From adae9d50bdb7a7e5263a2778d9eca7ef5eced423 Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Thu, 17 Sep 2026 15:51:23 +0800
Subject: [PATCH 01/10] =?UTF-8?q?fix(deploy):=20follow=20DotNS=20ABI=20gen?=
 =?UTF-8?q?erations=20=E2=80=94=20bump=20bulletin-deploy,=20configure=20th?=
 =?UTF-8?q?e=20availability=20probe?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deploys on paseo-next-v2 failed for every signer with "Contract execution
would revert during startingPrice on POP_RULES".

DotNS ships ABI *generations* redeployed behind the SAME contract addresses,
rolled out per environment rather than per release. Generation v0.5.8-rc1
removed PopRules.startingPrice(); bulletin-deploy 0.15.0 only knows the older
generation and calls it unconditionally. Since the addresses never change,
no version diff of environments.json showed anything.

- bump bulletin-deploy 0.15.0 -> 0.18.4 (probes the live generation at connect)
- availability preflight: resolve the env's DotNS contract map from
  bulletin-deploy's environments.json and pass it, plus environmentId, to
  DotNS.connect(). It previously passed only `rpc`, so DotNS fell back to a
  default map whose POP_RULES has no code here — invisible until 0.16 added
  the generation probe, because the deploy path (runStorageDeploy) already
  passed `env` and resolved correctly.
- config.test.ts: assert upstream ships that contract map, so a catalog
  change fails in CI instead of mid-deploy.

Verified end to end: storage-and-dotns completes (Bulletin chunks uploaded,
DotNS registered) where it previously reverted.

Note: `pnpm typecheck` still reports a pre-existing error at
playground.ts:509 (Option<Address> owner vs contracts@0.10's HexString),
unrelated to this change and tracked separately.
---
 .changeset/fix-dotns-generation-drift.md | 23 +++++++++++
 CLAUDE.md                                | 10 ++++-
 package.json                             |  2 +-
 pnpm-lock.yaml                           | 10 ++---
 pnpm-workspace.yaml                      |  2 +-
 src/config.test.ts                       | 16 ++++++++
 src/utils/deploy/availability.test.ts    | 14 +++++++
 src/utils/deploy/availability.ts         | 52 +++++++++++++++++++++++-
 8 files changed, 119 insertions(+), 10 deletions(-)
 create mode 100644 .changeset/fix-dotns-generation-drift.md

diff --git a/.changeset/fix-dotns-generation-drift.md b/.changeset/fix-dotns-generation-drift.md
new file mode 100644
index 00000000..f16c193d
--- /dev/null
+++ b/.changeset/fix-dotns-generation-drift.md
@@ -0,0 +1,23 @@
+---
+"playground-cli": patch
+---
+
+Fix deploys failing with `Contract execution would revert during startingPrice on POP_RULES`.
+
+The DotNS contracts ship in ABI *generations* that are redeployed behind the same
+contract addresses, and roll out per environment rather than per release. Generation
+`v0.5.8-rc1` removed `PopRules.startingPrice()`, so the pinned `bulletin-deploy@0.15.0`
+— which only knows the older generation and calls that function unconditionally — hit a
+revert on paseo-next-v2 for every deploy, dev mode included. Because the addresses never
+changed, this was invisible to any version diff of `environments.json`.
+
+Bumps `bulletin-deploy` to `0.18.4`, which probes the live generation at connect time and
+supports all three.
+
+Also fixes the domain-availability preflight, which constructed `DotNS` and connected with
+only an RPC URL. Without a contract map it fell back to built-in defaults whose `POP_RULES`
+has no code on this network, so 0.16+'s generation probe failed with "No contract deployed
+at this address". It now resolves the env's contracts from bulletin-deploy's own
+`environments.json` and passes them (plus `environmentId`) to `connect()`, matching what the
+deploy path already did. The divergence guard in `config.test.ts` now asserts that contract
+map exists upstream, so a catalog change fails in CI rather than mid-deploy.
diff --git a/CLAUDE.md b/CLAUDE.md
index 2a531257..89f6d3a6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,9 +27,12 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **`@novasamatech/*` resolves through `@parity/product-sdk-terminal@^0.6.2` (host-papp 0.8.11) — do NOT re-pin to 0.7.x, and do NOT slide back to 0.8.5.** The mobile app's Handshake V2 rewrite accepts ONLY the V2 pairing offer (SCALE discriminant 1); host-papp 0.7.x emits V1 (discriminant 0), which the phone rejects as the generic "Invalid QR code". There is no version-negotiation knob anywhere in the stack — compatibility is purely which host-papp version resolves. host-papp 0.8.6's `HandshakeSuccessV2` is a fixed 258-byte struct requiring `rootEntropySource` (RFC-0007); the matching mobile change merged as Android PR #754 (master `50dfcadb8`, 2026-06-05) and ships in builds v1.0.0-1231+. Phones on builds ≤ 1230 send the 226-byte body, which 0.8.6 cannot decode — pairing against an old phone fails at success-decode, and the remedy is updating the phone app, NOT downgrading host-papp (0.8.5's session key was broken without the local patch we deleted; see the patches bullet). 0.8.6 first moved stored SSO sessions/secrets to new `SsoSessionsV2` / `UserSecretsV2_*` storage keys with NO migration; **host-papp 0.8.7 renamed the session list again `SsoSessionsV2` → `SsoSessionsV3`** and added a required `deviceEncPubKey: Bytes(65)` field on the persisted session, also with no migration and no graceful-degrade (old blobs throw / are ignored at decode), so **every user must re-pair once after the 0.5.0 upgrade** (`playground logout` + `playground login`). `UserSecretsV2_*` is unchanged across 0.8.7. `clearLocalAppStorage()` deletes by `${DAPP_ID}_` prefix, so logout already covers `SsoSessionsV2`, `SsoSessionsV3`, and the orphaned secret blobs. `@parity/product-sdk-terminal@0.3.2` was the historical floor (its codec mirror matched the 0.8.6 `*V2` schemas). We pinned `^0.5.0` (June 2026): 0.5.0 bumps host-papp from `^0.8.6` to `^0.8.7` and updates the internal `createTestSession` codec mirror to the 0.8.7 `SsoSessionsV3` shape; the `./host` subpath we consume and every public signature are unchanged (0.5.0 is additive over 0.4.0's cache-only allowance probe helpers + `AllowanceError` re-export) — the frozen-vector tests (`auth.test.ts`, `signerMode*.test.ts`) pass unchanged across the bump. The statement-store patch is re-pinned to whatever version host-papp pins exactly (0.8.7 then, **0.8.11** now); pnpm fails the install loudly (`ERR_PNPM_UNUSED_PATCH`) if resolution drifts off a patched version (designed tripwire, not a bug). Stable 0.8.7 of the whole `@novasamatech/*` family publishes the same day as its prerelease line, so the `minimumReleaseAge` gate would otherwise pin us to the older `0.8.7-N` prerelease — `pnpm-workspace.yaml::minimumReleaseAgeExclude` opts the 0.8.7 family onto the stable line (drop those entries once the version ages past the window). polkadot-app-deploy's own subtree still pins `@parity/product-sdk-terminal@^0.4.0`, but its host-papp now DEDUPES onto our 0.8.7 (its `^0.8.6` range is satisfied by 0.8.7) — so the whole tree shares one host-papp/statement-store 0.8.7 and the patch covers it all; only `product-sdk-terminal` stays split (0.4.0 for pad, 0.5.0 for us). That dedup means pad's SSO-session probe now looks for `dot-cli_SsoSessionsV3.json` (which `playground login` DOES write) — still fully defused because we pass explicit auth/signers into polkadot-app-deploy in every mode (see the "Dev mode must pass EXPLICIT auth options" invariant). **As of July 2026 (#465) we pin `@parity/product-sdk-terminal@^0.6.2`, which moves the whole `@novasamatech/*` family (host-papp / statement-store / storage-adapter / host-api) to 0.8.11** (terminal 0.6.2 requires `host-papp@^0.8.9`, which resolves to the 0.8.11 line); the statement-store patch is re-pinned to `0.8.11` and `minimumReleaseAgeExclude` lists the 0.8.11 family. The truAPI switch (#464) landed only in `@parity/product-sdk-host` (now `0.14.1`, built on `@parity/truapi` instead of the former `@novasamatech/host-api` in-container transport); `product-sdk-terminal`'s SSO/pairing path STILL rides `@novasamatech/host-papp`, so the family stays in the tree until an upstream terminal moves SSO onto truAPI. `deviceEncPubKey` / re-pair-once semantics carry over unchanged from the 0.8.7 note above (0.8.9→0.8.11 are patch-level on the same session schema).
 - **`@polkadot-api/json-rpc-provider: ^0.2.0` override is load-bearing.** Removing it splits the lockfile across three versions of `json-rpc-provider` (`0.0.1`/`0.0.4`/`0.2.0`) — different PAPI 2.x transitive consumers ask for different versions. Forcing everyone onto `0.2.0` avoids subtle wire-shape divergence and reduces bundle/process memory.
 - **`@parity/dotns-cli` (pinned EXACT `0.8.0`) ships a broken publish manifest** declaring `"@polkadot-api/descriptors": "file:.papi/descriptors"` — a workspace path missing from the tarball. pnpm refuses; we redirect that sub-dep to `stubs/papi-descriptors-stub/` (an empty `{}` export) via the version-agnostic `@parity/dotns-cli>@polkadot-api/descriptors` override, so the stub carries across version bumps. dotns-cli's `dist/cli.js` is a fully-bundled Bun build, so the stub is functionally correct. The break persists through every published 0.6.x, `0.7.2`, AND `0.8.0` (verified: the `0.8.0` manifest still lists the `file:.papi/descriptors` dep — the `prepare` script generates `.papi/descriptors` locally but `files` is `["dist"]`, so the manifest keeps the unresolvable `file:` dep). The CLI consumes dotns-cli ONLY as the bundled `dist/cli.js` binary (auto-run on import under the `dotns` argv, see `src/dotns-cli-dispatch.ts`) — we import no dotns-cli TYPES, so a version bump is a pure binary refresh with no compile surface. Remove the override + stub only once `@parity/dotns-cli` republishes a clean manifest.
-- **`bulletin-deploy` (formerly `@parity/polkadot-app-deploy`) is pinned to an explicit version (`0.15.0`), not `latest`.** A previous `latest` (0.6.8) had a WebSocket-heartbeat bug that tore chunk uploads down mid-flight. The pin avoids ever silently sliding onto a broken `latest`. When bumping, read release notes for changes to `deploy()`, DotNS methods, or the `DeployOptions` we use (`jsMerkle`, `signer`, `signerAddress`, `storageSigner`, `storageSignerAddress`, `mnemonic`, `rpc`, `attributes`). Newer releases now also export environment helpers (`loadEnvironments`, `resolveEndpoints`, etc.); we don't consume them — our env table lives in `src/config.ts::CONFIGS`. Do NOT downgrade below 0.8.3: 0.7.30-rc/0.8.0 changed storage routing to use the injected `signer` (so phone-mode chunk uploads would phone-sign and die with "message too big"), and 0.8.3 is the first release with the `storageSigner` slot-key escape hatch. The `0.8.3 → 0.9.0` bump (June 2026) was a code/API drop-in: index exports unchanged, `deploy()` signature unchanged, `DeployOptions` only additive, console log strings unchanged (so `src/utils/deploy/progress.ts`'s banner/`[N/M]` parser still matches), `storageSigner` routing precedence unchanged. It aligns polkadot-app-deploy onto `@novasamatech/host-papp@0.8.6` / `@parity/product-sdk-terminal@0.3.x` (collapsing the prior split tree onto our root line), and prefix-matches `dot-cli_SsoSessions*` in its SSO-session probe (still defused because we always pass explicit auth/signer/storageSigner). 0.9.0 also ships a `postinstall` (`patch-package || true`) bundling an `@novasamatech/sdk-statement@0.6.0` patch; we DENY that build script (`allowBuilds: polkadot-app-deploy: false` in `pnpm-workspace.yaml`) because our own pnpm patch on that exact package already applies the fix — pnpm 11 will hard-fail every `pnpm <script>` with `ERR_PNPM_IGNORED_BUILDS` if the entry is left undecided. The phone-tap-reduction (`transferToSignedInUser`, now shipped in 0.10.0 stable) is unreachable for us regardless: it activates only on polkadot-app-deploy's own signer-resolution (`resolve`) branch, and we always inject an explicit `signer`/`mnemonic`. The `0.9.0 → 0.10.0` bump (June 2026) was the same class of additive drop-in: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (`transferToSignedInUser`/`transferTo`), console log strings unchanged (progress parser still matches), `storageSigner` routing precedence unchanged; it moves polkadot-app-deploy's own subtree onto `@parity/product-sdk-terminal@^0.4.0` and still ships the denied `patch-package` postinstall. (Since our June 2026 terminal `^0.5.0` bump, pad's `^0.8.6` host-papp range dedupes onto our 0.8.7 — only its `product-sdk-terminal` stays at 0.4.0; see the `@novasamatech/*` bullet above.) The `0.10.0 → 0.11.0` bump (June 2026) is the same additive drop-in class: `src/index.ts` byte-identical (all exports unchanged), `deploy()` signature unchanged, `DeployOptions` only additive (`onPhoneSignaturePlan`/`confirmPhoneReady`, both optional and unused by us), banner/`[N/M]` log strings unchanged (progress parser still matches — the #70 0-based chunk renumber only touched prose lines the parser drops), `storageSigner` routing precedence unchanged (now via the `resolveStorageSigner` helper, precedence `storageSigner > signer > mnemonic > session-slot > pool`), terminal subtree still `^0.4.0` / host-papp override still `0.8.6` (dedup story intact), and still ships the denied `patch-package` postinstall. **0.11.0 FIXES the nonce-collision re-upload bug (paritytech/polkadot-app-deploy#946):** the `storeChunkedContent` nonce-collision loop and the phase-B GRANDPA re-upload loop now call `doReconnect()` on a `ChainHead disjointed`/connection error (commit `f519eed`, gated by `isConnectionError` + `reconnectionsUsed < MAX_RECONNECTIONS`), so a WS halt mid-re-upload now recovers instead of failing the deploy. (The pre-0.11.0 remedy — re-run the deploy, incremental upload skips already-stored chunks — is no longer needed for that failure mode.) The `0.11.0 → 0.13.1` bump (July 2026, part of #465) is the same additive drop-in class: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (verified against every option we pass), `storageSigner` routing precedence unchanged, and pad still ships the denied `patch-package` postinstall (keep `allowBuilds: polkadot-app-deploy: false`). Its terminal subtree stays `^0.4.0` (its own split copy) and it no longer declares a direct `host-papp` dep. **0.13.x DROPS the `summit` environment from the bundled `environments.json`** — this is what forced the summit/w3s retirement (the `config.test.ts` divergence guard fails on any wired `CONFIGS` env missing upstream). ⚠️ The deploy log-string → progress-bar parser (`src/utils/deploy/progress.ts`) was NOT re-verified against 0.13.1's actual banner output (the bundled dist obscures the strings); the parser degrades gracefully (unknown banner → dropped, deploy still functions), so this is a cosmetic-only live-verify item. **The `0.13.1 → 0.15.0` bump (Aug 2026) RENAMED the npm package: `@parity/polkadot-app-deploy` stopped at 0.13.x, versions 0.14+ publish as `bulletin-deploy`** (update imports, the `allowBuilds` denial key, and `minimumReleaseAgeExclude` together when bumping). The bump was validated on `0.15.0-rc.2` and the pin moved to `0.15.0` stable the day upstream cut it — verified code-identical to rc.2 (git tag diff: version bump + an unshipped e2e script fix only; published dist byte-identical after normalizing tsup chunk hashes and the baked version string). Heads-up from that move: pnpm's min-age gate applies `minimumReleaseAgeExclude` when RESOLVING a version, but the lockfile-verification pass failed to honor the exclude for the PRERELEASE entry (`bulletin-deploy@0.15.0-rc.2` kept tripping `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` even while excluded; the stable `0.15.0` entry verifies fine) — if a young prerelease pin ever wedges installs like that again, rewrite the lockfile once with `pnpm install --config.minimumReleaseAge=0`, then confirm a plain `pnpm install` passes. 0.15 is the paseo-next-v2-wipe release: DotNS redeployed at new canonical addresses (owned by its `environments.json`, keyed by env id) and **the DotNS TLD went per-network** — `environments.json` gained a per-env `tld` field ("paseo" on paseo-next-v2; envs without one fall back to upstream `DEFAULT_TLD` "dot"), `deploy()` resolves the authoritative TLD on-chain at preflight (`DotnsProtocolRegistry.tld()`, dotns PR #218), and `parseDomainName(input, tld)` rejects wrong-TLD input. Our side: `ChainConfig.tld` + `getEnvTld()` in `src/config.ts` (divergence-guarded against upstream's catalog; the signing id `PLAYGROUND_PRODUCT_ID = "playground.dot"` is TLD-independent by convention and must NOT change), and `normalizeDomain(domain, tld)` mirrors the wrong-TLD rejection. API surface: `deploy()` signature + `DeployOptions` we pass unchanged (additive: `transferTo`, `contracts`, `bulletinEndpoints`/`assetHubEndpoints`, `publish`, `dumpCar`, …), banner titles (`Preflight`/`Storage`/`DotNS`/`DEPLOYMENT COMPLETE!`) and `[N/M]` chunk lines unchanged — verified against the 0.15 SOURCE this time; #1240 moved the `Domain:` echo to after the Preflight connect (prose the parser drops; test pins it). `storageSigner > signer > mnemonic > pool` routing precedence unchanged. Its subtree moved to `@parity/product-sdk-terminal@^0.5.1` (resolves 0.5.4) whose host-papp `^0.8.x` DEDUPES onto our 0.8.11 — one host-papp/statement-store tree, patches still apply; only `product-sdk-terminal` stays split (0.5.4 pad / 0.7.1 us). Still ships the denied `patch-package` postinstall (bundling the same sdk-statement@0.6.0 patch we carry). 0.15 also drops the `@parity/dotns-cli` subprocess path entirely (no references left), so the `[polkadot-app-deploy] @parity/dotns-cli not found` warning suppression in `src/index.ts` is now a dormant no-op; our own `playground dotns` passthrough keeps the direct dotns-cli dep.
+- **🔴 THE DOTNS CONTRACTS SHIP IN "GENERATIONS" AND A STALE `bulletin-deploy` PIN SILENTLY BREAKS EVERY DEPLOY — this is what `0.15.0` did (found 2026-09-17, fixed by bumping to `0.18.4`).** DotNS is redeployed in ABI generations *behind the same contract addresses*, so a version diff of `environments.json` shows NOTHING while the on-chain ABI has moved underneath you. Generations go live **per environment, not per release**, so the fleet is deliberately mixed (previewnet sat on generation 1 while paseo-next-v2 was already on 3) — bulletin-deploy's own `src/dotns-protocol.ts` warns "never assume a single live generation, and never read a date in a comment as current — probe." The three: `poprules-startingPrice` (4-field registration tuple; deposit gate reads flat `PopRules.startingPrice()`), `v0.5.8-rc1` (6-field tuple adding `maxPrice`/`pricingVersion`; deposit gate reads per-label `PopRules.price(label)`; **`startingPrice()` REMOVED — it now reverts**), and `v0.6.0` (encoding byte-identical to v0.5.8-rc1, but a SEMANTIC change in name classification; signature-identical on every PopRules function, so it can only be told apart by probing `DotnsPopController.isPopIssued(label)` on a different contract). `0.15.0` knows only generation 1, so on paseo-next-v2 every deploy — **dev mode included** — died at `Contract execution would revert during startingPrice on POP_RULES`, which reads like a chain/contract outage and is not. Diagnosis trap to avoid next time: the contract ADDRESS is identical across generations and across bulletin-deploy versions, so comparing addresses proves nothing; and a two-signer control (phone + `--signer dev`) failing identically means "our client is stale", NOT "the environment is down". `0.16+` added the runtime profile probe that handles all three. **When bumping, check the DotNS profile support, not just `deploy()`'s signature** — and prefer staying near tip on this dep, since the old "explicit pin for stability" rationale below is exactly what caused a month of broken deploys.
+- **`bulletin-deploy` (formerly `@parity/polkadot-app-deploy`) is pinned to an explicit version (`0.18.4` as of 2026-09-17; previously `0.15.0` — see the generations note above for why that was harmful), not `latest`.** A previous `latest` (0.6.8) had a WebSocket-heartbeat bug that tore chunk uploads down mid-flight. The pin avoids ever silently sliding onto a broken `latest`. When bumping, read release notes for changes to `deploy()`, DotNS methods, or the `DeployOptions` we use (`jsMerkle`, `signer`, `signerAddress`, `storageSigner`, `storageSignerAddress`, `mnemonic`, `rpc`, `attributes`). Newer releases now also export environment helpers (`loadEnvironments`, `resolveEndpoints`, etc.); we don't consume them — our env table lives in `src/config.ts::CONFIGS`. Do NOT downgrade below 0.8.3: 0.7.30-rc/0.8.0 changed storage routing to use the injected `signer` (so phone-mode chunk uploads would phone-sign and die with "message too big"), and 0.8.3 is the first release with the `storageSigner` slot-key escape hatch. The `0.8.3 → 0.9.0` bump (June 2026) was a code/API drop-in: index exports unchanged, `deploy()` signature unchanged, `DeployOptions` only additive, console log strings unchanged (so `src/utils/deploy/progress.ts`'s banner/`[N/M]` parser still matches), `storageSigner` routing precedence unchanged. It aligns polkadot-app-deploy onto `@novasamatech/host-papp@0.8.6` / `@parity/product-sdk-terminal@0.3.x` (collapsing the prior split tree onto our root line), and prefix-matches `dot-cli_SsoSessions*` in its SSO-session probe (still defused because we always pass explicit auth/signer/storageSigner). 0.9.0 also ships a `postinstall` (`patch-package || true`) bundling an `@novasamatech/sdk-statement@0.6.0` patch; we DENY that build script (`allowBuilds: polkadot-app-deploy: false` in `pnpm-workspace.yaml`) because our own pnpm patch on that exact package already applies the fix — pnpm 11 will hard-fail every `pnpm <script>` with `ERR_PNPM_IGNORED_BUILDS` if the entry is left undecided. The phone-tap-reduction (`transferToSignedInUser`, now shipped in 0.10.0 stable) is unreachable for us regardless: it activates only on polkadot-app-deploy's own signer-resolution (`resolve`) branch, and we always inject an explicit `signer`/`mnemonic`. The `0.9.0 → 0.10.0` bump (June 2026) was the same class of additive drop-in: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (`transferToSignedInUser`/`transferTo`), console log strings unchanged (progress parser still matches), `storageSigner` routing precedence unchanged; it moves polkadot-app-deploy's own subtree onto `@parity/product-sdk-terminal@^0.4.0` and still ships the denied `patch-package` postinstall. (Since our June 2026 terminal `^0.5.0` bump, pad's `^0.8.6` host-papp range dedupes onto our 0.8.7 — only its `product-sdk-terminal` stays at 0.4.0; see the `@novasamatech/*` bullet above.) The `0.10.0 → 0.11.0` bump (June 2026) is the same additive drop-in class: `src/index.ts` byte-identical (all exports unchanged), `deploy()` signature unchanged, `DeployOptions` only additive (`onPhoneSignaturePlan`/`confirmPhoneReady`, both optional and unused by us), banner/`[N/M]` log strings unchanged (progress parser still matches — the #70 0-based chunk renumber only touched prose lines the parser drops), `storageSigner` routing precedence unchanged (now via the `resolveStorageSigner` helper, precedence `storageSigner > signer > mnemonic > session-slot > pool`), terminal subtree still `^0.4.0` / host-papp override still `0.8.6` (dedup story intact), and still ships the denied `patch-package` postinstall. **0.11.0 FIXES the nonce-collision re-upload bug (paritytech/polkadot-app-deploy#946):** the `storeChunkedContent` nonce-collision loop and the phase-B GRANDPA re-upload loop now call `doReconnect()` on a `ChainHead disjointed`/connection error (commit `f519eed`, gated by `isConnectionError` + `reconnectionsUsed < MAX_RECONNECTIONS`), so a WS halt mid-re-upload now recovers instead of failing the deploy. (The pre-0.11.0 remedy — re-run the deploy, incremental upload skips already-stored chunks — is no longer needed for that failure mode.) The `0.11.0 → 0.13.1` bump (July 2026, part of #465) is the same additive drop-in class: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (verified against every option we pass), `storageSigner` routing precedence unchanged, and pad still ships the denied `patch-package` postinstall (keep `allowBuilds: polkadot-app-deploy: false`). Its terminal subtree stays `^0.4.0` (its own split copy) and it no longer declares a direct `host-papp` dep. **0.13.x DROPS the `summit` environment from the bundled `environments.json`** — this is what forced the summit/w3s retirement (the `config.test.ts` divergence guard fails on any wired `CONFIGS` env missing upstream). ⚠️ The deploy log-string → progress-bar parser (`src/utils/deploy/progress.ts`) was NOT re-verified against 0.13.1's actual banner output (the bundled dist obscures the strings); the parser degrades gracefully (unknown banner → dropped, deploy still functions), so this is a cosmetic-only live-verify item. **The `0.13.1 → 0.15.0` bump (Aug 2026) RENAMED the npm package: `@parity/polkadot-app-deploy` stopped at 0.13.x, versions 0.14+ publish as `bulletin-deploy`** (update imports, the `allowBuilds` denial key, and `minimumReleaseAgeExclude` together when bumping). The bump was validated on `0.15.0-rc.2` and the pin moved to `0.15.0` stable the day upstream cut it — verified code-identical to rc.2 (git tag diff: version bump + an unshipped e2e script fix only; published dist byte-identical after normalizing tsup chunk hashes and the baked version string). Heads-up from that move: pnpm's min-age gate applies `minimumReleaseAgeExclude` when RESOLVING a version, but the lockfile-verification pass failed to honor the exclude for the PRERELEASE entry (`bulletin-deploy@0.15.0-rc.2` kept tripping `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` even while excluded; the stable `0.15.0` entry verifies fine) — if a young prerelease pin ever wedges installs like that again, rewrite the lockfile once with `pnpm install --config.minimumReleaseAge=0`, then confirm a plain `pnpm install` passes. 0.15 is the paseo-next-v2-wipe release: DotNS redeployed at new canonical addresses (owned by its `environments.json`, keyed by env id) and **the DotNS TLD went per-network** — `environments.json` gained a per-env `tld` field ("paseo" on paseo-next-v2; envs without one fall back to upstream `DEFAULT_TLD` "dot"), `deploy()` resolves the authoritative TLD on-chain at preflight (`DotnsProtocolRegistry.tld()`, dotns PR #218), and `parseDomainName(input, tld)` rejects wrong-TLD input. Our side: `ChainConfig.tld` + `getEnvTld()` in `src/config.ts` (divergence-guarded against upstream's catalog; the signing id `PLAYGROUND_PRODUCT_ID = "playground.dot"` is TLD-independent by convention and must NOT change), and `normalizeDomain(domain, tld)` mirrors the wrong-TLD rejection. API surface: `deploy()` signature + `DeployOptions` we pass unchanged (additive: `transferTo`, `contracts`, `bulletinEndpoints`/`assetHubEndpoints`, `publish`, `dumpCar`, …), banner titles (`Preflight`/`Storage`/`DotNS`/`DEPLOYMENT COMPLETE!`) and `[N/M]` chunk lines unchanged — verified against the 0.15 SOURCE this time; #1240 moved the `Domain:` echo to after the Preflight connect (prose the parser drops; test pins it). `storageSigner > signer > mnemonic > pool` routing precedence unchanged. Its subtree moved to `@parity/product-sdk-terminal@^0.5.1` (resolves 0.5.4) whose host-papp `^0.8.x` DEDUPES onto our 0.8.11 — one host-papp/statement-store tree, patches still apply; only `product-sdk-terminal` stays split (0.5.4 pad / 0.7.1 us). Still ships the denied `patch-package` postinstall (bundling the same sdk-statement@0.6.0 patch we carry). 0.15 also drops the `@parity/dotns-cli` subprocess path entirely (no references left), so the `[polkadot-app-deploy] @parity/dotns-cli not found` warning suppression in `src/index.ts` is now a dormant no-op; our own `playground dotns` passthrough keeps the direct dotns-cli dep.
 - **`polkadot-api` is `^2.2.1`** and effectively the only 2.x version in the runtime — keeping it a single instance is load-bearing. The lockfile contains `polkadot-api@1.x` only because `@parity/dotns-cli` declares it, and dotns-cli ships as a single fully-bundled `dist/cli.js` with all deps inlined — never resolved at runtime. The root was bumped `^2.1.6 → ^2.2.1` during #465: `cdm-builder@3.2.0`'s newer product-sdk pins pulled a second 2.x copy (`2.2.1`) alongside `2.1.6`, and in `src/commands/contract.ts` the cdm asset-hub client (2.2.1) met our descriptors (2.1.6) as "two different `P` types" (`error TS2345`). Aligning the root to `^2.2.1` collapses the 2.x line to one instance. If a future bump reintroduces a split, re-align the root the same way rather than casting around it.
 
