained `__whiteListSlot` placeholder is what keeps `protocolRegistry` on the slot
-        // the live proxy uses. Without it this assertion is what fails.
-        _assertCompatible(
-            "DotnsRegistrarController.sol:DotnsRegistrarController",
-            "DotnsRegistrarControllerOld.sol:DotnsRegistrarControllerOld"
-        );
+    /// @notice As @custom:function _assertCompatible, with variables renamed in place accepted.
+    /// @dev Matches the options `UpgradePopResolverAndController` passes for the resolver. A rename
+    ///      keeps the slot and type, so the diff still fails on anything that moves or retypes.
+    /// @param newContract Artefact of the implementation being upgraded to.
+    /// @param referenceContract Artefact of the snapshot of what is deployed.
+    function _assertCompatibleAllowingRenames(
+        string memory newContract,
+        string memory referenceContract
+    )
+        internal
+    {
+        Options memory opts;
+        opts.referenceContract = referenceContract;
+        opts.unsafeAllowRenames = true;
+        Upgrades.validateUpgrade(newContract, opts);
     }
 
-    function test_popController_layout_is_compatible() public {
+    function test_registry_layout_is_compatible() public {
         _assertCompatible(
-            "DotnsPopController.sol:DotnsPopController",
-            "DotnsPopControllerOld.sol:DotnsPopControllerOld"
+            "DotnsRegistry.sol:DotnsRegistry", "DotnsRegistryOld.sol:DotnsRegistryOld"
         );
     }
 
@@ -73,57 +59,18 @@ contract LayoutCompatibilityTests is Test {
         _assertCompatible("PopRules.sol:PopRules", "PopRulesOld.sol:PopRulesOld");
     }
 
-    function test_nameEscrow_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsNameEscrow.sol:DotnsNameEscrow", "DotnsNameEscrowOld.sol:DotnsNameEscrowOld"
-        );
-    }
-
-    function test_nameWhitelist_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsNameWhitelist.sol:DotnsNameWhitelist",
-            "DotnsNameWhitelistOld.sol:DotnsNameWhitelistOld"
-        );
-    }
-
-    function test_resolver_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsResolver.sol:DotnsResolver", "DotnsResolverOld.sol:DotnsResolverOld"
-        );
-    }
-
-    function test_reverseResolver_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsReverseResolver.sol:DotnsReverseResolver",
-            "DotnsReverseResolverOld.sol:DotnsReverseResolverOld"
-        );
-    }
-
-    function test_contentResolver_layout_is_compatible() public {
-        _assertCompatible(
-            "DotnsContentResolver.sol:DotnsContentResolver",
-            "DotnsContentResolverOld.sol:DotnsContentResolverOld"
-        );
-    }
-
     function test_popResolver_layout_is_compatible() public {
-        _assertCompatible(
+        // `_liteLinks` becomes `_deviceLinks` in slot 2 and `_fullClaims` becomes
+        // `_personhoodNodes` in slot 3, types unchanged.
+        _assertCompatibleAllowingRenames(
             "DotnsPopResolver.sol:DotnsPopResolver", "DotnsPopResolverOld.sol:DotnsPopResolverOld"
         );
     }
 
-    /// @notice The store-factory migration swaps the implementation twice, so both directions have
-    ///         to be layout-compatible, not just the way in.
-    /// @dev The migrator is the shipped factory with four fields widened and one entrypoint added,
-    ///      so these hold by construction. Asserting them anyway is what catches someone editing
-    ///      the migrator into something that can no longer be swapped back out, which would strand
-    ///      the proxy on migration tooling.
-    function test_storeFactory_migration_is_compatible_in_both_directions() public {
-        _assertCompatible(
-            "StoreFactoryMigrator.sol:StoreFactoryMigrator", "StoreFactory.sol:StoreFactory"
-        );
+    function test_popController_layout_is_compatible() public {
         _assertCompatible(
-            "StoreFactory.sol:StoreFactory", "StoreFactoryMigrator.sol:StoreFactoryMigrator"
+            "DotnsPopController.sol:DotnsPopController",
+            "DotnsPopControllerOld.sol:DotnsPopControllerOld"
         );
     }
 }

From 73a6e3d1f10977c5b83563a8059b81c7c4ebb8f7 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 15:43:23 +0200
Subject: [PATCH 15/22] feat(upgrades): v1.0.0 campaign scripts and fork tests

UpgradePopResolverAndController swaps the PoP resolver and controller in
consecutive transactions, validating both layouts first and skipping a
proxy already upgraded. RedeployPopLens deploys the lens at a
release-scoped CREATE3 salt (the default one is spent on Paseo), rewires
popLens and declares its codehash. UpgradeRegistry and UpgradePopRules
are kept with v1.0.0 docs.

BaseDeployer gains a salt-taking _broadcastDeployCreate3, and the store
verification compares runtime code without its metadata trailer, since
v1.0.0 rewords store docs only.

Fork tests cover each step, re-runs, the state between steps, and the
whole campaign ending on a verified 1.0.0 declaration.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 scripts/deploy/BaseDeployer.s.sol             |  71 ++++++--
 scripts/deploy/RedeployPopLens.s.sol          | 119 +++++++++++++
 .../UpgradePopResolverAndController.s.sol     | 160 ++++++++++++++++++
 scripts/deploy/UpgradePopRules.s.sol          |   5 +-
 scripts/deploy/UpgradeRegistry.s.sol          |   6 +-
 test/fork/BasePopFork.t.sol                   | 108 ++++++++++++
 test/fork/PaseoV100Campaign.t.sol             |  90 ++++++++++
 test/fork/RedeployPopLens.t.sol               | 115 +++++++++++++
 .../UpgradePopResolverAndController.t.sol     | 144 ++++++++++++++++
 test/fork/UpgradePopRules.t.sol               |   6 +-
 test/fork/UpgradeRegistry.t.sol               |  14 +-
 11 files changed, 813 insertions(+), 25 deletions(-)
 create mode 100644 scripts/deploy/RedeployPopLens.s.sol
 create mode 100644 scripts/deploy/UpgradePopResolverAndController.s.sol
 create mode 100644 test/fork/BasePopFork.t.sol
 create mode 100644 test/fork/PaseoV100Campaign.t.sol
 create mode 100644 test/fork/RedeployPopLens.t.sol
 create mode 100644 test/fork/UpgradePopResolverAndController.t.sol

diff --git a/scripts/deploy/BaseDeployer.s.sol b/scripts/deploy/BaseDeployer.s.sol
index 1919dd1d0..bec7c44a9 100644
--- a/scripts/deploy/BaseDeployer.s.sol
+++ b/scripts/deploy/BaseDeployer.s.sol
@@ -189,12 +189,15 @@ abstract contract BaseDeployer is Script {
     ///      registry pointer here, the owner in the caller's ownership assertions, and the
     ///      beacons, which the initialiser mints and a squatter therefore chooses.
     ///      `LabelStore` and `UserStore` carry no immutables, so their runtime code compares
-    ///      exactly.
+    ///      exactly, up to the trailing CBOR metadata. That trailer hashes the sources, comments
+    ///      included, so a release that only rewords a store's documentation leaves the deployed
+    ///      code identical and the trailer different; every comparison here masks it.
     /// @dev The beacon contracts themselves are pinned by codehash first. Without that, the
     ///      checks below only prove that whatever sits at those addresses answered `owner()` and
     ///      `implementation()` the way this stage wanted at verification time; a bespoke contract
     ///      can do that and return something else afterwards. `UpgradeableBeacon` carries no
-    ///      immutables, so its code compares exactly and the topology cannot be faked.
+    ///      immutables, so its code compares exactly, metadata aside, and the topology cannot be
+    ///      faked.
     /// @dev Beacon ownership is asserted too. `upgradeLabelStoreImplementation` is `onlyOwner` on
     ///      the factory and the beacons are constructed as owned by it, so a beacon owned by
     ///      anything else leaves every store on the network following an implementation the
@@ -217,9 +220,15 @@ abstract contract BaseDeployer is Script {
         address labelBeacon = IStoreFactory(storeFactory).labelStoreBeacon();
         address userBeacon = IStoreFactory(storeFactory).userStoreBeacon();
 
-        bytes32 beaconCodehash = keccak256(vm.getDeployedCode(BEACON_ARTEFACT));
-        require(labelBeacon.codehash == beaconCodehash, "LabelStoreBeacon: unexpected beacon code");
-        require(userBeacon.codehash == beaconCodehash, "UserStoreBeacon: unexpected beacon code");
+        bytes32 beaconCodehash = _codehashSansMetadata(vm.getDeployedCode(BEACON_ARTEFACT));
+        require(
+            _codehashSansMetadata(labelBeacon.code) == beaconCodehash,
+            "LabelStoreBeacon: unexpected beacon code"
+        );
+        require(
+            _codehashSansMetadata(userBeacon.code) == beaconCodehash,
+            "UserStoreBeacon: unexpected beacon code"
+        );
 
         require(
             UpgradeableBeacon(labelBeacon).owner() == storeFactory,
@@ -231,19 +240,36 @@ abstract contract BaseDeployer is Script {
         );
 
         require(
-            UpgradeableBeacon(labelBeacon).implementation().codehash
-                == keccak256(vm.getDeployedCode("LabelStore.sol:LabelStore")),
+            _codehashSansMetadata(UpgradeableBeacon(labelBeacon).implementation().code)
+                == _codehashSansMetadata(vm.getDeployedCode("LabelStore.sol:LabelStore")),
             "LabelStoreBeacon: unexpected implementation"
         );
         require(
-            UpgradeableBeacon(userBeacon).implementation().codehash
-                == keccak256(vm.getDeployedCode("UserStore.sol:UserStore")),
+            _codehashSansMetadata(UpgradeableBeacon(userBeacon).implementation().code)
+                == _codehashSansMetadata(vm.getDeployedCode("UserStore.sol:UserStore")),
             "UserStoreBeacon: unexpected implementation"
         );
 
         console.log("  ok  store beacons and implementations");
     }
 
+    /// @notice Hash of runtime code with its trailing CBOR metadata removed.
+    /// @dev The last two bytes give the metadata length. Code too short to carry a trailer, or
+    ///      whose declared trailer exceeds it, is hashed whole, so a malformed occupant still
+    ///      fails the comparison instead of reverting here.
+    /// @param code Runtime code.
+    /// @return codehash keccak256 of the code without the metadata trailer.
+    function _codehashSansMetadata(bytes memory code) internal pure returns (bytes32 codehash) {
+        uint256 length = code.length;
+        if (length >= 2) {
+            uint256 trailer = (uint256(uint8(code[length - 2])) << 8) | uint8(code[length - 1]);
+            if (trailer + 2 <= length) length -= trailer + 2;
+        }
+        assembly ("memory-safe") {
+            codehash := keccak256(add(code, 0x20), length)
+        }
+    }
+
     /// @notice Deploys a UUPS implementation and ERC1967 proxy through CREATE3
     ///         inside its own broadcast scope, labels the proxy for trace
     ///         readability, and records it on the manifest.
@@ -334,10 +360,35 @@ abstract contract BaseDeployer is Script {
     )
         internal
         returns (address deployed)
+    {
+        deployed = _broadcastDeployCreate3(
+            owner, artefact, constructorData, label, _create3Salt(label, "contract")
+        );
+    }
+
+    /// @notice Deploys a non-upgradeable contract with CREATE3 at an explicit salt in a broadcast
+    ///         scope, labels it, and records it in the manifest.
+    /// @dev For a contract whose default salt is already spent on the target network, so its
+    ///      replacement needs an address of its own.
+    /// @param owner Broadcasting account.
+    /// @param artefact Fully-qualified artefact name.
+    /// @param constructorData ABI-encoded constructor arguments.
+    /// @param label Trace / manifest identifier.
+    /// @param salt CREATE3 salt to deploy at.
+    /// @return deployed Address of the deployed contract.
+    function _broadcastDeployCreate3(
+        address owner,
+        string memory artefact,
+        bytes memory constructorData,
+        string memory label,
+        bytes32 salt
+    )
+        internal
+        returns (address deployed)
     {
         vm.startBroadcast(owner);
         _activeBroadcaster = owner;
-        (deployed,) = _deployCreate3(artefact, constructorData, _create3Salt(label, "contract"));
+        (deployed,) = _deployCreate3(artefact, constructorData, salt);
         _activeBroadcaster = address(0);
         vm.stopBroadcast();
         vm.label(deployed, label);
diff --git a/scripts/deploy/RedeployPopLens.s.sol b/scripts/deploy/RedeployPopLens.s.sol
new file mode 100644
index 000000000..74d8adf7a
--- /dev/null
+++ b/scripts/deploy/RedeployPopLens.s.sol
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {console} from "forge-std/Script.sol";
+
+import {BaseDeployer} from "./BaseDeployer.s.sol";
+import {
+    OwnableUpgradeable
+} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
+import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
+
+/// @title RedeployPopLens
+/// @notice Deploys the current DotnsPopLens, points the `popLens` key at it, declares its
+///         codehash, and records it in the manifest.
+/// @dev The lens is a plain contract with an immutable protocol registry and no storage, so a new
+///      release replaces it with a fresh deployment. It reads the PoP resolver through the
+///      current getters, so it runs after `UpgradePopResolverAndController`.
+///
+///      The deterministic CREATE3 address a fresh deploy uses for the lens is already occupied on
+///      networks that ran an earlier lens there, and CREATE3 slots are single use. This script
+///      takes its own salt, scoped to the release in `DOTNS_RELEASE_TAG`, so the address is known
+///      before broadcasting and a re-run adopts the lens a previous run deployed.
+///
+///      The key and the codehash are written in consecutive transactions. `DEPLOYMENT_CHECKLIST.md`
+///      treats a rewire without a matching declaration as drift, indistinguishable from an
+///      unauthorised swap.
+///
+///      The outgoing lens is dropped from the manifest. Nothing holds state in it or points at it
+///      once the key moves, so it needs no `*Legacy` entry.
+/// @custom:security-contact admin@parity.io
+contract RedeployPopLens is BaseDeployer {
+    /// @notice Manifest label the lens is recorded under.
+    string internal constant POP_LENS_LABEL = "DotnsPopLens";
+
+    /// @notice Manifest label of the protocol registry.
+    string internal constant PROTOCOL_REGISTRY_LABEL = "DotnsProtocolRegistry";
+
+    /// @notice Lens artefact deployed by this script.
+    string internal constant POP_LENS_ARTEFACT = "DotnsPopLens.sol:DotnsPopLens";
+
+    /// @notice Deploys and wires the lens as `msg.sender`, then saves the manifest.
+    /// @dev `msg.sender` must own the protocol registry. The manifest's current lens is asserted
+    ///      against the `popLens` key before anything is broadcast, so a manifest that disagrees
+    ///      with the chain stops the run.
+    function run() external {
+        address owner = msg.sender;
+        vm.label(owner, "OWNER");
+
+        initDeployment(networkFolder(), vm.toString(block.chainid));
+
+        address protocolRegistry = _readAddress(PROTOCOL_REGISTRY_LABEL);
+        address outgoing = _readAddress(POP_LENS_LABEL);
+        string memory releaseTag = vm.envString("DOTNS_RELEASE_TAG");
+
+        _redeployPopLens(owner, protocolRegistry, outgoing, releaseTag);
+        saveDeployments();
+
+        console.log("=== RedeployPopLens complete ===");
+    }
+
+    /// @notice Deploys the lens at its release-scoped CREATE3 address, records it in the in-memory
+    ///         manifest, and wires the key to it.
+    /// @dev A re-run after the deploy adopts the lens at the predicted address, and the key writes
+    ///      are skipped once the chain already holds them, so the script can be run again after a
+    ///      failure at any point.
+    /// @param owner Account that owns the protocol registry and broadcasts.
+    /// @param protocolRegistry Registry the lens binds to and the key lives on.
+    /// @param outgoing Lens the manifest records today.
+    /// @param releaseTag Bare semver of the release being deployed, for example `1.0.0`.
+    /// @return lens Address of the new lens.
+    function _redeployPopLens(
+        address owner,
+        address protocolRegistry,
+        address outgoing,
+        string memory releaseTag
+    )
+        internal
+        returns (address lens)
+    {
+        IDotnsProtocolRegistry registry = IDotnsProtocolRegistry(protocolRegistry);
+        require(
+            owner == OwnableUpgradeable(protocolRegistry).owner(),
+            "RedeployPopLens: broadcaster is not the protocol registry owner"
+        );
+
+        address current = registry.get(DotnsConstants.POP_LENS);
+        bytes32 salt = _create3Salt(POP_LENS_LABEL, string.concat("contract:", releaseTag));
+        _setCreate3Factory(registry.get(DotnsConstants.CREATE3_FACTORY));
+        address predicted = _create3Factory().predict(salt);
+        require(
+            current == outgoing || current == predicted,
+            "RedeployPopLens: popLens key matches neither the manifest nor this release's lens"
+        );
+
+        lens = _broadcastDeployCreate3(
+            owner, POP_LENS_ARTEFACT, abi.encode(protocolRegistry), POP_LENS_LABEL, salt
+        );
+        console.log("  lens at", lens);
+
+        if (registry.get(DotnsConstants.POP_LENS) != lens) {
+            vm.broadcast(owner);
+            registry.set(DotnsConstants.POP_LENS, lens);
+        }
+        if (registry.expectedCodehash(DotnsConstants.POP_LENS) != lens.codehash) {
+            vm.broadcast(owner);
+            registry.setExpectedCodehash(DotnsConstants.POP_LENS, lens.codehash);
+        }
+
+        require(
+            registry.get(DotnsConstants.POP_LENS) == lens,
+            "RedeployPopLens: popLens key did not take"
+        );
+        require(
+            registry.expectedCodehash(DotnsConstants.POP_LENS) == lens.codehash,
+            "RedeployPopLens: popLens codehash declaration did not take"
+        );
+    }
+}
diff --git a/scripts/deploy/UpgradePopResolverAndController.s.sol b/scripts/deploy/UpgradePopResolverAndController.s.sol
new file mode 100644
index 000000000..1b277f872
--- /dev/null
+++ b/scripts/deploy/UpgradePopResolverAndController.s.sol
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {console} from "forge-std/Script.sol";
+import {Options} from "openzeppelin-foundry-upgrades/Options.sol";
+import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
+
+import {BaseDeployer} from "./BaseDeployer.s.sol";
+import {
+    OwnableUpgradeable
+} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {IDotnsPopController} from "../../contracts/registrars/IDotnsPopController.sol";
+import {IDotnsPopResolver} from "../../contracts/resolvers/IDotnsPopResolver.sol";
+
+/// @title UpgradePopResolverAndController
+/// @notice Upgrades the deployed DotnsPopResolver and DotnsPopController proxies to the current
+///         implementations, resolver first, in consecutive transactions. Resolves both proxies
+///         from the on-disk manifest, diffs each new storage layout against its pinned snapshot
+///         (@custom:contract DotnsPopResolverOld, @custom:contract DotnsPopControllerOld), and
+///         broadcasts only once both diffs and every unsafe-pattern check pass.
+/// @dev One script because the two implementations only work in pairs. The new controller writes
+///      the personhood link through `setDeviceLink`, which only the new resolver has, and the old
+///      controller writes it through `setLiteLink`, which the new resolver drops. Upgrading either
+///      alone leaves every linked personhood issuance reverting until the other lands. Between the
+///      two transactions here that window is a few blocks, and an issuance that reverts in it
+///      writes nothing.
+///
+///      Both layouts are validated before the first broadcast, so a controller that fails its
+///      diff cannot leave the resolver upgraded on its own. Each proxy is upgraded only while it
+///      still runs the previous implementation, detected by interface: a run that died between
+///      the two transactions is finished by running this script again.
+///
+///      The resolver's layout changes only by two renames in place, `_liteLinks` to `_deviceLinks`
+///      in slot 2 and `_fullClaims` to `_personhoodNodes` in slot 3, with types unchanged. They are
+///      allowed through `unsafeAllowRenames` on the resolver diff alone. The alternative,
+///      OpenZeppelin's renamed-from annotation on the two variables, edits the resolver source
+///      and with it the embedded metadata, so the deployed code would no longer reproduce the
+///      release build.
+///
+///      The snapshots are the implementations deployed on chain.
+///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building each snapshot
+///      and comparing it against the chain. The layout diff cannot: it compares whatever pair it
+///      is given, and is blind to a change that lives in calldata.
+/// @custom:security-contact admin@parity.io
+contract UpgradePopResolverAndController is BaseDeployer {
+    /// @notice Pre-upgrade resolver snapshot the resolver layout diff compares against.
+    string internal constant RESOLVER_REFERENCE = "DotnsPopResolverOld.sol:DotnsPopResolverOld";
+
+    /// @notice Pre-upgrade controller snapshot the controller layout diff compares against.
+    string internal constant CONTROLLER_REFERENCE =
+        "DotnsPopControllerOld.sol:DotnsPopControllerOld";
+
+    /// @notice New resolver implementation artefact.
+    string internal constant RESOLVER_ARTEFACT = "DotnsPopResolver.sol:DotnsPopResolver";
+
+    /// @notice New controller implementation artefact.
+    string internal constant CONTROLLER_ARTEFACT = "DotnsPopController.sol:DotnsPopController";
+
+    /// @notice Manifest label the DotnsPopResolver proxy is recorded under.
+    string internal constant POP_RESOLVER_LABEL = "DotnsPopResolver";
+
+    /// @notice Manifest label the DotnsPopController proxy is recorded under.
+    string internal constant POP_CONTROLLER_LABEL = "DotnsPopController";
+
+    /// @notice Reads the manifest, resolves both proxies, and upgrades them as `msg.sender`.
+    /// @dev `msg.sender` must own both proxies, otherwise the run stops before broadcasting.
+    function run() external {
+        address owner = msg.sender;
+        vm.label(owner, "OWNER");
+
+        initDeployment(networkFolder(), vm.toString(block.chainid));
+
+        address resolver = _readAddress(POP_RESOLVER_LABEL);
+        address controller = _readAddress(POP_CONTROLLER_LABEL);
+        _upgradeResolverAndController(owner, resolver, controller);
+
+        console.log("=== UpgradePopResolverAndController complete ===");
+    }
+
+    /// @notice Upgrades `resolver`, then `controller`, under `owner`.
+    /// @dev Empty upgrade calls: neither implementation seeds storage of its own, and the release
+    ///      declarations are written once by `DeclareRelease.s.sol` after every swap has verified.
+    /// @param owner Account that owns both proxies and broadcasts the upgrades.
+    /// @param resolver DotnsPopResolver proxy address resolved from the manifest.
+    /// @param controller DotnsPopController proxy address resolved from the manifest.
+    function _upgradeResolverAndController(
+        address owner,
+        address resolver,
+        address controller
+    )
+        internal
+    {
+        require(
+            owner == OwnableUpgradeable(resolver).owner(),
+            "UpgradePopResolverAndController: broadcaster is not the resolver owner"
+        );
+        require(
+            owner == OwnableUpgradeable(controller).owner(),
+            "UpgradePopResolverAndController: broadcaster is not the controller owner"
+        );
+
+        Options memory resolverOpts = _resolverOptions();
+        Options memory controllerOpts = _controllerOptions();
+        Upgrades.validateUpgrade(RESOLVER_ARTEFACT, resolverOpts);
+        Upgrades.validateUpgrade(CONTROLLER_ARTEFACT, controllerOpts);
+
+        if (_resolverUpgraded(resolver)) {
+            console.log("  DotnsPopResolver proxy already upgraded, skipping", resolver);
+        } else {
+            vm.startBroadcast(owner);
+            Upgrades.upgradeProxy(resolver, RESOLVER_ARTEFACT, "", resolverOpts);
+            vm.stopBroadcast();
+            console.log("  upgraded DotnsPopResolver proxy", resolver);
+        }
+
+        if (_controllerUpgraded(controller)) {
+            console.log("  DotnsPopController proxy already upgraded, skipping", controller);
+        } else {
+            vm.startBroadcast(owner);
+            Upgrades.upgradeProxy(controller, CONTROLLER_ARTEFACT, "", controllerOpts);
+            vm.stopBroadcast();
+            console.log("  upgraded DotnsPopController proxy", controller);
+        }
+
+        require(
+            _resolverUpgraded(resolver) && _controllerUpgraded(controller),
+            "UpgradePopResolverAndController: a proxy still runs the previous implementation"
+        );
+    }
+
+    /// @notice Layout-diff options for the resolver: its snapshot, plus the two in-place renames.
+    function _resolverOptions() internal pure returns (Options memory opts) {
+        opts.referenceContract = RESOLVER_REFERENCE;
+        opts.unsafeAllowRenames = true;
+    }
+
+    /// @notice Layout-diff options for the controller: its snapshot and nothing else.
+    function _controllerOptions() internal pure returns (Options memory opts) {
+        opts.referenceContract = CONTROLLER_REFERENCE;
+    }
+
+    /// @notice Whether `resolver` already runs an implementation exposing `deviceLabelhashOf`.
+    /// @dev The previous implementation has no such function, so the static call reverts there.
+    /// @param resolver DotnsPopResolver proxy.
+    /// @return upgraded True once the new implementation is behind the proxy.
+    function _resolverUpgraded(address resolver) internal view returns (bool upgraded) {
+        (upgraded,) =
+            resolver.staticcall(abi.encodeCall(IDotnsPopResolver.deviceLabelhashOf, (bytes32(0))));
+    }
+
+    /// @notice Whether `controller` already runs an implementation reporting the current interface.
+    /// @dev The previous implementation reports its own interface id, which differs from this one
+    ///      because the issuance entrypoints changed.
+    /// @param controller DotnsPopController proxy.
+    /// @return upgraded True once the new implementation is behind the proxy.
+    function _controllerUpgraded(address controller) internal view returns (bool upgraded) {
+        upgraded = IERC165(controller).supportsInterface(type(IDotnsPopController).interfaceId);
+    }
+}
diff --git a/scripts/deploy/UpgradePopRules.s.sol b/scripts/deploy/UpgradePopRules.s.sol
index a03cc2d20..db9ab693a 100644
--- a/scripts/deploy/UpgradePopRules.s.sol
+++ b/scripts/deploy/UpgradePopRules.s.sol
@@ -15,8 +15,9 @@ import {
 ///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
 ///         @custom:contract PopRulesOld snapshot, and swaps the implementation only when the
 ///         diff and every unsafe-pattern check pass.
-/// @dev The swap carries no behavioural change of its own: `version()` stops returning a hardcoded
-/// string and reads the protocol registry's declaration instead.
+/// @dev The swap renames `personhoodOf` to `popStatusOf` and the tiers `PopLite` and `PopFull` to
+///      `Devicehood` and `Personhood`, and rewords the revert and classification messages that
+///      named them. Classification and pricing are unchanged. No contract calls `personhoodOf`.
 ///
 ///      The snapshot is the implementation deployed on chain, not the previous release: these
 ///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
diff --git a/scripts/deploy/UpgradeRegistry.s.sol b/scripts/deploy/UpgradeRegistry.s.sol
index 0daebcf87..0948f81aa 100644
--- a/scripts/deploy/UpgradeRegistry.s.sol
+++ b/scripts/deploy/UpgradeRegistry.s.sol
@@ -15,9 +15,9 @@ import {
 ///         proxy from the on-disk manifest, diffs the new storage layout against the pinned
 ///         @custom:contract DotnsRegistryOld snapshot, and swaps the implementation only when the
 ///         diff and every unsafe-pattern check pass.
-/// @dev The swap adds the controller gate on a deferred store write (`persist` false), and moves
-/// the store write to `StoreUtils.writeNewLabel`, which refuses to overwrite a locked label with a
-///      different one instead of silently skipping it.
+/// @dev The swap changes the registry only through `StringUtils`: `isNamePath`, which every subnode
+///      write checks on its parent label, now rejects a path longer than 255 octets, and the
+///      device-name helpers carry their new names.
 ///
 ///      The snapshot is the implementation deployed on chain, not the previous release: these
 ///      proxies were upgraded in place after their last release, so a snapshot taken from a tag
diff --git a/test/fork/BasePopFork.t.sol b/test/fork/BasePopFork.t.sol
new file mode 100644
index 000000000..2f55d3796
--- /dev/null
+++ b/test/fork/BasePopFork.t.sol
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {BaseUpgradeFork} from "./BaseUpgradeFork.t.sol";
+import {IDotnsPopController} from "../../contracts/registrars/IDotnsPopController.sol";
+import {IDotnsPopControllerLegacy} from "../../contracts/registrars/IDotnsPopControllerLegacy.sol";
+import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
+import {IPersonhood} from "../../contracts/external/personhood/IPersonhood.sol";
+import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
+import {LabelUtils} from "../../contracts/utils/LabelUtils.sol";
+
+/// @title BasePopFork
+/// @notice Shared PoP issuance flow for the fork tests that swap the PoP resolver, controller and
+///         lens: issues a device name and a personhood name linked to it through the legacy
+///         entrypoints the gateway pallet calls.
+/// @dev Paseo's PoP resolver holds no links yet, so there is no live link to read back across the
+///      swap. Writing one through the upgraded pair and reading it back in both directions is
+///      what proves the pair works together. The labels are chosen to be unregistered on Paseo;
+///      `_requireUnregistered` turns a collision into a clear failure.
+/// @custom:security-contact admin@parity.io
+abstract contract BasePopFork is BaseUpgradeFork {