+- **🔴 BROKEN IN THE FIELD (Sept 2026): QR pairing cannot succeed on ANY current phone build, and we cannot fix it from this repo.** `@novasamatech/host-papp@0.9.0` (published 2026-07-29) moved the SSO pairing envelope from **P-256 / AES-GCM to X25519 / ChaCha20-Poly1305**, shrinking the device encryption key from **65 to 32 bytes**. The handshake codec is fixed-width SCALE (`dist/sso/auth/scale/handshakeV2.js`: `PublicKeyCodec = Bytes(65)` at 0.8.x → `Bytes(32)` at 0.9.0+), so there is no graceful degrade — a 32-byte reader starts the metadata `Vec` 33 bytes early, still inside the key, and dies on a garbage enum discriminant. Both shipping mobile apps moved mid-August 2026. We resolve host-papp **0.8.11** (via `product-sdk-terminal@^0.7.1`) and still emit 65 bytes, so `playground login` fails at scan time: iOS logs `PolkadotHandshakeProposal.init():66 - Failed to decode host data: unexpectedDecodedValue` → `missingInput` → "Something went wrong"; Android shows the generic **"invalid QR code"**. Device-verified 2026-09-15 with an A/B pair of QRs identical except the key encoding: 65-byte → rejected, 32-byte → **"Device linked"**. `bulletin-deploy login` (host-papp 0.8.7) fails identically, so this is the shared dependency, not our code. **Do NOT try to fix this by bumping our own deps** — EVERY published `@parity/product-sdk-terminal` (latest `0.8.2`, incl. the `dev` tag) pins `host-papp: ^0.8.9`, whose 0.x caret ceiling is 0.8.12, the last release of the old wire. Upstream is already fixed but UNRELEASED: product-sdk#362 (root cause), PR #364 (**merged** 2026-09-07, pin → exactly `0.10.0`; not 0.10.2, which needs PAPI 3). The release is deliberately held behind #168 / PR #366 (RFC-0022 product-account signing) so pairing-that-works doesn't ship alongside signing that doesn't. ⚠️ **#366 is a breaking change for us, not a drop-in** — see the RFC-0022 note in the accounts section. Existing sessions still sign fine; only NEW pairings break, which is why deploy tooling that uses local keys looks healthy. Unaffected: dev/`--suri` paths (`DEFAULT_MNEMONIC`, `DEV_PUBLISH_ACCOUNT`) never pair, so E2E publish legs are green throughout.
+
 ### Network / env
 
 - **`ACTIVE_TESTNET_ENV` (`src/config.ts`) is THE network switch — flipping it is the entire "change networks" PR.** It feeds both `DEFAULT_ENV` and the legacy `testnet` alias in `resolveLegacyEnv`, so one constant moves the whole CLI. Only `paseo-next-v2` is wired in `CONFIGS` today; other envs throw "not supported" from `getChainConfig()`. (Summit / w3s was retired in July 2026 — see the retirement note below.) The deploy `--env` flag accepts the new ids plus the legacy `testnet|mainnet` aliases. NOTE: the direct-chain layer (`getConnection()`) is hardwired to `getChainConfig()` (DEFAULT_ENV) and the `paseo_*` descriptors — `--env` only reroutes what we hand polkadot-app-deploy's `deploy()`, not our own reads. When adding an env, populate `CONFIGS` (every field, including `cdmEnvName` and `tokenSymbol`) and verify descriptors exist in `@parity/product-sdk-descriptors`. As of `descriptors@0.8.0` the ONLY exported descriptor set is `paseo-*` (the `summit-*` subpaths were dropped upstream), so `src/utils/descriptors.ts` returns the paseo descriptor for EVERY env — direct reads touch common pallets only, so that is safe; restore per-env selection there if another env regains dedicated descriptors. Each env also carries a display-only `tokenSymbol` (paseo-next-v2 → `PAS`); read it via `getTokenSymbol()` (the sole consumer is `formatPas` in `src/utils/account/drip.ts`), so flipping `ACTIVE_TESTNET_ENV` relabels every balance/drip amount automatically. It is NOT validated by the `config.test.ts` divergence guard — environments.json carries no symbol — so set it from the chain's own token, not upstream.
@@ -42,7 +45,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **Bulletin storage chunks must NEVER sign with the phone session signer.** Chunk txs carry up to 2 MiB of callData; the phone path (`session.createTransaction`) forwards the full callData over the statement store, whose host-side request cap is 4 KiB (`DEFAULT_MAX_REQUEST_SIZE = 4096`, unchanged through host-papp 0.8.x; Android's own statement cap grew to 256 KiB in May 2026 but 2 MiB chunks exceed both), so every chunk dies client-side with "Mobile transaction signing rejected: message too big" and the phone never even shows a prompt. Since polkadot-app-deploy 0.8.x, passing `signer` routes STORAGE through it too (not just DotNS), so phone mode must also pass `storageSigner`/`storageSignerAddress` (the local BulletInAllowance slot key, which takes precedence for storage routing only). `src/utils/deploy/signerMode.ts::resolveStorageSignerOptions` is the single place that resolves it; both `runDeploy` and `runDecentralize` thread it into `runStorageDeploy`. polkadot-app-deploy (0.8.3 through 0.13.1) can auto-resolve the same slot key from the shared `dot-cli` allowance cache, but silently falls back to phone-signing the chunks when it misses, so don't rely on it.
 - **Deploy delegates to `polkadot-app-deploy` for everything storage-related** — chunking, retries, pool accounts, nonce fallback, DAG-PB, DotNS commit-reveal. Don't reimplement. The one thing we own is `registry.publish()`. The contract takes an `Option<Address> owner` parameter — when None, it falls back to `env::caller()`; when Some, that H160 is recorded as the app owner regardless of who signed. Phone mode passes None (caller IS the user). Dev mode with an active session passes the session's `productH160` so Alice can sign the tx while the user still appears in MyApps. The `publisher` field on `AppInfo` always stores `env::caller()`, so `is_authorized_to_republish` lets the original signer iterate without rewriting ownership. See `src/utils/deploy/playground.ts` and `src/utils/deploy/signerMode.ts::resolveSignerSetup`.
 - **Do NOT call `polkadot-app-deploy.deploy()` just to store a metadata JSON.** `deploy()` unconditionally runs a DotNS `register()` + `setContenthash()`, and for `domainName: null` invents a `test-domain-<random>` label and registers THAT — the side-trip reverts cryptically. For metadata storage we submit `TransactionStorage.store` directly via PAPI using `calculateCid` from `@parity/product-sdk-bulletin`. The metadata `store` is signed with the product-scoped RFC-0010 Bulletin allowance account cached in `allowance-keys.json` (not Alice, not the product account). Asset Hub `registry.publish` is signed with the user's product account in phone mode, and with a dev signer in dev mode (claimed-owner H160 carries the user identity, per the bullet above). See `src/utils/deploy/playground.ts::publishToPlayground`.
-- **Dev mode must pass EXPLICIT auth options to `polkadot-app-deploy.deploy()` — never `{}`.** Since 0.8.x (the "#411 login UX"), `deploy()` called with no `mnemonic`, no `signer`, and no `suri` probes for a persisted SSO session file (`~/.polkadot-apps/dot-cli_SsoSessions.json` — the same `dot-cli` namespace `playground login` writes, because polkadot-app-deploy reuses `DOT_DAPP_ID = "dot-cli"`; since host-papp 0.8.7 our sessions land in `dot-cli_SsoSessionsV3.json`, and as of the terminal `^0.5.0` bump polkadot-app-deploy's host-papp dedupes onto 0.8.7 too, so its probe now DOES look for `SsoSessionsV3` and CAN find a logged-in user's session — the explicit options below are exactly what keeps this defused, so keep them regardless) and, when found, loads the SSO stack and phone-signs DotNS with the user's session — turning a "0 taps" dev deploy into 3-4 phone approvals for every logged-in user. Independently, an absent `storageSigner` makes it auto-read the user's cached BulletInAllowance slot key and burn their small phone-granted quota on chunk uploads, in every mode including `--suri`. `resolveSignerSetup` therefore pins `mnemonic: DEFAULT_MNEMONIC` for dev mode and `resolveStorageSignerOptions` pins `storageSigner` to the dev bare-root (dev) or the `--suri` key (suri) — the bare-root carries its own Bulletin authorization on paseo-next-v2, and polkadot-app-deploy's committed-signer wrapper falls back to the shared pool if it ever lapses. Tests in `signerMode.test.ts`, `run.test.ts`, and `decentralize/run.test.ts` pin the contract.
+- **Dev mode must pass EXPLICIT auth options to `polkadot-app-deploy.deploy()` — never `{}`.** Since 0.8.x (the "#411 login UX"), `deploy()` called with no `mnemonic`, no `signer`, and no `suri` probes for a persisted SSO session file and, when found, loads the SSO stack and phone-signs DotNS with the user's session. ⚠️ **CORRECTED Sept 2026: bulletin-deploy no longer shares our `dot-cli` storage namespace.** Its `DOT_DAPP_ID` is `"polkadot-app-deploy"` — verified in the PINNED `0.15.0` dist (`grep DOT_DAPP_ID node_modules/bulletin-deploy/dist/*.js`, and no `dot-cli` literal appears anywhere in that dist) and in the 0.18.2 source (`src/auth-config.ts:22`). So its session probe reads `~/.polkadot-apps/polkadot-app-deploy_SsoSessions*.json`, NOT the `dot-cli_*` files `playground login` writes, and it can no longer pick up a logged-in playground user's session. The earlier claim that it "reuses `DOT_DAPP_ID = "dot-cli"`" was true of the older `@parity/polkadot-app-deploy` line and is now stale — do not re-derive defenses from it. Keep passing explicit auth options anyway: the storageSigner half of this invariant (below) is unaffected by the namespace split, and a future rename could flip it back — turning a "0 taps" dev deploy into 3-4 phone approvals for every logged-in user. Independently, an absent `storageSigner` makes it auto-read the user's cached BulletInAllowance slot key and burn their small phone-granted quota on chunk uploads, in every mode including `--suri`. `resolveSignerSetup` therefore pins `mnemonic: DEFAULT_MNEMONIC` for dev mode and `resolveStorageSignerOptions` pins `storageSigner` to the dev bare-root (dev) or the `--suri` key (suri) — the bare-root carries its own Bulletin authorization on paseo-next-v2, and polkadot-app-deploy's committed-signer wrapper falls back to the shared pool if it ever lapses. Tests in `signerMode.test.ts`, `run.test.ts`, and `decentralize/run.test.ts` pin the contract.
 - **The "dev signer" used in dev mode is polkadot-app-deploy's `DEFAULT_MNEMONIC` bare-root account, not Substrate's `//Alice`.** The bare-root SS58 (`5DfhGyQd…`) is what polkadot-app-deploy uses internally for its DEFAULT_MNEMONIC storage + DotNS signing, so the CLI's `createDevPublishSigner` derives from the same `(mnemonic, path="")` pair via `seedToAccount`. Storage, DotNS, and registry publish all sign as one identity. Substrate's `//Alice` (`5Grwva…`) is a DIFFERENT account — `createDevSigner("Alice")` from `@parity/product-sdk-tx` returns that one. Don't mix them; the `signerModeAlice.test.ts` snapshot guards against regression.
 - **Dev-mode re-publish only works on apps that were first published from dev mode.** `is_authorized_to_republish` accepts `caller == owner OR caller == publisher`. In dev mode the publisher is always Alice (`5DfhGyQd…`), so dev-mode re-deploys of a dev-published app succeed. But an app first published from phone mode has `caller == publisher == user H160`; Alice is neither, so a dev-mode re-deploy reverts `Unauthorized`. To iterate on a phone-published app in dev mode the user must unpublish it from phone mode first. Intentional asymmetry: once a user "owns" an app from their phone, a shared dev key can't touch it.
 - **Build a dedicated Bulletin client with `heartbeatTimeout: 300_000` for the metadata upload.** The shared client from `getConnection()` uses `@parity/product-sdk-chain-client`'s default 40 s heartbeat; a single `TransactionStorage.store` round-trip can exceed that and the socket tears down as `WS halt (3)`. We mirror polkadot-app-deploy's 300 s heartbeat with a one-off client that gets destroyed immediately after the upload.
@@ -56,6 +59,9 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 
 - **`session.rootAccountId` is whatever the mobile app published as `rootUserAccountId` in the SSO handshake.** On current mobile builds (`polkadot-app-android-v2`, see `feature/sso/impl/.../RealSsoHandshakeUseCase.kt:34` → `deriveRootAccount() = derivationPath = null`) it's the bare-mnemonic sr25519 root with no junction. The host-papp SDK does not derive it — it just decodes the 32 bytes from `HandshakeResponseSensitiveData.rootUserAccountId` (`triangle-js-sdks/packages/host-papp/src/sso/auth/scale/handshake.ts:23-27`) and forwards them. If a future mobile release changes the path, our display will silently change with it — the source of truth is the phone, not the CLI.
 - **The mobile's "Wallet account address" and "Candidate account address" debug rows are NOT reachable from the host.** They're sr25519 of mnemonic + `//wallet` and mnemonic + `//candidate` respectively (`feature/account/impl/.../RealAccountRepository.kt:166-173`, hard junctions). Hard derivations can't be reproduced from a public key, so the CLI never sees those SS58s. Don't try to surface a "wallet address that matches mobile" — it isn't possible without the mnemonic.
+- **🔴 `PLAYGROUND_PRODUCT_ID = "playground.dot"` COLLIDES with the phone's TLD validation on a paseo-TLD build — RFC-0022 subtree lookup can never succeed for us until Android relaxes it** (root-caused by the Android team on polkadot-android-community#123, 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. Do NOT "fix" this by changing `PLAYGROUND_PRODUCT_ID`: it is the derivation input for every product account, so changing it silently moves every user's address (see the RFC-0022 note below for what that strands). The real fix is Android's — they flag the check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. Track #123 before attempting the #366 bump; the bump cannot work for us without it. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
+- **`AutoSigning` returns `NotAvailable` on current mobile builds** (measured 2026-09-15 via `@dotli/host-cli` against Android build 1026, alongside `BulletInAllowance` → `Allocated` on the same call). RFC-0010 says `AutoSigning` is the one resource that MUST be requested explicitly — but the wallet will not provision it today, and host-rust-core#343 records that the runtime consumes the capability only for `account.sign_vrf` anyway. So the "AutoSigning makes Bulletin chunk signing work under TrUAPI" plan in `docs-internal/2026-09-14-truapi-host-cli-signing.md` is blocked on BOTH a wallet change and #343. Do not assume it is merely a matter of adding the resource to `PLAYGROUND_RESOURCES`.
+- **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **🔴 CORRECTION (2026-09-17): the RFC-0022 address change DOES strand one thing — the builder-identity gate, which blocks EVERY existing builder from deploying.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so every user's competition membership — which is bound to the OLD H160 — stops being found, and they get the "Couldn't verify your builder status" notice on every deploy. Discovered empirically: a spike account derived the RFC-0022 way was gated out immediately. This is NOT specific to a product-id change; it happens on the plain #366 bump. It needs a migration answer (re-reveal flow, or a registry-side remap) BEFORE the bump ships, or deploy breaks for the entire existing user base. The list below was assessed before this was found and is therefore incomplete — treat it as "these specific things are fine", not "nothing is stranded". **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
 - **The playground product account is derived by exactly one function** (`src/utils/sessionSigner.ts::derivePlaygroundProductPublicKey`), called by both `createPlaygroundSessionSigner` (signer construction) and `auth.ts::deriveSessionAddresses` (display triple). The math is `deriveProductAccountPublicKey(rootAccountId, "playground.dot", 0)` from `@parity/product-sdk-keys`. Do NOT call `deriveProductAccountPublicKey` (or any helper that wraps it) on an already-product-derived SS58 — that yields a doubly-derived ghost account. The `productAccountDisplay` / `productAccountAddresses` helpers that used to live in `src/commands/login/identityLine.ts` had exactly this bug and were deleted; resist re-introducing them. A frozen-vector regression test in `src/utils/auth.test.ts` (`deriveSessionAddresses` block) locks the pubkey/H160 the playground-app expects.
 - **`SessionAddresses` triples are computed once in `auth.ts` and threaded through.** `ConnectResult`, `LoginStatus.success`, and `SessionHandle` all carry the `{ rootAddress, productAddress, productH160 }` bundle. `SessionHandle.address` is kept as a back-compat alias for `addresses.productAddress` because `signer.ts::resolveSigner` spreads the handle into `ResolvedSigner` and downstream deploy code (`signerMode.ts`, `playground.ts`, `registry.ts`, `DeployScreen.tsx`) reads `.address` for the signing key. UI code should prefer `addresses` so the root vs product distinction stays explicit.
 
diff --git a/package.json b/package.json
index a7aeae6b..3c37d022 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
         "@polkadot-api/sdk-ink": "^0.7.0",
         "@scure/sr25519": "^2.2.0",
         "@sentry/node": "^9.47.1",
-        "bulletin-deploy": "0.15.0",
+        "bulletin-deploy": "0.18.4",
         "commander": "^12.0.0",
         "ink": "^5.2.1",
         "polkadot-api": "^2.2.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dc44dee3..411d81fe 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -69,8 +69,8 @@ importers:
         specifier: ^9.47.1
         version: 9.47.1
       bulletin-deploy:
-        specifier: 0.15.0
-        version: 0.15.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
+        specifier: 0.18.4
+        version: 0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
       commander:
         specifier: ^12.0.0
         version: 12.1.0
@@ -2337,8 +2337,8 @@ packages:
   buffer@6.0.3:
     resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
 
-  bulletin-deploy@0.15.0:
-    resolution: {integrity: sha512-UFfj2HX+20aWwhulueqfm6uOGmeHf+Ee6+v0Enw/8BzKkEW6j4lbOo8VlpPsDTBc+CAW+/rxNaxtJ2AdrnIPXQ==}
+  bulletin-deploy@0.18.4:
+    resolution: {integrity: sha512-I9bHoAv3ZmGg+JATldYvgKVqi+d76byrrk6dBX9u4OTeF2cFIYB/VOGHtpwrlHJQdMNc2dQaT+tbIZDIqPLmhg==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -8527,7 +8527,7 @@ snapshots:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
-  bulletin-deploy@0.15.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
+  bulletin-deploy@0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
     dependencies:
       '@ipld/car': 5.4.3
       '@ipld/dag-pb': 4.1.5
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index bd0c461b..1abe28b4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -21,7 +21,7 @@ minimumReleaseAgeExclude:
   # 0.15.0 stable published 2026-08-12; it is byte-identical to the validated
   # rc.2 source (rc.3 was test-script-only), so we opt past the min-age window.
   # Drop once it ages out.
-  - "bulletin-deploy@0.15.0"
+  - "bulletin-deploy@0.18.4"
   - "@parity/dotns-cli@0.8.0"
   # The @novasamatech/* 0.8.11 family (pulled transitively by
   # @parity/product-sdk-terminal@^0.6.2 → host-papp@^0.8.9, which resolves to the
diff --git a/src/config.test.ts b/src/config.test.ts
index 5f21887a..ee3e364e 100644
--- a/src/config.test.ts
+++ b/src/config.test.ts
@@ -104,6 +104,22 @@ describe("config ↔ polkadot-app-deploy environments.json (divergence guard)",
                 expect(cfg.bulletinGateway).toBe(`${upstreamEnv(envId)?.ipfs}/ipfs/`);
             });
 
+            // `availability.ts` reads these at RUNTIME and hands them to
+            // `DotNS.connect()`. Without them DotNS falls back to a built-in
+            // default map whose POP_RULES has no code here, and connect()'s
+            // ABI-profile probe fails with "No contract deployed at this
+            // address" — which surfaces to the user as an unexplained deploy
+            // failure. Guard their presence so an upstream catalog change
+            // fails in CI instead. POP_RULES specifically is the one the
+            // profile probe dereferences.
+            it("upstream ships the DotNS contract map the availability probe needs", () => {
+                const contracts = upstreamEnv(envId)?.contracts;
+                expect(contracts, `no contracts map for ${envId}`).toBeDefined();
+                expect(contracts?.POP_RULES, `no POP_RULES for ${envId}`).toMatch(
+                    /^0x[0-9a-fA-F]{40}$/,
+                );
+            });
+
             it("faucet URL matches upstream popSelfServe.faucetUrl", () => {
                 // The `?parachain=<id>` form is load-bearing: `?network=pah`
                 // drips to the PUBLIC Paseo Asset Hub (para 1000), not this
diff --git a/src/utils/deploy/availability.test.ts b/src/utils/deploy/availability.test.ts
index 8639f4d8..a903ae61 100644
--- a/src/utils/deploy/availability.test.ts
+++ b/src/utils/deploy/availability.test.ts
@@ -41,6 +41,20 @@ vi.mock("bulletin-deploy", () => ({
             disconnect,
         };
     }),
+    // `availability.ts` reads the env's DotNS contract map from upstream and
+    // passes it to `connect()` — without it DotNS falls back to a default map
+    // whose POP_RULES has no code on paseo-next-v2. Mirror the real shape so
+    // the connect() assertions below see the same argument production does.
+    loadEnvironments: vi.fn(async () => ({
+        doc: {
+            environments: [
+                {
+                    id: "paseo-next-v2",
+                    contracts: { POP_RULES: "0x747B456bE03aec0b42bd85C51513730FBD45DA31" },
+                },
+            ],
+        },
+    })),
 }));
 
 // A realistic dev SS58 → H160 pair so the tests exercise the real derivation.
diff --git a/src/utils/deploy/availability.ts b/src/utils/deploy/availability.ts
index 14ee9b9a..59f2d279 100644
--- a/src/utils/deploy/availability.ts
+++ b/src/utils/deploy/availability.ts
@@ -50,6 +50,46 @@ async function createDotNS(): Promise<DotNSInstance> {
     return new DotNS();
 }
 
+/**
+ * DotNS contract addresses for `env`, read from bulletin-deploy's own
+ * `environments.json`.
+ *
+ * These addresses are bulletin-deploy's to own (our `config.ts` has never
+ * stored them), and they MUST be passed to `connect()` — without them `DotNS`
+ * falls back to a built-in default map whose `POP_RULES` has no code on
+ * paseo-next-v2, and connect()'s ABI-profile probe then fails with
+ * "No contract deployed at this address".
+ *
+ * That was silent until bulletin-deploy 0.16: before it, `connect()` did not
+ * probe POP_RULES, so this call site got away with passing only `rpc` while
+ * `runStorageDeploy` (which passes `env`) resolved them properly. Two call
+ * sites, two levels of configuration — keep them in sync.
+ *
+ * Returns undefined if the env is absent upstream, so `connect()` keeps its own
+ * defaults rather than being handed an empty map. `config.test.ts`'s divergence
+ * guard is the thing that stops that going unnoticed.
+ */
+async function dotnsContractsFor(
+    env: Env | undefined,
+): Promise<Record<string, string> | undefined> {
+    bulletinDeployPromise ??= import("bulletin-deploy");
+    const { loadEnvironments } = await bulletinDeployPromise;
+    const { doc } = await loadEnvironments();
+    const entries: unknown = Array.isArray(doc)
+        ? doc
+        : ((doc as { environments?: unknown }).environments ?? []);
+    if (!Array.isArray(entries)) return undefined;
+    const wanted = getChainConfig(env).env;
+    const match = entries.find(
+        (e): e is { contracts?: Record<string, string> } =>
+            typeof e === "object" &&
+            e !== null &&
+            ((e as { id?: string }).id ?? (e as { name?: string }).name) === wanted,
+    );
+    const contracts = match?.contracts;
+    return contracts && Object.keys(contracts).length > 0 ? contracts : undefined;
+}
+
 /**
  * What polkadot-app-deploy will submit on-chain, used to render a correct phone-tap
  * count BEFORE the user confirms.
@@ -128,11 +168,21 @@ export async function checkDomainAvailability(
     // Silence is narrowed to the `connect()` call ONLY — `checkOwnership`
     // below runs with normal console semantics so any unexpected log surfaces.
     const dotns = await createDotNS();
+    // Resolved BEFORE silencing: this is a local JSON read, not part of the
+    // connect() call the silence is scoped to, and swallowing its output would
+    // widen the suppression window documented above.
+    const contracts = await dotnsContractsFor(options.env);
     try {
         const restore = silenceConsole();
         try {
             await withTimeout(
-                dotns.connect({ rpc: cfg.assetHubRpc }),
+                dotns.connect({
+                    rpc: cfg.assetHubRpc,
+                    // Both are required for connect()'s ABI-profile probe to
+                    // reach the right contracts — see `dotnsContractsFor`.
+                    contracts,
+                    environmentId: cfg.env,
+                }),
                 options.timeoutMs ?? 30_000,
                 "DotNS connect",
             );

From 725d9c47470e57cd3b81b5443b34631ea236057e Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Thu, 17 Sep 2026 17:38:30 +0800
Subject: [PATCH 02/10] fix(deploy): resolve DotNS connect options via
 resolveEndpoints; address review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to adae9d5, from code review of that commit.

Two regressions introduced there:

- `dotnsContractsFor()` was awaited outside the try/catch, so a
  `loadEnvironments()` failure escaped `checkDomainAvailability` as a throw
  instead of the documented `{status:"unknown"}` — turning decentralize's
  warn-and-continue into a hard abort — and skipped `dotns.disconnect()`.
  Resolved inside the try now, still before `silenceConsole()`.
- The new mock's comment claimed connect() assertions that did not exist;
  the entire fix could be deleted with all 26 tests still green. Added an
  assertion pinning contracts/tld/network/autoAccountMapping/environmentId.

The hand-rolled env lookup is replaced by bulletin-deploy's own
`resolveEndpoints(doc, envId)`, which returns the contract map PLUS the
fields the first attempt omitted — each of which fails silently rather than
loudly:

- `tld`: connect() otherwise resolves it on-chain and falls back to "dot" on
  a revert, so checkOwnership would query `<label>.dot` while we report
  `<label>.paseo`.
- `autoAccountMapping`: omitted, connect() takes the manual-mapping branch,
  which can submit a `map_account` extrinsic from a read-only path.
- `network`: authoritative for isTestnet() instead of spec_name sniffing.

Also:

- memoize the resolution per env (loadEnvironments is uncached upstream and
  findAvailableRandomName calls it up to 20x per run)
- clear withTimeout's timer (pre-existing): left pending it holds the event
  loop open for the full 30s after the work completes
- guard five contract keys, not just POP_RULES — connect() merges over
  built-in defaults, so a missing key silently uses a default address with
  no code on this network. DOTNS_POP_CONTROLLER is dereferenced by the
  profile probe too; the previous comment claiming otherwise was wrong.
- correct three stale docs: the config.test.ts docblock that contradicted
  its own new test, the min-age justification still describing 0.15.0, and
  a CLAUDE.md claim citing evidence from the now-unpinned 0.15.0 dist.

Not addressed: the outer 30s withTimeout is no longer than one inner connect
attempt, so upstream's retries are unreachable and an abandoned race can leak
a WS client. Picking a new budget is a UX judgement call, left open.
---
 CLAUDE.md                             |   2 +-
 pnpm-workspace.yaml                   |  11 ++-
 src/config.test.ts                    |  44 ++++++----
 src/utils/deploy/availability.test.ts |  56 +++++++++---
 src/utils/deploy/availability.ts      | 117 ++++++++++++++++----------
 5 files changed, 154 insertions(+), 76 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 89f6d3a6..4ef4e9ee 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,7 +45,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **Bulletin storage chunks must NEVER sign with the phone session signer.** Chunk txs carry up to 2 MiB of callData; the phone path (`session.createTransaction`) forwards the full callData over the statement store, whose host-side request cap is 4 KiB (`DEFAULT_MAX_REQUEST_SIZE = 4096`, unchanged through host-papp 0.8.x; Android's own statement cap grew to 256 KiB in May 2026 but 2 MiB chunks exceed both), so every chunk dies client-side with "Mobile transaction signing rejected: message too big" and the phone never even shows a prompt. Since polkadot-app-deploy 0.8.x, passing `signer` routes STORAGE through it too (not just DotNS), so phone mode must also pass `storageSigner`/`storageSignerAddress` (the local BulletInAllowance slot key, which takes precedence for storage routing only). `src/utils/deploy/signerMode.ts::resolveStorageSignerOptions` is the single place that resolves it; both `runDeploy` and `runDecentralize` thread it into `runStorageDeploy`. polkadot-app-deploy (0.8.3 through 0.13.1) can auto-resolve the same slot key from the shared `dot-cli` allowance cache, but silently falls back to phone-signing the chunks when it misses, so don't rely on it.
 - **Deploy delegates to `polkadot-app-deploy` for everything storage-related** — chunking, retries, pool accounts, nonce fallback, DAG-PB, DotNS commit-reveal. Don't reimplement. The one thing we own is `registry.publish()`. The contract takes an `Option<Address> owner` parameter — when None, it falls back to `env::caller()`; when Some, that H160 is recorded as the app owner regardless of who signed. Phone mode passes None (caller IS the user). Dev mode with an active session passes the session's `productH160` so Alice can sign the tx while the user still appears in MyApps. The `publisher` field on `AppInfo` always stores `env::caller()`, so `is_authorized_to_republish` lets the original signer iterate without rewriting ownership. See `src/utils/deploy/playground.ts` and `src/utils/deploy/signerMode.ts::resolveSignerSetup`.
 - **Do NOT call `polkadot-app-deploy.deploy()` just to store a metadata JSON.** `deploy()` unconditionally runs a DotNS `register()` + `setContenthash()`, and for `domainName: null` invents a `test-domain-<random>` label and registers THAT — the side-trip reverts cryptically. For metadata storage we submit `TransactionStorage.store` directly via PAPI using `calculateCid` from `@parity/product-sdk-bulletin`. The metadata `store` is signed with the product-scoped RFC-0010 Bulletin allowance account cached in `allowance-keys.json` (not Alice, not the product account). Asset Hub `registry.publish` is signed with the user's product account in phone mode, and with a dev signer in dev mode (claimed-owner H160 carries the user identity, per the bullet above). See `src/utils/deploy/playground.ts::publishToPlayground`.
-- **Dev mode must pass EXPLICIT auth options to `polkadot-app-deploy.deploy()` — never `{}`.** Since 0.8.x (the "#411 login UX"), `deploy()` called with no `mnemonic`, no `signer`, and no `suri` probes for a persisted SSO session file and, when found, loads the SSO stack and phone-signs DotNS with the user's session. ⚠️ **CORRECTED Sept 2026: bulletin-deploy no longer shares our `dot-cli` storage namespace.** Its `DOT_DAPP_ID` is `"polkadot-app-deploy"` — verified in the PINNED `0.15.0` dist (`grep DOT_DAPP_ID node_modules/bulletin-deploy/dist/*.js`, and no `dot-cli` literal appears anywhere in that dist) and in the 0.18.2 source (`src/auth-config.ts:22`). So its session probe reads `~/.polkadot-apps/polkadot-app-deploy_SsoSessions*.json`, NOT the `dot-cli_*` files `playground login` writes, and it can no longer pick up a logged-in playground user's session. The earlier claim that it "reuses `DOT_DAPP_ID = "dot-cli"`" was true of the older `@parity/polkadot-app-deploy` line and is now stale — do not re-derive defenses from it. Keep passing explicit auth options anyway: the storageSigner half of this invariant (below) is unaffected by the namespace split, and a future rename could flip it back — turning a "0 taps" dev deploy into 3-4 phone approvals for every logged-in user. Independently, an absent `storageSigner` makes it auto-read the user's cached BulletInAllowance slot key and burn their small phone-granted quota on chunk uploads, in every mode including `--suri`. `resolveSignerSetup` therefore pins `mnemonic: DEFAULT_MNEMONIC` for dev mode and `resolveStorageSignerOptions` pins `storageSigner` to the dev bare-root (dev) or the `--suri` key (suri) — the bare-root carries its own Bulletin authorization on paseo-next-v2, and polkadot-app-deploy's committed-signer wrapper falls back to the shared pool if it ever lapses. Tests in `signerMode.test.ts`, `run.test.ts`, and `decentralize/run.test.ts` pin the contract.
+- **Dev mode must pass EXPLICIT auth options to `polkadot-app-deploy.deploy()` — never `{}`.** Since 0.8.x (the "#411 login UX"), `deploy()` called with no `mnemonic`, no `signer`, and no `suri` probes for a persisted SSO session file and, when found, loads the SSO stack and phone-signs DotNS with the user's session. ⚠️ **CORRECTED Sept 2026: bulletin-deploy no longer shares our `dot-cli` storage namespace.** Its `DOT_DAPP_ID` is `"polkadot-app-deploy"` — re-verify against whatever is pinned with `grep -r DOT_DAPP_ID node_modules/bulletin-deploy/dist/`; it holds at the pinned `0.18.4` (`dist/auth-config.d.ts`) and in the 0.18.2 source (`src/auth-config.ts:22`), with no `dot-cli` literal anywhere in the dist. So its session probe reads `~/.polkadot-apps/polkadot-app-deploy_SsoSessions*.json`, NOT the `dot-cli_*` files `playground login` writes, and it can no longer pick up a logged-in playground user's session. The earlier claim that it "reuses `DOT_DAPP_ID = "dot-cli"`" was true of the older `@parity/polkadot-app-deploy` line and is now stale — do not re-derive defenses from it. Keep passing explicit auth options anyway: the storageSigner half of this invariant (below) is unaffected by the namespace split, and a future rename could flip it back — turning a "0 taps" dev deploy into 3-4 phone approvals for every logged-in user. Independently, an absent `storageSigner` makes it auto-read the user's cached BulletInAllowance slot key and burn their small phone-granted quota on chunk uploads, in every mode including `--suri`. `resolveSignerSetup` therefore pins `mnemonic: DEFAULT_MNEMONIC` for dev mode and `resolveStorageSignerOptions` pins `storageSigner` to the dev bare-root (dev) or the `--suri` key (suri) — the bare-root carries its own Bulletin authorization on paseo-next-v2, and polkadot-app-deploy's committed-signer wrapper falls back to the shared pool if it ever lapses. Tests in `signerMode.test.ts`, `run.test.ts`, and `decentralize/run.test.ts` pin the contract.
 - **The "dev signer" used in dev mode is polkadot-app-deploy's `DEFAULT_MNEMONIC` bare-root account, not Substrate's `//Alice`.** The bare-root SS58 (`5DfhGyQd…`) is what polkadot-app-deploy uses internally for its DEFAULT_MNEMONIC storage + DotNS signing, so the CLI's `createDevPublishSigner` derives from the same `(mnemonic, path="")` pair via `seedToAccount`. Storage, DotNS, and registry publish all sign as one identity. Substrate's `//Alice` (`5Grwva…`) is a DIFFERENT account — `createDevSigner("Alice")` from `@parity/product-sdk-tx` returns that one. Don't mix them; the `signerModeAlice.test.ts` snapshot guards against regression.
 - **Dev-mode re-publish only works on apps that were first published from dev mode.** `is_authorized_to_republish` accepts `caller == owner OR caller == publisher`. In dev mode the publisher is always Alice (`5DfhGyQd…`), so dev-mode re-deploys of a dev-published app succeed. But an app first published from phone mode has `caller == publisher == user H160`; Alice is neither, so a dev-mode re-deploy reverts `Unauthorized`. To iterate on a phone-published app in dev mode the user must unpublish it from phone mode first. Intentional asymmetry: once a user "owns" an app from their phone, a shared dev key can't touch it.
 - **Build a dedicated Bulletin client with `heartbeatTimeout: 300_000` for the metadata upload.** The shared client from `getConnection()` uses `@parity/product-sdk-chain-client`'s default 40 s heartbeat; a single `TransactionStorage.store` round-trip can exceed that and the socket tears down as `WS halt (3)`. We mirror polkadot-app-deploy's 300 s heartbeat with a one-off client that gets destroyed immediately after the upload.
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1abe28b4..842143db 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -18,9 +18,14 @@ allowBuilds:
   node-datachannel: false
 
 minimumReleaseAgeExclude:
-  # 0.15.0 stable published 2026-08-12; it is byte-identical to the validated
-  # rc.2 source (rc.3 was test-script-only), so we opt past the min-age window.
-  # Drop once it ages out.
+  # 0.18.4: taken to follow the DotNS ABI generations (0.15.0 only knew the
+  # generation that still had PopRules.startingPrice(), so every deploy reverted
+  # — see the generations note in CLAUDE.md). Validated by diffing the published
+  # 0.15.0 and 0.18.4 tarballs: index exports are additive only, every
+  # DeployOptions field we pass still exists, and the deploy banner strings the
+  # progress parser matches are unchanged; then confirmed live — a deploy that
+  # previously reverted at startingPrice now completes storage + DotNS.
+  # Drop once it ages past the min-age window.
   - "bulletin-deploy@0.18.4"
   - "@parity/dotns-cli@0.8.0"
   # The @novasamatech/* 0.8.11 family (pulled transitively by
diff --git a/src/config.test.ts b/src/config.test.ts
index ee3e364e..3630e295 100644
--- a/src/config.test.ts
+++ b/src/config.test.ts
@@ -24,10 +24,16 @@
  * moves an endpoint, or a typo in a hand-added block, fails CI.
  *
  * Scope: this checks the values WE duplicate (endpoints, network, gateway,
- * autoAccountMapping). It does NOT assert the DotNS contract-address map —
- * polkadot-app-deploy owns and resolves that internally by env id, so as long as
- * our `env` string matches a known upstream env, the contracts come from the same
- * source by construction.
+ * autoAccountMapping), AND that upstream still ships the DotNS contract-address
+ * map the availability preflight reads at runtime.
+ *
+ * That second part used to be out of scope, on the assumption that "polkadot-app-deploy
+ * owns and resolves the contracts internally by env id, so they come from the
+ * same source by construction". That was false for `availability.ts`, which
+ * constructed `DotNS` and connected WITHOUT the map — DotNS then merged nothing
+ * over its built-in defaults, whose `POP_RULES` has no code on paseo-next-v2,
+ * and the ABI-profile probe failed with "No contract deployed at this address".
+ * The map is now resolved explicitly, so its presence upstream is ours to guard.
  *
  * It also guards the single-line network switch: the default env's CDM
  * meta-registry address (owned by `@parity/cdm-env`, keyed by `cdmEnvName`) must
@@ -105,19 +111,27 @@ describe("config ↔ polkadot-app-deploy environments.json (divergence guard)",
             });
 