+    /// @notice Device name issued by the flow, `stem.NN`.
+    string internal constant DEVICE_LABEL = "zqxforkp.07";
+
+    /// @notice Personhood name issued by the flow, linked to `DEVICE_LABEL`.
+    string internal constant PERSONHOOD_LABEL = "zqxforkp";
+
+    /// @notice Account the flow issues both names to.
+    address internal popUser;
+
+    function setUp() public virtual override {
+        super.setUp();
+        popUser = makeAddr("popUser");
+    }
+
+    /// @notice Issues `DEVICE_LABEL`, then `PERSONHOOD_LABEL` linked to it, under a Root origin.
+    /// @dev Goes through `IDotnsPopControllerLegacy`, the selectors the frozen gateway pallet
+    ///      dispatches, so the test covers the path live traffic takes.
+    /// @param controller DotnsPopController proxy.
+    /// @return personhoodNode Node of the issued personhood name.
+    function _issueLinkedPair(address controller) internal returns (bytes32 personhoodNode) {
+        _mockRootOrigin();
+        _mockPersonhood(popUser, 2);
+
+        personhoodNode = _nodeOf(PERSONHOOD_LABEL);
+        _requireUnregistered(personhoodNode);
+
+        IDotnsPopControllerLegacy(controller)
+            .reserveLiteName(
+                IDotnsPopController.DeviceNameIssuance({
+                label: DEVICE_LABEL, user: popUser, chatKey: _chatKey()
+            })
+            );
+        IDotnsPopControllerLegacy(controller)
+            .registerBaseName(
+                IDotnsPopController.PersonhoodNameIssuance({
+                label: PERSONHOOD_LABEL,
+                user: popUser,
+                link: IDotnsPopController.Link({
+                kind: IDotnsPopController.LinkKind.DeviceName,
+                deviceLabel: DEVICE_LABEL,
+                chatKey: ""
+            })
+            })
+            );
+    }
+
+    /// @notice Node of a name directly under the TLD.
+    function _nodeOf(string memory label) internal view returns (bytes32 node) {
+        bytes32 tldNode = IDotnsProtocolRegistry(_live("DotnsProtocolRegistry")).tldNode();
+        node = LabelUtils.namehashUnder(tldNode, LabelUtils.labelhashMemory(label));
+    }
+
+    /// @notice A valid 65-byte uncompressed chat key.
+    function _chatKey() internal pure returns (bytes memory key) {
+        key = new bytes(65);
+        key[0] = 0x04;
+        for (uint256 i = 1; i < 65; ++i) {
+            key[i] = 0x2a;
+        }
+    }
+
+    /// @notice Makes the personhood precompile report `status` for `who` in the dotNS context.
+    /// @dev The precompile is not part of forked state, so every read of it is mocked.
+    function _mockPersonhood(address who, uint8 status) internal {
+        vm.mockCall(
+            DotnsConstants.PERSONHOOD,
+            abi.encodeWithSelector(
+                IPersonhood.personhoodStatus.selector, who, DotnsConstants.PERSONHOOD_CONTEXT
+            ),
+            abi.encode(
+                IPersonhood.PersonhoodInfo({
+                    status: status, contextAlias: keccak256(abi.encode(who, status))
+                })
+            )
+        );
+    }
+
+    /// @notice Reverts unless `node` is unowned on the fork.
+    function _requireUnregistered(bytes32 node) internal view {
+        (bool ok, bytes memory data) =
+            _live("DotnsRegistry").staticcall(abi.encodeWithSignature("owner(bytes32)", node));
+        require(
+            ok && abi.decode(data, (address)) == address(0),
+            "fork: the PoP test label is already registered on this network"
+        );
+    }
+}
diff --git a/test/fork/PaseoV100Campaign.t.sol b/test/fork/PaseoV100Campaign.t.sol
new file mode 100644
index 000000000..879374a27
--- /dev/null
+++ b/test/fork/PaseoV100Campaign.t.sol
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {BasePopFork} from "./BasePopFork.t.sol";
+import {UpgradeRegistryHarness} from "./UpgradeRegistry.t.sol";
+import {UpgradePopRulesHarness} from "./UpgradePopRules.t.sol";
+import {UpgradePopResolverAndControllerHarness} from "./UpgradePopResolverAndController.t.sol";
+import {RedeployPopLensHarness} from "./RedeployPopLens.t.sol";
+import {DeclareRelease} from "../../scripts/deploy/DeclareRelease.s.sol";
+import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
+import {IDotnsPopLens} from "../../contracts/registrars/IDotnsPopLens.sol";
+
+/// @title DeclareReleaseHarness
+/// @notice Runs `DeclareRelease.declare` against the manifest with the lens the campaign deployed.
+/// @dev On chain, the operator commits the manifest `RedeployPopLens` wrote before `DeclareRelease`
+///      runs. A fork test must not write the manifest, so the harness substitutes the new lens in
+///      the loaded addresses and runs the same steps in the same order.
+contract DeclareReleaseHarness is DeclareRelease {
+    /// @notice The body of `declare`, with `popLens` replaced by `lens`.
+    function declareWithLens(address owner, address lens, string memory releaseTag) external {
+        initDeployment("paseo-assethub", vm.toString(block.chainid));
+        Addresses memory addr = _loadAddresses();
+        addr.popLens = lens;
+
+        _wireMissingKeys(owner, addr);
+        _declareCodeIdentity(owner, addr);
+        _verifyDeployment(addr, owner);
+        _declareProtocolVersion(owner, addr, releaseTag);
+    }
+}
+
+/// @title PaseoV100CampaignForkTest
+/// @notice The whole v0.8.0 to v1.0.0 campaign on one fork, in broadcast order: registry, rules,
+///         the PoP resolver and controller pair, the lens, then the release declaration.
+/// @dev The rehearsal for the label-driven run. Each step's own fork test proves the step; this
+///      proves the sequence, including that the release declaration verifies once every swap has
+///      landed and that the network is consistent between the steps.
+/// @custom:security-contact admin@parity.io
+contract PaseoV100CampaignForkTest is BasePopFork {
+    /// @notice Bare semver the campaign declares.
+    string internal constant RELEASE_TAG = "1.0.0";
+
+    /// @notice Owner of every proxy and of the protocol registry.
+    address internal owner;
+
+    /// @notice The protocol registry.
+    IDotnsProtocolRegistry internal registry;
+
+    function setUp() public override {
+        super.setUp();
+        registry = IDotnsProtocolRegistry(_live("DotnsProtocolRegistry"));
+        owner = _ownerOf(address(registry));
+    }
+
+    /// @notice All five steps in order end on a verified 1.0.0 declaration.
+    function test_campaign_ends_on_a_verified_release() public {
+        assertEq(registry.protocolVersion(), "0.8.0", "starts on 0.8.0");
+
+        new UpgradeRegistryHarness().upgrade(owner, _live("DotnsRegistry"));
+        new UpgradePopRulesHarness().upgrade(owner, _live("PopRules"));
+        new UpgradePopResolverAndControllerHarness()
+            .upgrade(owner, _live("DotnsPopResolver"), _live("DotnsPopController"));
+        address lens = new RedeployPopLensHarness()
+            .redeploy(owner, address(registry), _live("DotnsPopLens"), RELEASE_TAG);
+
+        new DeclareReleaseHarness().declareWithLens(owner, lens, RELEASE_TAG);
+
+        assertEq(registry.protocolVersion(), RELEASE_TAG, "declares 1.0.0");
+
+        bytes32 personhoodNode = _issueLinkedPair(_live("DotnsPopController"));
+        assertEq(
+            IDotnsPopLens(lens).nameDetail(DEVICE_LABEL).personhoodNode,
+            personhoodNode,
+            "issuance and lens work end to end"
+        );
+    }
+
+    /// @notice After the first two steps alone, the v0.8.0 PoP controller still issues against the
+    ///         upgraded registry and rules, so the pause between labels leaves a working network.
+    function test_v080_controller_still_issues_after_registry_and_rules() public {
+        new UpgradeRegistryHarness().upgrade(owner, _live("DotnsRegistry"));
+        new UpgradePopRulesHarness().upgrade(owner, _live("PopRules"));
+
+        bytes32 personhoodNode = _issueLinkedPair(_live("DotnsPopController"));
+        (bool ok, bytes memory data) = _live("DotnsRegistry")
+            .staticcall(abi.encodeWithSignature("owner(bytes32)", personhoodNode));
+        assertTrue(ok, "registry readable");
+        assertEq(abi.decode(data, (address)), popUser, "issued through the v0.8.0 controller");
+    }
+}
diff --git a/test/fork/RedeployPopLens.t.sol b/test/fork/RedeployPopLens.t.sol
new file mode 100644
index 000000000..874ea09d1
--- /dev/null
+++ b/test/fork/RedeployPopLens.t.sol
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {BasePopFork} from "./BasePopFork.t.sol";
+import {UpgradePopResolverAndControllerHarness} from "./UpgradePopResolverAndController.t.sol";
+import {RedeployPopLens} from "../../scripts/deploy/RedeployPopLens.s.sol";
+import {IDotnsPopLens} from "../../contracts/registrars/IDotnsPopLens.sol";
+import {IDotnsPopResolver} from "../../contracts/resolvers/IDotnsPopResolver.sol";
+import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolRegistry.sol";
+import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
+
+/// @title RedeployPopLensHarness
+/// @notice Exposes the script's internal path so the test drives the code the production run
+///         executes.
+/// @dev The script's `run` reads the network folder and writes the manifest, neither of which a
+///      fork test should touch, so the harness enters below both.
+contract RedeployPopLensHarness is RedeployPopLens {
+    /// @notice Deploys and wires the lens under `owner` through the script's own internal.
+    function redeploy(
+        address owner,
+        address protocolRegistry,
+        address outgoing,
+        string memory releaseTag
+    )
+        external
+        returns (address lens)
+    {
+        lens = _redeployPopLens(owner, protocolRegistry, outgoing, releaseTag);
+    }
+}
+
+/// @title RedeployPopLensForkTest
+/// @notice Pairs one-to-one with `scripts/deploy/RedeployPopLens.s.sol`. Runs after the PoP
+///         resolver and controller swap, as on chain, then redeploys the lens and proves the key,
+///         the declaration and the reads it serves.
+/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`.
+/// @custom:security-contact admin@parity.io
+contract RedeployPopLensForkTest is BasePopFork {
+    /// @notice Release tag the salt is scoped to.
+    string internal constant RELEASE_TAG = "1.0.0";
+
+    /// @notice The protocol registry holding the `popLens` key.
+    IDotnsProtocolRegistry internal registry;
+
+    /// @notice Lens the manifest records today.
+    address internal outgoing;
+
+    /// @notice Protocol registry owner, impersonated to authorise the rewire.
+    address internal registryOwner;
+
+    /// @notice Drives the script's redeploy path.
+    RedeployPopLensHarness internal redeployer;
+
+    function setUp() public override {
+        super.setUp();
+        registry = IDotnsProtocolRegistry(_live("DotnsProtocolRegistry"));
+        outgoing = _live("DotnsPopLens");
+        registryOwner = _ownerOf(address(registry));
+        redeployer = new RedeployPopLensHarness();
+
+        UpgradePopResolverAndControllerHarness pair = new UpgradePopResolverAndControllerHarness();
+        address controller = _live("DotnsPopController");
+        pair.upgrade(_ownerOf(controller), _live("DotnsPopResolver"), controller);
+    }
+
+    /// @notice The key moves to the new lens with a matching declaration, and the lens serves the
+    ///         link the upgraded pair writes.
+    function test_redeploy_rewires_declares_and_serves_links() public {
+        assertEq(registry.get(DotnsConstants.POP_LENS), outgoing, "key starts on the outgoing lens");
+
+        address lens = redeployer.redeploy(registryOwner, address(registry), outgoing, RELEASE_TAG);
+
+        assertTrue(lens != outgoing, "a new lens");
+        assertEq(registry.get(DotnsConstants.POP_LENS), lens, "key points at the new lens");
+        assertEq(
+            registry.expectedCodehash(DotnsConstants.POP_LENS),
+            lens.codehash,
+            "declaration matches the executing code"
+        );
+        assertEq(IDotnsPopLens(lens).protocolRegistry(), address(registry), "bound to the registry");
+
+        bytes32 personhoodNode = _issueLinkedPair(_live("DotnsPopController"));
+        IDotnsPopLens.NameDetail memory detail = IDotnsPopLens(lens).nameDetail(PERSONHOOD_LABEL);
+        assertEq(detail.node, personhoodNode, "node");
+        assertEq(detail.owner, popUser, "owner");
+        assertEq(
+            detail.deviceLabelhash,
+            IDotnsPopResolver(_live("DotnsPopResolver")).deviceLabelhashOf(personhoodNode),
+            "device link read through the lens"
+        );
+
+        IDotnsPopLens.NameDetail memory device = IDotnsPopLens(lens).nameDetail(DEVICE_LABEL);
+        assertEq(device.personhoodNode, personhoodNode, "personhood link read through the lens");
+    }
+
+    /// @notice A second run adopts the lens the first one deployed and broadcasts nothing new.
+    function test_rerun_adopts_the_deployed_lens() public {
+        address first = redeployer.redeploy(registryOwner, address(registry), outgoing, RELEASE_TAG);
+        address second =
+            redeployer.redeploy(registryOwner, address(registry), outgoing, RELEASE_TAG);
+
+        assertEq(second, first, "same lens");
+        assertEq(registry.get(DotnsConstants.POP_LENS), first, "key unchanged");
+    }
+
+    /// @notice A key pointing somewhere unexpected stops the run before it broadcasts.
+    function test_refuses_a_key_the_manifest_does_not_describe() public {
+        vm.expectRevert(
+            bytes(
+                "RedeployPopLens: popLens key matches neither the manifest nor this release's lens"
+            )
+        );
+        redeployer.redeploy(registryOwner, address(registry), makeAddr("elsewhere"), RELEASE_TAG);
+    }
+}
diff --git a/test/fork/UpgradePopResolverAndController.t.sol b/test/fork/UpgradePopResolverAndController.t.sol
new file mode 100644
index 000000000..f6662f4de
--- /dev/null
+++ b/test/fork/UpgradePopResolverAndController.t.sol
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
+
+import {BasePopFork} from "./BasePopFork.t.sol";
+import {
+    UpgradePopResolverAndController
+} from "../../scripts/deploy/UpgradePopResolverAndController.s.sol";
+import {IDotnsPopController} from "../../contracts/registrars/IDotnsPopController.sol";
+import {IDotnsPopResolver} from "../../contracts/resolvers/IDotnsPopResolver.sol";
+import {IDotnsRegistry} from "../../contracts/registry/IDotnsRegistry.sol";
+
+/// @title UpgradePopResolverAndControllerHarness
+/// @notice Exposes the upgrade script's internal path so the test drives the code the production
+///         run executes, including both fail-closed storage-layout diffs.
+contract UpgradePopResolverAndControllerHarness is UpgradePopResolverAndController {
+    /// @notice Upgrades both proxies under `owner` through the script's own internal.
+    function upgrade(address owner, address resolver, address controller) external {
+        _upgradeResolverAndController(owner, resolver, controller);
+    }
+
+    /// @notice Upgrades the resolver alone, leaving the state a run that died between its two
+    ///         transactions leaves behind.
+    function upgradeResolverOnly(address owner, address resolver) external {
+        vm.startBroadcast(owner);
+        Upgrades.upgradeProxy(resolver, RESOLVER_ARTEFACT, "", _resolverOptions());
+        vm.stopBroadcast();
+    }
+}
+
+/// @title UpgradePopResolverAndControllerForkTest
+/// @notice Pairs one-to-one with `scripts/deploy/UpgradePopResolverAndController.s.sol`. Upgrades
+///         the deployed PoP resolver and controller and proves they work as a pair: reservation
+///         state survives, and a linked personhood issuance through the gateway's legacy
+///         entrypoints writes the link in both directions.
+/// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
+///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
+///      before the first test runs.
+/// @custom:security-contact admin@parity.io
+contract UpgradePopResolverAndControllerForkTest is BasePopFork {
+    /// @notice The deployed PoP resolver proxy.
+    address internal resolver;
+
+    /// @notice The deployed PoP controller proxy.
+    address internal controller;
+
+    /// @notice Owner of both proxies, impersonated to authorise the upgrades.
+    address internal proxyOwner;
+
+    /// @notice Drives the script's upgrade path against the live proxies.
+    UpgradePopResolverAndControllerHarness internal upgrader;
+
+    function setUp() public override {
+        super.setUp();
+        resolver = _live("DotnsPopResolver");
+        controller = _live("DotnsPopController");
+        proxyOwner = _ownerOf(controller);
+        assertEq(_ownerOf(resolver), proxyOwner, "one owner for both proxies");
+        upgrader = new UpgradePopResolverAndControllerHarness();
+    }
+
+    /// @notice Both implementations change, controller state survives, and a linked issuance
+    ///         round-trips through the new resolver.
+    function test_upgrade_swaps_both_and_links_round_trip() public {
+        uint256 pendingUsersBefore = IDotnsPopController(controller).pendingClaimUserCount();
+        uint64 durationBefore = IDotnsPopController(controller).reservationDuration();
+        address resolverImplementationBefore = _implementationOf(resolver);
+        address controllerImplementationBefore = _implementationOf(controller);
+
+        upgrader.upgrade(proxyOwner, resolver, controller);
+
+        assertTrue(
+            _implementationOf(resolver) != resolverImplementationBefore,
+            "the resolver implementation actually changed"
+        );
+        assertTrue(
+            _implementationOf(controller) != controllerImplementationBefore,
+            "the controller implementation actually changed"
+        );
+        assertEq(
+            IDotnsPopController(controller).pendingClaimUserCount(),
+            pendingUsersBefore,
+            "pending claim users preserved"
+        );
+        assertEq(
+            IDotnsPopController(controller).reservationDuration(),
+            durationBefore,
+            "reservation window preserved"
+        );
+
+        _assertLinkedIssuance();
+    }
+
+    /// @notice A run that died between its two transactions is finished by running it again.
+    function test_rerun_completes_a_resolver_only_upgrade() public {
+        upgrader.upgradeResolverOnly(proxyOwner, resolver);
+        address resolverImplementation = _implementationOf(resolver);
+        address controllerImplementationBefore = _implementationOf(controller);
+
+        upgrader.upgrade(proxyOwner, resolver, controller);
+
+        assertEq(
+            _implementationOf(resolver),
+            resolverImplementation,
+            "the already-upgraded resolver is left alone"
+        );
+        assertTrue(
+            _implementationOf(controller) != controllerImplementationBefore,
+            "the controller is upgraded"
+        );
+        _assertLinkedIssuance();
+    }
+
+    /// @notice A second run after a complete one broadcasts nothing.
+    function test_rerun_after_completion_is_a_no_op() public {
+        upgrader.upgrade(proxyOwner, resolver, controller);
+        address resolverImplementation = _implementationOf(resolver);
+        address controllerImplementation = _implementationOf(controller);
+
+        upgrader.upgrade(proxyOwner, resolver, controller);
+
+        assertEq(_implementationOf(resolver), resolverImplementation, "resolver untouched");
+        assertEq(_implementationOf(controller), controllerImplementation, "controller untouched");
+    }
+
+    /// @notice Issues the linked pair and checks ownership and both link directions.
+    function _assertLinkedIssuance() internal {
+        bytes32 personhoodNode = _issueLinkedPair(controller);
+
+        IDotnsRegistry registry = IDotnsRegistry(_live("DotnsRegistry"));
+        assertEq(registry.owner(personhoodNode), popUser, "personhood name issued to the user");
+
+        IDotnsPopResolver popResolver = IDotnsPopResolver(resolver);
+        bytes32 deviceLabelhash = popResolver.deviceLabelhashOf(personhoodNode);
+        assertTrue(deviceLabelhash != bytes32(0), "device link written");
+        assertEq(
+            popResolver.personhoodNodeOf(deviceLabelhash),
+            personhoodNode,
+            "personhood link written in lockstep"
+        );
+        assertEq(popResolver.chatKey(personhoodNode), _chatKey(), "chat key inherited");
+    }
+}
diff --git a/test/fork/UpgradePopRules.t.sol b/test/fork/UpgradePopRules.t.sol
index eb8d56842..f75bc5572 100644
--- a/test/fork/UpgradePopRules.t.sol
+++ b/test/fork/UpgradePopRules.t.sol
@@ -43,9 +43,9 @@ contract UpgradePopRulesForkTest is BaseUpgradeFork {
     }
 
     /// @notice Pricing answers the same before and after.
-    /// @dev The swap carries no behavioural change, so pricing returning something different
-    ///      would mean the upgrade changed something it was not supposed to. Asserting equality
-    ///      across the swap is the cheapest way to catch that.
+    /// @dev The swap renames functions and messages and leaves pricing alone, so pricing returning
+    ///      something different would mean the upgrade changed something it was not supposed to.
+    ///      Asserting equality across the swap is the cheapest way to catch that.
     function test_upgrade_leaves_pricing_unchanged() public {
         IPopRules rules = IPopRules(proxy);
 
diff --git a/test/fork/UpgradeRegistry.t.sol b/test/fork/UpgradeRegistry.t.sol
index b11a0ad48..5cd5f1e5f 100644
--- a/test/fork/UpgradeRegistry.t.sol
+++ b/test/fork/UpgradeRegistry.t.sol
@@ -21,8 +21,8 @@ contract UpgradeRegistryHarness is UpgradeRegistry {
 
 /// @title UpgradeRegistryForkTest
 /// @notice Pairs one-to-one with `scripts/deploy/UpgradeRegistry.s.sol`. Upgrades the deployed
-/// registry and proves records survive, then that the gate the release adds actually closes on the
-/// live controller set.
+/// registry and proves records survive, then that the deferral gate still closes on the live
+/// controller set.
 /// @dev Requires the local ETH-RPC adapter on `paseo_local`; see `DEPLOYMENTS.md`. Run the suite
 ///      with `bun run test:fork`, which also checks every snapshot against the deployed bytecode
 ///      before the first test runs.
@@ -48,11 +48,11 @@ contract UpgradeRegistryForkTest is BaseUpgradeFork {
         tldNode = IDotnsProtocolRegistry(_live("DotnsProtocolRegistry")).tldNode();
     }
 