             // `availability.ts` reads these at RUNTIME and hands them to
-            // `DotNS.connect()`. Without them DotNS falls back to a built-in
-            // default map whose POP_RULES has no code here, and connect()'s
-            // ABI-profile probe fails with "No contract deployed at this
-            // address" — which surfaces to the user as an unexplained deploy
-            // failure. Guard their presence so an upstream catalog change
-            // fails in CI instead. POP_RULES specifically is the one the
-            // profile probe dereferences.
-            it("upstream ships the DotNS contract map the availability probe needs", () => {
+            // `DotNS.connect()`. Guard EVERY address the connect path
+            // dereferences, not just one: connect() does
+            // `{ ...DEFAULTS, ...options.contracts }`, so a key missing
+            // upstream silently falls back to a default address with no code on
+            // this network rather than erroring. Each has its own failure mode —
+            // POP_RULES: the pricing/deposit read that reverts outright;
+            // DOTNS_POP_CONTROLLER: the `isPopIssued` discriminator, whose
+            // absence makes the probe silently assume v0.5.8-rc1 label
+            // semantics; DOTNS_PROTOCOL_REGISTRY: the on-chain TLD read;
+            // DOTNS_REGISTRAR/DOTNS_REGISTRY: ownership lookups that would
+            // report the wrong owner.
+            it.each([
+                "POP_RULES",
+                "DOTNS_POP_CONTROLLER",
+                "DOTNS_PROTOCOL_REGISTRY",
+                "DOTNS_REGISTRAR",
+                "DOTNS_REGISTRY",
+            ])("upstream ships a %s address for the availability probe", (key) => {
                 const contracts = upstreamEnv(envId)?.contracts;
                 expect(contracts, `no contracts map for ${envId}`).toBeDefined();
-                expect(contracts?.POP_RULES, `no POP_RULES for ${envId}`).toMatch(
-                    /^0x[0-9a-fA-F]{40}$/,
-                );
+                expect(contracts?.[key], `no ${key} for ${envId}`).toMatch(/^0x[0-9a-fA-F]{40}$/);
             });
 
             it("faucet URL matches upstream popSelfServe.faucetUrl", () => {
diff --git a/src/utils/deploy/availability.test.ts b/src/utils/deploy/availability.test.ts
index a903ae61..85dc6dae 100644
--- a/src/utils/deploy/availability.test.ts
+++ b/src/utils/deploy/availability.test.ts
@@ -14,6 +14,7 @@
 // limitations under the License.
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ACTIVE_TESTNET_ENV, getEnvTld } from "../../config.js";
 
 // Mock polkadot-app-deploy's DotNS class. As of 0.7.6, label classification is
 // done by a top-level `classifyDotnsLabel` that the package doesn't re-export
@@ -41,19 +42,22 @@ vi.mock("bulletin-deploy", () => ({
             disconnect,
         };
     }),
-    // `availability.ts` reads the env's DotNS contract map from upstream and
-    // passes it to `connect()` — without it DotNS falls back to a default map
-    // whose POP_RULES has no code on paseo-next-v2. Mirror the real shape so
-    // the connect() assertions below see the same argument production does.
-    loadEnvironments: vi.fn(async () => ({
-        doc: {
-            environments: [
-                {
-                    id: "paseo-next-v2",
-                    contracts: { POP_RULES: "0x747B456bE03aec0b42bd85C51513730FBD45DA31" },
-                },
-            ],
-        },
+    // `availability.ts` resolves the env's DotNS options through upstream's own
+    // `resolveEndpoints` and passes them to `connect()`. Without them DotNS
+    // falls back to defaults whose POP_RULES has no code on this network. The
+    // doc is opaque to us here — `resolveEndpoints` is what reads it — so the
+    // mock returns the resolved shape directly, keyed by the env id the code
+    // asks for rather than a hardcoded one (so flipping ACTIVE_TESTNET_ENV does
+    // not silently make the resolution return nothing).
+    loadEnvironments: vi.fn(async () => ({ doc: {} })),
+    resolveEndpoints: vi.fn((_doc: unknown, envId: string) => ({
+        envName: envId,
+        network: "testnet",
+        tld: "paseo",
+        autoAccountMapping: true,
+        nativeToEthRatio: 1n,
+        registerStorageDeposit: 0n,
+        contracts: { POP_RULES: "0x747B456bE03aec0b42bd85C51513730FBD45DA31" },
     })),
 }));
 
@@ -86,6 +90,32 @@ beforeEach(() => {
 });
 
 describe("checkDomainAvailability", () => {
+    // Regression guard for the "No contract deployed at this address" outage:
+    // this preflight used to call connect() with only `rpc`, so DotNS fell back
+    // to a built-in default contract map whose POP_RULES has no code on this
+    // network and 0.16+'s ABI-profile probe failed. Without this assertion the
+    // whole fix can be deleted with every other test still green.
+    it("connects with the env-resolved DotNS options, not just an RPC", async () => {
+        await checkDomainAvailability(NO_STATUS_LABEL);
+        expect(connect).toHaveBeenCalledWith(
+            expect.objectContaining({
+                rpc: expect.any(String),
+                environmentId: ACTIVE_TESTNET_ENV,
+                contracts: expect.objectContaining({
+                    POP_RULES: expect.stringMatching(/^0x[0-9a-fA-F]{40}$/),
+                }),
+                // Omitting these silently changes behaviour rather than
+                // erroring: a wrong `tld` makes checkOwnership query a
+                // different domain than we report, and a missing
+                // `autoAccountMapping` takes the manual branch that can submit
+                // a map_account extrinsic from this read-only path.
+                tld: getEnvTld(),
+                autoAccountMapping: true,
+                network: "testnet",
+            }),
+        );
+    });
+
     it("returns 'available' when classification is NoStatus", async () => {
         const result = await checkDomainAvailability(NO_STATUS_LABEL);
         // No ownerSs58Address passed → we can't check user's current PoP, so
diff --git a/src/utils/deploy/availability.ts b/src/utils/deploy/availability.ts
index 59f2d279..383a09d4 100644
--- a/src/utils/deploy/availability.ts
+++ b/src/utils/deploy/availability.ts
@@ -51,43 +51,55 @@ async function createDotNS(): Promise<DotNSInstance> {
 }
 
 /**
- * DotNS contract addresses for `env`, read from bulletin-deploy's own
- * `environments.json`.
+ * Env-derived `DotNS.connect()` options, resolved through bulletin-deploy's own
+ * `resolveEndpoints` so this preflight is configured from the SAME source as
+ * the deploy path.
  *
- * These addresses are bulletin-deploy's to own (our `config.ts` has never
- * stored them), and they MUST be passed to `connect()` — without them `DotNS`
- * falls back to a built-in default map whose `POP_RULES` has no code on
- * paseo-next-v2, and connect()'s ABI-profile probe then fails with
- * "No contract deployed at this address".
+ * All of this is bulletin-deploy's to own (our `config.ts` has never stored
+ * DotNS contract addresses), and it MUST reach `connect()`:
  *
- * That was silent until bulletin-deploy 0.16: before it, `connect()` did not
- * probe POP_RULES, so this call site got away with passing only `rpc` while
- * `runStorageDeploy` (which passes `env`) resolved them properly. Two call
- * sites, two levels of configuration — keep them in sync.
+ *   - `contracts` — without it `DotNS` merges nothing over its built-in default
+ *     map, whose `POP_RULES` has no code on paseo-next-v2, so connect()'s
+ *     ABI-profile probe fails with "No contract deployed at this address".
+ *     `DOTNS_POP_CONTROLLER` matters too: the probe dereferences it for the
+ *     `isPopIssued` discriminator that separates v0.6.0 from v0.5.8-rc1.
+ *   - `tld` — otherwise `connect()` resolves it on-chain and falls back to
+ *     `DEFAULT_TLD` ("dot") on a revert, and `checkOwnership` would then compute
+ *     the token id for `<label>.dot` while we report `<label>.paseo` to the user.
+ *   - `autoAccountMapping` — omitted, `connect()` takes the MANUAL mapping
+ *     branch, which can submit a `map_account` extrinsic from what the comment
+ *     below calls a pure read path.
+ *   - `network` — authoritative for `isTestnet()`; otherwise it sniffs spec_name.
  *
- * Returns undefined if the env is absent upstream, so `connect()` keeps its own
- * defaults rather than being handed an empty map. `config.test.ts`'s divergence
- * guard is the thing that stops that going unnoticed.
+ * Passing only `rpc` (as this call site did until 2026-09) was silent until
+ * bulletin-deploy 0.16 added the generation probe. Resolve the whole option set
+ * from one helper rather than re-adding fields one outage at a time.
+ *
+ * Memoized per env: `loadEnvironments()` is not cached upstream and re-reads +
+ * parses the bundled catalog on every call, and `findAvailableRandomName` calls
+ * this up to 20 times per run.
  */
-async function dotnsContractsFor(
-    env: Env | undefined,
-): Promise<Record<string, string> | undefined> {
-    bulletinDeployPromise ??= import("bulletin-deploy");
-    const { loadEnvironments } = await bulletinDeployPromise;
-    const { doc } = await loadEnvironments();
-    const entries: unknown = Array.isArray(doc)
-        ? doc
-        : ((doc as { environments?: unknown }).environments ?? []);
-    if (!Array.isArray(entries)) return undefined;
-    const wanted = getChainConfig(env).env;
-    const match = entries.find(
-        (e): e is { contracts?: Record<string, string> } =>
-            typeof e === "object" &&
-            e !== null &&
-            ((e as { id?: string }).id ?? (e as { name?: string }).name) === wanted,
-    );
-    const contracts = match?.contracts;
-    return contracts && Object.keys(contracts).length > 0 ? contracts : undefined;
+const dotnsConnectOptionsCache = new Map<string, Promise<Record<string, unknown>>>();
+
+async function dotnsConnectOptionsFor(envId: string): Promise<Record<string, unknown>> {
+    const cached = dotnsConnectOptionsCache.get(envId);
+    if (cached) return cached;
+    const resolved = (async () => {
+        bulletinDeployPromise ??= import("bulletin-deploy");
+        const { loadEnvironments, resolveEndpoints } = await bulletinDeployPromise;
+        const { doc } = await loadEnvironments();
+        const e = resolveEndpoints(doc, envId);
+        return {
+            contracts: e.contracts,
+            tld: e.tld,
+            network: e.network,
+            autoAccountMapping: e.autoAccountMapping,
+            nativeToEthRatio: e.nativeToEthRatio,
+            registerStorageDeposit: e.registerStorageDeposit,
+        };
+    })();
+    dotnsConnectOptionsCache.set(envId, resolved);
+    return resolved;
 }
 
 /**
@@ -168,19 +180,27 @@ export async function checkDomainAvailability(
     // Silence is narrowed to the `connect()` call ONLY — `checkOwnership`
     // below runs with normal console semantics so any unexpected log surfaces.
     const dotns = await createDotNS();
-    // Resolved BEFORE silencing: this is a local JSON read, not part of the
-    // connect() call the silence is scoped to, and swallowing its output would
-    // widen the suppression window documented above.
-    const contracts = await dotnsContractsFor(options.env);
     try {
+        // INSIDE the try: a failure here (e.g. an unreadable
+        // BULLETIN_DEPLOY_ENV_FILE) must surface as `status: "unknown"` like any
+        // other preflight failure — callers such as `decentralize`'s
+        // `resolveDomain` treat that as warn-and-continue — and must still reach
+        // the `finally` that disconnects the DotNS client. Resolved before
+        // `silenceConsole()` so the suppression window stays scoped to
+        // `connect()` as documented above.
+        const envOptions = await dotnsConnectOptionsFor(cfg.env);
         const restore = silenceConsole();
         try {
             await withTimeout(
                 dotns.connect({
                     rpc: cfg.assetHubRpc,
-                    // Both are required for connect()'s ABI-profile probe to
-                    // reach the right contracts — see `dotnsContractsFor`.
-                    contracts,
+                    // The env-derived set — contracts, tld, network,
+                    // autoAccountMapping, … — see `dotnsConnectOptionsFor` for
+                    // why each one matters. `environmentId` is message-only
+                    // upstream (it names the env in error strings); it does NOT
+                    // drive contract resolution, so it is not a substitute for
+                    // `contracts`.
+                    ...envOptions,
                     environmentId: cfg.env,
                 }),
                 options.timeoutMs ?? 30_000,
@@ -318,10 +338,19 @@ export function formatAvailability(result: AvailabilityResult): string {
 }
 
 function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
+    // The timer MUST be cleared once the race settles. Left pending it keeps the
+    // Node event loop alive for the full `ms` after the work is done — the
+    // "`playground <cmd>` hangs after the work is visibly finished" symptom in
+    // CLAUDE.md. `findAvailableRandomName` calls this up to 20× per run, so an
+    // uncleared timer per call is the difference between exiting promptly and
+    // sitting for 30 s.
+    let timer: ReturnType<typeof setTimeout> | undefined;
     return Promise.race([
         promise,
-        new Promise<T>((_, reject) =>
-            setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms),
-        ),
-    ]);
+        new Promise<T>((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+        }),
+    ]).finally(() => {
+        if (timer !== undefined) clearTimeout(timer);
+    });
 }

From d859c74b3bf26d61c1cb4699e3ef13c16c1c3b42 Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Mon, 21 Sep 2026 22:27:12 +0800
Subject: [PATCH 03/10] feat(contracts): migrate to the v2 playground registry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

registry #525 changed `publish` to four arguments
(domain, metadata_uri, visibility, modded_from) and changed the selector,
so the previous seven-argument call reverts against the deployed contract.

The dropped `owner` parameter is the behavioural change worth knowing: the
registry now always records `env::caller()`, so dev mode can no longer
publish under the signed-in user's identity. `claimedOwnerH160` was renamed
`userSessionH160` because it no longer claims anything — it only drives the
deploy summary, which now says plainly that a dev-mode app is owned by the
dev signer and won't show in MyApps. `is_moddable` and `is_dev_signer` are
gone too; moddability lives in the metadata JSON's `repository` field.

Also fixes `playground mod` and `playground init`, which failed with
`App "<domain>" not found in registry` for every app, including ones that
exist. v2 returns `getMetadataUri` as a plain string (empty when absent)
rather than an Option, and the `value.isSome` narrowing at both call sites
read `undefined` every time. Decoding now lives in one helper that treats an
unexpected payload as an error instead of silently reporting "not found" —
the shape drift was invisible to tsc because both call sites were untyped.
---
 .changeset/v2-registry-contracts.md  |   21 +
 CLAUDE.md                            |    7 +-
 cdm.json                             | 1556 +++++++++++++++-----------
 src/commands/deploy/DeployScreen.tsx |    2 +-
 src/commands/deploy/index.ts         |    2 +-
 src/commands/deploy/summary.test.ts  |   21 +-
 src/commands/deploy/summary.ts       |   18 +-
 src/commands/mod/SetupScreen.tsx     |    9 +-
 src/commands/mod/index.ts            |   14 +-
 src/utils/decentralize/run.test.ts   |    6 +-
 src/utils/decentralize/run.ts        |    7 +-
 src/utils/deploy/playground.test.ts  |  111 +-
 src/utils/deploy/playground.ts       |   59 +-
 src/utils/deploy/run.test.ts         |   36 +-
 src/utils/deploy/run.ts              |    3 -
 src/utils/deploy/signerMode.test.ts  |    6 +-
 src/utils/deploy/signerMode.ts       |   45 +-
 src/utils/mod/metadataUri.test.ts    |   70 ++
 src/utils/mod/metadataUri.ts         |   58 +
 src/utils/signer.ts                  |    3 +-
 20 files changed, 1141 insertions(+), 913 deletions(-)
 create mode 100644 .changeset/v2-registry-contracts.md
 create mode 100644 src/utils/mod/metadataUri.test.ts
 create mode 100644 src/utils/mod/metadataUri.ts

diff --git a/.changeset/v2-registry-contracts.md b/.changeset/v2-registry-contracts.md
new file mode 100644
index 00000000..bb2cf482
--- /dev/null
+++ b/.changeset/v2-registry-contracts.md
@@ -0,0 +1,21 @@
+---
+"playground-cli": minor
+---
+
+Move to the v2 playground contracts (registry + identity + verifier).
+
+`registry.publish` now takes four arguments (`domain`, `metadata_uri`,
+`visibility`, `modded_from`) and has a new selector, so this release is
+required to publish at all — the previous seven-argument form reverts against
+the deployed contract. The dropped `owner` parameter changes who owns an app:
+the registry now always records the caller, so a dev-mode deploy is owned by
+the dev signer and will not appear in your MyApps. `playground deploy` says so
+explicitly in its summary instead of implying otherwise.
+
+Also fixes `playground mod` and `playground init`, which failed with
+`App "<domain>" not found in registry` for every app, including ones that
+demonstrably existed. The v2 registry returns `getMetadataUri` as a plain
+string (empty when absent) rather than an `Option`, and the old
+`value.isSome` narrowing read `undefined` every time. Decoding now lives in
+one place and treats an unexpected payload as an error rather than silently
+reporting "not found".
diff --git a/CLAUDE.md b/CLAUDE.md
index 4ef4e9ee..a1cc8c5b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -43,11 +43,12 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 ### Deploy / Bulletin
 