-    /// @notice The TLD record survives the swap and the new deferral gate rejects a plain caller.
-    /// @dev The gate is the reason this upgrade exists. It reads `registrar.controllers` from live
-    ///      state on every call, so a unit test cannot show it closing against the real controller
-    ///      set; this can. The caller here owns nothing, so it fails the ownership modifier too,
-    ///      which is why the assertion is only that a plain caller cannot defer.
+    /// @notice The TLD record survives the swap and the deferral gate rejects a plain caller.
+    /// @dev The gate reads `registrar.controllers` from live state on every call, so a unit test
+    ///      cannot show it closing against the real controller set; this can. The caller here owns
+    ///      nothing, so it fails the ownership modifier too, which is why the assertion is only
+    ///      that a plain caller cannot defer.
     function test_upgrade_preserves_records_and_closes_the_deferral_gate() public {
         IDotnsRegistry registry = IDotnsRegistry(proxy);
 

From 2bd3a8cf2430a42bf40eeb574967c87dc924e3d5 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 15:43:26 +0200
Subject: [PATCH 16/22] ci(upgrades): console steps for the v1.0.0 campaign

Allowlists the five steps and checks, before each upgrade step, the
snapshots of the contracts that step upgrades (SNAPSHOT_SUBJECTS in
verify-snapshots.sh). Drops the rotation and migration plumbing.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/paseo-upgrade-step.yml | 54 +++++++++++-------------
 scripts/shell/verify-snapshots.sh        | 16 ++++++-
 2 files changed, 39 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/paseo-upgrade-step.yml b/.github/workflows/paseo-upgrade-step.yml
index 00d800e84..bc360d666 100644
--- a/.github/workflows/paseo-upgrade-step.yml
+++ b/.github/workflows/paseo-upgrade-step.yml
@@ -13,16 +13,13 @@ name: Paseo Upgrade Step
 # The gate is the `testnet-upgrades` environment: every run pauses until a required reviewer
 # approves it, whoever added the label. The label is the request; the approval is the decision.
 # Labels are also how retries work: the job removes its label when it finishes, so re-adding it
-# re-runs the step. The rotation script skips what already moved and the twelve swaps are
-# idempotent; step 13 is the exception, and its runbook section says to inspect, not re-add.
+# re-runs the step. Re-running one that already landed is harmless: a single-proxy upgrade swaps
+# in the same code again, and the other steps skip what is already on chain.
 #
-# Key handling. Step 0 signs with the repository-level `DOTNS_ADMIN_KEY`, because its value
-# cannot be read by anyone, so it cannot be re-entered as an environment secret. That exposure
-# is time-boxed: step 0's whole purpose is to make that key powerless. The fresh key the
-# operator generates IS entered as an environment secret under the same name, which shadows the
-# repository one for every later step, and the repository copy is then deleted. Runner logs on
-# this public repository are world-readable, so nothing here may ever echo key material; the
-# password below only encrypts a keystore that lives for one run.
+# Key handling. Every step signs with `DOTNS_ADMIN_KEY` from the `testnet-upgrades`
+# environment, the owner of every proxy and of the protocol registry. Runner logs on this public
+# repository are world-readable, so nothing here may ever echo key material; the password below
+# only encrypts a keystore that lives for one run.
 
 on:
   pull_request:
@@ -57,17 +54,20 @@ jobs:
         run: |
           set -euo pipefail
           SCRIPT="${LABEL#run:}"
+          # Each step names the contracts it upgrades, whose snapshots are checked against the
+          # chain right before it broadcasts. Steps that upgrade no proxy name none.
           case "$SCRIPT" in
-            RotateOwnership|UpgradeProtocolRegistry|UpgradeRegistry|UpgradeRegistrar|\
-            UpgradeRegistrarController|UpgradePopController|UpgradePopRules|\
-            UpgradeNameEscrow|UpgradeNameWhitelist|UpgradeResolver|UpgradeReverseResolver|\
-            UpgradeContentResolver|UpgradePopResolver|MigrateStoreFactory|DeclareRelease) ;;
+            UpgradeRegistry) SUBJECTS="DotnsRegistry" ;;
+            UpgradePopRules) SUBJECTS="PopRules" ;;
+            UpgradePopResolverAndController) SUBJECTS="DotnsPopResolver DotnsPopController" ;;
+            RedeployPopLens|DeclareRelease) SUBJECTS="" ;;
             *)
-              echo "::error::'$SCRIPT' is not a runbook step; see docs/PASEO-V080-RUNBOOK.md"
+              echo "::error::'$SCRIPT' is not a runbook step; see docs/PASEO-V100-RUNBOOK.md"
               exit 1
               ;;
           esac
           echo "script=$SCRIPT" >> "$GITHUB_OUTPUT"
+          echo "subjects=$SUBJECTS" >> "$GITHUB_OUTPUT"
 
       # The head commit, not the merge ref. A pull_request checkout defaults to the PR merged
       # into its base, and master merged into this branch is not the code that was reviewed or
@@ -93,32 +93,28 @@ jobs:
           docker compose up --build -d eth-rpc
           scripts/shell/wait-for-eth-rpc.sh http://127.0.0.1:8545
 
-      # Only before anything has been broadcast: the moment step 1 lands, the snapshots stop
-      # matching the chain by design, so this gate is pinned to step 0 instead of pretending to
-      # be a mid-flight health check.
+      # Scoped to the contracts this step upgrades. Every proxy an earlier step upgraded has
+      # moved past its snapshot by design; the ones this step is about to swap must still match,
+      # and a mismatch here means the code changed underneath the campaign.
       - name: Verify snapshots against the deployed bytecode
-        if: steps.step.outputs.script == 'RotateOwnership'
+        if: steps.step.outputs.subjects != ''
         env:
           RPC_URL: http://127.0.0.1:8545
+          SNAPSHOT_SUBJECTS: ${{ steps.step.outputs.subjects }}
         run: scripts/shell/verify-snapshots.sh
 
       - name: Broadcast ${{ steps.step.outputs.script }}
         env:
           SCRIPT: ${{ steps.step.outputs.script }}
           RPC_URL: http://127.0.0.1:8545
-          # `_account.sh` imports this into a run-local keystore when none exists. Environment
-          # secrets shadow repository ones for jobs that declare the environment, which is what
-          # switches every post-rotation step onto the fresh key without touching this file.
+          # `_account.sh` imports this into a run-local keystore when none exists.
           PRIVATE_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
           # Encrypts a keystore that exists for the lifetime of this runner. Masked because no
           # log line should print even throwaway credentials in cleartext.
           ACCOUNT_PASSWORD: testnet-upgrades-run-${{ github.run_id }}
-          # Step parameters, configured as environment variables on `testnet-upgrades`:
-          # DOTNS_NEW_OWNER for step 0, DOTNS_RELEASE_TAG for step 14, and optionally
-          # DOTNS_OLD_STORE_FACTORY as the step 13 cross-check.
-          DOTNS_NEW_OWNER: ${{ vars.DOTNS_NEW_OWNER }}
+          # Step parameter, configured as an environment variable on `testnet-upgrades`: the
+          # release tag `RedeployPopLens` scopes its salt to and `DeclareRelease` declares.
           DOTNS_RELEASE_TAG: ${{ vars.DOTNS_RELEASE_TAG }}
-          DOTNS_OLD_STORE_FACTORY: ${{ vars.DOTNS_OLD_STORE_FACTORY }}
         run: |
           set -euo pipefail
           echo "::add-mask::$ACCOUNT_PASSWORD"
@@ -126,8 +122,8 @@ jobs:
 
       # The broadcast record and the manifest are the two things a step changes on disk. The
       # manifest cannot be pushed back from here: the branch requires signed commits, which a
-      # runner cannot produce, so step 13's manifest change is committed by the operator from
-      # the artifact. Everything else leaves the workspace unchanged.
+      # runner cannot produce, so the manifest `RedeployPopLens` writes is committed by the
+      # operator from the artifact. Everything else leaves the workspace unchanged.
       - name: Keep the broadcast record
         if: always()
         uses: actions/upload-artifact@v4
@@ -151,5 +147,5 @@ jobs:
         run: |
           set -euo pipefail
           gh pr comment "$PR" --repo "$GITHUB_REPOSITORY" \
-            --body "**${SCRIPT}**: ${RESULT}. [Run](${RUN_URL}). Broadcast record and manifest attached as artifacts. Re-add \`${LABEL}\` to retry; for MigrateStoreFactory, read the runbook before retrying anything."
+            --body "**${SCRIPT}**: ${RESULT}. [Run](${RUN_URL}). Broadcast record and manifest attached as artifacts. Re-add \`${LABEL}\` to retry."
           gh pr edit "$PR" --repo "$GITHUB_REPOSITORY" --remove-label "$LABEL"
diff --git a/scripts/shell/verify-snapshots.sh b/scripts/shell/verify-snapshots.sh
index 608da79c0..16f213e9e 100755
--- a/scripts/shell/verify-snapshots.sh
+++ b/scripts/shell/verify-snapshots.sh
@@ -21,6 +21,11 @@ set -euo pipefail
 #   scripts/shell/verify-snapshots.sh                        # against RPC_URL
 #   RPC_URL=https://eth-rpc-paseo-next.polkadot.io ...
 #   DOTNS_NETWORK=paseo-assethub scripts/shell/verify-snapshots.sh
+#   SNAPSHOT_SUBJECTS="DotnsPopResolver DotnsPopController" ...   # only these contracts
+#
+# SNAPSHOT_SUBJECTS limits the bytecode comparison to the named contracts. Mid-campaign, every
+# proxy already upgraded has moved past its snapshot by design, so the gate before a step checks
+# only the contracts that step upgrades. Every snapshot is still built.
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
@@ -50,11 +55,12 @@ echo "verify-snapshots: $manifest against $RPC_URL (chain $chain_id)"
 
 forge build >/dev/null
 
-RPC_URL="$RPC_URL" MANIFEST="$manifest" python3 - "${snapshots[@]}" <<'PY'
+RPC_URL="$RPC_URL" MANIFEST="$manifest" SNAPSHOT_SUBJECTS="${SNAPSHOT_SUBJECTS:-}" python3 - "${snapshots[@]}" <<'PY'
 import json, os, sys, time, urllib.request
 
 RPC = os.environ["RPC_URL"]
 manifest = json.load(open(os.environ["MANIFEST"]))
+only = set(os.environ["SNAPSHOT_SUBJECTS"].split())
 # EIP-1967 implementation slot.
 SLOT = "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"
 
@@ -108,6 +114,9 @@ for path in sys.argv[1:]:
         # their own; they are pulled in so the contract snapshots compile.
         skipped.append(snapshot)
         continue
+    if only and subject not in only:
+        skipped.append(snapshot)
+        continue
 
     artefact = f"out/{snapshot}.sol/{snapshot}.json"
     if not os.path.exists(artefact):
@@ -137,8 +146,11 @@ for path in sys.argv[1:]:
     else:
         print(f"  ok  {snapshot} == {subject} at {impl}")
 
+if only - {os.path.basename(p)[:-7] for p in sys.argv[1:]}:
+    failures.append(f"SNAPSHOT_SUBJECTS names contracts with no snapshot: {sorted(only - {os.path.basename(p)[:-7] for p in sys.argv[1:]})}")
+
 if skipped:
-    print(f"  --  {len(skipped)} snapshot(s) with no deployed counterpart: {', '.join(skipped)}")
+    print(f"  --  {len(skipped)} snapshot(s) not compared: {', '.join(skipped)}")
 
 if failures:
     print("\nverify-snapshots: FAILED", file=sys.stderr)

From d444806814048609e0497c1f8a32692d9812c071 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 15:43:32 +0200
Subject: [PATCH 17/22] docs(upgrades): v1.0.0 runbook

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 DEPLOYMENTS.md             |  12 +--
 docs/PASEO-V100-RUNBOOK.md | 182 +++++++++++++++++++++++++++++++++++++
 2 files changed, 188 insertions(+), 6 deletions(-)
 create mode 100644 docs/PASEO-V100-RUNBOOK.md

diff --git a/DEPLOYMENTS.md b/DEPLOYMENTS.md
index 96e89884d..67e0519c0 100644
--- a/DEPLOYMENTS.md
+++ b/DEPLOYMENTS.md
@@ -505,12 +505,12 @@ question about this network. Use an archive node, or Blockscout at
 
 ### Broadcast order
 
-The in-place upgrade to v0.8.0 has a fixed order, and nothing in the scripts enforces it: the
-protocol registry has to go first because every other contract's `version()` reads through it,
-the store migration after that because it rewires a key the declaration records, and the
-declaration last because it is a claim about the whole deployment.
-[`docs/PASEO-V080-RUNBOOK.md`](./docs/PASEO-V080-RUNBOOK.md) is the step list, with what to check
-after each one.
+The in-place upgrade to v1.0.0 has a fixed order: the PoP resolver and controller change together
+because the new controller writes links through a resolver function the old resolver lacks, and
+the old controller through one the new resolver drops; the lens goes after them
+because it reads the resolver's new getters, and the declaration goes last because it is a claim
+about the whole deployment. [`docs/PASEO-V100-RUNBOOK.md`](./docs/PASEO-V100-RUNBOOK.md) is the
+step list, with what to check after each one.
 
 ### The deployed code is not always the code in a release
 
diff --git a/docs/PASEO-V100-RUNBOOK.md b/docs/PASEO-V100-RUNBOOK.md
new file mode 100644
index 000000000..126176774
--- /dev/null
+++ b/docs/PASEO-V100-RUNBOOK.md
@@ -0,0 +1,182 @@
+# Paseo Asset Hub Next: broadcast order for the v1.0.0 in-place upgrade
+
+Upgrades the deployment from v0.8.0 to v1.0.0. Every step is one `scripts/deploy/upgrade.sh`
+invocation under the deployment owner, broadcast through CI with one label per step; see
+"Broadcasting through the review PR" below. The owner key lives only in the `testnet-upgrades`
+environment, so the label path is the mechanism.
+
+Four contracts change code and one is replaced. StoreFactory, RegistrarController,
+ReverseResolver and the rest are unchanged at the bytecode level and are left alone.
+
+## Order
+
+| # | Script | Why here |
+| --- | --- | --- |
+| 1 | `UpgradeRegistry` | `isNamePath` bounds a name path at 255 octets. No dependency on the others. |
+| 2 | `UpgradePopRules` | Renames `personhoodOf` to `popStatusOf` and the tier names. No contract calls it. |
+| 3 | `UpgradePopResolverAndController` | One script, two transactions: resolver, then controller. |
+| 4 | `RedeployPopLens` | Reads the resolver through its new getters, so after step 3. Writes the manifest. |
+| 5 | `DeclareRelease` | Declares every codehash, then `1.0.0`. Last, always. |
+
+Steps 1 and 2 can go in either order. Three dependencies fix the rest:
+
+- **The PoP resolver and controller change together.** The new controller writes the personhood
+  link through `setDeviceLink`, which only the new resolver has; the old controller writes it
+  through `setLiteLink`, which the new resolver drops. Either one alone leaves every linked
+  personhood issuance reverting. Step 3 swaps both in consecutive transactions, and an issuance
+  that lands between them reverts without writing anything.
+- **The lens goes after the pair.** It reads `deviceLabelhashOf` and `personhoodNodeOf`, which the
+  old resolver does not have.
+- **The declaration goes last.** It is a claim about the whole deployment. An abandoned run
+  leaves `0.8.0` declared, which clients read as an older network.
+
+Between steps 1 and 5 the declared codehashes of the swapped proxies trail the chain, so a client
+that verifies them sees drift for that window. Step 4 declares the lens in the same run that
+rewires it, so the lens never shows drift.
+
+## Before anything is broadcast
+
+```bash
+RPC_URL=https://eth-rpc-paseo-next.polkadot.io scripts/shell/verify-snapshots.sh
+
+PASEO_FORK_RPC=https://eth-rpc-paseo-next.polkadot.io \
+  RPC_URL=https://eth-rpc-paseo-next.polkadot.io scripts/shell/fork-tests.sh
+```
+
+Run both on the day. Every `*Old.sol` snapshot must reproduce the implementation deployed now;
+the proxies are upgraded in place, so a swap landing in between changes the answer. The fork suite
+includes `PaseoV100CampaignForkTest`, which runs all five steps in order on one fork and ends on a
+verified `1.0.0` declaration.
+
+The broadcaster owns every proxy and the protocol registry. Each script asserts this before it
+broadcasts.
+
+## Broadcasting through the review PR
+
+The workflow (`.github/workflows/paseo-upgrade-step.yml`) lives only on `dev/testnet-upgrades`
+and is triggered by labels on an open review PR into master. One step:
+
+1. Add the label `run:<Script>` to the review PR, for example `run:UpgradeRegistry`.
+2. The run pauses on the `testnet-upgrades` environment. Approve it there. The run is pinned to
+   the PR's head commit at label time, so a push after labelling does not change what an approval
+   executes.
+3. Before an upgrade step, the job checks the snapshots of the contracts that step upgrades
+   against the chain. Proxies an earlier step upgraded have moved past their snapshots by design,
+   so the check is scoped to the step.
+4. The job starts the local ETH-RPC adapter, broadcasts the one script, uploads the broadcast
+   record and the manifest as artifacts, comments the outcome on the PR, and removes the label.
+5. Retry by re-adding the label. Manual work between steps (committing the step 4 manifest from
+   the artifact, since the runner cannot produce the signed commit this branch requires) happens
+   with no label applied.
+
+Setup, in the repository UI plus one shell loop:
+
+- Environment `testnet-upgrades`: required reviewer(s), secret `DOTNS_ADMIN_KEY` (the owner key),
+  variable `DOTNS_RELEASE_TAG` set to `1.0.0`. Step 4 scopes the lens salt to it and step 5
+  declares it.
+- **Leave the environment's deployment branch policy unrestricted.** A `pull_request` run deploys
+  from `refs/pull/N/merge`, which no branch-name pattern matches, so any restriction blocks every
+  gated run with a misleading error. The protection is the required reviewer.
+- The labels:
+
+```bash
+for s in UpgradeRegistry UpgradePopRules UpgradePopResolverAndController RedeployPopLens \
+  DeclareRelease; do
+  gh label create "run:$s" --repo paritytech/dotns --color 4FEF0F \
+    --description "Broadcast $s on Paseo (gated)" --force
+done
+```
+
+- Re-enable the console once the review PR is open: `gh workflow enable "Paseo Upgrade Step"`.
+
+## After each step
+
+Verify from an independent client before the next label. The workflow's green check means the
+transactions landed; it does not read the chain back.
+
+- **Steps 1 to 3:** `cast implementation <proxy>` moved; the new implementation's runtime code
+  equals this branch's build, with the `__self` immutable and the trailing metadata masked; the
+  owner is unchanged; one state read survives (the TLD record for the registry, `price` for a
+  probe name on PopRules, `pendingClaimUserCount` and `reservationDuration` on the controller).
+- **Step 3, additionally:** the controller reports the current interface,
+  `supportsInterface(type(IDotnsPopController).interfaceId)`, and the resolver answers
+  `deviceLabelhashOf(0)`.
+- **Step 4:** `protocolRegistry.get(popLens)` is the address the run logged,
+  `expectedCodehash(popLens)` equals that address's `extcodehash`, and the lens's
+  `protocolRegistry()` is the registry. Commit the manifest from the run's artifact to the review
+  PR before step 5: `DeclareRelease` reads the lens address from it.
+- **Step 5:**
+
+```bash
+node scripts/js/release-metadata.mjs verify --network paseo-assethub \
+  --rpc https://eth-rpc-paseo-next.polkadot.io --tag v1.0.0
+```
+
+Any key this reports is a real finding.
+
+## The lens address
+
+A fresh deploy puts the lens at the CREATE3 address for the label `DotnsPopLens`. On Paseo that
+address already holds an earlier lens build, and CREATE3 slots are single use, so
+`RedeployPopLens` uses a salt scoped to the release, the kind `contract:<DOTNS_RELEASE_TAG>`. The
+address is predictable before broadcasting (`0x309C5ff21f9082A53211500c6f33cA2a21024Ae4` for
+`1.0.0` on Paseo, as the fork tests log it), and a re-run adopts the lens a previous run deployed.
+The outgoing lens holds no state and nothing points at it once the key moves, so it leaves the
+manifest without a `*Legacy` entry.
+
+## If a step fails
+
+Stop. Every step can be re-run by re-adding its label:
+
+- `UpgradeRegistry` and `UpgradePopRules` swap in the same code again.
+- `UpgradePopResolverAndController` upgrades only the proxies still on the previous
+  implementation, detected by interface, so a run that died between its two transactions is
+  finished by running it again. `test_rerun_completes_a_resolver_only_upgrade` is the executable
+  version.
+- `RedeployPopLens` adopts the lens at its predicted address and skips the key writes the chain
+  already holds.
+- `DeclareRelease` writes the version last, so a failure before that leaves `0.8.0` declared.
+
+Do not skip ahead to `DeclareRelease` to tidy up. Declaring a release the deployment does not
+fully run is the one state the declarations cannot represent.
+
+Rolling a proxy back means upgrading it to its previous implementation, recorded below, through
+the same console.
+
+| Proxy | Implementation before this campaign |
+| --- | --- |
+| DotnsRegistry `0xf34054fd76BbF85f216cf9908226D5f0A72E50CA` | `0x0d4708a5bb49b4f237d7bd9dea51fe895415625f` |
+| PopRules `0x747B456bE03aec0b42bd85C51513730FBD45DA31` | `0xef403ba39bed71c806d5777996012647df968014` |
+| DotnsPopResolver `0xDaC984884EcA8Fc44011f1D6C49B27828390A72B` | `0x90ef3ed7897fee2f18717a99f198e4c219541deb` |
+| DotnsPopController `0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b` | `0x20e8026c960da6185877c8ad41c2ad25b7861e98` |
+
+The outgoing lens is `0xAE374b07c7e6f473CBa21d57e36AC15C631Abc51`.
+
+## Close-out
+
+Once the release verify is clean: disable the console with
+`gh workflow disable "Paseo Upgrade Step"`, close the review PR, and tag the branch head
+`upgrades/paseo-nv2-v1.0.0` so the campaign's exact code stays addressable.
+
+## Running the next campaign on this branch
+
+The branch and its tooling are permanent; the step list changes. In order:
+
+1. Merge `master` into `dev/testnet-upgrades`. Nothing ever merges back.
+2. Remove the previous campaign's snapshots, scripts and fork tests. They stay in the branch
+   history and under the previous campaign's tag.
+3. Take fresh `*Old.sol` snapshots from the code the chain is running: the previous campaign's
+   tag, proven by `scripts/shell/verify-snapshots.sh` before anything else is written. A file in
+   a snapshot's import closure needs an `Old` copy only when its code differs from the merged tip;
+   files that differ only in comments are imported directly. String literals keep their text, so
+   the copies compile to the deployed bytecode.
+4. Write one upgrade script and one fork test per contract that changes, plus a campaign fork
+   test that runs every step in order on one fork. Any script leg that loops over live state is
+   paged from day one; see "Limits the simulator cannot see" in CONTRIBUTING.
+5. Update the step map in `.github/workflows/paseo-upgrade-step.yml` (each script and the
+   contracts whose snapshots it checks), create the labels, set `DOTNS_RELEASE_TAG`, re-enable
+   the console, open a review PR, and broadcast one label at a time.
+6. Close out as above.
+
+From the first swap on, CI's full `verify-snapshots` on the review PR fails by design, because
+the chain no longer matches the pre-upgrade snapshots. That red is the guard working.

From 2088bdae86f42bf70e879f0dc23595d4223b6f61 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 16:00:13 +0200
Subject: [PATCH 18/22] fix(upgrades): validate the PoP resolver layout with no
 override

---
 .../UpgradePopResolverAndController.s.sol     | 11 ++++------
 test/unit/upgrade/LayoutCompatibility.t.sol   | 21 ++-----------------
 2 files changed, 6 insertions(+), 26 deletions(-)

diff --git a/scripts/deploy/UpgradePopResolverAndController.s.sol b/scripts/deploy/UpgradePopResolverAndController.s.sol
index 1b277f872..323b991bb 100644
--- a/scripts/deploy/UpgradePopResolverAndController.s.sol
+++ b/scripts/deploy/UpgradePopResolverAndController.s.sol
@@ -32,11 +32,9 @@ import {IDotnsPopResolver} from "../../contracts/resolvers/IDotnsPopResolver.sol
 ///      the two transactions is finished by running this script again.
 ///
 ///      The resolver's layout changes only by two renames in place, `_liteLinks` to `_deviceLinks`
-///      in slot 2 and `_fullClaims` to `_personhoodNodes` in slot 3, with types unchanged. They are
-///      allowed through `unsafeAllowRenames` on the resolver diff alone. The alternative,
-///      OpenZeppelin's renamed-from annotation on the two variables, edits the resolver source
-///      and with it the embedded metadata, so the deployed code would no longer reproduce the
-///      release build.
+///      in slot 2 and `_fullClaims` to `_personhoodNodes` in slot 3, with types unchanged. The
+///      resolver source declares both through OpenZeppelin's renamed-from annotation, so both
+///      diffs run with no override.
 ///
 ///      The snapshots are the implementations deployed on chain.
 ///      `scripts/shell/verify-snapshots.sh` is what holds that property, by building each snapshot
@@ -129,10 +127,9 @@ contract UpgradePopResolverAndController is BaseDeployer {
         );
     }
 
-    /// @notice Layout-diff options for the resolver: its snapshot, plus the two in-place renames.
+    /// @notice Layout-diff options for the resolver: its snapshot and nothing else.
     function _resolverOptions() internal pure returns (Options memory opts) {
         opts.referenceContract = RESOLVER_REFERENCE;
-        opts.unsafeAllowRenames = true;
     }
 
     /// @notice Layout-diff options for the controller: its snapshot and nothing else.
diff --git a/test/unit/upgrade/LayoutCompatibility.t.sol b/test/unit/upgrade/LayoutCompatibility.t.sol
index 8b2e5e346..1bc57ce90 100644
--- a/test/unit/upgrade/LayoutCompatibility.t.sol
+++ b/test/unit/upgrade/LayoutCompatibility.t.sol
@@ -32,23 +32,6 @@ contract LayoutCompatibilityTests is Test {
         Upgrades.validateUpgrade(newContract, opts);
     }
 