 - **Bulletin storage chunks must NEVER sign with the phone session signer.** Chunk txs carry up to 2 MiB of callData; the phone path (`session.createTransaction`) forwards the full callData over the statement store, whose host-side request cap is 4 KiB (`DEFAULT_MAX_REQUEST_SIZE = 4096`, unchanged through host-papp 0.8.x; Android's own statement cap grew to 256 KiB in May 2026 but 2 MiB chunks exceed both), so every chunk dies client-side with "Mobile transaction signing rejected: message too big" and the phone never even shows a prompt. Since polkadot-app-deploy 0.8.x, passing `signer` routes STORAGE through it too (not just DotNS), so phone mode must also pass `storageSigner`/`storageSignerAddress` (the local BulletInAllowance slot key, which takes precedence for storage routing only). `src/utils/deploy/signerMode.ts::resolveStorageSignerOptions` is the single place that resolves it; both `runDeploy` and `runDecentralize` thread it into `runStorageDeploy`. polkadot-app-deploy (0.8.3 through 0.13.1) can auto-resolve the same slot key from the shared `dot-cli` allowance cache, but silently falls back to phone-signing the chunks when it misses, so don't rely on it.
-- **Deploy delegates to `polkadot-app-deploy` for everything storage-related** — chunking, retries, pool accounts, nonce fallback, DAG-PB, DotNS commit-reveal. Don't reimplement. The one thing we own is `registry.publish()`. The contract takes an `Option<Address> owner` parameter — when None, it falls back to `env::caller()`; when Some, that H160 is recorded as the app owner regardless of who signed. Phone mode passes None (caller IS the user). Dev mode with an active session passes the session's `productH160` so Alice can sign the tx while the user still appears in MyApps. The `publisher` field on `AppInfo` always stores `env::caller()`, so `is_authorized_to_republish` lets the original signer iterate without rewriting ownership. See `src/utils/deploy/playground.ts` and `src/utils/deploy/signerMode.ts::resolveSignerSetup`.
-- **Do NOT call `polkadot-app-deploy.deploy()` just to store a metadata JSON.** `deploy()` unconditionally runs a DotNS `register()` + `setContenthash()`, and for `domainName: null` invents a `test-domain-<random>` label and registers THAT — the side-trip reverts cryptically. For metadata storage we submit `TransactionStorage.store` directly via PAPI using `calculateCid` from `@parity/product-sdk-bulletin`. The metadata `store` is signed with the product-scoped RFC-0010 Bulletin allowance account cached in `allowance-keys.json` (not Alice, not the product account). Asset Hub `registry.publish` is signed with the user's product account in phone mode, and with a dev signer in dev mode (claimed-owner H160 carries the user identity, per the bullet above). See `src/utils/deploy/playground.ts::publishToPlayground`.
+- **Deploy delegates to `polkadot-app-deploy` for everything storage-related** — chunking, retries, pool accounts, nonce fallback, DAG-PB, DotNS commit-reveal. Don't reimplement. The one thing we own is `registry.publish()`. **On the v2 registry that is `publish(domain, metadata_uri, visibility, modded_from)` — four args, and the SELECTOR CHANGED, so an older CLI reverts against the deployed contract.** The `owner` parameter is GONE: the registry always records `env::caller()` as owner, and there is no way to publish on someone else's behalf. That kills the old "dev mode claims the user's identity" trick — a dev-mode deploy is owned by the dev signer and will NOT appear in the user's MyApps, which `src/commands/deploy/summary.ts` now states outright instead of implying otherwise. `is_moddable` and `is_dev_signer` are gone too: moddability is expressed by `metadata.repository` in the off-chain metadata JSON (see the `--moddable` invariant below), not by a contract flag. See `src/utils/deploy/playground.ts` and `src/utils/deploy/signerMode.ts::resolveSignerSetup`.
+- **The v2 registry returns `getMetadataUri` as a PLAIN STRING, not `Option<String>` — an absent app is the EMPTY STRING.** Decoding lives in exactly one place (`src/utils/mod/metadataUri.ts::getAppMetadataUri`); keep it there. The pre-v2 contract did return an Option, and the call sites narrowed with `value.isSome ? value.value : null` — against a plain string that reads `undefined` every time, so `playground mod` and `playground init` reported EVERY app as "not found in registry", including ones that demonstrably existed. Both call sites were typed `any`/unnarrowed, so neither `tsc` nor the tests could see it (same class as the cast seams above — and the reason CI must generate `.cdm/` and typecheck contract call sites). The decoder throws on an unexpected payload rather than degrading to "not found": a silent wrong-shape read is exactly this bug, and a missing app and a changed ABI need different responses. `getApps` is `{total, scanned, entries}` (`AppBrowser.tsx` already handles it) — verify a shape against the chain before trusting an older code path.
+- **Do NOT call `polkadot-app-deploy.deploy()` just to store a metadata JSON.** `deploy()` unconditionally runs a DotNS `register()` + `setContenthash()`, and for `domainName: null` invents a `test-domain-<random>` label and registers THAT — the side-trip reverts cryptically. For metadata storage we submit `TransactionStorage.store` directly via PAPI using `calculateCid` from `@parity/product-sdk-bulletin`. The metadata `store` is signed with the product-scoped RFC-0010 Bulletin allowance account cached in `allowance-keys.json` (not Alice, not the product account). Asset Hub `registry.publish` is signed with the user's product account in phone mode, and with a dev signer in dev mode — and since v2 the signer IS the recorded owner, so dev mode cannot publish under the user's identity (per the bullet above). See `src/utils/deploy/playground.ts::publishToPlayground`.
 - **Dev mode must pass EXPLICIT auth options to `polkadot-app-deploy.deploy()` — never `{}`.** Since 0.8.x (the "#411 login UX"), `deploy()` called with no `mnemonic`, no `signer`, and no `suri` probes for a persisted SSO session file and, when found, loads the SSO stack and phone-signs DotNS with the user's session. ⚠️ **CORRECTED Sept 2026: bulletin-deploy no longer shares our `dot-cli` storage namespace.** Its `DOT_DAPP_ID` is `"polkadot-app-deploy"` — re-verify against whatever is pinned with `grep -r DOT_DAPP_ID node_modules/bulletin-deploy/dist/`; it holds at the pinned `0.18.4` (`dist/auth-config.d.ts`) and in the 0.18.2 source (`src/auth-config.ts:22`), with no `dot-cli` literal anywhere in the dist. So its session probe reads `~/.polkadot-apps/polkadot-app-deploy_SsoSessions*.json`, NOT the `dot-cli_*` files `playground login` writes, and it can no longer pick up a logged-in playground user's session. The earlier claim that it "reuses `DOT_DAPP_ID = "dot-cli"`" was true of the older `@parity/polkadot-app-deploy` line and is now stale — do not re-derive defenses from it. Keep passing explicit auth options anyway: the storageSigner half of this invariant (below) is unaffected by the namespace split, and a future rename could flip it back — turning a "0 taps" dev deploy into 3-4 phone approvals for every logged-in user. Independently, an absent `storageSigner` makes it auto-read the user's cached BulletInAllowance slot key and burn their small phone-granted quota on chunk uploads, in every mode including `--suri`. `resolveSignerSetup` therefore pins `mnemonic: DEFAULT_MNEMONIC` for dev mode and `resolveStorageSignerOptions` pins `storageSigner` to the dev bare-root (dev) or the `--suri` key (suri) — the bare-root carries its own Bulletin authorization on paseo-next-v2, and polkadot-app-deploy's committed-signer wrapper falls back to the shared pool if it ever lapses. Tests in `signerMode.test.ts`, `run.test.ts`, and `decentralize/run.test.ts` pin the contract.
 - **The "dev signer" used in dev mode is polkadot-app-deploy's `DEFAULT_MNEMONIC` bare-root account, not Substrate's `//Alice`.** The bare-root SS58 (`5DfhGyQd…`) is what polkadot-app-deploy uses internally for its DEFAULT_MNEMONIC storage + DotNS signing, so the CLI's `createDevPublishSigner` derives from the same `(mnemonic, path="")` pair via `seedToAccount`. Storage, DotNS, and registry publish all sign as one identity. Substrate's `//Alice` (`5Grwva…`) is a DIFFERENT account — `createDevSigner("Alice")` from `@parity/product-sdk-tx` returns that one. Don't mix them; the `signerModeAlice.test.ts` snapshot guards against regression.
-- **Dev-mode re-publish only works on apps that were first published from dev mode.** `is_authorized_to_republish` accepts `caller == owner OR caller == publisher`. In dev mode the publisher is always Alice (`5DfhGyQd…`), so dev-mode re-deploys of a dev-published app succeed. But an app first published from phone mode has `caller == publisher == user H160`; Alice is neither, so a dev-mode re-deploy reverts `Unauthorized`. To iterate on a phone-published app in dev mode the user must unpublish it from phone mode first. Intentional asymmetry: once a user "owns" an app from their phone, a shared dev key can't touch it.
+- **Dev-mode re-publish only works on apps that were first published from dev mode.** Re-publish authorization accepts `caller == owner OR caller == publisher`. Since v2 dropped the `owner` parameter, BOTH are just `env::caller()` at first publish — so a dev-mode deploy is owned+published by the dev bare-root (`5DfhGyQd…`) and a phone-mode deploy by the user's product H160. A dev-mode re-deploy of a phone-published app is therefore neither, and reverts `Unauthorized`; to iterate on it in dev mode the user must unpublish from phone mode first. Intentional asymmetry: once a user "owns" an app from their phone, a shared dev key can't touch it. Note this now cuts the other way too — an app you dev-deployed can't be claimed by your phone account later, because nothing can rewrite `owner`.
 - **Build a dedicated Bulletin client with `heartbeatTimeout: 300_000` for the metadata upload.** The shared client from `getConnection()` uses `@parity/product-sdk-chain-client`'s default 40 s heartbeat; a single `TransactionStorage.store` round-trip can exceed that and the socket tears down as `WS halt (3)`. We mirror polkadot-app-deploy's 300 s heartbeat with a one-off client that gets destroyed immediately after the upload.
 - **`playground deploy` does NOT pass `jsMerkle: true` today.** polkadot-app-deploy's pure-JS merkleizer produces CARs containing only raw leaves (DAG-PB blocks are silently dropped by `blockstore-core/memory`'s `getAll()` under `rawLeaves: true` + `wrapWithDirectory: true`) → polkadot-desktop parses zero files → sites return 404. We rely on the Kubo binary path until the upstream merkleizer collects all blocks, not just leaves. `playground login` installs `ipfs`. Trade-off: this temporarily breaks the RevX WebContainer story for the main storage upload — flip `jsMerkle: true` back once `merkleizeJS` is fixed.
 - **The mobile app wraps `signRaw` data with `<Bytes>…</Bytes>`** (anti-phishing envelope). On paseo-next-v2 this doesn't matter for tx signing: `@parity/product-sdk-terminal@0.3.x`'s `createSessionSignerForAccount` routes transaction signing through `session.createTransaction` — the wallet builds and signs the full extrinsic from a structured `ProductAccountTransaction`, no `<Bytes>` envelope — so every signed extension declared by the chain (including paseo-next-v2's `AsPgas`) survives end-to-end. Don't reach for `signRaw` to sign extrinsic payloads from anywhere outside the signer; raw-message signing keeps the `Bytes` tag for arbitrary user data. (History: 0.2.1 used `session.signRaw({ data: { tag: "Payload", … } })`; the pre-0.2.1 PJS path failed on v2 with `PJS does not support this signed-extension: AsPgas`.)
diff --git a/cdm.json b/cdm.json
index 97926bbe..bfc1c84d 100644
--- a/cdm.json
+++ b/cdm.json
@@ -1,214 +1,117 @@
 {
-  "registry": "0xa5747e60ae27f93e92019e4021abfc4957050141",
   "dependencies": {
-    "@w3s/playground-registry": "latest"
+    "@w3s/playground-registry": "latest",
+    "@w3s/playground-identity": "latest",
+    "@w3s/playground-open-verifier": "latest"
   },
   "contracts": {
     "@w3s/playground-registry": {
-      "version": 1,
-      "address": "0x49091Eb6dbBf2f95B55243b987ebc15eaaEe711F",
+      "version": 2,
+      "address": "0xF5E4E95c73a8F5Bc603b284D5fa2DE6cc86b7198",
       "abi": [
         {
-          "type": "constructor",
           "inputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "constructor"
         },
         {
-          "type": "function",
-          "name": "spikeVerify",
-          "inputs": [
-            {
-              "name": "signature",
-              "type": "uint8[]"
-            },
-            {
-              "name": "message",
-              "type": "uint8[]"
-            },
-            {
-              "name": "public_key",
-              "type": "bytes32"
-            }
-          ],
+          "inputs": [],
+          "name": "getAppCount",
           "outputs": [
             {
               "name": "",
-              "type": "bool"
+              "type": "uint32"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "publish",
           "inputs": [
             {
-              "name": "domain",
-              "type": "string"
-            },
-            {
-              "name": "metadata_uri",
-              "type": "string"
-            },
-            {
-              "name": "visibility",
-              "type": "uint8"
-            },
-            {
-              "name": "owner",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "isSome",
-                  "type": "bool"
-                },
-                {
-                  "name": "value",
-                  "type": "address"
-                }
-              ]
-            },
+              "name": "index",
+              "type": "uint32"
+            }
+          ],
+          "name": "getDomainAt",
+          "outputs": [
             {
-              "name": "modded_from",
+              "name": "",
               "type": "string"
-            },
-            {
-              "name": "is_moddable",
-              "type": "bool"
-            },
-            {
-              "name": "is_dev_signer",
-              "type": "bool"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "publishDev",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
-            },
-            {
-              "name": "metadata_uri",
-              "type": "string"
-            },
-            {
-              "name": "visibility",
-              "type": "uint8"
-            },
-            {
-              "name": "owner",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "isSome",
-                  "type": "bool"
-                },
-                {
-                  "name": "value",
-                  "type": "address"
-                }
-              ]
-            },
-            {
-              "name": "modded_from",
-              "type": "string"
-            },
-            {
-              "name": "is_moddable",
-              "type": "bool"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
-        },
-        {
-          "type": "function",
-          "name": "unpublish",
-          "inputs": [
+          "name": "getMetadataUri",
+          "outputs": [
             {
-              "name": "domain",
+              "name": "",
               "type": "string"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "star",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
-        },
-        {
-          "type": "function",
-          "name": "getAppCount",
-          "inputs": [],
+          "name": "getOwner",
           "outputs": [
             {
               "name": "",
-              "type": "uint32"
+              "type": "address"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getDomainAt",
           "inputs": [
             {
-              "name": "index",
-              "type": "uint32"
+              "name": "domain",
+              "type": "string"
             }
           ],
+          "name": "getVisibility",
           "outputs": [
             {
               "name": "",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "isSome",
-                  "type": "bool"
-                },
-                {
-                  "name": "value",
-                  "type": "string"
-                }
-              ]
+              "type": "uint8"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getOwnerAppCount",
           "inputs": [
             {
               "name": "owner",
               "type": "address"
             }
           ],
+          "name": "getOwnerAppCount",
           "outputs": [
             {
               "name": "",
               "type": "uint32"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getOwnerDomainAt",
           "inputs": [
             {
               "name": "owner",
@@ -219,233 +122,253 @@
               "type": "uint32"
             }
           ],
+          "name": "getOwnerDomainAt",
           "outputs": [
             {
               "name": "",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "isSome",
-                  "type": "bool"
-                },
-                {
-                  "name": "value",
-                  "type": "string"
-                }
-              ]
+              "type": "string"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getSudo",
           "inputs": [],
+          "name": "getSudo",
           "outputs": [
             {
               "name": "",
               "type": "address"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "addAdmin",
           "inputs": [
             {
-              "name": "admin",
+              "name": "addr",
               "type": "address"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
-        },
-        {
-          "type": "function",
-          "name": "removeAdmin",
-          "inputs": [
+          "name": "isAdmin",
+          "outputs": [
             {
-              "name": "admin",
-              "type": "address"
+              "name": "",
+              "type": "bool"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "isAdmin",
           "inputs": [
             {
-              "name": "addr",
+              "name": "account",
               "type": "address"
             }
           ],
+          "name": "isBlacklisted",
           "outputs": [
             {
               "name": "",
               "type": "bool"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "adminSetDeployAwardCount",
           "inputs": [
             {
               "name": "account",
               "type": "address"
-            },
-            {
-              "name": "count",
-              "type": "uint32"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
-        },
-        {
-          "type": "function",
-          "name": "adminSetAppSocialCounts",
-          "inputs": [
-            {
-              "name": "domain",
-              "type": "string"
-            },
-            {
-              "name": "star_count",
-              "type": "uint32"
-            },
+          "name": "getPoints",
+          "outputs": [
             {
-              "name": "mod_count",
-              "type": "uint32"
+              "name": "",
+              "type": "uint128"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "setBlacklisted",
           "inputs": [
             {
-              "name": "accounts",
-              "type": "address[]"
+              "name": "start",
+              "type": "uint32"
             },
             {
-              "name": "value",
-              "type": "bool"
-            }
-          ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
-        },
-        {
-          "type": "function",
-          "name": "isBlacklisted",
-          "inputs": [
-            {
-              "name": "account",
-              "type": "address"
+              "name": "count",
+              "type": "uint32"
             }
           ],
+          "name": "getApps",
           "outputs": [
             {
+              "components": [
+                {
+                  "name": "total",
+                  "type": "uint32"
+                },
+                {
+                  "name": "scanned",
+                  "type": "uint32"
+                },
+                {
+                  "components": [
+                    {
+                      "name": "index",
+                      "type": "uint32"
+                    },
+                    {
+                      "name": "domain",
+                      "type": "string"
+                    },
+                    {
+                      "name": "metadata_uri",
+                      "type": "string"
+                    },
+                    {
+                      "name": "owner",
+                      "type": "address"
+                    },
+                    {
+                      "name": "visibility",
+                      "type": "uint8"
+                    },
+                    {
+                      "name": "publisher",
+                      "type": "address"
+                    }
+                  ],
+                  "name": "entries",
+                  "type": "tuple[]"
+                }
+              ],
               "name": "",
-              "type": "bool"
+              "type": "tuple"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "setVisibility",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
-            },
+            }
+          ],
+          "name": "getStarCount",
+          "outputs": [
             {
-              "name": "visibility",
-              "type": "uint8"
+              "name": "",
+              "type": "uint32"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getVisibility",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
             }
           ],
+          "name": "getModCount",
           "outputs": [
             {
               "name": "",
-              "type": "uint8"
+              "type": "uint32"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "pin",
-          "inputs": [
+          "inputs": [],
+          "name": "getLineageCount",
+          "outputs": [
             {
-              "name": "domain",
-              "type": "string"
+              "name": "",
+              "type": "uint32"
             }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "unpin",
           "inputs": [
             {
-              "name": "domain",
-              "type": "string"
-            }
+              "name": "start",
+              "type": "uint32"
+            },
+            {
+              "name": "count",
+              "type": "uint32"
+            }
           ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "name": "getLineage",
+          "outputs": [
+            {
+              "components": [
+                {
+                  "name": "child",
+                  "type": "string"
+                },
+                {
+                  "name": "source",
+                  "type": "string"
+                }
+              ],
+              "name": "",
+              "type": "tuple[]"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "isPinned",
           "inputs": [
+            {
+              "name": "voter",
+              "type": "address"
+            },
             {
               "name": "domain",
               "type": "string"
             }
           ],
+          "name": "hasStarred",
           "outputs": [
             {
               "name": "",
               "type": "bool"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getPinnedApps",
-          "inputs": [],
+          "inputs": [
+            {
+              "name": "domains",
+              "type": "string[]"
+            },
+            {
+              "name": "voter",
+              "type": "address"
+            }
+          ],
+          "name": "getAppData",
           "outputs": [
             {
-              "name": "",
-              "type": "tuple[]",
               "components": [
-                {
-                  "name": "index",
-                  "type": "uint32"
-                },
                 {
                   "name": "domain",
                   "type": "string"
@@ -465,137 +388,126 @@
                 {
                   "name": "publisher",
                   "type": "address"
+                },
+                {
+                  "name": "star_count",
+                  "type": "uint32"
+                },
+                {
+                  "name": "mod_count",
+                  "type": "uint32"
+                },
+                {
+                  "name": "has_starred",
+                  "type": "bool"
                 }
-              ]
+              ],
+              "name": "",
+              "type": "tuple[]"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getApps",
           "inputs": [
             {
-              "name": "start",
-              "type": "uint32"
-            },
-            {
-              "name": "count",
-              "type": "uint32"
+              "name": "account",
+              "type": "address"
             }
           ],
+          "name": "getPointBreakdown",
           "outputs": [
             {
-              "name": "",
-              "type": "tuple",
               "components": [
                 {
-                  "name": "total",
-                  "type": "uint32"
+                  "name": "mod_points",
+                  "type": "uint128"
                 },
                 {
-                  "name": "scanned",
-                  "type": "uint32"
+                  "name": "star_points",
+                  "type": "uint128"
                 },
                 {
-                  "name": "entries",
-                  "type": "tuple[]",
-                  "components": [
-                    {
-                      "name": "index",
-                      "type": "uint32"
-                    },
-                    {
-                      "name": "domain",
-                      "type": "string"
-                    },
-                    {
-                      "name": "metadata_uri",
-                      "type": "string"
-                    },
-                    {
-                      "name": "owner",
-                      "type": "address"
-                    },
-                    {
-                      "name": "visibility",
-                      "type": "uint8"
-                    },
-                    {
-                      "name": "publisher",
-                      "type": "address"
-                    }
-                  ]
+                  "name": "total",
+                  "type": "uint128"
                 }
-              ]
+              ],
+              "name": "",
+              "type": "tuple"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getTopStarred",
           "inputs": [
             {
-              "name": "start",
-              "type": "uint32"
-            },
-            {
-              "name": "count",
-              "type": "uint32"
+              "name": "domain",
+              "type": "string"
             }
           ],
+          "name": "isPinned",
           "outputs": [
             {
               "name": "",
-              "type": "tuple",
+              "type": "bool"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "getPinnedApps",
+          "outputs": [
+            {
               "components": [
                 {
-                  "name": "total",
+                  "name": "index",
                   "type": "uint32"
                 },
                 {
-                  "name": "scanned",
-                  "type": "uint32"
+                  "name": "domain",
+                  "type": "string"
                 },
                 {
-                  "name": "entries",
-                  "type": "tuple[]",
-                  "components": [
-                    {
-                      "name": "index",
-                      "type": "uint32"
-                    },
-                    {
-                      "name": "domain",
-                      "type": "string"
-                    },
-                    {
-                      "name": "metadata_uri",
-                      "type": "string"
-                    },
-                    {
-                      "name": "owner",
-                      "type": "address"
-                    },
-                    {
-                      "name": "visibility",
-                      "type": "uint8"
-                    },
-                    {
-                      "name": "publisher",
-                      "type": "address"
-                    }
-                  ]
+                  "name": "metadata_uri",
+                  "type": "string"
+                },
+                {
+                  "name": "owner",
+                  "type": "address"
+                },
+                {
+                  "name": "visibility",
+                  "type": "uint8"
+                },
+                {
+                  "name": "publisher",
+                  "type": "address"
                 }
-              ]
+              ],
+              "name": "",
+              "type": "tuple[]"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "getBuilderCount",
+          "outputs": [
+            {
+              "name": "",
+              "type": "uint32"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getTopModded",
           "inputs": [
             {
               "name": "start",
@@ -606,10 +518,9 @@
               "type": "uint32"
             }
           ],
+          "name": "getBuilders",
           "outputs": [
             {
-              "name": "",
-              "type": "tuple",
               "components": [
                 {
                   "name": "total",
@@ -620,357 +531,240 @@
                   "type": "uint32"
                 },
                 {
-                  "name": "entries",
-                  "type": "tuple[]",
                   "components": [
                     {
-                      "name": "index",
-                      "type": "uint32"
-                    },
-                    {
-                      "name": "domain",
-                      "type": "string"
-                    },
-                    {
-                      "name": "metadata_uri",
-                      "type": "string"
-                    },
-                    {
-                      "name": "owner",
+                      "name": "account",
                       "type": "address"
                     },
                     {
-                      "name": "visibility",
-                      "type": "uint8"
-                    },
-                    {
-                      "name": "publisher",
-                      "type": "address"
+                      "name": "score",
+                      "type": "uint128"
                     }
-                  ]
+                  ],
+                  "name": "entries",
+                  "type": "tuple[]"
                 }
-              ]
+              ],
+              "name": "",
+              "type": "tuple"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getLineageCount",
-          "inputs": [],
-          "outputs": [
+          "inputs": [
             {
-              "name": "",
-              "type": "uint32"
+              "name": "domain",
+              "type": "string"
             }
           ],
-          "stateMutability": "view"
+          "name": "pin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getLineage",
           "inputs": [
             {
-              "name": "start",
-              "type": "uint32"
-            },
-            {
-              "name": "count",
-              "type": "uint32"
-            }
-          ],
-          "outputs": [
-            {
-              "name": "",
-              "type": "tuple[]",
-              "components": [
-                {
-                  "name": "child",
-                  "type": "string"
-                },
-                {
-                  "name": "source",
-                  "type": "string"
-                }
-              ]
+              "name": "domain",
+              "type": "string"
             }
           ],
-          "stateMutability": "view"
+          "name": "unpin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getMetadataUri",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
             }
           ],
-          "outputs": [
-            {
-              "name": "",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "isSome",
-                  "type": "bool"
-                },
-                {
-                  "name": "value",
-                  "type": "string"
-                }
-              ]
-            }
-          ],
-          "stateMutability": "view"
+          "name": "star",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getAppData",
           "inputs": [
             {
-              "name": "domains",
-              "type": "string[]"
+              "name": "domain",
+              "type": "string"
             },
             {
-              "name": "voter",
-              "type": "address"
-            }
-          ],
-          "outputs": [
+              "name": "metadata_uri",
+              "type": "string"
+            },
             {
-              "name": "",
-              "type": "tuple[]",
-              "components": [
-                {
-                  "name": "domain",
-                  "type": "string"
-                },
-                {
-                  "name": "metadata_uri",
-                  "type": "tuple",
-                  "components": [
-                    {
-                      "name": "isSome",
-                      "type": "bool"
-                    },
-                    {
-                      "name": "value",
-                      "type": "string"
-                    }
-                  ]
-                },
-                {
-                  "name": "owner",
-                  "type": "address"
-                },
-                {
-                  "name": "visibility",
-                  "type": "uint8"
-                },
-                {
-                  "name": "publisher",
-                  "type": "address"
-                },
-                {
-                  "name": "star_count",
-                  "type": "uint32"
-                },
-                {
-                  "name": "mod_count",
-                  "type": "uint32"
-                },
-                {
-                  "name": "has_starred",
-                  "type": "bool"
-                }
-              ]
+              "name": "visibility",
+              "type": "uint8"
+            },
+            {
+              "name": "modded_from",
+              "type": "string"
             }
           ],
-          "stateMutability": "view"
+          "name": "publish",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getOwner",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
+            },
+            {
+              "name": "visibility",
+              "type": "uint8"
             }
           ],
-          "outputs": [
+          "name": "setVisibility",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
             {
-              "name": "",
-              "type": "address"
+              "name": "domain",
+              "type": "string"
             }
           ],
-          "stateMutability": "view"
+          "name": "unpublish",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getPoints",
           "inputs": [
             {
-              "name": "account",
+              "name": "admin",
               "type": "address"
             }
           ],
-          "outputs": [
+          "name": "addAdmin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
             {
-              "name": "",
-              "type": "uint128"
+              "name": "admin",
+              "type": "address"
             }
           ],
-          "stateMutability": "view"
+          "name": "removeAdmin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getTopBuilders",
           "inputs": [
             {
-              "name": "start",
-              "type": "uint32"
+              "name": "account",
+              "type": "address"
             },
             {
               "name": "count",
               "type": "uint32"
             }
           ],
-          "outputs": [
-            {
-              "name": "",
-              "type": "tuple[]",
-              "components": [
-                {
-                  "name": "account",
-                  "type": "address"
-                },
-                {
-                  "name": "score",
-                  "type": "uint128"
-                }
-              ]
-            }
-          ],
-          "stateMutability": "view"
+          "name": "adminSetDeployAwardCount",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getModCount",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
-            }
-          ],
-          "outputs": [
+            },
             {
-              "name": "",
+              "name": "star_count",
               "type": "uint32"
-            }
-          ],
-          "stateMutability": "view"
-        },
-        {
-          "type": "function",
-          "name": "getStarCount",
-          "inputs": [
-            {
-              "name": "domain",
-              "type": "string"
-            }
-          ],
-          "outputs": [
+            },
             {
-              "name": "",
+              "name": "mod_count",
               "type": "uint32"
             }
           ],
-          "stateMutability": "view"
+          "name": "adminSetAppSocialCounts",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "hasStarred",
           "inputs": [
             {
-              "name": "voter",
-              "type": "address"
+              "name": "accounts",
+              "type": "address[]"
             },
             {
-              "name": "domain",
-              "type": "string"
-            }
-          ],
-          "outputs": [
-            {
-              "name": "",
+              "name": "value",
               "type": "bool"
             }
           ],
-          "stateMutability": "view"
+          "name": "setBlacklisted",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getPointBreakdown",
           "inputs": [
             {
-              "name": "account",
-              "type": "address"
+              "name": "value",
+              "type": "bool"
             }
           ],
+          "name": "setFrozen",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "isFrozen",
           "outputs": [
             {
               "name": "",
-              "type": "tuple",
-              "components": [
-                {
-                  "name": "launch_points",
-                  "type": "uint128"
-                },
-                {
-                  "name": "mod_points",
-                  "type": "uint128"
-                },
-                {
-                  "name": "star_points",
-                  "type": "uint128"
-                },
-                {
-                  "name": "total",
-                  "type": "uint128"
-                }
-              ]
+              "type": "bool"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "setFrozen",
           "inputs": [
             {
-              "name": "value",
-              "type": "bool"
+              "name": "verifier",
+              "type": "address"
             }
           ],
+          "name": "setVerifier",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "isFrozen",
           "inputs": [],
+          "name": "getVerifier",
           "outputs": [
             {
               "name": "",
-              "type": "bool"
+              "type": "address"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importApp",
           "inputs": [
             {
               "name": "domain",
@@ -991,22 +785,16 @@
             {
               "name": "metadata_uri",
               "type": "string"
-            },
-            {
-              "name": "is_moddable",
-              "type": "bool"
             }
           ],
+          "name": "importApp",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importApps",
           "inputs": [
             {
-              "name": "apps",
-              "type": "tuple[]",
               "components": [
                 {
                   "name": "domain",
@@ -1027,36 +815,32 @@
                 {
                   "name": "metadata_uri",
                   "type": "string"
-                },
-                {
-                  "name": "is_moddable",
-                  "type": "bool"
                 }
-              ]
+              ],
+              "name": "apps",
+              "type": "tuple[]"
             }
           ],
+          "name": "importApps",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importPinned",
           "inputs": [
             {
               "name": "domain",
               "type": "string"
             }
           ],
+          "name": "importPinned",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importLineage",
           "inputs": [
             {
-              "name": "entries",
-              "type": "tuple[]",
               "components": [
                 {
                   "name": "child",
@@ -1066,19 +850,19 @@
                   "name": "source",
                   "type": "string"
                 }
-              ]
+              ],
+              "name": "entries",
+              "type": "tuple[]"
             }
           ],
+          "name": "importLineage",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importPoints",
           "inputs": [
             {
-              "name": "entries",
-              "type": "tuple[]",
               "components": [
                 {
                   "name": "account",
@@ -1088,19 +872,19 @@
                   "name": "total",
                   "type": "uint128"
                 }
-              ]
+              ],
+              "name": "entries",
+              "type": "tuple[]"
             }
           ],
+          "name": "importPoints",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importSocialCounts",
           "inputs": [
             {
-              "name": "entries",
-              "type": "tuple[]",
               "components": [
                 {
                   "name": "domain",
@@ -1114,101 +898,210 @@
                   "name": "mod_count",
                   "type": "uint32"
                 }
-              ]
+              ],
+              "name": "entries",
+              "type": "tuple[]"
             }
           ],
+          "name": "importSocialCounts",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "importIdentities",
-          "inputs": [
-            {
-              "name": "entries",
-              "type": "tuple[]",
-              "components": [
-                {
-                  "name": "account",
-                  "type": "address"
-                },
-                {
-                  "name": "root_pubkey",
-                  "type": "bytes32"
-                }
-              ]
-            }
-          ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "inputs": [],
+          "name": "NotRevealed",
+          "type": "error"
         },
         {
-          "type": "function",
-          "name": "setIdentity",
-          "inputs": [
-            {
-              "name": "root_pubkey",
-              "type": "bytes32"
-            },
-            {
-              "name": "signature",
-              "type": "uint8[]"
-            }
-          ],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "inputs": [],
+          "name": "CannotPinPrivateApp",
+          "type": "error"
         },
         {
-          "type": "function",
-          "name": "claimAnonymousBonus",
           "inputs": [],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "name": "AlreadyPinned",
+          "type": "error"
         },
         {
-          "type": "function",
-          "name": "clearIdentity",
           "inputs": [],
-          "outputs": [],
-          "stateMutability": "nonpayable"
+          "name": "NotPinned",
+          "type": "error"
         },
         {
-          "type": "function",
-          "name": "getRootAccount",
-          "inputs": [
-            {
-              "name": "account",
-              "type": "address"
-            }
-          ],
-          "outputs": [
-            {
-              "name": "",
-              "type": "bytes32"
-            }
-          ],
-          "stateMutability": "view"
+          "inputs": [],
+          "name": "DeployAwardCountTooHigh",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "Unauthorized",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "Frozen",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "InvalidVisibility",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "EmptyMetadataUri",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "InvalidModdedFrom",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "AppNotFound",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "SelfStarForbidden",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "AlreadyStarred",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "InvalidCalldata",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "CalldataTooLarge",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NoSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "UnknownSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NonPayableValueReceived",
+          "type": "error"
+        }
+      ],
+      "metadataCid": "bafk2bzaceaik3v2d427yxjnvd646u67ppes6q3bn7srirucljce2ovlk4wgao"
+    },
+    "@w3s/playground-identity": {
+      "version": 2,
+      "address": "0x5ac7a2F1f0d3f162189bF00Cbd8c4c1aD319057d",
+      "abi": [
+        {
+          "inputs": [],
+          "stateMutability": "nonpayable",
+          "type": "constructor"
+        },
+        {
+          "inputs": [
+            {
+              "name": "root_pubkey",
+              "type": "bytes32"
+            },
+            {
+              "name": "signature",
+              "type": "uint8[]"
+            }
+          ],
+          "name": "setIdentity",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "clearIdentity",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "isVerified",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bool"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "rootOf",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bytes32"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "getRootAccount",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bytes32"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "getRootAccounts",
           "inputs": [
             {
               "name": "accounts",
               "type": "address[]"
             }
           ],
+          "name": "getRootAccounts",
           "outputs": [
             {
               "name": "",
               "type": "bytes32[]"
             }
           ],
-          "stateMutability": "view"
+          "stateMutability": "view",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "adminSetIdentity",
           "inputs": [
             {
               "name": "account",
@@ -1219,30 +1112,325 @@
               "type": "bytes32"
             }
           ],
+          "name": "adminSetIdentity",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
         },
         {
-          "type": "function",
-          "name": "adminClearIdentity",
           "inputs": [
             {
               "name": "account",
               "type": "address"
             }
           ],
+          "name": "adminClearIdentity",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "admin",
+              "type": "address"
+            }
+          ],
+          "name": "addAdmin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "admin",
+              "type": "address"
+            }
+          ],
+          "name": "removeAdmin",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "value",
+              "type": "bool"
+            }
+          ],
+          "name": "setFrozen",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "accounts",
+              "type": "address[]"
+            },
+            {
+              "name": "roots",
+              "type": "bytes32[]"
+            }
+          ],
+          "name": "importIdentities",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "IdentitySigLen",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "IdentityRootZero",
+          "type": "error"
         },
         {
-          "type": "function",
-          "name": "faucet",
           "inputs": [],
+          "name": "IdentitySigInvalid",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "IdentityRootTaken",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "Unauthorized",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "Frozen",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "InvalidCalldata",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "CalldataTooLarge",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NoSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "UnknownSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NonPayableValueReceived",
+          "type": "error"
+        }
+      ],
+      "metadataCid": "bafk2bzacebyvwwyklujqsnsyvajbanxzkxcqebokcfud7aguhp265ckysc2q4"
+    },
+    "@w3s/playground-open-verifier": {
+      "version": 2,
+      "address": "0x904c2BFc3d38F2FA5E755c95CEaA4929F8a23255",
+      "abi": [
+        {
+          "inputs": [],
+          "stateMutability": "nonpayable",
+          "type": "constructor"
+        },
+        {
+          "inputs": [
+            {
+              "name": "_account",
+              "type": "address"
+            }
+          ],
+          "name": "isVerified",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bool"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "rootOf",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bytes32"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "getRootAccount",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bytes32"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "accounts",
+              "type": "address[]"
+            }
+          ],
+          "name": "getRootAccounts",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bytes32[]"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "faucet",
           "outputs": [],
-          "stateMutability": "nonpayable"
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "canClaim",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bool"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "account",
+              "type": "address"
+            }
+          ],
+          "name": "lastClaimAt",
+          "outputs": [
+            {
+              "name": "",
+              "type": "uint32"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [
+            {
+              "name": "value",
+              "type": "bool"
+            }
+          ],
+          "name": "setFrozen",
+          "outputs": [],
+          "stateMutability": "nonpayable",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "getSudo",
+          "outputs": [
+            {
+              "name": "",
+              "type": "address"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "isFrozen",
+          "outputs": [
+            {
+              "name": "",
+              "type": "bool"
+            }
+          ],
+          "stateMutability": "view",
+          "type": "function"
+        },
+        {
+          "inputs": [],
+          "name": "Unauthorized",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "Frozen",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "InvalidCalldata",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "CalldataTooLarge",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NoSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "UnknownSelector",
+          "type": "error"
+        },
+        {
+          "inputs": [],
+          "name": "NonPayableValueReceived",
+          "type": "error"
         }
       ],
-      "metadataCid": "bafk2bzaceciehmxltebki5zxj4p7i476dnbn4yxeuisja76ko4shbjd6op5g2"
+      "metadataCid": "bafk2bzaceasznmzat57hb3igidwwxkhmh7yyvr5ua37yuxb34n7q5dwugjvd6"
     }
-  }
+  },
+  "registry": "0xc1a73a4f93fde65b1cb1680baead248073566cb0"
 }
diff --git a/src/commands/deploy/DeployScreen.tsx b/src/commands/deploy/DeployScreen.tsx
index c3393264..09b68fd6 100644
--- a/src/commands/deploy/DeployScreen.tsx
+++ b/src/commands/deploy/DeployScreen.tsx
@@ -876,7 +876,7 @@ function ConfirmStage({
                 : inputs.mode === "phone" || userSigner?.source === "dev"
                   ? userSigner?.address
                   : undefined,
-        claimedOwnerH160: "claimedOwnerH160" in setup ? setup.claimedOwnerH160 : undefined,
+        userSessionH160: "userSessionH160" in setup ? setup.userSessionH160 : undefined,
     });
 
     useInput((_input, key) => {
diff --git a/src/commands/deploy/index.ts b/src/commands/deploy/index.ts
index 5efcab66..20b5943e 100644
--- a/src/commands/deploy/index.ts
+++ b/src/commands/deploy/index.ts
@@ -582,7 +582,7 @@ async function runHeadless(ctx: {
             (mode === "phone" || ctx.userSigner?.source === "dev"
                 ? ctx.userSigner?.address
                 : undefined),
-        claimedOwnerH160: setup.claimedOwnerH160,
+        userSessionH160: setup.userSessionH160,
     });
     process.stdout.write("\n" + renderSummaryText(view) + "\n");
 
diff --git a/src/commands/deploy/summary.test.ts b/src/commands/deploy/summary.test.ts
index a4226fd9..5042e7e0 100644
--- a/src/commands/deploy/summary.test.ts
+++ b/src/commands/deploy/summary.test.ts
@@ -65,16 +65,17 @@ describe("buildSummaryView", () => {
         });
         expect(view.totalApprovals).toBe(0);
         expect(view.approvalLines).toEqual([]);
-        // Without claimedOwnerH160, no "App owner" row is added.
+        // Without userSessionH160, no "App owner" row is added.
         expect(view.rows.find((r) => r.label === "App owner")).toBeUndefined();
     });
 
-    it("dev mode with playground surfaces the claimed owner row when a session H160 is set", () => {
-        // Headline scenario: user did `dot login`, chose dev signer mode.
-        // The summary must tell them which H160 will be recorded as the
-        // app owner so they can trust that MyApps will resolve their app
-        // — without this row, the user sees "0 phone taps" and a blank
-        // owner with no way to verify their identity will land on chain.
+    it("dev mode with playground warns that the DEV signer owns the app, not the user", () => {
+        // Registry #525 removed `publish`'s owner argument, so a dev-mode
+        // deploy records the DEV signer as owner — the user's app will not
+        // appear in their MyApps. This row previously promised the opposite
+        // ("your account (0x…)"), which is false against the deployed v2
+        // registry. It must warn, and must NOT echo the user's H160 as if it
+        // were going on chain.
         const view = buildSummaryView({
             mode: "dev",
             domain: "my-app.dot",
@@ -82,11 +83,13 @@ describe("buildSummaryView", () => {
             skipBuild: false,
             publishToPlayground: true,
             approvals: [],
-            claimedOwnerH160: "0xbeefbeefbeefbeefbeefbeefbeefbeefbeefbeef",
+            userSessionH160: "0xbeefbeefbeefbeefbeefbeefbeefbeefbeefbeef",
         });
         expect(view.totalApprovals).toBe(0);
         const ownerRow = view.rows.find((r) => r.label === "App owner");
-        expect(ownerRow?.value).toContain("0xbeefbeef");
+        expect(ownerRow?.value).toContain("not your account");
+        // The user's H160 must not be presented as the recorded owner.
+        expect(ownerRow?.value).not.toContain("0xbeefbeef");
     });
 
     it("shows the chosen tag in the Tag row when publishing to playground", () => {
diff --git a/src/commands/deploy/summary.ts b/src/commands/deploy/summary.ts
index d71cb954..c87b375b 100644
--- a/src/commands/deploy/summary.ts
+++ b/src/commands/deploy/summary.ts
@@ -48,7 +48,7 @@ export interface SummaryInputs {
      * user's session H160. When present, the summary surfaces it so the
      * user knows the app will still appear in their MyApps view.
      */
-    claimedOwnerH160?: string | null;
+    userSessionH160?: string | null;
 }
 
 export interface SummaryView {
@@ -98,15 +98,17 @@ export function buildSummaryView(input: SummaryInputs): SummaryView {
             value: input.moddable ? `yes — ${input.repositoryUrl}` : "no",
         });
         rows.push({ label: "Tag", value: input.tag ? input.tag : "none" });
-        if (input.claimedOwnerH160) {
-            // Dev mode + session: Alice signs the registry tx but the
-            // user's H160 is recorded as owner. Surfacing it here is
-            // what the spec promises: "Signing as Alice (dev). Your
-            // account will be recorded as the app owner so the app
-            // shows in MyApps."
+        // Registry #525 dropped `publish`'s owner argument: the CALLER is
+        // always recorded as owner, and no path can name another account. In
+        // dev mode that is the shared dev signer, NOT the logged-in user — so
+        // the app will not appear in their MyApps. This row used to promise the
+        // opposite ("your account (0x…)"), which is now false on-chain; verified
+        // against the deployed v2 registry, where a dev-mode publish recorded
+        // the dev H160. Say who will actually own it instead of hiding it.
+        if (input.mode === "dev" && input.userSessionH160) {
             rows.push({
                 label: "App owner",
-                value: `your account (${input.claimedOwnerH160})`,
+                value: "the dev signer — not your account (won't show in MyApps)",
             });
         }
     }
diff --git a/src/commands/mod/SetupScreen.tsx b/src/commands/mod/SetupScreen.tsx
index 0738595c..32dffa96 100644
--- a/src/commands/mod/SetupScreen.tsx
+++ b/src/commands/mod/SetupScreen.tsx
@@ -40,6 +40,7 @@ import { Select } from "../../utils/ui/theme/Select.js";
 import { VERSION_LABEL } from "../../utils/version.js";
 import { getEnvTld, getNetworkLabel } from "../../config.js";
 import { fetchBulletinJson, getBulletinGateway } from "../../utils/bulletinGateway.js";
+import { getAppMetadataUri } from "../../utils/mod/metadataUri.js";
 
 interface AppMetadata {
     name?: string;
@@ -94,13 +95,7 @@ export function SetupScreen({ domain, metadata: initial, registry, targetDir, on
                     return;
                 }
                 log(`querying registry for ${domain}...`);
-                const metaRes = await registry.getMetadataUri.query(domain);
-                if (!metaRes.success) {
-                    throw new Error(
-                        `Registry lookup for "${domain}" failed at dry-run (chain rejected the call).`,
-                    );
-                }
-                const cid = metaRes.value.isSome ? metaRes.value.value : null;
+                const cid = await getAppMetadataUri(registry, domain);
                 if (!cid) throw new Error(`App "${domain}" not found in registry`);
 
                 log(`fetching metadata from IPFS (${cid.slice(0, 16)}...)...`);
diff --git a/src/commands/mod/index.ts b/src/commands/mod/index.ts
index 9003f8d0..011cb874 100644
--- a/src/commands/mod/index.ts
+++ b/src/commands/mod/index.ts
@@ -30,6 +30,7 @@ import { QuestPicker } from "./QuestPicker.js";
 import { defaultRepoName } from "../../utils/git/repoName.js";
 import { runCliCommand } from "../../cli-runtime.js";
 import { parseGitHubRepoUrl, type GitHubRepoRef } from "../../utils/mod/source.js";
+import { getAppMetadataUri, type MetadataUriReader } from "../../utils/mod/metadataUri.js";
 import { fetchBulletinJson, getBulletinGateway } from "../../utils/bulletinGateway.js";
 import { editWithAgentStep } from "./nextSteps.js";
 import { shouldShowTutorialPrompt } from "./tutorialPromptHint.js";
@@ -227,14 +228,11 @@ async function resolveTargetDir(args: { domain: string }): Promise<string | null
     return fallback;
 }
 