-    /// @notice As @custom:function _assertCompatible, with variables renamed in place accepted.
-    /// @dev Matches the options `UpgradePopResolverAndController` passes for the resolver. A rename
-    ///      keeps the slot and type, so the diff still fails on anything that moves or retypes.
-    /// @param newContract Artefact of the implementation being upgraded to.
-    /// @param referenceContract Artefact of the snapshot of what is deployed.
-    function _assertCompatibleAllowingRenames(
-        string memory newContract,
-        string memory referenceContract
-    )
-        internal
-    {
-        Options memory opts;
-        opts.referenceContract = referenceContract;
-        opts.unsafeAllowRenames = true;
-        Upgrades.validateUpgrade(newContract, opts);
-    }
-
     function test_registry_layout_is_compatible() public {
         _assertCompatible(
             "DotnsRegistry.sol:DotnsRegistry", "DotnsRegistryOld.sol:DotnsRegistryOld"
@@ -61,8 +44,8 @@ contract LayoutCompatibilityTests is Test {
 
     function test_popResolver_layout_is_compatible() public {
         // `_liteLinks` becomes `_deviceLinks` in slot 2 and `_fullClaims` becomes
-        // `_personhoodNodes` in slot 3, types unchanged.
-        _assertCompatibleAllowingRenames(
+        // `_personhoodNodes` in slot 3, types unchanged, declared by renamed-from annotations.
+        _assertCompatible(
             "DotnsPopResolver.sol:DotnsPopResolver", "DotnsPopResolverOld.sol:DotnsPopResolverOld"
         );
     }

From c23fcea018744258f672d851372e3d02f2ce338e Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 16:18:34 +0200
Subject: [PATCH 19/22] forge fmt

---
 contracts/pop/IPopRulesOld.sol                 |  4 ++--
 contracts/pop/PopRulesOld.sol                  |  3 ++-
 contracts/registrars/DotnsPopControllerOld.sol |  3 ++-
 contracts/registrars/DotnsRegistrarOld.sol     | 14 ++++++++------
 contracts/resolvers/DotnsPopResolverOld.sol    |  5 ++---
 contracts/utils/SubnodeUtilsOld.sol            |  4 ++--
 6 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/contracts/pop/IPopRulesOld.sol b/contracts/pop/IPopRulesOld.sol
index cbe512ce7..5fb8f5c0c 100644
--- a/contracts/pop/IPopRulesOld.sol
+++ b/contracts/pop/IPopRulesOld.sol
@@ -156,8 +156,8 @@ interface IPopRulesOld {
     ///      enforces, but does require the input to be canonical and stem-shaped (no trailing
     ///      digits); a non-canonical or non-stem label triggers @custom:reverts PopError. If the
     ///      slot is already live and held by a different user, @custom:reverts PopError so the
-    ///      caller's local bookkeeping and PopRulesOld state stay in lockstep; if it is live for the
-    ///      same user, expiry is refreshed to `block.timestamp + MAX_RESERVATION_TIME`. Emits
+    ///      caller's local bookkeeping and PopRulesOld state stay in lockstep; if it is live for
+    ///      the same user, expiry is refreshed to `block.timestamp + MAX_RESERVATION_TIME`. Emits
     ///      @custom:emits BaseNameReserved on every successful write.
     /// @param stem The base label with no trailing digits.
     /// @param user The address receiving reservation rights.
diff --git a/contracts/pop/PopRulesOld.sol b/contracts/pop/PopRulesOld.sol
index 49bc3bfbe..65f3a1efc 100644
--- a/contracts/pop/PopRulesOld.sol
+++ b/contracts/pop/PopRulesOld.sol
@@ -545,7 +545,8 @@ contract PopRulesOld is
 
     /// @notice Ensures the caller is any controller authorised on the registrar.
     function _onlyRegistry() internal view {
-        DotnsRegistrarOld registrar = DotnsRegistrarOld(protocolRegistry.get(DotnsConstants.REGISTRAR));
+        DotnsRegistrarOld registrar =
+            DotnsRegistrarOld(protocolRegistry.get(DotnsConstants.REGISTRAR));
         require(registrar.controllers(IDotnsController(msg.sender)), NotRegistry());
     }
 
diff --git a/contracts/registrars/DotnsPopControllerOld.sol b/contracts/registrars/DotnsPopControllerOld.sol
index ff14e642c..cb6b5c847 100644
--- a/contracts/registrars/DotnsPopControllerOld.sol
+++ b/contracts/registrars/DotnsPopControllerOld.sol
@@ -262,7 +262,8 @@ contract DotnsPopControllerOld is
         IPopRulesOld rules = _popRules();
         (IPopRulesOld.PopStatus required,) = rules.classifyName(label);
         require(
-            required != IPopRulesOld.PopStatus.Reserved && required != IPopRulesOld.PopStatus.PopLite,
+            required != IPopRulesOld.PopStatus.Reserved
+                && required != IPopRulesOld.PopStatus.PopLite,
             InvalidBaseLabel()
         );
 
diff --git a/contracts/registrars/DotnsRegistrarOld.sol b/contracts/registrars/DotnsRegistrarOld.sol
index 3b35a888a..4a239a736 100644
--- a/contracts/registrars/DotnsRegistrarOld.sol
+++ b/contracts/registrars/DotnsRegistrarOld.sol
@@ -26,8 +26,9 @@ import {DotnsConstants} from "../utils/DotnsConstants.sol";
 /// @title Dotns Registrar
 /// @notice ERC721-backed registrar implementing permanent name ownership.
 /// @dev Deliberately policy-free on pricing, reservations, and PoP gating; those live in the
-/// controllers and @custom:contract IPopRulesOld. The registrar owns transferability itself: publicly
-/// registered names transfer freely, while names minted through the PoP gateway are soulbound and
+/// controllers and @custom:contract IPopRulesOld. The registrar owns transferability itself:
+/// publicly registered names transfer freely, while names minted through the PoP gateway are
+/// soulbound and
 /// revert on transfer. The `_update` hook enforces both the soulbound gate and the fee-on-transfer
 /// settlement that consults the escrow.
 /// @custom:security-contact admin@parity.io
@@ -143,8 +144,9 @@ contract DotnsRegistrarOld is
         require(owner != protocolRegistry.get(DotnsConstants.NAME_ESCROW), InvalidOwner());
         // Empty labels are an intentional gateway-cold path (substrate Root cannot deploy a
         // `LabelStore` under `pallet-revive`, so the controller stashes a pending claim and the
-        // user settles via @custom:function IDotnsPopControllerOld.claimLabelStore later). Non-empty
-        // labels must still be canonical so the transfer-floor lookup in `_quoteTransferFee`
+        // user settles via @custom:function IDotnsPopControllerOld.claimLabelStore later).
+        // Non-empty labels must still be canonical so the transfer-floor lookup in
+        // `_quoteTransferFee`
         // cannot brick the token by reverting on a malformed stem.
         require(bytes(label).length == 0 || label.isSingleLabel(), InvalidLabel());
         _mint(owner, id);
@@ -422,8 +424,8 @@ contract DotnsRegistrarOld is
 
     /// @notice Quotes the friction fee required for a transfer.
     /// @dev Required fee is the name's own price returned by @custom:function
-    /// PopRulesOld.transferFloor. It is paid by the sender on every downward or cross-reach transfer
-    /// and settles to the
+    /// PopRulesOld.transferFloor. It is paid by the sender on every downward or cross-reach
+    /// transfer and settles to the
     /// protocol fee pot. Any prior deposit travels with the NFT: the escrow rebinds the position to
     /// the new holder rather than refunding the sender, so transferring a funded name forfeits the
     /// locked deposit to the recipient. Self-transfers and escrow-touching transfers return zero.
diff --git a/contracts/resolvers/DotnsPopResolverOld.sol b/contracts/resolvers/DotnsPopResolverOld.sol
index 21b92fbf8..23c49c813 100644
--- a/contracts/resolvers/DotnsPopResolverOld.sol
+++ b/contracts/resolvers/DotnsPopResolverOld.sol
@@ -145,9 +145,8 @@ contract DotnsPopResolverOld is
 
     /// @inheritdoc ERC165Upgradeable
     function supportsInterface(bytes4 interfaceId) public view override returns (bool) {
-        return
-            interfaceId == type(IDotnsPopResolverOld).interfaceId
-                || super.supportsInterface(interfaceId);
+        return interfaceId == type(IDotnsPopResolverOld).interfaceId
+            || super.supportsInterface(interfaceId);
     }
 
     /// @notice Internal check enforcing PoP-controller-only access.
diff --git a/contracts/utils/SubnodeUtilsOld.sol b/contracts/utils/SubnodeUtilsOld.sol
index 73a9a9394..f9fd0b62b 100644
--- a/contracts/utils/SubnodeUtilsOld.sol
+++ b/contracts/utils/SubnodeUtilsOld.sol
@@ -59,8 +59,8 @@ library SubnodeUtilsOld {
     /// separator first.
     /// @dev The single place a lite label is turned into a node, shared by the write path and every
     ///      reader of a lite name so the issuer and its readers agree on where a lite name lives.
-    ///      Callers gate on @custom:function StringUtilsOld.isLitePersonLabelMemory beforehand, so the
-    ///      label is known to carry the separator this splits on.
+    ///      Callers gate on @custom:function StringUtilsOld.isLitePersonLabelMemory beforehand, so
+    ///      the label is known to carry the separator this splits on.
     /// @param tldNode The TLD node.
     /// @param liteLabel Lite label, e.g. `alice.01`.
     /// @return subnode Namehash of the stem beneath its numeric container beneath the TLD.

From 69f2bd2294c2c226fa56fa56d0a49fae6caf8f12 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 16:44:11 +0200
Subject: [PATCH 20/22] fix(upgrades): allow partial-step retries and check
 keys before declaring

---
 .github/workflows/push_checking.yml |  2 +-
 docs/PASEO-V100-RUNBOOK.md          | 15 +++++++--
 scripts/deploy/DeclareRelease.s.sol | 29 ++++++++++++++---
 scripts/shell/fork-tests.sh         |  3 +-
 scripts/shell/verify-snapshots.sh   | 50 ++++++++++++++++++++---------
 test/fork/PaseoV100Campaign.t.sol   | 14 ++++++++
 6 files changed, 90 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/push_checking.yml b/.github/workflows/push_checking.yml
index fc53fd5a8..6becb7a18 100644
--- a/.github/workflows/push_checking.yml
+++ b/.github/workflows/push_checking.yml
@@ -210,7 +210,7 @@ jobs:
     needs: detect-fork
     if: github.event.action != 'closed' && needs.detect-fork.outputs.has_fork == 'true'
     # The fork job builds the revive ETH-RPC adapter image and runs the upgrade
-    # suite, so it is kept off the shared test runner and onto the Parity XL runner.
+    # suite in a job of its own, separate from the matrix test runners.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/docs/PASEO-V100-RUNBOOK.md b/docs/PASEO-V100-RUNBOOK.md
index 126176774..0041d96de 100644
--- a/docs/PASEO-V100-RUNBOOK.md
+++ b/docs/PASEO-V100-RUNBOOK.md
@@ -62,7 +62,8 @@ and is triggered by labels on an open review PR into master. One step:
    executes.
 3. Before an upgrade step, the job checks the snapshots of the contracts that step upgrades
    against the chain. Proxies an earlier step upgraded have moved past their snapshots by design,
-   so the check is scoped to the step.
+   so the check is scoped to the step. A contract the step names also passes when it already runs
+   this branch's build, which is what a retry of a step that died part way finds.
 4. The job starts the local ETH-RPC adapter, broadcasts the one script, uploads the broadcast
    record and the manifest as artifacts, comments the outcome on the PR, and removes the label.
 5. Retry by re-adding the label. Manual work between steps (committing the step 4 manifest from
@@ -114,6 +115,14 @@ node scripts/js/release-metadata.mjs verify --network paseo-assethub \
 
 Any key this reports is a real finding.
 
+## The controller is not the release artefact
+
+DotnsPopController on this branch keeps `__gap` at 49, the size the live proxy's layout needs;
+the v1.0.0 tag has 50. The runtime code is the same, but the metadata trailer differs, so the
+deployed controller's `extcodehash` does not match the v1.0.0 release asset. The release verify
+compares declarations with the chain, so it stays clean. Expect the difference when diffing the
+implementation against published bytecode; mask the metadata trailer to compare code.
+
 ## The lens address
 
 A fresh deploy puts the lens at the CREATE3 address for the label `DotnsPopLens`. On Paseo that
@@ -135,7 +144,9 @@ Stop. Every step can be re-run by re-adding its label:
   version.
 - `RedeployPopLens` adopts the lens at its predicted address and skips the key writes the chain
   already holds.
-- `DeclareRelease` writes the version last, so a failure before that leaves `0.8.0` declared.
+- `DeclareRelease` first checks that every key points where the manifest says, so a run with the
+  step 4 manifest not yet committed stops before writing anything. It writes the version last, so
+  a failure before that leaves `0.8.0` declared.
 
 Do not skip ahead to `DeclareRelease` to tidy up. Declaring a release the deployment does not
 fully run is the one state the declarations cannot represent.
diff --git a/scripts/deploy/DeclareRelease.s.sol b/scripts/deploy/DeclareRelease.s.sol
index 1c9bd2815..787dd92d6 100644
--- a/scripts/deploy/DeclareRelease.s.sol
+++ b/scripts/deploy/DeclareRelease.s.sol
@@ -39,6 +39,7 @@ contract DeclareRelease is WireDeployments {
 
         Addresses memory addr = _loadAddresses();
 
+        _requireKeysMatchManifest(addr);
         _wireMissingKeys(owner, addr);
         _declareCodeIdentity(owner, addr);
         _verifyDeployment(addr, owner);
@@ -56,10 +57,10 @@ contract DeclareRelease is WireDeployments {
     ///      consumers bootstrap from the manifest address, so nothing is broken by its absence
     ///      until something tries to declare against it.
     ///
-    ///      Only unset keys are written. A key pointing somewhere unexpected is left exactly as
-    ///      it is, so `_verifyDeployment` still fails on it: that is drift, and repairing it here
-    ///      would make the verification that follows tautological and hide the thing it exists to
-    ///      surface.
+    ///      Only unset keys are written. A key pointing somewhere unexpected never reaches this
+    ///      function: `_requireKeysMatchManifest` reverts on it first. That is drift, and
+    ///      repairing it here would make the verification that follows tautological and hide the
+    ///      thing it exists to surface.
     /// @param owner Account that owns the registry and broadcasts.
     /// @param addr Deployment addresses read from the manifest.
     function _wireMissingKeys(address owner, Addresses memory addr) internal {
@@ -74,4 +75,24 @@ contract DeclareRelease is WireDeployments {
             console.log("  wired missing key", entries[i].label, entries[i].target);
         }
     }
+
+    /// @notice Reverts unless every key that is set already points where the manifest says.
+    /// @dev `_declareCodeIdentity` hashes the manifest's addresses. A key that moved without the
+    ///      manifest following, such as a lens rewired by `RedeployPopLens` whose manifest was not
+    ///      committed, would otherwise get the outgoing contract's codehash declared before
+    ///      `_verifyDeployment` notices. Unset keys are left to `_wireMissingKeys`.
+    /// @param addr Deployment addresses read from the manifest.
+    function _requireKeysMatchManifest(Addresses memory addr) internal view {
+        IDotnsProtocolRegistry registry = IDotnsProtocolRegistry(addr.protocolRegistry);
+        RegistryEntry[] memory entries = _registryEntries(addr);
+        for (uint256 i; i < entries.length; ++i) {
+            address current = registry.get(entries[i].key);
+            require(
+                current == address(0) || current == entries[i].target,
+                string.concat(
+                    "DeclareRelease: key ", entries[i].label, " points away from the manifest"
+                )
+            );
+        }
+    }
 }
diff --git a/scripts/shell/fork-tests.sh b/scripts/shell/fork-tests.sh
index eef4b01df..d27695afa 100755
--- a/scripts/shell/fork-tests.sh
+++ b/scripts/shell/fork-tests.sh
@@ -39,8 +39,9 @@ if adapter_is_up; then
 else
   echo "fork-tests: starting the eth-rpc adapter (docker compose up --build -d eth-rpc)"
   docker compose up --build -d eth-rpc
-  scripts/shell/wait-for-eth-rpc.sh "$RPC_URL"
 fi
+# Answering `eth_chainId` comes before the block index is usable, so a reused adapter waits too.
+scripts/shell/wait-for-eth-rpc.sh "$RPC_URL"
 
 # The OpenZeppelin upgrade validator reads Foundry build-info, and a stale incremental
 # build trips it with "Found multiple contracts with name ...". Start from a clean
diff --git a/scripts/shell/verify-snapshots.sh b/scripts/shell/verify-snapshots.sh
index 16f213e9e..1fc1285ed 100755
--- a/scripts/shell/verify-snapshots.sh
+++ b/scripts/shell/verify-snapshots.sh
@@ -25,7 +25,9 @@ set -euo pipefail
 #
 # SNAPSHOT_SUBJECTS limits the bytecode comparison to the named contracts. Mid-campaign, every
 # proxy already upgraded has moved past its snapshot by design, so the gate before a step checks
-# only the contracts that step upgrades. Every snapshot is still built.
+# only the contracts that step upgrades. A named contract also passes when it already runs this
+# build's implementation, which is what a step that died part way leaves behind; anything else is
+# still a failure. Every snapshot is still built.
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
@@ -105,7 +107,21 @@ def deployed(name):
     return addr, bytes.fromhex((rpc("eth_getCode", [addr, "latest"]) or "0x")[2:])
 
 
-failures, checked, skipped = [], 0, []
+def matches(art, live):
+    """Whether `live` is the artefact's runtime code, immutables and metadata masked."""
+    built = bytearray(bytes.fromhex(art["deployedBytecode"]["object"][2:]))
+    live = bytearray(live)
+    if len(built) != len(live):
+        return False
+    for refs in art["deployedBytecode"].get("immutableReferences", {}).values():
+        for r in refs:
+            start, length = r["start"], r["length"]
+            built[start:start + length] = b"\0" * length
+            live[start:start + length] = b"\0" * length
+    return strip_metadata(built) == strip_metadata(live)
+
+
+failures, checked, skipped, upgraded = [], 0, [], 0
 for path in sys.argv[1:]:
     snapshot = os.path.basename(path)[:-4]          # DotnsRegistryOld
     subject = snapshot[:-3]                          # DotnsRegistry
@@ -126,25 +142,26 @@ for path in sys.argv[1:]:
     art = json.load(open(artefact))
     built = bytearray(bytes.fromhex(art["deployedBytecode"]["object"][2:]))
     impl, live = deployed(subject)
-    live = bytearray(live)
     checked += 1
 
+    if matches(art, live):
+        print(f"  ok  {snapshot} == {subject} at {impl}")
+        continue
+
+    # Scoped to a step: a subject that already runs this build was upgraded by an earlier run of
+    # the same step, which is the state a retry has to start from.
+    current = f"out/{subject}.sol/{subject}.json"
+    if only and os.path.exists(current) and matches(json.load(open(current)), live):
+        print(f"  ok  {subject} at {impl} already runs this build")
+        upgraded += 1
+        continue
+
     if len(built) != len(live):
         failures.append(
             f"{snapshot}: {len(built)} bytes built against {len(live)} deployed at {impl}"
         )
-        continue
-
-    for refs in art["deployedBytecode"].get("immutableReferences", {}).values():
-        for r in refs:
-            start, length = r["start"], r["length"]
-            built[start:start + length] = b"\0" * length
-            live[start:start + length] = b"\0" * length
-
-    if strip_metadata(built) != strip_metadata(live):
-        failures.append(f"{snapshot}: same length but different code from {impl}")
     else:
-        print(f"  ok  {snapshot} == {subject} at {impl}")
+        failures.append(f"{snapshot}: same length but different code from {impl}")
 
 if only - {os.path.basename(p)[:-7] for p in sys.argv[1:]}:
     failures.append(f"SNAPSHOT_SUBJECTS names contracts with no snapshot: {sorted(only - {os.path.basename(p)[:-7] for p in sys.argv[1:]})}")
@@ -164,5 +181,8 @@ if failures:
     )
     sys.exit(1)
 
-print(f"\nverify-snapshots: {checked} snapshot(s) reproduce the deployed bytecode")
+summary = f"{checked - upgraded} snapshot(s) reproduce the deployed bytecode"
+if upgraded:
+    summary += f", {upgraded} contract(s) already run this build"
+print(f"\nverify-snapshots: {summary}")
 PY
diff --git a/test/fork/PaseoV100Campaign.t.sol b/test/fork/PaseoV100Campaign.t.sol
index 879374a27..c72201046 100644
--- a/test/fork/PaseoV100Campaign.t.sol
+++ b/test/fork/PaseoV100Campaign.t.sol
@@ -22,6 +22,7 @@ contract DeclareReleaseHarness is DeclareRelease {
         Addresses memory addr = _loadAddresses();
         addr.popLens = lens;
 
+        _requireKeysMatchManifest(addr);
         _wireMissingKeys(owner, addr);
         _declareCodeIdentity(owner, addr);
         _verifyDeployment(addr, owner);
@@ -75,6 +76,19 @@ contract PaseoV100CampaignForkTest is BasePopFork {
         );
     }
 
+    /// @notice A declaration run against a manifest that still names the outgoing lens stops
+    ///         before it writes a codehash.
+    function test_declaration_refuses_a_stale_manifest() public {
+        address outgoing = _live("DotnsPopLens");
+        new UpgradePopResolverAndControllerHarness()
+            .upgrade(owner, _live("DotnsPopResolver"), _live("DotnsPopController"));
+        new RedeployPopLensHarness().redeploy(owner, address(registry), outgoing, RELEASE_TAG);
+
+        DeclareReleaseHarness declarer = new DeclareReleaseHarness();
+        vm.expectRevert(bytes("DeclareRelease: key popLens points away from the manifest"));
+        declarer.declareWithLens(owner, outgoing, RELEASE_TAG);
+    }
+
     /// @notice After the first two steps alone, the v0.8.0 PoP controller still issues against the
     ///         upgraded registry and rules, so the pause between labels leaves a working network.
     function test_v080_controller_still_issues_after_registry_and_rules() public {

From 2e3dfd1db1614301cf6af30f8c2af00bd6d67973 Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 16:48:36 +0200
Subject: [PATCH 21/22] ci: skip live manifests carried unchanged from master

---
 .github/workflows/release-metadata.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release-metadata.yml b/.github/workflows/release-metadata.yml
index 22a13fd2f..af29be386 100644
--- a/.github/workflows/release-metadata.yml
+++ b/.github/workflows/release-metadata.yml
@@ -65,6 +65,17 @@ jobs:
           IS_DEPLOY_RECORD: ${{ contains(github.event.pull_request.labels.*.name, 'deployment-record') }}
         run: |
           changed=$(git diff --name-only "$BASE_SHA"...HEAD -- 'deployments/*/*.json')
+          # A manifest identical to master's was carried in by merging master into a long-lived
+          # branch, which records nothing new. On a pull request into master it cannot match.
+          edited=""
+          for f in $changed; do
+            if git diff --quiet origin/master HEAD -- "$f" 2>/dev/null; then
+              echo "Carried from master unchanged: $f"
+            else
+              edited="$edited $f"
+            fi
+          done
+          changed="${edited# }"
           if [ -z "$changed" ]; then
             echo "No live network manifest was edited."
             exit 0

From 28b140f418d44c16508a130c0021d4c91ad6565c Mon Sep 17 00:00:00 2001
From: giuseppere <giuseppe.re@parity.io>
Date: Mon, 5 Oct 2026 17:25:48 +0200
Subject: [PATCH 22/22] fix(upgrades): run DeclareRelease through declare

---
 scripts/deploy/DeclareRelease.s.sol  | 13 +++++++++++++
 scripts/deploy/WireDeployments.s.sol |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy/DeclareRelease.s.sol b/scripts/deploy/DeclareRelease.s.sol
index 787dd92d6..6da7e4135 100644
--- a/scripts/deploy/DeclareRelease.s.sol
+++ b/scripts/deploy/DeclareRelease.s.sol
@@ -25,11 +25,24 @@ import {IDotnsProtocolRegistry} from "../../contracts/registry/IDotnsProtocolReg
 ///      read as an older network rather than as a false new one.
 /// @custom:security-contact admin@parity.io
 contract DeclareRelease is WireDeployments {
+    /// @notice Runs @custom:function declare.
+    /// @dev `forge script` and `upgrade.sh` enter through `run`. Without this override that is
+    ///      the inherited wiring stage, which re-sets every key from the manifest and skips the
+    ///      checks `declare` makes before it writes.
+    function run() external override {
+        _declare();
+    }
+
     /// @notice Declares every key's codehash, verifies the deployment, then declares the release.
     /// @dev `DOTNS_RELEASE_TAG` is the bare semver the registry stores, for example `0.8.0`. It is
     ///      read before anything is broadcast, so a run that could not declare its release at the
     ///      end fails before it has written any of the codehashes.
     function declare() external {
+        _declare();
+    }
+
+    /// @notice Body of @custom:function run and @custom:function declare.
+    function _declare() internal {
         address owner = msg.sender;
         vm.label(owner, "OWNER");
 
diff --git a/scripts/deploy/WireDeployments.s.sol b/scripts/deploy/WireDeployments.s.sol
index 5fa054981..e3a976b0d 100644
--- a/scripts/deploy/WireDeployments.s.sol
+++ b/scripts/deploy/WireDeployments.s.sol
@@ -59,7 +59,7 @@ contract WireDeployments is BaseDeployer {
         string label;
     }
 
-    function run() external {
+    function run() external virtual {
         address owner = msg.sender;
         vm.label(owner, "OWNER");