-async function fetchAppMetadata(registry: any, domain: string): Promise<FetchedAppMetadata> {
-    const metaRes = await registry.getMetadataUri.query(domain);
-    if (!metaRes.success) {
-        throw new Error(
-            `Registry lookup for "${domain}" failed at dry-run (chain rejected the call)`,
-        );
-    }
-    const cid = metaRes.value.isSome ? metaRes.value.value : null;
+async function fetchAppMetadata(
+    registry: MetadataUriReader,
+    domain: string,
+): Promise<FetchedAppMetadata> {
+    const cid = await getAppMetadataUri(registry, domain);
     if (!cid) throw new Error(`App "${domain}" not found in registry`);
     return await fetchBulletinJson<FetchedAppMetadata>(cid, getBulletinGateway());
 }
diff --git a/src/utils/decentralize/run.test.ts b/src/utils/decentralize/run.test.ts
index cfbf0dff..cc6cb2f6 100644
--- a/src/utils/decentralize/run.test.ts
+++ b/src/utils/decentralize/run.test.ts
@@ -231,7 +231,6 @@ describe("runDecentralize — playground publish metadata", () => {
 
     type PublishArg = {
         repositoryUrl: string | null;
-        isModdable?: boolean;
         cwd?: string;
     };
 
@@ -250,7 +249,6 @@ describe("runDecentralize — playground publish metadata", () => {
         expect(publishToPlaygroundMock).toHaveBeenCalledTimes(1);
         const arg = publishToPlaygroundMock.mock.calls[0][0] as PublishArg;
         expect(arg.repositoryUrl).toBe("https://github.com/acme/site");
-        expect(arg.isModdable).toBe(true);
         // cwd is the resolved git repo root (walked up from the typed --path),
         // not the build dir — publishToPlayground inlines the *project* README
         // as the app's detail page, matching how the moddable origin resolves.
@@ -272,11 +270,10 @@ describe("runDecentralize — playground publish metadata", () => {
 
         const arg = publishToPlaygroundMock.mock.calls[0][0] as PublishArg;
         expect(arg.repositoryUrl).toBeNull();
-        expect(arg.isModdable).toBe(false);
         expect(arg.cwd).toBe("./dist/__repo_root__");
     });
 
-    it("url source records no repository, no moddable bit, and no project root", async () => {
+    it("url source records no repository and no project root", async () => {
         // Mirrored sites have no git source: even if a caller smuggled a repo
         // URL in, the contract for url mode is null/false/undefined — pinned
         // here without the smuggling (callers can't reach the option in url
@@ -293,7 +290,6 @@ describe("runDecentralize — playground publish metadata", () => {
 
         const arg = publishToPlaygroundMock.mock.calls[0][0] as PublishArg;
         expect(arg.repositoryUrl).toBeNull();
-        expect(arg.isModdable).toBe(false);
         expect(arg.cwd).toBeUndefined();
     });
 });
diff --git a/src/utils/decentralize/run.ts b/src/utils/decentralize/run.ts
index 4186349a..9c7e8e75 100644
--- a/src/utils/decentralize/run.ts
+++ b/src/utils/decentralize/run.ts
@@ -145,7 +145,7 @@ export interface RunDecentralizeOptions {
      * — git origin exists, public, GitHub) before passing it in; the runner
      * just threads it through. Only meaningful for `path` sources — mirrored
      * URL sites have no git source, so URL-mode callers always pass
-     * null/omit, and `isModdable` stays false.
+     * null/omit, and the app records no repository (not moddable).
      */
     repositoryUrl?: string | null;
     env: Env;
@@ -198,7 +198,7 @@ export async function runDecentralize(
     // signs with a dev key (polkadot-app-deploy default mnemonic or `--suri`).
     // This drives the "owned by a development account" callout — which speaks
     // to DotNS *domain* ownership (dev-signed in dev mode regardless of any
-    // registry-level `claimedOwnerH160`).
+    // registry-level owner override — #525 removed that capability).
     const storageSignerSource: ResolvedSigner["source"] = mode === "phone" ? "session" : "dev";
 
     // Shared counter across every phone tap (DotNS commitment/finalize/link,
@@ -320,7 +320,6 @@ export async function runDecentralize(
             const publishResult = await publishToPlayground({
                 domain: label,
                 publishSigner,
-                claimedOwnerH160: setup.claimedOwnerH160,
                 repositoryUrl,
                 tag: options.tag ?? null,
                 // Path sources have a real project root — its README.md (if
@@ -332,8 +331,6 @@ export async function runDecentralize(
                 cwd: source.kind === "path" ? findProjectRoot(source.directory) : undefined,
                 env,
                 isPrivate: false,
-                isModdable: repositoryUrl !== null,
-                isDevSigner: setup.publishSigner.source === "dev",
                 onLogEvent: (event) => onEvent?.({ kind: "playground-event", event }),
                 onAllowancePrompt: allowancePrompt,
             });
diff --git a/src/utils/deploy/playground.test.ts b/src/utils/deploy/playground.test.ts
index ae7b9fa9..489872c2 100644
--- a/src/utils/deploy/playground.test.ts
+++ b/src/utils/deploy/playground.test.ts
@@ -548,18 +548,7 @@ describe("publishToPlayground", () => {
                 expect.objectContaining({ __kind: "store" }),
                 bulletinStorageSigner,
             );
-            expect(publishTx).toHaveBeenCalledWith(
-                "my-app.paseo",
-                "bafymeta",
-                1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
-                "",
-                false,
-                false,
-            );
+            expect(publishTx).toHaveBeenCalledWith("my-app.paseo", "bafymeta", 1, "");
         } finally {
             rmSync(dir, { recursive: true, force: true });
         }
@@ -621,27 +610,14 @@ describe("publishToPlayground", () => {
         }
     });
 
-    it("passes claimedOwnerH160 through as the dev-signer publish owner argument", async () => {
+    it("cannot name an owner — #525 made the caller the owner unconditionally", async () => {
         await publishToPlayground({
             domain: "claimed-app",
             publishSigner: fakeSigner,
             repositoryUrl: null,
             cwd: "/definitely/not/a/repo",
-            claimedOwnerH160: "0x1234567890abcdef1234567890abcdef12345678",
-            isDevSigner: true,
         });
-        expect(publishTx).toHaveBeenCalledWith(
-            "claimed-app.paseo",
-            "bafymeta",
-            1,
-            {
-                isSome: true,
-                value: "0x1234567890abcdef1234567890abcdef12345678",
-            },
-            "",
-            false,
-            true,
-        );
+        expect(publishTx).toHaveBeenCalledWith("claimed-app.paseo", "bafymeta", 1, "");
     });
 
     it("passes visibility=0 when isPrivate is true", async () => {
@@ -652,41 +628,17 @@ describe("publishToPlayground", () => {
             cwd: "/definitely/not/a/repo",
             isPrivate: true,
         });
-        expect(publishTx).toHaveBeenCalledWith(
-            "secret.paseo",
-            "bafymeta",
-            0,
-            {
-                isSome: false,
-                value: "0x0000000000000000000000000000000000000000",
-            },
-            "",
-            false,
-            false,
-        );
+        expect(publishTx).toHaveBeenCalledWith("secret.paseo", "bafymeta", 0, "");
     });
 
-    it("routes dev signer publishes through publish with is_dev_signer=true", async () => {
+    it("publishes with four args only — #525 dropped owner/is_moddable/is_dev_signer", async () => {
         await publishToPlayground({
             domain: "modded-by-dev",
             publishSigner: fakeSigner,
             repositoryUrl: "https://github.com/foo/bar",
             cwd: "/definitely/not/a/repo",
-            isModdable: true,
-            isDevSigner: true,
         });
-        expect(publishTx).toHaveBeenCalledWith(
-            "modded-by-dev.paseo",
-            "bafymeta",
-            1,
-            {
-                isSome: false,
-                value: "0x0000000000000000000000000000000000000000",
-            },
-            "",
-            true,
-            true,
-        );
+        expect(publishTx).toHaveBeenCalledWith("modded-by-dev.paseo", "bafymeta", 1, "");
     });
 
     it("forwards moddedFrom captured by `dot mod` in dot.json to registry.publish", async () => {
@@ -699,18 +651,7 @@ describe("publishToPlayground", () => {
                 repositoryUrl: null,
                 cwd: dir,
             });
-            expect(publishTx).toHaveBeenCalledWith(
-                "my-mod.paseo",
-                "bafymeta",
-                1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
-                "original.paseo",
-                false,
-                false,
-            );
+            expect(publishTx).toHaveBeenCalledWith("my-mod.paseo", "bafymeta", 1, "original.paseo");
         } finally {
             rmSync(dir, { recursive: true, force: true });
         }
@@ -741,13 +682,7 @@ describe("publishToPlayground", () => {
                 "my-mod.paseo",
                 "bafymeta",
                 1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
                 "steampunk-lizard-spock01.paseo",
-                false,
-                false,
             );
             // The explicit value must ALSO drive the metadata JSON, not just the
             // on-chain arg — otherwise the badge and the XP edge disagree.
@@ -775,13 +710,7 @@ describe("publishToPlayground", () => {
                 "my-mod.paseo",
                 "bafymeta",
                 1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
                 "steampunk-lizard-spock01.paseo",
-                false,
-                false,
             );
             expect(result.metadata.moddedFrom).toBe("steampunk-lizard-spock01.paseo");
         } finally {
@@ -800,18 +729,7 @@ describe("publishToPlayground", () => {
                 cwd: dir,
                 moddedFrom: "   ",
             });
-            expect(publishTx).toHaveBeenCalledWith(
-                "my-mod.paseo",
-                "bafymeta",
-                1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
-                "original.paseo",
-                false,
-                false,
-            );
+            expect(publishTx).toHaveBeenCalledWith("my-mod.paseo", "bafymeta", 1, "original.paseo");
             expect(result.metadata.moddedFrom).toBe("original.paseo");
         } finally {
             rmSync(dir, { recursive: true, force: true });
@@ -832,18 +750,7 @@ describe("publishToPlayground", () => {
                 cwd: dir,
                 moddedFrom: "Not A Domain!",
             });
-            expect(publishTx).toHaveBeenCalledWith(
-                "my-mod.paseo",
-                "bafymeta",
-                1,
-                {
-                    isSome: false,
-                    value: "0x0000000000000000000000000000000000000000",
-                },
-                "original.paseo",
-                false,
-                false,
-            );
+            expect(publishTx).toHaveBeenCalledWith("my-mod.paseo", "bafymeta", 1, "original.paseo");
             expect(result.metadata.moddedFrom).toBe("original.paseo");
         } finally {
             rmSync(dir, { recursive: true, force: true });
diff --git a/src/utils/deploy/playground.ts b/src/utils/deploy/playground.ts
index 9820ee27..ec629ce5 100644
--- a/src/utils/deploy/playground.ts
+++ b/src/utils/deploy/playground.ts
@@ -22,7 +22,8 @@
  * `getRegistryContract()`.
  * Phone publishing is signed by the user's product account so the contract's
  * `env::caller()` matches their address. Dev publishing is signed by the dev
- * account and may pass a claimed owner for the playground-app "myApps" view.
+ * account and is therefore itself the recorded owner (registry #525 removed
+ * the `owner` argument, so no path can name another account).
  *
  * We deliberately do NOT use `polkadot-app-deploy.deploy()` for the metadata
  * upload: `deploy()` unconditionally runs a DotNS `register()` +
@@ -113,20 +114,11 @@ export interface PublishToPlaygroundOptions {
     /**
      * Signer that submits the registry publish tx. In phone mode this is the
      * user's session signer and calls `publish(...)` (caller becomes owner).
-     * In dev mode this is a dev signer (Alice / `--suri`) and calls
-     * `publish(...)` with `is_dev_signer: true`; `claimedOwnerH160` carries the
-     * H160 to record as owner.
+     * In dev mode this is a dev signer (Alice / `--suri`) — and since registry
+     * #525 the caller is ALWAYS the recorded owner, so a dev-mode publish is
+     * owned by the dev account, not the logged-in user.
      */
     publishSigner: ResolvedSigner;
-    /**
-     * Optional H160 to record as the app owner via the contract's `owner`
-     * parameter. Used by dev mode + active session so the app shows in the
-     * user's MyApps view even though the tx is signed by Alice. `null` or
-     * omitted ⇒ contract defaults to caller (`publishSigner.address`
-     * translated to H160), which is correct for phone mode and pure-dev
-     * throwaway.
-     */
-    claimedOwnerH160?: `0x${string}` | null;
     /** Repository URL to record in metadata. `null` = omit the field entirely. */
     repositoryUrl: string | null;
     /**
@@ -160,7 +152,6 @@ export interface PublishToPlaygroundOptions {
      * records this bit so the playground-app filter doesn't need to fetch
      * each metadata JSON to know.
      */
-    isModdable?: boolean;
     /**
      * Domain (`<label>.<tld>`) the user modded this app from, or `""`/omitted if
      * this is a first-party publish. Recorded on-chain so the playground-app
@@ -185,7 +176,6 @@ export interface PublishToPlaygroundOptions {
      * `is_dev_signer` flag on `publish(...)`, which records the app without
      * awarding deploy XP or source-app mod XP.
      */
-    isDevSigner?: boolean;
 }
 
 export interface PublishToPlaygroundResult {
@@ -476,16 +466,6 @@ export async function publishToPlayground(
         "publish playground registry entry",
         { "cli.deploy.domain": fullDomain },
         async () => {
-            // Encode the Option<Address> owner parameter. None ⇒ contract
-            // defaults to env::caller(). Some(h160) ⇒ recorded as the app
-            // owner regardless of who signed the tx.
-            const owner = options.claimedOwnerH160
-                ? { isSome: true as const, value: options.claimedOwnerH160 }
-                : {
-                      isSome: false as const,
-                      value: "0x0000000000000000000000000000000000000000" as const,
-                  };
-
             let lastError: unknown;
             for (let attempt = 1; attempt <= MAX_REGISTRY_RETRIES; attempt++) {
                 try {
@@ -495,21 +475,30 @@ export async function publishToPlayground(
                     // The contract credits the source owner the mod XP off this
                     // argument, so an empty string records no lineage edge.
                     const moddedFromArg = moddedFrom ?? "";
-                    const isModdable = options.isModdable ?? false;
-                    const isDevSigner = options.isDevSigner ?? false;
-                    // contracts@0.9 dropped the separate `publishDev` method:
-                    // the dev-signer path is now the same `publish` call with
-                    // the trailing `is_dev_signer` boolean set. `true` records
-                    // the app without awarding mod XP (the former `publishDev`
-                    // behaviour); `false` is the normal user publish.
+                    // registry #525 narrowed `publish` to four arguments and
+                    // CHANGED THE SELECTOR — an older CLI hits the contract's
+                    // fallback and reverts, so this must move in lockstep with
+                    // the deployed registry.
+                    //
+                    // Dropped, and why each is safe to drop here:
+                    //   owner (Option<Address>) — no path may name an owner
+                    //     other than the caller any more. Dev-mode publishes are
+                    //     therefore owned by the DEV account, not the logged-in
+                    //     user: nothing can name a different owner, so a dev-signed
+                    //     deploy never lands in the user's MyApps view.
+                    //     The admin-only `importApp(domain, owner, publisher,
+                    //     visibility, metadata_uri)` is the only owner-naming
+                    //     path that remains.
+                    //   is_moddable — nothing read it (the moddable bonus moved
+                    //     in #286). `--moddable` still works: it is carried by
+                    //     `metadata.repository`, which is what `playground mod`
+                    //     actually reads.
+                    //   is_dev_signer — nothing read it (#525).
                     const result = await registry.publish.tx(
                         fullDomain,
                         metadataCid,
                         visibility,
-                        owner,
                         moddedFromArg,
-                        isModdable,
-                        isDevSigner,
                     );
                     if (!result.ok) {
                         const { deterministic, detail } = classifyRevert(result.error);
diff --git a/src/utils/deploy/run.test.ts b/src/utils/deploy/run.test.ts
index 2b8457e7..81432f01 100644
--- a/src/utils/deploy/run.test.ts
+++ b/src/utils/deploy/run.test.ts
@@ -192,7 +192,7 @@ describe("runDeploy", () => {
         expect(createBulletinAuthContextMock).not.toHaveBeenCalled();
     });
 
-    it("dev mode with playground: ZERO planned approvals AND user H160 is claimed as owner", async () => {
+    it("dev mode with playground: ZERO planned approvals, and the dev signer owns the app", async () => {
         const { events, push } = collectEvents();
         const outcome = await runDeploy({
             projectDir: "/tmp/proj",
@@ -211,22 +211,26 @@ describe("runDeploy", () => {
         expect(outcome.metadataCid).toBe("bafymeta");
         expect(publishToPlaygroundMock).toHaveBeenCalledTimes(1);
 
-        // The headline contract: the user's session H160 is passed as
-        // claimedOwnerH160 so MyApps still resolves the app even though
-        // Alice signed the publish tx. Without this assertion the test
-        // would pass even if the user's H160 silently never reached the
-        // chain.
+        // Registry #525 removed `publish`'s owner argument, so the user's
+        // H160 must NOT be forwarded to the publish call any more — the dev
+        // signer is the owner and nothing can override that. Pinning its
+        // absence stops the old "claimed owner" plumbing being reintroduced
+        // as an argument the contract has no parameter for. (The deploy
+        // summary warns the user separately; see summary.test.ts.)
         const calls = publishToPlaygroundMock.mock.calls as unknown[][];
-        const publishCall = calls[0]?.[0] as { claimedOwnerH160?: string } | undefined;
-        expect(publishCall?.claimedOwnerH160).toBe("0xbeefbeefbeefbeefbeefbeefbeefbeefbeefbeef");
+        const publishCall = calls[0]?.[0] as Record<string, unknown> | undefined;
+        expect(publishCall).toBeDefined();
+        expect(publishCall).not.toHaveProperty("userSessionH160");
 
         const plan = events.find((e) => e.kind === "plan");
         expect(plan?.kind).toBe("plan");
         if (plan?.kind === "plan") expect(plan.approvals).toHaveLength(0);
     });
 
-    it("threads isModdable + isDevSigner into publishToPlayground", async () => {
-        // Phone-mode publish: isDevSigner=false, isModdable=true.
+    it("threads the moddable repository URL into publishToPlayground", async () => {
+        // registry #525 dropped the `is_moddable` / `is_dev_signer` publish args.
+        // Moddability now travels ONLY as `metadata.repository`, which is what
+        // `playground mod` reads — so that is the thing worth pinning.
         const { push } = collectEvents();
         await runDeploy({
             projectDir: "/tmp/proj",
@@ -240,14 +244,13 @@ describe("runDeploy", () => {
             onEvent: push,
         });
         const phoneCall = (publishToPlaygroundMock.mock.calls as unknown[][])[0]?.[0] as
-            | { isModdable?: boolean; isDevSigner?: boolean }
+            | { repositoryUrl?: string | null }
             | undefined;
-        expect(phoneCall?.isModdable).toBe(true);
-        expect(phoneCall?.isDevSigner).toBe(false);
+        expect(phoneCall?.repositoryUrl).toBe("https://github.com/foo/bar");
 
         publishToPlaygroundMock.mockClear();
 
-        // Dev-mode publish (no session): isDevSigner=true, isModdable=false.
+        // Dev-mode publish (no session): no repository recorded.
         await runDeploy({
             projectDir: "/tmp/proj",
             buildDir: "/tmp/proj/dist",
@@ -259,10 +262,9 @@ describe("runDeploy", () => {
             onEvent: push,
         });
         const devCall = (publishToPlaygroundMock.mock.calls as unknown[][])[0]?.[0] as
-            | { isModdable?: boolean; isDevSigner?: boolean }
+            | { repositoryUrl?: string | null }
             | undefined;
-        expect(devCall?.isModdable).toBe(false);
-        expect(devCall?.isDevSigner).toBe(true);
+        expect(devCall?.repositoryUrl ?? null).toBeNull();
     });
 
     it("threads the chosen tag into publishToPlayground (and defaults to null)", async () => {
diff --git a/src/utils/deploy/run.ts b/src/utils/deploy/run.ts
index 39038949..dfb4c498 100644
--- a/src/utils/deploy/run.ts
+++ b/src/utils/deploy/run.ts
@@ -294,7 +294,6 @@ export async function runDeploy(options: RunDeployOptions): Promise<DeployOutcom
                 publishToPlayground({
                     domain: fullDomain,
                     publishSigner: wrappedPublishSigner,
-                    claimedOwnerH160: setup.claimedOwnerH160,
                     repositoryUrl: options.repositoryUrl ?? null,
                     tag: options.tag ?? null,
                     cwd: options.projectDir,
@@ -303,8 +302,6 @@ export async function runDeploy(options: RunDeployOptions): Promise<DeployOutcom
                     onAllowancePrompt: allowancePrompt,
                     env: options.env,
                     isPrivate: options.playgroundPrivate,
-                    isModdable: options.moddable ?? false,
-                    isDevSigner: publishSigner.source === "dev",
                 }),
         );
         return pub.metadataCid;
diff --git a/src/utils/deploy/signerMode.test.ts b/src/utils/deploy/signerMode.test.ts
index cc909659..af441bb3 100644
--- a/src/utils/deploy/signerMode.test.ts
+++ b/src/utils/deploy/signerMode.test.ts
@@ -103,7 +103,7 @@ describe("resolveSignerSetup — dev mode", () => {
         expect(result.publishSigner?.source).toBe("dev");
         // The user's H160 is claimed via the owner parameter so MyApps still
         // resolves their app even though Alice signed the tx.
-        expect(result.claimedOwnerH160).toBe("0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+        expect(result.userSessionH160).toBe("0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
         // Dev mode keeps polkadot-app-deploy on its built-in default mnemonic —
         // passed EXPLICITLY so the persisted phone session is never resolved.
         expect(result.bulletinDeployAuthOptions).toEqual({ mnemonic: DEFAULT_MNEMONIC });
@@ -120,7 +120,7 @@ describe("resolveSignerSetup — dev mode", () => {
         });
         expect(result.approvals).toEqual([]);
         expect(result.publishSigner?.source).toBe("dev");
-        expect(result.claimedOwnerH160).toBeNull();
+        expect(result.userSessionH160).toBeNull();
     });
 
     it("dev SURI signer is forwarded to DotNS auth AND used as the publish signer", () => {
@@ -134,7 +134,7 @@ describe("resolveSignerSetup — dev mode", () => {
         // the user's chosen address, recorded as caller by default.
         expect(result.approvals).toEqual([]);
         expect(result.publishSigner).toBe(user);
-        expect(result.claimedOwnerH160).toBeNull();
+        expect(result.userSessionH160).toBeNull();
         expect(result.bulletinDeployAuthOptions.signer).toBe(user.signer);
         expect(result.bulletinDeployAuthOptions.signerAddress).toBe("5DevSuri");
         // The injected signer wins inside polkadot-app-deploy; no mnemonic needed.
diff --git a/src/utils/deploy/signerMode.ts b/src/utils/deploy/signerMode.ts
index aad1d7a4..c029e4a1 100644
--- a/src/utils/deploy/signerMode.ts
+++ b/src/utils/deploy/signerMode.ts
@@ -33,17 +33,17 @@
  *     DotNS, `storageSigner` for chunks, and the dev publish signer below.
  *     Playground publish is ALSO signed by the dev
  *     account — Alice's H160 is recorded as `publisher`, but the contract
- *     accepts an optional `owner` parameter so we can record the user's
- *     H160 as the `owner` (the H160 MyApps queries with). When a phone
- *     session is present we pass `claimedOwnerH160 = session.productH160`
- *     so the user still sees the app in MyApps without ever tapping the
- *     phone. With no session, `claimedOwnerH160 = null` and the contract
- *     falls back to caller (dev account owns the app).
+ *     records the CALLER as owner — the dev account. ⚠️ Registry #525
+ *     dropped `publish`'s `owner` argument entirely, so a dev-mode deploy
+ *     can NO LONGER record the logged-in user as owner: their app will not
+ *     appear in MyApps. `userSessionH160` below is retained only to drive
+ *     the deploy summary's warning; nothing passes it on-chain any more.
+ *     The sudo-only `importApp` is the only owner-naming path that remains.
  *   - Phone mode: polkadot-app-deploy uses the user's phone signer for DotNS
  *     (3 taps). Storage uses the BulletInAllowance slot key resolved by
  *     `resolveStorageSignerOptions` — NEVER the phone signer (see that
  *     function's doc for why). Playground publish uses the user's phone
- *     signer (1 more tap). `claimedOwnerH160 = null` — the contract
+ *     signer (1 more tap). `userSessionH160 = null` — the caller
  *     defaults to caller, which is the user's H160 anyway.
  */
 
@@ -137,8 +137,9 @@ export interface DeploySignerSetup {
      * Signer used to call the registry publish method for the playground step.
      *
      * - Phone mode: the user's session signer — caller becomes owner.
-     * - Dev mode: the dev signer (Alice or `--suri`) — caller becomes
-     *   publisher, and `claimedOwnerH160` (when set) becomes owner.
+     * - Dev mode: the dev signer (Alice or `--suri`) — caller becomes BOTH
+     *   publisher and owner since registry #525; the user's H160 cannot be
+     *   substituted any more.
      *
      * `null` means we cannot publish (no signer at all — only valid when
      * `publishToPlayground === false`).
@@ -146,14 +147,16 @@ export interface DeploySignerSetup {
     publishSigner: ResolvedSigner | null;
 
     /**
-     * The H160 to pass as the `owner` argument of the registry publish method.
-     * Non-null only in dev mode WITH an active phone session — the dev
-     * account signs the tx but the user's H160 is recorded as owner so the
-     * app shows in their MyApps view. `null` ⇒ contract defaults to
-     * `env::caller()` (the signer's H160), which is correct for phone mode
-     * and for pure dev mode (no session).
+     * The logged-in user's H160, when dev mode runs with an active phone
+     * session.
+     *
+     * ⚠️ NO LONGER SENT ON-CHAIN. Registry #525 removed `publish`'s `owner`
+     * argument, so this can no longer make the user the owner — the dev
+     * signer is. It survives only so the deploy summary can WARN that the
+     * app won't show in the user's MyApps. Do not reintroduce it as a
+     * publish argument; the contract has no parameter for it.
      */
-    claimedOwnerH160: `0x${string}` | null;
+    userSessionH160: `0x${string}` | null;
 
     /**
      * Count of phone approvals the user should expect under this setup,
@@ -259,13 +262,13 @@ export function resolveSignerSetup(opts: ResolveOptions): DeploySignerSetup {
     // Dev mode: we ALWAYS sign with a dev key, never with the session.
     //   - With `--suri`: that SURI dev signer (its address becomes owner).
     //   - With a session (user did `dot login`): construct Alice and pass
-    //     the session's product H160 as `claimedOwnerH160` — the contract
+    //     the session's product H160 as `userSessionH160` — used ONLY for
     //     records the user as owner so MyApps resolves their app.
-    //   - With neither: construct Alice and leave claimedOwnerH160 null
+    //   - With neither: construct Alice and leave userSessionH160 null
     //     (Alice owns the entry — pure-dev throwaway).
     // No phone approval is ever added in dev mode.
     let publishSigner: ResolvedSigner | null = null;
-    let claimedOwnerH160: `0x${string}` | null = null;
+    let userSessionH160: `0x${string}` | null = null;
     if (opts.publishToPlayground) {
         if (opts.mode === "phone") {
             publishSigner = opts.userSigner!;
@@ -280,12 +283,12 @@ export function resolveSignerSetup(opts: ResolveOptions): DeploySignerSetup {
             // tx phases sign as the same on-chain identity.
             publishSigner = createDevPublishSigner();
             if (opts.userSigner?.source === "session") {
-                claimedOwnerH160 = opts.userSigner.addresses?.productH160 ?? null;
+                userSessionH160 = opts.userSigner.addresses?.productH160 ?? null;
             }
         }
     }
 
-    return { bulletinDeployAuthOptions, publishSigner, claimedOwnerH160, approvals };
+    return { bulletinDeployAuthOptions, publishSigner, userSessionH160, approvals };
 }
 
 /**
diff --git a/src/utils/mod/metadataUri.test.ts b/src/utils/mod/metadataUri.test.ts
new file mode 100644
index 00000000..fc1cf48c
--- /dev/null
+++ b/src/utils/mod/metadataUri.test.ts
@@ -0,0 +1,70 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { describe, expect, it } from "vitest";
+import { getAppMetadataUri, type MetadataUriReader } from "./metadataUri.js";
+
+const reader = (res: { success: boolean; value?: unknown }): MetadataUriReader => ({
+    getMetadataUri: { query: async () => res },
+});
+
+describe("getAppMetadataUri", () => {
+    /**
+     * Both cases are the shapes observed live against the v2 registry on
+     * paseo-next-v2 (`rps-mod-test.paseo` vs a domain that was never
+     * published), not a guess at the ABI.
+     */
+    it("returns the CID for a published app", async () => {
+        const cid = "bafk2bzacebh3n5gtceo3u4m7u5zssy23ewbtfrj7e3k4f3msiivlkzxndo6ug";
+        await expect(
+            getAppMetadataUri(reader({ success: true, value: cid }), "x.paseo"),
+        ).resolves.toBe(cid);
+    });
+
+    it("treats the empty string as 'no such app' — v2 has no Option wrapper", async () => {
+        await expect(
+            getAppMetadataUri(reader({ success: true, value: "" }), "nope.paseo"),
+        ).resolves.toBeNull();
+    });
+
+    /**
+     * Regression guard. The pre-v2 call sites did `value.isSome ? … : null`,
+     * which reads `undefined` off a plain string and reported EVERY app as
+     * missing — `playground mod` failed for apps that demonstrably existed.
+     * If a future refactor reintroduces Option-style narrowing, this fails.
+     */
+    it("does not depend on an isSome wrapper", async () => {
+        const cid = "bafkreiexample";
+        const res = { success: true, value: cid };
+        expect((res.value as unknown as { isSome?: boolean }).isSome).toBeUndefined();
+        await expect(getAppMetadataUri(reader(res), "x.paseo")).resolves.toBe(cid);
+    });
+
+    it("throws when the dry-run itself was rejected", async () => {
+        await expect(getAppMetadataUri(reader({ success: false }), "x.paseo")).rejects.toThrow(
+            /failed at dry-run/,
+        );
+    });
+
+    /** A changed ABI must be loud, not silently indistinguishable from "not found". */
+    it("throws on an unexpected payload shape rather than reporting 'not found'", async () => {
+        await expect(
+            getAppMetadataUri(
+                reader({ success: true, value: { isSome: true, value: "x" } }),
+                "x.paseo",
+            ),
+        ).rejects.toThrow(/unexpected shape/);
+    });
+});
diff --git a/src/utils/mod/metadataUri.ts b/src/utils/mod/metadataUri.ts
new file mode 100644
index 00000000..62df91ab
--- /dev/null
+++ b/src/utils/mod/metadataUri.ts
@@ -0,0 +1,58 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/** Minimal structural view of the registry handle this decoder needs. */
+export interface MetadataUriReader {
+    getMetadataUri: { query(domain: string): Promise<{ success: boolean; value?: unknown }> };
+}
+
+/**
+ * Read an app's metadata CID from the playground registry.
+ *
+ * Returns `null` when the registry has no entry for `domain`.
+ *
+ * ⚠️ Shape, and why this is the ONLY place that decodes it: on the v2 registry
+ * `getMetadataUri` returns a plain `String`, and an ABSENT app decodes as the
+ * EMPTY STRING. There is no `Option` wrapper, so there is no `isSome` to
+ * narrow on. The pre-v2 contract did return `Option<String>`, and the code
+ * written against it (`value.isSome ? value.value : null`) reads `undefined`
+ * on every call — reporting every app as missing, including ones that exist.
+ * That shipped briefly and broke `playground mod` outright; the call sites are
+ * typed loosely enough that neither tsc nor the tests could see it.
+ *
+ * An unexpected payload therefore throws rather than degrading to "not found":
+ * a silent wrong-shape read is exactly the failure mode above, and a missing
+ * app and a changed ABI need very different responses from whoever hits it.
+ */
+export async function getAppMetadataUri(
+    registry: MetadataUriReader,
+    domain: string,
+): Promise<string | null> {
+    const res = await registry.getMetadataUri.query(domain);
+    if (!res.success) {
+        throw new Error(
+            `Registry lookup for "${domain}" failed at dry-run (chain rejected the call).`,
+        );
+    }
+    if (res.value === undefined || res.value === null) return null;
+    if (typeof res.value !== "string") {
+        throw new Error(
+            `Registry returned an unexpected shape for getMetadataUri("${domain}"): ` +
+                `expected a string, got ${typeof res.value}. The registry ABI has probably ` +
+                `changed — re-run \`cdm i\` and check this decoder.`,
+        );
+    }
+    return res.value === "" ? null : res.value;
+}
diff --git a/src/utils/signer.ts b/src/utils/signer.ts
index 28c4d468..3bb48d5a 100644
--- a/src/utils/signer.ts
+++ b/src/utils/signer.ts
@@ -40,7 +40,8 @@ export interface ResolvedSigner {
     /**
      * The session's root / product / H160 triple. Present for QR/mobile
      * sessions (forwarded from `SessionHandle`); absent for local dev/SURI
-     * signers. Consumed by `resolveSignerSetup` to pick the `claimedOwnerH160`
+     * signers. Consumed by `resolveSignerSetup` to pick the `userSessionH160`
+     * used for the deploy summary's dev-ownership warning
      * for dev-mode playground publish.
      */
     addresses?: SessionAddresses;

From c2b18ad16150872e76bc5e41fb8b86e7ec066bcc Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Mon, 21 Sep 2026 22:28:44 +0800
Subject: [PATCH 04/10] feat(config): derive the product id from the
 environment TLD
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`PLAYGROUND_PRODUCT_ID` becomes `playground.${getEnvTld()}` — so
`playground.paseo` on paseo-next-v2 — instead of a fixed `playground.dot`.

This is an identity migration: the product id is an input to the account
derivation, so every product account address moves. Anything keyed on the
old id (cached subtrees, the SDK allowance cache under `~/.polkadot-apps/`)
is not found under the new one and is re-granted at the next login. Apps
published under the old address stay owned by it.

It is also required for the CLI to work against a phone on a paseo
environment at all. The mobile host re-validates the product id against its
own TLD in the ProductSubtreeRequest mapper and the throw is swallowed, so a
`.dot` id produced no prompt, no error and no reply — just the full ~180s
deadline. Measured on one session: `playground.paseo` answered in ~3s while
`playground.dot` and `playground.testnet` never did.

playground-app already ships the environment-suffixed form, and the two must
match exactly or the CLI and the app derive different H160s for the same
person, splitting app ownership and XP across two identities.

The pinned test now asserts against getEnvTld() rather than a literal, so
flipping ACTIVE_TESTNET_ENV cannot silently desync the two again. The frozen
address vector was regenerated; the old id still reproduces the old pair,
confirming only the input changed.
---
 .changeset/product-id-follows-env-tld.md | 21 +++++++++++++++++
 CLAUDE.md                                |  2 +-
 src/config.ts                            | 30 ++++++++++++++++++++----
 src/utils/auth.test.ts                   | 20 ++++++++++++++--
 src/utils/sessionSigner.test.ts          | 16 +++++++++----
 5 files changed, 77 insertions(+), 12 deletions(-)
 create mode 100644 .changeset/product-id-follows-env-tld.md

diff --git a/.changeset/product-id-follows-env-tld.md b/.changeset/product-id-follows-env-tld.md
new file mode 100644
index 00000000..4cebd56c
--- /dev/null
+++ b/.changeset/product-id-follows-env-tld.md
@@ -0,0 +1,21 @@
+---
+"playground-cli": minor
+---
+
+Derive the product account from an environment-scoped product id
+(`playground.paseo` on paseo-next-v2) instead of a fixed `playground.dot`.
+
+This is an identity migration, not a cosmetic change: the product id is an
+input to the account derivation, so **your product account address changes**.
+Apps published from the CLI before this release are owned by the old address
+and will no longer show as yours; anything keyed to the old product id (cached
+subtrees, the SDK allowance cache under `~/.polkadot-apps/`) is simply not
+found under the new one and is re-granted at your next `playground login`.
+
+The change is required for the CLI to work at all against a phone on a
+`paseo` environment. The mobile host validates the product id against its own
+TLD and drops a mismatch silently, so a `.dot` id produced no prompt, no error
+and no reply — only a ~180 second timeout. It also keeps the CLI and the
+playground web app on one identity: the app already ships the
+environment-suffixed form, and two different ids for the same person would
+split app ownership and XP across two accounts.
diff --git a/CLAUDE.md b/CLAUDE.md
index a1cc8c5b..32507ba7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,7 +60,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 
 - **`session.rootAccountId` is whatever the mobile app published as `rootUserAccountId` in the SSO handshake.** On current mobile builds (`polkadot-app-android-v2`, see `feature/sso/impl/.../RealSsoHandshakeUseCase.kt:34` → `deriveRootAccount() = derivationPath = null`) it's the bare-mnemonic sr25519 root with no junction. The host-papp SDK does not derive it — it just decodes the 32 bytes from `HandshakeResponseSensitiveData.rootUserAccountId` (`triangle-js-sdks/packages/host-papp/src/sso/auth/scale/handshake.ts:23-27`) and forwards them. If a future mobile release changes the path, our display will silently change with it — the source of truth is the phone, not the CLI.
 - **The mobile's "Wallet account address" and "Candidate account address" debug rows are NOT reachable from the host.** They're sr25519 of mnemonic + `//wallet` and mnemonic + `//candidate` respectively (`feature/account/impl/.../RealAccountRepository.kt:166-173`, hard junctions). Hard derivations can't be reproduced from a public key, so the CLI never sees those SS58s. Don't try to surface a "wallet address that matches mobile" — it isn't possible without the mnemonic.
-- **🔴 `PLAYGROUND_PRODUCT_ID = "playground.dot"` COLLIDES with the phone's TLD validation on a paseo-TLD build — RFC-0022 subtree lookup can never succeed for us until Android relaxes it** (root-caused by the Android team on polkadot-android-community#123, 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. Do NOT "fix" this by changing `PLAYGROUND_PRODUCT_ID`: it is the derivation input for every product account, so changing it silently moves every user's address (see the RFC-0022 note below for what that strands). The real fix is Android's — they flag the check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. Track #123 before attempting the #366 bump; the bump cannot work for us without it. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
+- **🔴 `PLAYGROUND_PRODUCT_ID` MUST FOLLOW THE ENV TLD — it is `` `playground.${getEnvTld()}` `` (`config.ts`), NOT a fixed `.dot`.** The phone validates the product id against ITS OWN TLD and silently drops a mismatch (polkadot-android-community#123, root-caused by the Android team 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. **An earlier version of this note said the id was "TLD-independent by convention" and told you NOT to thread `getEnvTld` through it. That was wrong** — the phone decides, and playground-app already shipped the env-suffixed form (`defaultDotNsId`, commit `6e9337c`; it prints `product id : playground.paseo` at boot). The two strings MUST match exactly or the CLI and the app derive different H160s for the same human, splitting app ownership, XP and dedupe across two identities. ⚠️ Changing the TLD is an IDENTITY MIGRATION: every derived product account moves, and anything keyed on the old id — cached subtrees and the SDK allowance cache, both `~/.polkadot-apps/{productId}_*.json` — is simply not found under the new id (re-granted at next login, not corrupted). Android still flags their check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. With the env-suffixed id in place, #123 no longer blocks us — it still matters for `localhost:*` ids and for any consumer hardcoding `.dot`. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
 - **`AutoSigning` returns `NotAvailable` on current mobile builds** (measured 2026-09-15 via `@dotli/host-cli` against Android build 1026, alongside `BulletInAllowance` → `Allocated` on the same call). RFC-0010 says `AutoSigning` is the one resource that MUST be requested explicitly — but the wallet will not provision it today, and host-rust-core#343 records that the runtime consumes the capability only for `account.sign_vrf` anyway. So the "AutoSigning makes Bulletin chunk signing work under TrUAPI" plan in `docs-internal/2026-09-14-truapi-host-cli-signing.md` is blocked on BOTH a wallet change and #343. Do not assume it is merely a matter of adding the resource to `PLAYGROUND_RESOURCES`.
 - **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **🔴 CORRECTION (2026-09-17): the RFC-0022 address change DOES strand one thing — the builder-identity gate, which blocks EVERY existing builder from deploying.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so every user's competition membership — which is bound to the OLD H160 — stops being found, and they get the "Couldn't verify your builder status" notice on every deploy. Discovered empirically: a spike account derived the RFC-0022 way was gated out immediately. This is NOT specific to a product-id change; it happens on the plain #366 bump. It needs a migration answer (re-reveal flow, or a registry-side remap) BEFORE the bump ships, or deploy breaks for the entire existing user base. The list below was assessed before this was found and is therefore incomplete — treat it as "these specific things are fine", not "nothing is stranded". **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
 - **The playground product account is derived by exactly one function** (`src/utils/sessionSigner.ts::derivePlaygroundProductPublicKey`), called by both `createPlaygroundSessionSigner` (signer construction) and `auth.ts::deriveSessionAddresses` (display triple). The math is `deriveProductAccountPublicKey(rootAccountId, "playground.dot", 0)` from `@parity/product-sdk-keys`. Do NOT call `deriveProductAccountPublicKey` (or any helper that wraps it) on an already-product-derived SS58 — that yields a doubly-derived ghost account. The `productAccountDisplay` / `productAccountAddresses` helpers that used to live in `src/commands/login/identityLine.ts` had exactly this bug and were deleted; resist re-introducing them. A frozen-vector regression test in `src/utils/auth.test.ts` (`deriveSessionAddresses` block) locks the pubkey/H160 the playground-app expects.
diff --git a/src/config.ts b/src/config.ts
index 25959fba..c6610bbe 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -279,10 +279,32 @@ export const DAPP_ID = "dot-cli";
  * `mnemonic + "/product/{PLAYGROUND_PRODUCT_ID}/0"`; changing this value
  * changes the on-chain account.
  */
-// NOTE: this id is TLD-independent by ecosystem convention — product ids stay
-// `<label>.dot` on every network; only DotNS registration/serving names use
-// the per-env TLD (see `getEnvTld`). Do NOT thread `getEnvTld` through here.
-export const PLAYGROUND_PRODUCT_ID = "playground.dot";
+// The product id FOLLOWS THE ENVIRONMENT TLD. It is not `<label>.dot` on every
+// network — an earlier note here claimed that "by ecosystem convention" and was
+// wrong; the phone is what decides, and it disagrees.
+//
+// Android validates the incoming product id against ITS OWN TLD before any
+// handler runs (`productIdPattern = ([a-z0-9-]+\.)+<tld>`,
+// `SsoSessionMessageMappers.kt:151`). A `.dot` id sent to a `paseo` phone fails
+// that check, the throw is swallowed, and `ProductSubtreeRequest` is never
+// answered — silent in both directions, surfacing only as a ~180 s hang and a
+// client that thinks nobody is signed in. Measured on one session:
+// `playground.paseo` → subtree in ~3 s; `playground.dot` → no reply.
+// See polkadot-android-community#123.
+//
+// playground-app already ships the same rule (`defaultDotNsId`, commit
+// `6e9337c`) and prints `product id : playground.paseo` at boot. These two
+// strings MUST match exactly: the derivation is
+// `mnemonic + "/product/{PLAYGROUND_PRODUCT_ID}/0"`, so the id IS the account.
+// If they diverge, the CLI and the app resolve different H160s for the same
+// human and app ownership, XP and dedupe split across two identities.
+//
+// ⚠️ Changing the TLD is an IDENTITY MIGRATION, not a constant edit: every
+// derived product account moves. Anything keyed on the old id — cached product
+// subtrees and the SDK allowance cache, both stored as
+// `~/.polkadot-apps/{productId}_*.json` — belongs to the old account and is
+// simply not found under the new one (re-granted on next login, not corrupted).
+export const PLAYGROUND_PRODUCT_ID = `playground.${getEnvTld()}`;
 
 /**
  * Host metadata carried inline in the V2 pairing proposal (host-papp 0.8+).
diff --git a/src/utils/auth.test.ts b/src/utils/auth.test.ts
index 0ebeafa4..769337da 100644
--- a/src/utils/auth.test.ts
+++ b/src/utils/auth.test.ts
@@ -430,8 +430,24 @@ describe("deriveSessionAddresses", () => {
         const addresses = deriveSessionAddresses(session);
 
         expect(addresses.rootAddress).toBe(TEST_ROOT_SS58);
-        expect(addresses.productAddress).toBe("5GGpUaN7XNaUp3nEVDPBSR4SQLxFxQsiPHbFwf69Apr3HgDZ");
-        expect(addresses.productH160).toBe("0x47f68a0851a663dfacb4610d673ec708f05576b0");
+        // Regenerated when PLAYGROUND_PRODUCT_ID moved from `playground.dot` to
+        // the env-suffixed `playground.paseo` (android#123 — the phone rejects a
+        // foreign TLD). Provenance, because a fixture regenerated from the code
+        // it checks is worthless: feeding the OLD id to the same primitives
+        // still reproduces the OLD pair below exactly, so ONLY the id changed —
+        // the derivation path is untouched. That path is independently pinned
+        // upstream against host-rust-core's cross-host vector
+        // (product-sdk `product-account.test.ts`).
+        //
+        //   playground.dot   -> 5GGpUaN7XNaUp3nEVDPBSR4SQLxFxQsiPHbFwf69Apr3HgDZ
+        //                       0x47f68a0851a663dfacb4610d673ec708f05576b0
+        //   playground.paseo -> the pair asserted below
+        //
+        // ⚠️ These are OLD-derivation values. When RFC-0022 (product-sdk #366)
+        // lands, the derivation itself changes and they must be re-verified
+        // against the app's boot banner, not just regenerated again.
+        expect(addresses.productAddress).toBe("5DoVmDX98xjw2XyHPpABgDuDJ2qFLGoTFwfzaiUEdW3a4M8e");
+        expect(addresses.productH160).toBe("0xb1ced7e7a64966ae0dc346eea7dcf66f823ccdca");
     });
 
     it("returns a product address distinct from the root — guards against double-derivation", () => {
diff --git a/src/utils/sessionSigner.test.ts b/src/utils/sessionSigner.test.ts
index 65150703..a553833f 100644
--- a/src/utils/sessionSigner.test.ts
+++ b/src/utils/sessionSigner.test.ts
@@ -18,7 +18,7 @@ import { ss58Encode } from "@parity/product-sdk-address";
 import { seedToAccount } from "@parity/product-sdk-keys";
 import type { UserSession } from "@parity/product-sdk-terminal";
 import type { PolkadotSigner } from "polkadot-api";
-import { PLAYGROUND_PRODUCT_ID } from "../config.js";
+import { PLAYGROUND_PRODUCT_ID, getEnvTld } from "../config.js";
 import {
     INCOMPLETE_SESSION_MESSAGE,
     SESSION_EXPIRED_MESSAGE,
@@ -107,10 +107,16 @@ describe("createPlaygroundSessionSigner", () => {
         ).toThrow(INCOMPLETE_SESSION_MESSAGE);
     });
 
-    test("playground product id is pinned", () => {
-        // playground-app derives MyApps ownership from this exact id; a silent
-        // rename would orphan every published app.
-        expect(PLAYGROUND_PRODUCT_ID).toEqual("playground.dot");
+    test("playground product id follows the environment TLD", () => {
+        // playground-app derives MyApps ownership from this exact id, and the
+        // phone REJECTS an id whose TLD is not its own (android#123) — so the
+        // label is fixed but the suffix must track the env. Pinned against
+        // getEnvTld() rather than a literal so flipping ACTIVE_TESTNET_ENV
+        // cannot silently desync the CLI from the app.
+        expect(PLAYGROUND_PRODUCT_ID).toEqual(`playground.${getEnvTld()}`);
+        // Guard the shape too: a bare label or a doubled suffix would both
+        // still be "a string" but would derive a different account.
+        expect(PLAYGROUND_PRODUCT_ID).toMatch(/^playground\.[a-z0-9-]+$/);
     });
 });
 

From f0d357ad7a85df28ec2a298b673ab34cb0ce90cf Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Mon, 21 Sep 2026 22:30:16 +0800
Subject: [PATCH 05/10] fix(identity): gate on the verifier the registry
 actually consults
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

deploy, deploy-all, mod and decentralize refused with "Join the competition
first" for users whose publish the chain would have accepted.

The gate read `getRootAccount` from the identity spine. The registry does
not consult the spine — `require_revealed()` delegates to whatever
`set_verifier` names, which on this deployment is an open verifier that
returns true for every account. The CLI was enforcing a stricter rule than
the chain, against a different contract, so the two drifted the moment the
deployment wired something else.

It now resolves `registry.getVerifier()` and calls `isVerified` on that
address, which is correct both today and on a competition deployment that
wires the spine, with no flag to keep in sync. The verifier is asked a
question rather than identified by address: ADR-0011 names three
implementations and an operator picks one per event, so any
`verifier === <known address>` check is correct only until the next one.
The minimal ABI is attached at runtime so this also works for a verifier
that is not in our cdm.json.

The option to inject a pre-resolved contract is REMOVED rather than
renamed. It existed so a caller holding a registry handle could skip a
second meta-registry resolution, and it cannot work any more: the gate
reads `getVerifier()` and then queries a different contract, so no handle a
caller already has is the right one. `mod` injected its registry anyway —
the narrowing is a cast, so tsc stayed silent — and every `mod` run
reported "couldn't verify your builder status" on a healthy chain. Removing
the parameter makes that unrepresentable instead of merely discouraged;
tests mock `getVerifierContract`.

`IdentityRegistry` is likewise renamed `PersonhoodVerifier`, since the old
name is what made passing a registry look right.

`getReadOnlyIdentityContract` is kept but documented as deliberately unused
— the spine is real and a reveal flow will need it, but it must not come
back as the gate.

Adds coverage for `getVerifierContract`, including that it follows whatever
`getVerifier()` returns rather than a hardcoded address, so a future
"optimisation" to a constant fails the build.
---
 .changeset/gate-asks-wired-verifier.md   |  20 +++++
 CLAUDE.md                                |   2 +-
 src/commands/mod/index.ts                |  13 ++-
 src/commands/shared/gateOrNotice.test.ts |  15 +++-
 src/commands/shared/gateOrNotice.ts      |   9 +-
 src/utils/contractManifest.ts            |  10 +++
 src/utils/identity/identityGate.test.ts  | 109 +++++++++--------------
 src/utils/identity/identityGate.ts       |  90 +++++++++----------
 src/utils/registry.test.ts               |  82 ++++++++++++++++-
 src/utils/registry.ts                    |  88 +++++++++++++++++-
 10 files changed, 300 insertions(+), 138 deletions(-)
 create mode 100644 .changeset/gate-asks-wired-verifier.md

diff --git a/.changeset/gate-asks-wired-verifier.md b/.changeset/gate-asks-wired-verifier.md
new file mode 100644
index 00000000..2308fd55
--- /dev/null
+++ b/.changeset/gate-asks-wired-verifier.md
@@ -0,0 +1,20 @@
+---
+"playground-cli": patch
+---
+
+Ask the personhood verifier the registry actually uses before blocking a
+command.
+
+`playground deploy`, `deploy-all`, `mod` and `decentralize` refused with
+"Join the competition first" for users whose publish the chain would have
+accepted. The gate read `getRootAccount` from the identity spine, but the
+registry does not consult the spine — it consults whatever `set_verifier`
+names, which on the current deployment is an open verifier that accepts every
+account. The CLI was enforcing a stricter rule than the chain, against a
+different contract.
+
+The gate now resolves `registry.getVerifier()` and calls `isVerified` on that
+address, so it is correct both today and on a competition deployment that
+wires the spine, with no flag to keep in sync. It asks the verifier a
+question rather than comparing its address — an address comparison would be
+correct only until the next verifier implementation.
diff --git a/CLAUDE.md b/CLAUDE.md
index 32507ba7..9228775e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -62,7 +62,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **The mobile's "Wallet account address" and "Candidate account address" debug rows are NOT reachable from the host.** They're sr25519 of mnemonic + `//wallet` and mnemonic + `//candidate` respectively (`feature/account/impl/.../RealAccountRepository.kt:166-173`, hard junctions). Hard derivations can't be reproduced from a public key, so the CLI never sees those SS58s. Don't try to surface a "wallet address that matches mobile" — it isn't possible without the mnemonic.
 - **🔴 `PLAYGROUND_PRODUCT_ID` MUST FOLLOW THE ENV TLD — it is `` `playground.${getEnvTld()}` `` (`config.ts`), NOT a fixed `.dot`.** The phone validates the product id against ITS OWN TLD and silently drops a mismatch (polkadot-android-community#123, root-caused by the Android team 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. **An earlier version of this note said the id was "TLD-independent by convention" and told you NOT to thread `getEnvTld` through it. That was wrong** — the phone decides, and playground-app already shipped the env-suffixed form (`defaultDotNsId`, commit `6e9337c`; it prints `product id : playground.paseo` at boot). The two strings MUST match exactly or the CLI and the app derive different H160s for the same human, splitting app ownership, XP and dedupe across two identities. ⚠️ Changing the TLD is an IDENTITY MIGRATION: every derived product account moves, and anything keyed on the old id — cached subtrees and the SDK allowance cache, both `~/.polkadot-apps/{productId}_*.json` — is simply not found under the new id (re-granted at next login, not corrupted). Android still flags their check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. With the env-suffixed id in place, #123 no longer blocks us — it still matters for `localhost:*` ids and for any consumer hardcoding `.dot`. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
 - **`AutoSigning` returns `NotAvailable` on current mobile builds** (measured 2026-09-15 via `@dotli/host-cli` against Android build 1026, alongside `BulletInAllowance` → `Allocated` on the same call). RFC-0010 says `AutoSigning` is the one resource that MUST be requested explicitly — but the wallet will not provision it today, and host-rust-core#343 records that the runtime consumes the capability only for `account.sign_vrf` anyway. So the "AutoSigning makes Bulletin chunk signing work under TrUAPI" plan in `docs-internal/2026-09-14-truapi-host-cli-signing.md` is blocked on BOTH a wallet change and #343. Do not assume it is merely a matter of adding the resource to `PLAYGROUND_RESOURCES`.
-- **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **🔴 CORRECTION (2026-09-17): the RFC-0022 address change DOES strand one thing — the builder-identity gate, which blocks EVERY existing builder from deploying.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so every user's competition membership — which is bound to the OLD H160 — stops being found, and they get the "Couldn't verify your builder status" notice on every deploy. Discovered empirically: a spike account derived the RFC-0022 way was gated out immediately. This is NOT specific to a product-id change; it happens on the plain #366 bump. It needs a migration answer (re-reveal flow, or a registry-side remap) BEFORE the bump ships, or deploy breaks for the entire existing user base. The list below was assessed before this was found and is therefore incomplete — treat it as "these specific things are fine", not "nothing is stranded". **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
+- **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **The builder-identity gate is address-bound, so it resets across the RFC-0022 change — no impact today, but it will bite once builders exist.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so a competition membership recorded against the OLD H160 stops resolving and the user gets "Couldn't verify your builder status" on every deploy. Observed directly: a spike account derived the RFC-0022 way was gated out immediately. **Not a blocker for the #366 bump as of Sept 2026 — there are no joined builders to strand** (confirmed by the product owner), so the reset costs nothing right now. Re-evaluate before the bump if builders have joined by then, or if the gate's backing registry is ever populated ahead of a derivation change; the remedy would be a re-reveal flow or a registry-side remap. Keep in mind generally: anything keyed to the product H160 resets when the derivation changes, and the list below only enumerates the bindings checked at that time. **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
 - **The playground product account is derived by exactly one function** (`src/utils/sessionSigner.ts::derivePlaygroundProductPublicKey`), called by both `createPlaygroundSessionSigner` (signer construction) and `auth.ts::deriveSessionAddresses` (display triple). The math is `deriveProductAccountPublicKey(rootAccountId, "playground.dot", 0)` from `@parity/product-sdk-keys`. Do NOT call `deriveProductAccountPublicKey` (or any helper that wraps it) on an already-product-derived SS58 — that yields a doubly-derived ghost account. The `productAccountDisplay` / `productAccountAddresses` helpers that used to live in `src/commands/login/identityLine.ts` had exactly this bug and were deleted; resist re-introducing them. A frozen-vector regression test in `src/utils/auth.test.ts` (`deriveSessionAddresses` block) locks the pubkey/H160 the playground-app expects.
 - **`SessionAddresses` triples are computed once in `auth.ts` and threaded through.** `ConnectResult`, `LoginStatus.success`, and `SessionHandle` all carry the `{ rootAddress, productAddress, productH160 }` bundle. `SessionHandle.address` is kept as a back-compat alias for `addresses.productAddress` because `signer.ts::resolveSigner` spreads the handle into `ResolvedSigner` and downstream deploy code (`signerMode.ts`, `playground.ts`, `registry.ts`, `DeployScreen.tsx`) reads `.address` for the signing key. UI code should prefer `addresses` so the root vs product distinction stays explicit.
 
diff --git a/src/commands/mod/index.ts b/src/commands/mod/index.ts
index 011cb874..c8da0873 100644
--- a/src/commands/mod/index.ts
+++ b/src/commands/mod/index.ts
@@ -22,7 +22,6 @@ import { getEnvTld } from "../../config.js";
 import { normalizeDomain } from "../../utils/deploy/playground.js";
 import { getConnection, destroyConnection } from "../../utils/connection.js";
 import { getReadOnlyRegistryContract } from "../../utils/registry.js";
-import type { IdentityRegistry } from "../../utils/identity/identityGate.js";
 import { enforceIdentityGate } from "../shared/gateOrNotice.js";
 import { AppBrowser, type AppEntry } from "./AppBrowser.js";
 import { SetupScreen } from "./SetupScreen.js";
@@ -64,13 +63,11 @@ export async function runModCommand(rawDomain: string | undefined): Promise<void
             getReadOnlyRegistryContract(client.raw.assetHub),
         );
 
-        // Builder-identity gate: modding is reserved for revealed builders who
-        // joined the competition. This also gates `playground init`, which
-        // delegates here. Reuse the registry we just resolved so the gate
-        // doesn't re-resolve it. Blocked is a soft outcome (yellow box, exit 0).
-        if (
-            await enforceIdentityGate(client.raw.assetHub, registry as unknown as IdentityRegistry)
-        ) {
+        // Builder-identity gate: modding is reserved for callers the wired
+        // personhood verifier accepts. This also gates `playground init`,
+        // which delegates here. Blocked is a soft outcome (yellow box, exit 0).
+        //
+        if (await enforceIdentityGate(client.raw.assetHub)) {
             process.exitCode = 0;
             return;
         }
diff --git a/src/commands/shared/gateOrNotice.test.ts b/src/commands/shared/gateOrNotice.test.ts
index 60f8a580..c8372b0e 100644
--- a/src/commands/shared/gateOrNotice.test.ts
+++ b/src/commands/shared/gateOrNotice.test.ts
@@ -70,12 +70,19 @@ describe("enforceIdentityGate", () => {
         },
     );
 
-    it("forwards a pre-resolved registry to the gate (so mod doesn't re-resolve)", async () => {
+    /**
+     * Callers pass the client and nothing else. There used to be a second
+     * parameter for a pre-resolved contract; `mod` passed its registry handle
+     * (which has no `isVerified`), the cast hid it from tsc, and every `mod`
+     * run reported "couldn't verify your builder status" on a healthy chain.
+     * The gate resolves the verifier itself now, so that is unrepresentable —
+     * this pins that nothing is forwarded.
+     */
+    it("passes only the client to the gate — no contract can be injected", async () => {
         checkIdentityGateMock.mockResolvedValue({ status: "revealed", productH160: H160 });
-        const registry = { getRootAccount: { query: vi.fn() } };
 
-        await enforceIdentityGate(RAW, registry as any);
+        await enforceIdentityGate(RAW);
 
-        expect(checkIdentityGateMock).toHaveBeenCalledWith(RAW, { registry });
+        expect(checkIdentityGateMock).toHaveBeenCalledWith(RAW);
     });
 });
diff --git a/src/commands/shared/gateOrNotice.ts b/src/commands/shared/gateOrNotice.ts
index 8303ac9f..87b93f0f 100644
--- a/src/commands/shared/gateOrNotice.ts
+++ b/src/commands/shared/gateOrNotice.ts
@@ -15,7 +15,7 @@
 
 import type { PolkadotClient } from "polkadot-api";
 import { withSpan } from "../../telemetry.js";
-import { checkIdentityGate, type IdentityRegistry } from "../../utils/identity/identityGate.js";
+import { checkIdentityGate } from "../../utils/identity/identityGate.js";
 import { renderIdentityGateNotice } from "./IdentityGateNotice.js";
 
 /**
@@ -26,12 +26,9 @@ import { renderIdentityGateNotice } from "./IdentityGateNotice.js";
  * its own cleanup. Returns `false` when the user is a revealed builder and the
  * command may proceed; nothing is printed on that path (no flash on success).
  */
-export async function enforceIdentityGate(
-    rawAssetHubClient: PolkadotClient,
-    registry?: IdentityRegistry,
-): Promise<boolean> {
+export async function enforceIdentityGate(rawAssetHubClient: PolkadotClient): Promise<boolean> {
     const result = await withSpan("cli.identity-gate", "check builder identity", () =>
-        checkIdentityGate(rawAssetHubClient, { registry }),
+        checkIdentityGate(rawAssetHubClient),
     );
     if (result.status === "revealed") return false;
     await renderIdentityGateNotice(result.status);
diff --git a/src/utils/contractManifest.ts b/src/utils/contractManifest.ts
index 2832024d..931e0229 100644
--- a/src/utils/contractManifest.ts
+++ b/src/utils/contractManifest.ts
@@ -25,6 +25,16 @@
 
 export const PLAYGROUND_REGISTRY_CONTRACT = "@w3s/playground-registry";
 
+/**
+ * Identity lives in its OWN contract since the registry split (registry #525).
+ * `getRootAccount` — the builder-identity gate's only read — used to be on the
+ * registry and is not there any more: calling it on the registry handle now
+ * reverts. The split is invisible to `tsc` wherever a call site narrows the
+ * handle to a local structural interface, so keep identity reads pointed at
+ * this name explicitly.
+ */
+export const PLAYGROUND_IDENTITY_CONTRACT = "@w3s/playground-identity";
+
 const REVIVE_TRACE_CALL_COMPAT_ERROR =
     "Incompatible runtime entry RuntimeCall(ReviveApi_trace_call)";
 
diff --git a/src/utils/identity/identityGate.test.ts b/src/utils/identity/identityGate.test.ts
index 10295fac..09765cc7 100644
--- a/src/utils/identity/identityGate.test.ts
+++ b/src/utils/identity/identityGate.test.ts
@@ -16,14 +16,12 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 // Boundary mocks: the gate composes session lookup (auth.ts) + a read-only
-// registry dry-run (registry.ts). We never want a real adapter / network here.
-const { findSessionMock, deriveSessionAddressesMock, getReadOnlyRegistryContractMock } = vi.hoisted(
-    () => ({
-        findSessionMock: vi.fn(),
-        deriveSessionAddressesMock: vi.fn(),
-        getReadOnlyRegistryContractMock: vi.fn(),
-    }),
-);
+// verifier dry-run (registry.ts). We never want a real adapter / network here.
+const { findSessionMock, deriveSessionAddressesMock, getVerifierContractMock } = vi.hoisted(() => ({
+    findSessionMock: vi.fn(),
+    deriveSessionAddressesMock: vi.fn(),
+    getVerifierContractMock: vi.fn(),
+}));
 
 vi.mock("../auth.js", () => ({
     findSession: findSessionMock,
@@ -31,10 +29,10 @@ vi.mock("../auth.js", () => ({
 }));
 
 vi.mock("../registry.js", () => ({
-    getReadOnlyRegistryContract: getReadOnlyRegistryContractMock,
+    getVerifierContract: getVerifierContractMock,
 }));
 
-import { checkIdentityGate, isAnonymousRoot } from "./identityGate.js";
+import { checkIdentityGate } from "./identityGate.js";
 
 const ZERO = ("0x" + "00".repeat(32)) as `0x${string}`;
 const REVEALED = ("0x" + "11".repeat(32)) as `0x${string}`;
@@ -45,10 +43,14 @@ function fakeHandle() {
     return { adapter: { destroy }, address: "5x", session: { rootAccountId: new Uint8Array(32) } };
 }
 
-function fakeRegistry(
+// Stands in for whatever `registry.getVerifier()` names — the gate must ask
+// THAT contract's `isVerified`, never the identity spine's `getRootAccount`
+// (the spine said "anonymous" while the wired open verifier said "yes",
+// so the CLI refused publishes the chain would have accepted).
+function fakeVerifier(
     query: (addr: `0x${string}`) => Promise<{ success: boolean; value?: unknown }>,
 ) {
-    return { getRootAccount: { query: vi.fn(query) } };
+    return { isVerified: { query: vi.fn(query) } };
 }
 
 const FAST = { attempts: 2, delayMs: 0 };
@@ -62,57 +64,21 @@ beforeEach(() => {
     });
 });
 
-describe("isAnonymousRoot", () => {
-    it("treats the 32-zero-byte hex sentinel as anonymous", () => {
-        expect(isAnonymousRoot(ZERO)).toBe(true);
-        expect(isAnonymousRoot("0X" + "00".repeat(32))).toBe(true);
-        expect(isAnonymousRoot("00".repeat(32))).toBe(true); // no 0x prefix
-        expect(isAnonymousRoot("0x")).toBe(true); // empty body
-    });
-
-    it("treats a non-zero root as revealed", () => {
-        expect(isAnonymousRoot(REVEALED)).toBe(false);
-        expect(isAnonymousRoot("0x" + "00".repeat(31) + "01")).toBe(false);
-        expect(
-            isAnonymousRoot("0xAbC0000000000000000000000000000000000000000000000000000000000000"),
-        ).toBe(false);
-    });
-
-    it("handles byte-array representations", () => {
-        expect(isAnonymousRoot(new Uint8Array(32))).toBe(true);
-        const nonZero = new Uint8Array(32);
-        nonZero[31] = 1;
-        expect(isAnonymousRoot(nonZero)).toBe(false);
-        expect(isAnonymousRoot([0, 0, 0])).toBe(true);
-        expect(isAnonymousRoot([0, 1, 0])).toBe(false);
-    });
-
-    it("treats null/undefined as anonymous", () => {
-        expect(isAnonymousRoot(null)).toBe(true);
-        expect(isAnonymousRoot(undefined)).toBe(true);
-    });
-
-    it("throws on an unrecognized representation (forces unverifiable upstream)", () => {
-        expect(() => isAnonymousRoot(5 as unknown)).toThrow();
-        expect(() => isAnonymousRoot({} as unknown)).toThrow();
-    });
-});
-
 describe("checkIdentityGate", () => {
-    it("returns not-logged-in and never reads the registry when no session exists", async () => {
+    it("returns not-logged-in and never reads the verifier when no session exists", async () => {
         findSessionMock.mockResolvedValue(null);
 
         const result = await checkIdentityGate({} as any, FAST);
 
         expect(result).toEqual({ status: "not-logged-in" });
-        expect(getReadOnlyRegistryContractMock).not.toHaveBeenCalled();
+        expect(getVerifierContractMock).not.toHaveBeenCalled();
     });
 
-    it("returns revealed for a non-zero root and releases the session adapter", async () => {
+    it("returns revealed when the wired verifier accepts the caller, and releases the adapter", async () => {
         const handle = fakeHandle();
         findSessionMock.mockResolvedValue(handle);
-        getReadOnlyRegistryContractMock.mockResolvedValue(
-            fakeRegistry(async () => ({ success: true, value: REVEALED })),
+        getVerifierContractMock.mockResolvedValue(
+            fakeVerifier(async () => ({ success: true, value: true })),
         );
 
         const result = await checkIdentityGate({} as any, FAST);
@@ -121,11 +87,11 @@ describe("checkIdentityGate", () => {
         expect(handle.adapter.destroy).toHaveBeenCalledTimes(1);
     });
 
-    it("returns anonymous for the zero-root sentinel and releases the adapter", async () => {
+    it("returns anonymous when the wired verifier rejects the caller, and releases the adapter", async () => {
         const handle = fakeHandle();
         findSessionMock.mockResolvedValue(handle);
-        getReadOnlyRegistryContractMock.mockResolvedValue(
-            fakeRegistry(async () => ({ success: true, value: ZERO })),
+        getVerifierContractMock.mockResolvedValue(
+            fakeVerifier(async () => ({ success: true, value: false })),
         );
 
         const result = await checkIdentityGate({} as any, FAST);
@@ -137,21 +103,21 @@ describe("checkIdentityGate", () => {
     it("returns unverifiable when the dry-run fails on every attempt", async () => {
         const handle = fakeHandle();
         findSessionMock.mockResolvedValue(handle);
-        const registry = fakeRegistry(async () => ({ success: false }));
-        getReadOnlyRegistryContractMock.mockResolvedValue(registry);
+        const verifier = fakeVerifier(async () => ({ success: false }));
+        getVerifierContractMock.mockResolvedValue(verifier);
 
         const result = await checkIdentityGate({} as any, FAST);
 
         expect(result.status).toBe("unverifiable");
-        expect(registry.getRootAccount.query).toHaveBeenCalledTimes(2); // retried
+        expect(verifier.isVerified.query).toHaveBeenCalledTimes(2); // retried
         expect(handle.adapter.destroy).toHaveBeenCalledTimes(1);
     });
 
     it("returns unverifiable when the query throws", async () => {
         const handle = fakeHandle();
         findSessionMock.mockResolvedValue(handle);
-        getReadOnlyRegistryContractMock.mockResolvedValue(
-            fakeRegistry(async () => {
+        getVerifierContractMock.mockResolvedValue(
+            fakeVerifier(async () => {
                 throw new Error("RPC down");
             }),
         );
@@ -162,16 +128,25 @@ describe("checkIdentityGate", () => {
         expect(handle.adapter.destroy).toHaveBeenCalledTimes(1);
     });
 
-    it("uses an injected registry without re-resolving its own", async () => {
+    /**
+     * There is no way to hand the gate a pre-resolved contract, by design: the
+     * verifier it must query is named by `registry.getVerifier()`, so no handle
+     * a caller already holds is the right one. `mod` used to inject its registry
+     * (a cast, so tsc stayed silent) and the gate reported "couldn't verify your
+     * builder status" on a healthy chain. This pins that it always resolves the
+     * verifier itself.
+     */
+    it("always resolves the verifier itself — there is no injection seam", async () => {
         const handle = fakeHandle();
         findSessionMock.mockResolvedValue(handle);
-        const registry = fakeRegistry(async () => ({ success: true, value: REVEALED }));
+        getVerifierContractMock.mockResolvedValue(
+            fakeVerifier(async () => ({ success: true, value: true })),
+        );
 
-        const result = await checkIdentityGate({} as any, { ...FAST, registry });
+        const result = await checkIdentityGate({} as any, FAST);
 
         expect(result).toEqual({ status: "revealed", productH160: H160 });
-        expect(registry.getRootAccount.query).toHaveBeenCalledTimes(1);
-        expect(getReadOnlyRegistryContractMock).not.toHaveBeenCalled();
+        expect(getVerifierContractMock).toHaveBeenCalledTimes(1);
     });
 
     it("returns unverifiable (and releases the adapter) when the session can't be derived", async () => {
@@ -185,6 +160,6 @@ describe("checkIdentityGate", () => {
 
         expect(result.status).toBe("unverifiable");
         expect(handle.adapter.destroy).toHaveBeenCalledTimes(1);
-        expect(getReadOnlyRegistryContractMock).not.toHaveBeenCalled();
+        expect(getVerifierContractMock).not.toHaveBeenCalled();
     });
 });
diff --git a/src/utils/identity/identityGate.ts b/src/utils/identity/identityGate.ts
index 901c6a27..e7fd3478 100644
--- a/src/utils/identity/identityGate.ts
+++ b/src/utils/identity/identityGate.ts
@@ -23,20 +23,20 @@
  * act for them.
  *
  * "Revealed" is decided exactly as the playground-app decides it
- * (`hasRevealedIdentity`): `playground-registry.getRootAccount(productH160)`
+ * (`hasRevealedIdentity`): `playground-identity.getRootAccount(productH160)`
  * returns a NON-zero bytes32. The contract `unwrap_or`s a missing binding to 32
  * zero bytes and never reverts, so the zero sentinel IS the "anonymous" answer.
  *
  * This module is pure logic (no React/Ink). The session's product H160 is
  * derived signer-free from the persisted login (`findSession` ->
  * `deriveSessionAddresses`), and the read uses the keyless revive origin
- * (`getReadOnlyRegistryContract`), so evaluating the gate needs neither a phone
+ * (`getReadOnlyIdentityContract`), so evaluating the gate needs neither a phone
  * tap nor a mapped/funded account.
  */
 
 import type { PolkadotClient } from "polkadot-api";
 import { findSession, deriveSessionAddresses } from "../auth.js";
-import { getReadOnlyRegistryContract } from "../registry.js";
+import { getVerifierContract } from "../registry.js";
 
 export type IdentityGateResult =
     | { status: "revealed"; productH160: `0x${string}` }
@@ -47,20 +47,25 @@ export type IdentityGateResult =
 /** Blocked outcomes — everything except `revealed`. */
 export type BlockedIdentityStatus = "not-logged-in" | "anonymous" | "unverifiable";
 
-interface RootQueryResult {
+interface VerifiedQueryResult {
     success: boolean;
+    /** `true` when the wired verifier accepts this account. */
     value?: unknown;
 }
 
 /**
- * Minimal structural view of the registry handle. `getReadOnlyRegistryContract`
+ * Minimal structural view of the VERIFIER handle. `getVerifierContract`
  * returns a runtime Proxy (via `suppressReviveTraceNoise`) whose full typing we
- * don't want to depend on here. The generated ABI does expose `getRootAccount`
- * (`.cdm/contracts.d.ts`, `response: SizedHex<32>` — i.e. a hex string); we
- * narrow to just the one read method we call.
+ * don't want to depend on here; we narrow to the one read method we call.
+ *
+ * ⚠️ This narrowing is a cast, so `tsc` CANNOT tell you when the underlying
+ * contract stops having the method. Identity moved off the registry in registry
+ * #525, and the gate then asked the spine rather than the verifier the registry
+ * consults — blocking publishes the chain would have accepted. Whatever this is
+ * pointed at, it must be the contract `registry.getVerifier()` names.
  */
-export interface IdentityRegistry {
-    getRootAccount: { query(account: `0x${string}`): Promise<RootQueryResult> };
+export interface PersonhoodVerifier {
+    isVerified: { query(account: `0x${string}`): Promise<VerifiedQueryResult> };
 }
 
 interface GateOptions {
@@ -68,41 +73,29 @@ interface GateOptions {
     attempts?: number;
     /** Delay between retries in ms. Defaults to 250. */
     delayMs?: number;
-    /**
-     * Pre-resolved registry handle. Callers that already built one (e.g. `mod`)
-     * pass it to avoid a second meta-registry resolution + Revive dry-run. When
-     * omitted, the gate resolves its own from `rawAssetHubClient`.
-     */
-    registry?: IdentityRegistry;
 }
 
+/**
+ * ⚠️ There is deliberately NO option to inject a pre-resolved contract here.
+ *
+ * There used to be one, so a caller holding a registry handle could skip a
+ * second meta-registry resolution. It cannot work any more: the gate must read
+ * `registry.getVerifier()` and then query a DIFFERENT contract, so no handle a
+ * caller already has is the right one. `mod` passed its registry anyway — the
+ * narrowing is a cast, so `tsc` saw nothing — and the gate collapsed to
+ * "unverifiable", telling users their builder status couldn't be checked on a
+ * perfectly healthy chain. Resolving internally makes that unrepresentable.
+ * Tests mock `getVerifierContract` instead.
+ */
+
 function describe(err: unknown): string {
     return err instanceof Error ? err.message : String(err);
 }
 
 const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
 
-/**
- * Whether a `getRootAccount` result represents an anonymous (unbound) account.
- *
- * Robust to the representations a bytes32 contract output can arrive as: a
- * `0x`-prefixed (or bare) hex string, a `Uint8Array`/number array, or
- * null/undefined (treated as anonymous). Throws on anything unrecognized so the
- * orchestrator degrades to `unverifiable` rather than guessing.
- */
-export function isAnonymousRoot(value: unknown): boolean {
-    if (value === null || value === undefined) return true;
-    if (typeof value === "string") {
-        const hex = value.slice(0, 2).toLowerCase() === "0x" ? value.slice(2) : value;
-        return hex.length === 0 || /^0+$/.test(hex);
-    }
-    if (value instanceof Uint8Array) return value.every((b) => b === 0);
-    if (Array.isArray(value)) return value.every((b) => Number(b) === 0);
-    throw new Error(`Unrecognized root account representation: ${typeof value}`);
-}
-
-async function queryRoot(
-    registry: IdentityRegistry,
+async function queryVerified(
+    verifier: PersonhoodVerifier,
     account: `0x${string}`,
     attempts: number,
     delayMs: number,
@@ -110,9 +103,9 @@ async function queryRoot(
     let lastError: unknown;
     for (let i = 0; i < attempts; i++) {
         try {
-            const res = await registry.getRootAccount.query(account);
+            const res = await verifier.isVerified.query(account);
             if (res.success) return res.value;
-            lastError = new Error("registry.getRootAccount dry-run was rejected (success=false)");
+            lastError = new Error("verifier.isVerified dry-run was rejected (success=false)");
         } catch (err) {
             lastError = err;
         }
@@ -151,13 +144,18 @@ export async function checkIdentityGate(
     }
 
     try {
-        const registry =
-            opts.registry ??
-            ((await getReadOnlyRegistryContract(rawAssetHubClient)) as unknown as IdentityRegistry);
-        const root = await queryRoot(registry, productH160, attempts, delayMs);
-        return isAnonymousRoot(root)
-            ? { status: "anonymous", productH160 }
-            : { status: "revealed", productH160 };
+        // Ask the verifier the registry itself consults — NOT the identity
+        // spine. `registry::require_revealed()` delegates to whatever
+        // `getVerifier()` names, so querying anything else means the CLI can
+        // refuse a publish the chain would accept (which it did: the open
+        // verifier returns true for everyone while the spine had no binding).
+        const verifier = (await getVerifierContract(
+            rawAssetHubClient,
+        )) as unknown as PersonhoodVerifier;
+        const verified = await queryVerified(verifier, productH160, attempts, delayMs);
+        return verified === true
+            ? { status: "revealed", productH160 }
+            : { status: "anonymous", productH160 };
     } catch (err) {
         return { status: "unverifiable", detail: describe(err) };
     }
diff --git a/src/utils/registry.test.ts b/src/utils/registry.test.ts
index c2729b89..fa2e0291 100644
--- a/src/utils/registry.test.ts
+++ b/src/utils/registry.test.ts
@@ -19,15 +19,17 @@ import type { ResolvedSigner } from "./signer.js";
 import { getChainConfig } from "../config.js";
 import cdmJson from "../../cdm.json";
 
-const { fromLiveClientMock, getContractMock } = vi.hoisted(() => ({
+const { fromLiveClientMock, getContractMock, createContractFromClientMock } = vi.hoisted(() => ({
     fromLiveClientMock: vi.fn(),
     getContractMock: vi.fn(),
+    createContractFromClientMock: vi.fn(),
 }));
 
 vi.mock("@parity/product-sdk-contracts", () => ({
     ContractManager: {
         fromLiveClient: (...args: unknown[]) => fromLiveClientMock(...args),
     },
+    createContractFromClient: (...args: unknown[]) => createContractFromClientMock(...args),
 }));
 
 vi.mock("@parity/product-sdk-descriptors/paseo-asset-hub", () => ({
@@ -36,12 +38,19 @@ vi.mock("@parity/product-sdk-descriptors/paseo-asset-hub", () => ({
 
 vi.mock("./contractManifest.js", () => ({
     PLAYGROUND_REGISTRY_CONTRACT: "@w3s/playground-registry",
+    // Identity split out of the registry in registry #525; `liveManager` now
+    // resolves both names, so the mock must expose both.
+    PLAYGROUND_IDENTITY_CONTRACT: "@w3s/playground-identity",
     suppressReviveTraceNoise: (contract: unknown) => contract,
     // Pass-through wrapper so the live resolution runs unchanged in tests.
     withoutReviveTraceNoise: (fn: () => unknown) => fn(),
 }));
 
-import { getRegistryContract, getReadOnlyRegistryContract } from "./registry.js";
+import {
+    getRegistryContract,
+    getReadOnlyRegistryContract,
+    getVerifierContract,
+} from "./registry.js";
 
 // pallet-revive's keyless pallet account ("modlpy/reviv" + 20 zero bytes),
 // frozen here so a regression back to Alice (or any other origin) fails loudly.
@@ -61,6 +70,8 @@ const fakeSigner: ResolvedSigner = {
 beforeEach(() => {
     fromLiveClientMock.mockReset();
     getContractMock.mockReset();
+    createContractFromClientMock.mockReset();
+    createContractFromClientMock.mockReturnValue({ isVerified: { query: vi.fn() } });
     getContractMock.mockReturnValue({ publish: { tx: vi.fn() } });
     // contracts@0.9 `fromLiveClient` resolves a `Result<ContractManager, …>`.
     fromLiveClientMock.mockResolvedValue({ ok: true, value: { getContract: getContractMock } });
@@ -77,7 +88,7 @@ describe("getRegistryContract", () => {
             rawClient,
             EXPECTED_ASSET_DESCRIPTOR,
             {
-                libraries: ["@w3s/playground-registry"],
+                libraries: ["@w3s/playground-registry", "@w3s/playground-identity"],
                 defaultOrigin: fakeSigner.address,
                 defaultSigner: fakeSigner.signer,
             },
@@ -106,7 +117,7 @@ describe("getReadOnlyRegistryContract", () => {
             rawClient,
             EXPECTED_ASSET_DESCRIPTOR,
             {
-                libraries: ["@w3s/playground-registry"],
+                libraries: ["@w3s/playground-registry", "@w3s/playground-identity"],
                 defaultOrigin: READ_ONLY_ORIGIN,
             },
         );
@@ -121,3 +132,66 @@ describe("getReadOnlyRegistryContract", () => {
         await expect(getReadOnlyRegistryContract({} as any)).rejects.toThrow(/MetaRegistryFailure/);
     });
 });
+
+describe("getVerifierContract", () => {
+    const withVerifier = (res: { success: boolean; value?: unknown }) =>
+        getContractMock.mockReturnValue({ getVerifier: { query: async () => res } });
+
+    it("attaches the minimal ABI to the address the registry reports", async () => {
+        const rawClient = {} as any;
+        withVerifier({ success: true, value: "0x904c2BFc3d38F2FA5E755c95CEaA4929F8a23255" });
+
+        await getVerifierContract(rawClient);
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            rawClient,
+            EXPECTED_ASSET_DESCRIPTOR,
+            "0x904c2BFc3d38F2FA5E755c95CEaA4929F8a23255",
+            [
+                {
+                    inputs: [{ name: "_account", type: "address" }],
+                    name: "isVerified",
+                    outputs: [{ name: "", type: "bool" }],
+                    stateMutability: "view",
+                    type: "function",
+                },
+            ],
+            { defaultOrigin: READ_ONLY_ORIGIN },
+        );
+    });
+
+    /**
+     * The load-bearing property from ADR-0011: ask the verifier a question,
+     * never compare (or hardcode) its address. An operator picks one of several
+     * implementations per deployment, so the address must come from the chain
+     * on every call. If someone "optimises" this to a constant, this fails.
+     */
+    it("follows whatever getVerifier() returns rather than a hardcoded address", async () => {
+        const rawClient = {} as any;
+        withVerifier({ success: true, value: "0x1111111111111111111111111111111111111111" });
+        await getVerifierContract(rawClient);
+        withVerifier({ success: true, value: "0x2222222222222222222222222222222222222222" });
+        await getVerifierContract(rawClient);
+
+        const used = createContractFromClientMock.mock.calls.map((c) => c[2]);
+        expect(used).toEqual([
+            "0x1111111111111111111111111111111111111111",
+            "0x2222222222222222222222222222222222222222",
+        ]);
+    });
+
+    it("throws a clear error when the getVerifier dry-run is rejected", async () => {
+        withVerifier({ success: false });
+
+        await expect(getVerifierContract({} as any)).rejects.toThrow(/getVerifier/);
+        expect(createContractFromClientMock).not.toHaveBeenCalled();
+    });
+
+    /** A non-address payload must fail loudly, not resolve a garbage contract. */
+    it("throws when getVerifier returns something that is not an address", async () => {
+        withVerifier({ success: true, value: { unexpected: "shape" } });
+
+        await expect(getVerifierContract({} as any)).rejects.toThrow(/getVerifier/);
+        expect(createContractFromClientMock).not.toHaveBeenCalled();
+    });
+});
diff --git a/src/utils/registry.ts b/src/utils/registry.ts
index d9c14d57..d84b7f93 100644
--- a/src/utils/registry.ts
+++ b/src/utils/registry.ts
@@ -17,7 +17,12 @@
  * Playground registry contract access.
  */
 
-import { ContractManager, type CdmJson } from "@parity/product-sdk-contracts";
+import {
+    ContractManager,
+    createContractFromClient,
+    type AbiEntry,
+    type CdmJson,
+} from "@parity/product-sdk-contracts";
 import { ss58Encode } from "@parity/product-sdk-address";
 import { getRegistryAddress } from "@parity/cdm-env";
 import type { PolkadotClient } from "polkadot-api";
@@ -26,6 +31,7 @@ import type { ResolvedSigner } from "./signer.js";
 import { getAssetHubDescriptor } from "./descriptors.js";
 import { unwrapResult } from "./tx.js";
 import {
+    PLAYGROUND_IDENTITY_CONTRACT,
     PLAYGROUND_REGISTRY_CONTRACT,
     suppressReviveTraceNoise,
     withoutReviveTraceNoise,
@@ -96,7 +102,7 @@ async function liveManager(
         return unwrapResult(
             await withoutReviveTraceNoise(() =>
                 ContractManager.fromLiveClient(manifest, rawClient, getAssetHubDescriptor(env), {
-                    libraries: [PLAYGROUND_REGISTRY_CONTRACT],
+                    libraries: [PLAYGROUND_REGISTRY_CONTRACT, PLAYGROUND_IDENTITY_CONTRACT],
                     defaultOrigin: origin,
                     ...(signer ? { defaultSigner: signer.signer } : {}),
                 }),
@@ -135,3 +141,81 @@ export async function getReadOnlyRegistryContract(rawClient: PolkadotClient) {
     const manager = await liveManager(rawClient, READ_ONLY_QUERY_ORIGIN);
     return suppressReviveTraceNoise(manager.getContract(PLAYGROUND_REGISTRY_CONTRACT));
 }
+
+/**
+ * Minimal ABI for the personhood-verifier interface: the one read the gate
+ * needs. Deliberately not the full open-verifier ABI — any verifier
+ * implementation exposes `isVerified`, and narrowing to it keeps this working
+ * against implementations that do not exist yet.
+ */
+const VERIFIER_ABI = [
+    {
+        inputs: [{ name: "_account", type: "address" }],
+        name: "isVerified",
+        outputs: [{ name: "", type: "bool" }],
+        stateMutability: "view",
+        type: "function",
+    },
+] as const;
+
+/**
+ * Read-only handle to whichever verifier the REGISTRY is currently wired to.
+ *
+ * The registry's `require_revealed()` delegates to `getVerifier()`, so that —
+ * not the identity spine — is the authority on whether a publish is allowed.
+ * On the current deployment it is the open verifier, whose `is_verified()`
+ * returns `true` for every account; on a competition deployment it is the
+ * spine, which returns false for an unrevealed caller. Asking the wired
+ * verifier is therefore correct in BOTH regimes with no flag to keep in sync.
+ *
+ * Load-bearing: **ask the verifier a question, never compare its address.**
+ * ADR-0011 names three implementations (PoP spine, attendance SBT, open
+ * verifier) and an operator picks one per event, so `verifier === <known
+ * address>` is correct only until the next one. We resolve the address at
+ * runtime and attach the minimal ABI to it via `createContractFromClient`,
+ * which works for implementations that are not in our `cdm.json` at all.
+ */
+export async function getVerifierContract(rawClient: PolkadotClient) {
+    const registry = await getReadOnlyRegistryContract(rawClient);
+    const res = await (
+        registry as unknown as {
+            getVerifier: { query(): Promise<{ success: boolean; value?: unknown }> };
+        }
+    ).getVerifier.query();
+    if (!res?.success || typeof res.value !== "string") {
+        throw new Error(
+            "Could not read registry.getVerifier() — cannot determine which personhood " +
+                "verifier gates publishing on this deployment.",
+        );
+    }
+    return suppressReviveTraceNoise(
+        createContractFromClient(
+            rawClient,
+            getAssetHubDescriptor(getChainConfig().env),
+            res.value as `0x${string}`,
+            VERIFIER_ABI as unknown as AbiEntry[],
+            { defaultOrigin: READ_ONLY_QUERY_ORIGIN },
+        ),
+    );
+}
+
+/**
+ * Read-only handle to the playground IDENTITY contract (the personhood spine).
+ *
+ * ⚠️ CURRENTLY UNUSED, and deliberately so. The builder gate used to read
+ * `getRootAccount` here; it now asks `getVerifierContract()` instead, because
+ * the registry consults the verifier it was wired with and the spine is only
+ * one possible implementation. Kept because the spine is a real contract we
+ * will need for a reveal / "become a builder" path — but do NOT reintroduce it
+ * as a gate: that is the bug this replaced.
+ *
+ * Identity moved out of the registry in registry #525 — `getRootAccount` is no
+ * longer a registry method, so the builder-identity gate must read it here or
+ * the call reverts on-chain. Same read-only contract as
+ * `getReadOnlyRegistryContract`: no signer, `READ_ONLY_QUERY_ORIGIN` as the
+ * dry-run origin, `.query()` only.
+ */
+export async function getReadOnlyIdentityContract(rawClient: PolkadotClient) {
+    const manager = await liveManager(rawClient, READ_ONLY_QUERY_ORIGIN);
+    return suppressReviveTraceNoise(manager.getContract(PLAYGROUND_IDENTITY_CONTRACT));
+}

From 0fdae6dd84e0e854c74412137982b4ade9997386 Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Tue, 22 Sep 2026 10:19:14 +0800
Subject: [PATCH 06/10] fix(mod): compile without the generated .cdm contract
 types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI's Typecheck failed on this PR: `Argument of type 'Contract<ContractDef>'
is not assignable to parameter of type 'MetadataUriReader'`.

The registry handle only carries its per-method types when `.cdm/` has been
generated by `cdm install`. That directory is gitignored and CI never
creates it, so there the handle is a bare `Contract<ContractDef>` with no
`getMetadataUri` at all — no structural interface can match it. Locally,
with `.cdm/` present, the same code type-checks cleanly, which is why this
could not be caught before pushing.

Cast at the single call site. `getAppMetadataUri` validates the response
shape at runtime and throws on anything unexpected, so the cast costs no
real safety.

Verified under both conditions by temporarily hiding `.cdm/` and re-running
`tsc`: zero errors with and without it.
---
 src/commands/mod/index.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/commands/mod/index.ts b/src/commands/mod/index.ts
index c8da0873..a6af18c6 100644
--- a/src/commands/mod/index.ts
+++ b/src/commands/mod/index.ts
@@ -133,7 +133,16 @@ export async function runModCommand(rawDomain: string | undefined): Promise<void
                     const fetched = await withSpan(
                         "cli.mod.fetch-metadata",
                         "fetch app metadata for quest probe",
-                        () => fetchAppMetadata(registry, domain),
+                        // The registry handle only carries its per-method types
+                        // when `.cdm/` has been generated. That directory is
+                        // gitignored and CI never creates it, so there the
+                        // handle is a bare `Contract<ContractDef>` with no
+                        // `getMetadataUri` and this call fails to compile —
+                        // locally it type-checks fine, which is exactly why the
+                        // gap is worth closing (see the follow-up in the PR).
+                        // `getAppMetadataUri` validates the response at runtime,
+                        // so the cast costs no real safety.
+                        () => fetchAppMetadata(registry as unknown as MetadataUriReader, domain),
                     );
                     repoRef = fetched.repository ? parseGitHubRepoUrl(fetched.repository) : null;
                     questBranch = fetched.branch;

From d59058d55a582ba9916be55d11e648ccd882c7de Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Wed, 23 Sep 2026 09:45:11 +0800
Subject: [PATCH 07/10] ci: commit the generated contract types so CI
 typechecks contract calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`.cdm/` was gitignored wholesale and CI never generated it — the `cdm` CLI is
a global tool that needs chain access, not a repo dependency. So the
`Typecheck` job was checking everything EXCEPT the contract call sites: with
no module augmentation, every registry handle is a bare
`Contract<ContractDef>` and `.query()`/`.tx()` calls go unchecked.

That is not hypothetical. It hid the 7-argument `publish` call against a
4-argument v2 contract, and a `getMetadataUri` shape bug that broke
`playground mod` and `playground init` for every app. It also produces the
inverse trap, which this PR hit: code that compiles locally fails in CI,
because a structural interface cannot match the un-augmented type.

Commit only the two `.d.ts` module augmentations. The rest of `.cdm/` stays
ignored: `contracts/**/info.json` snapshots per-version contract addresses we
never read (they resolve live from the CDM meta-registry), so committing them
would add a second, stale source of truth.

Verified by hiding `.cdm/contracts/` — leaving exactly what CI will have — and
re-running `tsc`: zero errors.

The license check now skips `.cdm/`. Those files are generated and marked "do
not edit", so a header would be stripped by the next `cdm i` and turn the
check red on a routine regeneration.
---
 .cdm/cdm.d.ts                    | 85 ++++++++++++++++++++++++++++++++
 .cdm/contracts.d.ts              | 85 ++++++++++++++++++++++++++++++++
 .gitignore                       | 10 +++-
 CLAUDE.md                        |  4 +-
 scripts/check-license-headers.sh |  7 ++-
 5 files changed, 188 insertions(+), 3 deletions(-)
 create mode 100644 .cdm/cdm.d.ts
 create mode 100644 .cdm/contracts.d.ts

diff --git a/.cdm/cdm.d.ts b/.cdm/cdm.d.ts
new file mode 100644
index 00000000..a1696028
--- /dev/null
+++ b/.cdm/cdm.d.ts
@@ -0,0 +1,85 @@
+// Auto-generated by cdm install -- do not edit
+import type { HexString, SizedHex } from "polkadot-api";
+
+declare module "@parity/cdm-codegen" {
+    interface CdmContracts {
+        "@w3s/playground-registry": {
+            methods: {
+                getAppCount: { args: []; response: number };
+                getDomainAt: { args: [index: number]; response: string };
+                getMetadataUri: { args: [domain: string]; response: string };
+                getOwner: { args: [domain: string]; response: HexString };
+                getVisibility: { args: [domain: string]; response: number };
+                getOwnerAppCount: { args: [owner: HexString]; response: number };
+                getOwnerDomainAt: { args: [owner: HexString, index: number]; response: string };
+                getSudo: { args: []; response: HexString };
+                isAdmin: { args: [addr: HexString]; response: boolean };
+                isBlacklisted: { args: [account: HexString]; response: boolean };
+                getPoints: { args: [account: HexString]; response: bigint };
+                getApps: { args: [start: number, count: number]; response: { total: number; scanned: number; entries: { index: number; domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString }[] } };
+                getStarCount: { args: [domain: string]; response: number };
+                getModCount: { args: [domain: string]; response: number };
+                getLineageCount: { args: []; response: number };
+                getLineage: { args: [start: number, count: number]; response: { child: string; source: string }[] };
+                hasStarred: { args: [voter: HexString, domain: string]; response: boolean };
+                getAppData: { args: [domains: string[], voter: HexString]; response: { domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString; star_count: number; mod_count: number; has_starred: boolean }[] };
+                getPointBreakdown: { args: [account: HexString]; response: { mod_points: bigint; star_points: bigint; total: bigint } };
+                isPinned: { args: [domain: string]; response: boolean };
+                getPinnedApps: { args: []; response: { index: number; domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString }[] };
+                getBuilderCount: { args: []; response: number };
+                getBuilders: { args: [start: number, count: number]; response: { total: number; scanned: number; entries: { account: HexString; score: bigint }[] } };
+                pin: { args: [domain: string]; response: undefined };
+                unpin: { args: [domain: string]; response: undefined };
+                star: { args: [domain: string]; response: undefined };
+                publish: { args: [domain: string, metadata_uri: string, visibility: number, modded_from: string]; response: undefined };
+                setVisibility: { args: [domain: string, visibility: number]; response: undefined };
+                unpublish: { args: [domain: string]; response: undefined };
+                addAdmin: { args: [admin: HexString]; response: undefined };
+                removeAdmin: { args: [admin: HexString]; response: undefined };
+                adminSetDeployAwardCount: { args: [account: HexString, count: number]; response: undefined };
+                adminSetAppSocialCounts: { args: [domain: string, star_count: number, mod_count: number]; response: undefined };
+                setBlacklisted: { args: [accounts: HexString[], value: boolean]; response: undefined };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                isFrozen: { args: []; response: boolean };
+                setVerifier: { args: [verifier: HexString]; response: undefined };
+                getVerifier: { args: []; response: HexString };
+                importApp: { args: [domain: string, owner: HexString, publisher: HexString, visibility: number, metadata_uri: string]; response: undefined };
+                importApps: { args: [apps: { domain: string; owner: HexString; publisher: HexString; visibility: number; metadata_uri: string }[]]; response: undefined };
+                importPinned: { args: [domain: string]; response: undefined };
+                importLineage: { args: [entries: { child: string; source: string }[]]; response: undefined };
+                importPoints: { args: [entries: { account: HexString; total: bigint }[]]; response: undefined };
+                importSocialCounts: { args: [entries: { domain: string; star_count: number; mod_count: number }[]]; response: undefined };
+            };
+        };
+        "@w3s/playground-identity": {
+            methods: {
+                setIdentity: { args: [root_pubkey: SizedHex<32>, signature: number[]]; response: undefined };
+                clearIdentity: { args: []; response: undefined };
+                isVerified: { args: [account: HexString]; response: boolean };
+                rootOf: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccount: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccounts: { args: [accounts: HexString[]]; response: SizedHex<32>[] };
+                adminSetIdentity: { args: [account: HexString, root_pubkey: SizedHex<32>]; response: undefined };
+                adminClearIdentity: { args: [account: HexString]; response: undefined };
+                addAdmin: { args: [admin: HexString]; response: undefined };
+                removeAdmin: { args: [admin: HexString]; response: undefined };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                importIdentities: { args: [accounts: HexString[], roots: SizedHex<32>[]]; response: undefined };
+            };
+        };
+        "@w3s/playground-open-verifier": {
+            methods: {
+                isVerified: { args: [_account: HexString]; response: boolean };
+                rootOf: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccount: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccounts: { args: [accounts: HexString[]]; response: SizedHex<32>[] };
+                faucet: { args: []; response: undefined };
+                canClaim: { args: [account: HexString]; response: boolean };
+                lastClaimAt: { args: [account: HexString]; response: number };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                getSudo: { args: []; response: HexString };
+                isFrozen: { args: []; response: boolean };
+            };
+        };
+    }
+}
diff --git a/.cdm/contracts.d.ts b/.cdm/contracts.d.ts
new file mode 100644
index 00000000..492ea946
--- /dev/null
+++ b/.cdm/contracts.d.ts
@@ -0,0 +1,85 @@
+// Auto-generated by cdm install -- do not edit
+import type { HexString, SizedHex } from "polkadot-api";
+
+declare module "@parity/product-sdk-contracts" {
+    interface Contracts {
+        "@w3s/playground-registry": {
+            methods: {
+                getAppCount: { args: []; response: number };
+                getDomainAt: { args: [index: number]; response: string };
+                getMetadataUri: { args: [domain: string]; response: string };
+                getOwner: { args: [domain: string]; response: HexString };
+                getVisibility: { args: [domain: string]; response: number };
+                getOwnerAppCount: { args: [owner: HexString]; response: number };
+                getOwnerDomainAt: { args: [owner: HexString, index: number]; response: string };
+                getSudo: { args: []; response: HexString };
+                isAdmin: { args: [addr: HexString]; response: boolean };
+                isBlacklisted: { args: [account: HexString]; response: boolean };
+                getPoints: { args: [account: HexString]; response: bigint };
+                getApps: { args: [start: number, count: number]; response: { total: number; scanned: number; entries: { index: number; domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString }[] } };
+                getStarCount: { args: [domain: string]; response: number };
+                getModCount: { args: [domain: string]; response: number };
+                getLineageCount: { args: []; response: number };
+                getLineage: { args: [start: number, count: number]; response: { child: string; source: string }[] };
+                hasStarred: { args: [voter: HexString, domain: string]; response: boolean };
+                getAppData: { args: [domains: string[], voter: HexString]; response: { domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString; star_count: number; mod_count: number; has_starred: boolean }[] };
+                getPointBreakdown: { args: [account: HexString]; response: { mod_points: bigint; star_points: bigint; total: bigint } };
+                isPinned: { args: [domain: string]; response: boolean };
+                getPinnedApps: { args: []; response: { index: number; domain: string; metadata_uri: string; owner: HexString; visibility: number; publisher: HexString }[] };
+                getBuilderCount: { args: []; response: number };
+                getBuilders: { args: [start: number, count: number]; response: { total: number; scanned: number; entries: { account: HexString; score: bigint }[] } };
+                pin: { args: [domain: string]; response: undefined };
+                unpin: { args: [domain: string]; response: undefined };
+                star: { args: [domain: string]; response: undefined };
+                publish: { args: [domain: string, metadata_uri: string, visibility: number, modded_from: string]; response: undefined };
+                setVisibility: { args: [domain: string, visibility: number]; response: undefined };
+                unpublish: { args: [domain: string]; response: undefined };
+                addAdmin: { args: [admin: HexString]; response: undefined };
+                removeAdmin: { args: [admin: HexString]; response: undefined };
+                adminSetDeployAwardCount: { args: [account: HexString, count: number]; response: undefined };
+                adminSetAppSocialCounts: { args: [domain: string, star_count: number, mod_count: number]; response: undefined };
+                setBlacklisted: { args: [accounts: HexString[], value: boolean]; response: undefined };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                isFrozen: { args: []; response: boolean };
+                setVerifier: { args: [verifier: HexString]; response: undefined };
+                getVerifier: { args: []; response: HexString };
+                importApp: { args: [domain: string, owner: HexString, publisher: HexString, visibility: number, metadata_uri: string]; response: undefined };
+                importApps: { args: [apps: { domain: string; owner: HexString; publisher: HexString; visibility: number; metadata_uri: string }[]]; response: undefined };
+                importPinned: { args: [domain: string]; response: undefined };
+                importLineage: { args: [entries: { child: string; source: string }[]]; response: undefined };
+                importPoints: { args: [entries: { account: HexString; total: bigint }[]]; response: undefined };
+                importSocialCounts: { args: [entries: { domain: string; star_count: number; mod_count: number }[]]; response: undefined };
+            };
+        };
+        "@w3s/playground-identity": {
+            methods: {
+                setIdentity: { args: [root_pubkey: SizedHex<32>, signature: number[]]; response: undefined };
+                clearIdentity: { args: []; response: undefined };
+                isVerified: { args: [account: HexString]; response: boolean };
+                rootOf: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccount: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccounts: { args: [accounts: HexString[]]; response: SizedHex<32>[] };
+                adminSetIdentity: { args: [account: HexString, root_pubkey: SizedHex<32>]; response: undefined };
+                adminClearIdentity: { args: [account: HexString]; response: undefined };
+                addAdmin: { args: [admin: HexString]; response: undefined };
+                removeAdmin: { args: [admin: HexString]; response: undefined };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                importIdentities: { args: [accounts: HexString[], roots: SizedHex<32>[]]; response: undefined };
+            };
+        };
+        "@w3s/playground-open-verifier": {
+            methods: {
+                isVerified: { args: [_account: HexString]; response: boolean };
+                rootOf: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccount: { args: [account: HexString]; response: SizedHex<32> };
+                getRootAccounts: { args: [accounts: HexString[]]; response: SizedHex<32>[] };
+                faucet: { args: []; response: undefined };
+                canClaim: { args: [account: HexString]; response: boolean };
+                lastClaimAt: { args: [account: HexString]; response: number };
+                setFrozen: { args: [value: boolean]; response: undefined };
+                getSudo: { args: []; response: HexString };
+                isFrozen: { args: []; response: boolean };
+            };
+        };
+    }
+}
diff --git a/.gitignore b/.gitignore
index eac1ca67..2b37f56f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,15 @@
 node_modules/
 dist/
 
-.cdm/
+# Generated by `cdm install`. The TYPE augmentations ARE committed (below) so
+# CI typechecks contract call sites — without them the registry handle is a bare
+# `Contract<ContractDef>` and every call silently goes unchecked. The resolved
+# artifacts under .cdm/contracts/ are NOT committed: they snapshot per-version
+# contract addresses we never read (addresses resolve live from the CDM
+# meta-registry), so they would be a second, stale source of truth.
+.cdm/*
+!.cdm/cdm.d.ts
+!.cdm/contracts.d.ts
 docs-internal/
 docs/superpowers/
 .worktrees/
diff --git a/CLAUDE.md b/CLAUDE.md
index 9228775e..5c5d3b60 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,7 +13,9 @@ pnpm typecheck
 pnpm test
 ```
 
-`pnpm build` compiles with bun, which STRIPS types without checking them — it is NOT a type signal. The tsc baseline was burned to zero in June 2026 and `pnpm typecheck` (`tsc --noEmit`) now runs as a CI job, so any new type error fails the build — keep it at zero. The cdm-builder version skew is bridged through THREE cast seams: `asCloudStorageApi` in `src/utils/allowances/bulletin.ts` (the `TypedApi<Paseo_bulletin>` vs `BulletinTypedApi` codegen skew — two codegens of the same chain), plus `asCdmAssetHubApi`/`asCdmAssetHubDescriptor` and `asCdmRegistryContract` in `src/commands/contract.ts`. The asset-hub seams bridge the paseo-asset-hub `DotnsGateway`/descriptor shape drift between cdm-builder's pinned `@parity/product-sdk-descriptors` and our root's (the contract pipeline never touches DotnsGateway, so the cast is runtime-safe). `asCdmRegistryContract` was added when our root `@parity/product-sdk-contracts` reached `0.9.x`: `Contract.tx()` now resolves a `Result<TxResult, …>`, nominally unassignable to cdm-builder's older `RegistryContract` param — but the install-time registry is query-only (no signer wired in), so `.tx()` is never invoked through it and the cast is runtime-safe. At `cdm-builder@3.2.0` the pinned product-sdk moved up to `contracts@0.9.0` / `descriptors@0.7.0` while our root is `contracts@^0.9.2` / `descriptors@^0.8.0` — so the `.tx()` Result shape realigns (making `asCdmRegistryContract` likely redundant) while a descriptors minor gap (0.7 vs 0.8) remains. Before deleting any seam, remove it and run `pnpm typecheck`. If `lint:license` flags a file you authored, run `./scripts/check-license-headers.sh --fix` to prepend the standard Parity Apache-2.0 header (`SPDX-License-Identifier: Apache-2.0` + `Copyright (C) Parity Technologies (UK) Ltd.`, both lines required). The check script keeps shebangs on line 1 and places the header below them.
+`pnpm build` compiles with bun, which STRIPS types without checking them — it is NOT a type signal. The tsc baseline was burned to zero in June 2026 and `pnpm typecheck` (`tsc --noEmit`) now runs as a CI job, so any new type error fails the build — keep it at zero.
+
+**`.cdm/cdm.d.ts` and `.cdm/contracts.d.ts` are COMMITTED, and must stay so.** They are generated by `cdm install` and are the module augmentation that gives contract handles their real per-method signatures. Without them the registry handle is a bare `Contract<ContractDef>`, and every `.query()`/`.tx()` call site goes silently unchecked — that gap let the 7-arg `publish` regression and a `getMetadataUri` shape bug through, and it also produces the inverse trap (code that compiles locally and fails only in CI, because a structural interface can't match the un-augmented type). `.cdm/` was gitignored wholesale until Sept 2026; CI never ran `cdm install` (the `cdm` CLI is a global tool needing chain access, not a repo dep), so the `Typecheck` job was checking everything EXCEPT the contract calls. The rest of `.cdm/` stays ignored on purpose: `contracts/**/info.json` snapshots per-version contract addresses that we never read (addresses resolve live from the CDM meta-registry), so committing them would add a second, stale source of truth. **After any `cdm i`, commit the regenerated `.d.ts` files** — a stale one type-checks against the previous ABI, which is exactly the failure this prevents. The cdm-builder version skew is bridged through THREE cast seams: `asCloudStorageApi` in `src/utils/allowances/bulletin.ts` (the `TypedApi<Paseo_bulletin>` vs `BulletinTypedApi` codegen skew — two codegens of the same chain), plus `asCdmAssetHubApi`/`asCdmAssetHubDescriptor` and `asCdmRegistryContract` in `src/commands/contract.ts`. The asset-hub seams bridge the paseo-asset-hub `DotnsGateway`/descriptor shape drift between cdm-builder's pinned `@parity/product-sdk-descriptors` and our root's (the contract pipeline never touches DotnsGateway, so the cast is runtime-safe). `asCdmRegistryContract` was added when our root `@parity/product-sdk-contracts` reached `0.9.x`: `Contract.tx()` now resolves a `Result<TxResult, …>`, nominally unassignable to cdm-builder's older `RegistryContract` param — but the install-time registry is query-only (no signer wired in), so `.tx()` is never invoked through it and the cast is runtime-safe. At `cdm-builder@3.2.0` the pinned product-sdk moved up to `contracts@0.9.0` / `descriptors@0.7.0` while our root is `contracts@^0.9.2` / `descriptors@^0.8.0` — so the `.tx()` Result shape realigns (making `asCdmRegistryContract` likely redundant) while a descriptors minor gap (0.7 vs 0.8) remains. Before deleting any seam, remove it and run `pnpm typecheck`. If `lint:license` flags a file you authored, run `./scripts/check-license-headers.sh --fix` to prepend the standard Parity Apache-2.0 header (`SPDX-License-Identifier: Apache-2.0` + `Copyright (C) Parity Technologies (UK) Ltd.`, both lines required). The check script keeps shebangs on line 1 and places the header below them.
 
 ## Non-obvious invariants
 
diff --git a/scripts/check-license-headers.sh b/scripts/check-license-headers.sh
index 4eb35067..b01fda05 100755
--- a/scripts/check-license-headers.sh
+++ b/scripts/check-license-headers.sh
@@ -26,6 +26,11 @@ HEADER='// Copyright (C) Parity Technologies (UK) Ltd.
 '
 
 # git ls-files honors .gitignore, so dist/, node_modules/, target/ are skipped.
+#
+# `.cdm/` is excluded explicitly: its two committed `.d.ts` files are generated
+# by `cdm install` ("do not edit"), and any header we added would be stripped by
+# the next regeneration — turning this check red on a routine `cdm i`. They are
+# committed so CI can typecheck contract call sites, not as authored source.
 mode="${1:-check}"
 missing=()
 total=0
@@ -39,7 +44,7 @@ while IFS= read -r f; do
      || ! grep -q 'Copyright (C) Parity Technologies' "$f"; then
     missing+=("$f")
   fi
-done < <(git ls-files '*.ts' '*.tsx' '*.rs')
+done < <(git ls-files '*.ts' '*.tsx' '*.rs' | grep -v '^\.cdm/')
 
 if [[ ${#missing[@]} -eq 0 ]]; then
   echo "All ${total} source files have the Apache-2.0 SPDX header."

From f65f5dd17ee1b25aa921bcb52989dd5f4da2e62b Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Thu, 24 Sep 2026 08:04:18 +0800
Subject: [PATCH 08/10] feat(auth): fix QR pairing and sign as the RFC-0022
 product account
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Moves to @parity/product-sdk-terminal@^0.10.0 (host-papp 0.10.0), which
carries product-sdk #364 and #366 together.

Pairing has been impossible since mid-August. host-papp 0.9.0 moved the SSO
envelope from P-256/AES-GCM to X25519/ChaCha20-Poly1305, shrinking the device
key from 65 to 32 bytes; the handshake codec is fixed-width, so a 65-byte
sender is undecodable rather than degraded — iOS said "Something went wrong",
Android "invalid QR code". Every terminal up to 0.8.2 pinned host-papp ^0.8.9,
whose 0.x ceiling is the last release of the old wire, so no bump below 0.9
could have helped.

Do NOT take 0.9.x on the way past: that is #364 without #366, where pairing
succeeds and then checkMapping fails permanently, because the phone mints PGAS
to the RFC-0022 address while an unmigrated CLI checks the old one — reported
in the UI as transient, so it loops forever.

RFC-0022 puts the product account at //product//{productId}/{index} with the
two //product//{productId} junctions HARD. A public key cannot cross a hard
junction, so the parent is now a subtree key the wallet provides, and the
derivation is async. `deriveSessionAddresses` becomes async with it.

Two things the pre-merge notes got wrong, both caught here:

  - `ProductAccountRef.derivationIndex` stayed a plain number. The tagged
    DerivationIndex lives inside @parity/product-sdk-keys, whose
    `deriveProductAccountPublicKey(subtree, {tag,value})` is a 2-arg form, so
    the root moves to keys ^0.4.0. On 0.3.x that call is a tsc error; bypass
    tsc and it derives from a stringified object instead. Worth noting because
    a vitest-only run does not typecheck — which is how it reached a test run
    at all.
  - `publicKey` on the ref is optional; we omit it deliberately so the signer
    and the address we display resolve through the same cached subtree and
    cannot desync.

Tests pin the derivation at the primitive against host-rust-core's own
cross-host vector (wasm_crypto_vectors.rs), not against our output — a fixture
regenerated from the code it checks is worthless. They also mock the SDK's
subtree fetch: unmocked it hangs waiting for a phone and writes a bogus key
into the developer's real ~/.polkadot-apps cache, breaking their live session.

`productAccount.test.ts` is deleted: the product id no longer enters that
primitive, so it could no longer test the wiring it claimed to, and its
assertions are subsumed by the exact vector test.

Verified against a real paired session: the built binary derives
0x8755a050e0b47300a7454942dac4f5dafd8222e5 — the address playground-app prints
and the owner of the apps deployed today.

Users pair again once (playground logout + playground login); anything already
published stays owned by the old address.
---
 .changeset/rfc0022-product-accounts.md        |  25 ++
 CLAUDE.md                                     |   4 +-
 package.json                                  |   4 +-
 ...ovasamatech__statement-store@0.10.0.patch} |   0
 pnpm-lock.yaml                                | 243 ++++++++++++++++--
 pnpm-workspace.yaml                           |  29 ++-
 src/utils/auth.connect.test.ts                |  18 ++
 src/utils/auth.test.ts                        |  71 +++--
 src/utils/auth.ts                             |  20 +-
 src/utils/productAccount.test.ts              |  33 ---
 src/utils/sessionSigner.test.ts               | 128 ++++++---
 src/utils/sessionSigner.ts                    |  50 ++--
 src/utils/signer.ts                           |   3 +-
 13 files changed, 482 insertions(+), 146 deletions(-)
 create mode 100644 .changeset/rfc0022-product-accounts.md
 rename patches/{@novasamatech__statement-store@0.8.11.patch => @novasamatech__statement-store@0.10.0.patch} (100%)
 delete mode 100644 src/utils/productAccount.test.ts

diff --git a/.changeset/rfc0022-product-accounts.md b/.changeset/rfc0022-product-accounts.md
new file mode 100644
index 00000000..4d5a6d72
--- /dev/null
+++ b/.changeset/rfc0022-product-accounts.md
@@ -0,0 +1,25 @@
+---
+"playground-cli": minor
+---
+
+Fix QR pairing, and sign as the RFC-0022 product account.
+
+`playground login` has been unable to pair with current phones since
+mid-August: `@novasamatech/host-papp` 0.9.0 moved the pairing envelope from
+P-256/AES-GCM to X25519/ChaCha20-Poly1305, shrinking the device key from 65 to
+32 bytes. The handshake codec is fixed-width, so there was no graceful
+degrade — iOS reported "Something went wrong" and Android "invalid QR code".
+Moving to `@parity/product-sdk-terminal@0.10.0` (host-papp 0.10.0) puts the CLI
+back on the wire both shipping apps speak.
+
+The same release changes how the product account is derived. RFC-0022 places it
+at `//product//{productId}/{index}`, where the two `//product//{productId}`
+junctions are HARD — and a public key cannot cross a hard junction, so the
+account is now derived from a subtree key the wallet provides rather than from
+the session's root key locally.
+
+**Your product account address changes, and you must pair again.** Run
+`playground logout` and then `playground login`. Apps published from the old
+address stay owned by it; allowances and PGAS are re-granted at the next login.
+The new derivation is what current phones and the playground web app already
+use, so this brings the CLI back into agreement with them rather than away.
diff --git a/CLAUDE.md b/CLAUDE.md
index 5c5d3b60..64e3d528 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -33,7 +33,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **`bulletin-deploy` (formerly `@parity/polkadot-app-deploy`) is pinned to an explicit version (`0.18.4` as of 2026-09-17; previously `0.15.0` — see the generations note above for why that was harmful), not `latest`.** A previous `latest` (0.6.8) had a WebSocket-heartbeat bug that tore chunk uploads down mid-flight. The pin avoids ever silently sliding onto a broken `latest`. When bumping, read release notes for changes to `deploy()`, DotNS methods, or the `DeployOptions` we use (`jsMerkle`, `signer`, `signerAddress`, `storageSigner`, `storageSignerAddress`, `mnemonic`, `rpc`, `attributes`). Newer releases now also export environment helpers (`loadEnvironments`, `resolveEndpoints`, etc.); we don't consume them — our env table lives in `src/config.ts::CONFIGS`. Do NOT downgrade below 0.8.3: 0.7.30-rc/0.8.0 changed storage routing to use the injected `signer` (so phone-mode chunk uploads would phone-sign and die with "message too big"), and 0.8.3 is the first release with the `storageSigner` slot-key escape hatch. The `0.8.3 → 0.9.0` bump (June 2026) was a code/API drop-in: index exports unchanged, `deploy()` signature unchanged, `DeployOptions` only additive, console log strings unchanged (so `src/utils/deploy/progress.ts`'s banner/`[N/M]` parser still matches), `storageSigner` routing precedence unchanged. It aligns polkadot-app-deploy onto `@novasamatech/host-papp@0.8.6` / `@parity/product-sdk-terminal@0.3.x` (collapsing the prior split tree onto our root line), and prefix-matches `dot-cli_SsoSessions*` in its SSO-session probe (still defused because we always pass explicit auth/signer/storageSigner). 0.9.0 also ships a `postinstall` (`patch-package || true`) bundling an `@novasamatech/sdk-statement@0.6.0` patch; we DENY that build script (`allowBuilds: polkadot-app-deploy: false` in `pnpm-workspace.yaml`) because our own pnpm patch on that exact package already applies the fix — pnpm 11 will hard-fail every `pnpm <script>` with `ERR_PNPM_IGNORED_BUILDS` if the entry is left undecided. The phone-tap-reduction (`transferToSignedInUser`, now shipped in 0.10.0 stable) is unreachable for us regardless: it activates only on polkadot-app-deploy's own signer-resolution (`resolve`) branch, and we always inject an explicit `signer`/`mnemonic`. The `0.9.0 → 0.10.0` bump (June 2026) was the same class of additive drop-in: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (`transferToSignedInUser`/`transferTo`), console log strings unchanged (progress parser still matches), `storageSigner` routing precedence unchanged; it moves polkadot-app-deploy's own subtree onto `@parity/product-sdk-terminal@^0.4.0` and still ships the denied `patch-package` postinstall. (Since our June 2026 terminal `^0.5.0` bump, pad's `^0.8.6` host-papp range dedupes onto our 0.8.7 — only its `product-sdk-terminal` stays at 0.4.0; see the `@novasamatech/*` bullet above.) The `0.10.0 → 0.11.0` bump (June 2026) is the same additive drop-in class: `src/index.ts` byte-identical (all exports unchanged), `deploy()` signature unchanged, `DeployOptions` only additive (`onPhoneSignaturePlan`/`confirmPhoneReady`, both optional and unused by us), banner/`[N/M]` log strings unchanged (progress parser still matches — the #70 0-based chunk renumber only touched prose lines the parser drops), `storageSigner` routing precedence unchanged (now via the `resolveStorageSigner` helper, precedence `storageSigner > signer > mnemonic > session-slot > pool`), terminal subtree still `^0.4.0` / host-papp override still `0.8.6` (dedup story intact), and still ships the denied `patch-package` postinstall. **0.11.0 FIXES the nonce-collision re-upload bug (paritytech/polkadot-app-deploy#946):** the `storeChunkedContent` nonce-collision loop and the phase-B GRANDPA re-upload loop now call `doReconnect()` on a `ChainHead disjointed`/connection error (commit `f519eed`, gated by `isConnectionError` + `reconnectionsUsed < MAX_RECONNECTIONS`), so a WS halt mid-re-upload now recovers instead of failing the deploy. (The pre-0.11.0 remedy — re-run the deploy, incremental upload skips already-stored chunks — is no longer needed for that failure mode.) The `0.11.0 → 0.13.1` bump (July 2026, part of #465) is the same additive drop-in class: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (verified against every option we pass), `storageSigner` routing precedence unchanged, and pad still ships the denied `patch-package` postinstall (keep `allowBuilds: polkadot-app-deploy: false`). Its terminal subtree stays `^0.4.0` (its own split copy) and it no longer declares a direct `host-papp` dep. **0.13.x DROPS the `summit` environment from the bundled `environments.json`** — this is what forced the summit/w3s retirement (the `config.test.ts` divergence guard fails on any wired `CONFIGS` env missing upstream). ⚠️ The deploy log-string → progress-bar parser (`src/utils/deploy/progress.ts`) was NOT re-verified against 0.13.1's actual banner output (the bundled dist obscures the strings); the parser degrades gracefully (unknown banner → dropped, deploy still functions), so this is a cosmetic-only live-verify item. **The `0.13.1 → 0.15.0` bump (Aug 2026) RENAMED the npm package: `@parity/polkadot-app-deploy` stopped at 0.13.x, versions 0.14+ publish as `bulletin-deploy`** (update imports, the `allowBuilds` denial key, and `minimumReleaseAgeExclude` together when bumping). The bump was validated on `0.15.0-rc.2` and the pin moved to `0.15.0` stable the day upstream cut it — verified code-identical to rc.2 (git tag diff: version bump + an unshipped e2e script fix only; published dist byte-identical after normalizing tsup chunk hashes and the baked version string). Heads-up from that move: pnpm's min-age gate applies `minimumReleaseAgeExclude` when RESOLVING a version, but the lockfile-verification pass failed to honor the exclude for the PRERELEASE entry (`bulletin-deploy@0.15.0-rc.2` kept tripping `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` even while excluded; the stable `0.15.0` entry verifies fine) — if a young prerelease pin ever wedges installs like that again, rewrite the lockfile once with `pnpm install --config.minimumReleaseAge=0`, then confirm a plain `pnpm install` passes. 0.15 is the paseo-next-v2-wipe release: DotNS redeployed at new canonical addresses (owned by its `environments.json`, keyed by env id) and **the DotNS TLD went per-network** — `environments.json` gained a per-env `tld` field ("paseo" on paseo-next-v2; envs without one fall back to upstream `DEFAULT_TLD` "dot"), `deploy()` resolves the authoritative TLD on-chain at preflight (`DotnsProtocolRegistry.tld()`, dotns PR #218), and `parseDomainName(input, tld)` rejects wrong-TLD input. Our side: `ChainConfig.tld` + `getEnvTld()` in `src/config.ts` (divergence-guarded against upstream's catalog; the signing id `PLAYGROUND_PRODUCT_ID = "playground.dot"` is TLD-independent by convention and must NOT change), and `normalizeDomain(domain, tld)` mirrors the wrong-TLD rejection. API surface: `deploy()` signature + `DeployOptions` we pass unchanged (additive: `transferTo`, `contracts`, `bulletinEndpoints`/`assetHubEndpoints`, `publish`, `dumpCar`, …), banner titles (`Preflight`/`Storage`/`DotNS`/`DEPLOYMENT COMPLETE!`) and `[N/M]` chunk lines unchanged — verified against the 0.15 SOURCE this time; #1240 moved the `Domain:` echo to after the Preflight connect (prose the parser drops; test pins it). `storageSigner > signer > mnemonic > pool` routing precedence unchanged. Its subtree moved to `@parity/product-sdk-terminal@^0.5.1` (resolves 0.5.4) whose host-papp `^0.8.x` DEDUPES onto our 0.8.11 — one host-papp/statement-store tree, patches still apply; only `product-sdk-terminal` stays split (0.5.4 pad / 0.7.1 us). Still ships the denied `patch-package` postinstall (bundling the same sdk-statement@0.6.0 patch we carry). 0.15 also drops the `@parity/dotns-cli` subprocess path entirely (no references left), so the `[polkadot-app-deploy] @parity/dotns-cli not found` warning suppression in `src/index.ts` is now a dormant no-op; our own `playground dotns` passthrough keeps the direct dotns-cli dep.
 - **`polkadot-api` is `^2.2.1`** and effectively the only 2.x version in the runtime — keeping it a single instance is load-bearing. The lockfile contains `polkadot-api@1.x` only because `@parity/dotns-cli` declares it, and dotns-cli ships as a single fully-bundled `dist/cli.js` with all deps inlined — never resolved at runtime. The root was bumped `^2.1.6 → ^2.2.1` during #465: `cdm-builder@3.2.0`'s newer product-sdk pins pulled a second 2.x copy (`2.2.1`) alongside `2.1.6`, and in `src/commands/contract.ts` the cdm asset-hub client (2.2.1) met our descriptors (2.1.6) as "two different `P` types" (`error TS2345`). Aligning the root to `^2.2.1` collapses the 2.x line to one instance. If a future bump reintroduces a split, re-align the root the same way rather than casting around it.
 
-- **🔴 BROKEN IN THE FIELD (Sept 2026): QR pairing cannot succeed on ANY current phone build, and we cannot fix it from this repo.** `@novasamatech/host-papp@0.9.0` (published 2026-07-29) moved the SSO pairing envelope from **P-256 / AES-GCM to X25519 / ChaCha20-Poly1305**, shrinking the device encryption key from **65 to 32 bytes**. The handshake codec is fixed-width SCALE (`dist/sso/auth/scale/handshakeV2.js`: `PublicKeyCodec = Bytes(65)` at 0.8.x → `Bytes(32)` at 0.9.0+), so there is no graceful degrade — a 32-byte reader starts the metadata `Vec` 33 bytes early, still inside the key, and dies on a garbage enum discriminant. Both shipping mobile apps moved mid-August 2026. We resolve host-papp **0.8.11** (via `product-sdk-terminal@^0.7.1`) and still emit 65 bytes, so `playground login` fails at scan time: iOS logs `PolkadotHandshakeProposal.init():66 - Failed to decode host data: unexpectedDecodedValue` → `missingInput` → "Something went wrong"; Android shows the generic **"invalid QR code"**. Device-verified 2026-09-15 with an A/B pair of QRs identical except the key encoding: 65-byte → rejected, 32-byte → **"Device linked"**. `bulletin-deploy login` (host-papp 0.8.7) fails identically, so this is the shared dependency, not our code. **Do NOT try to fix this by bumping our own deps** — EVERY published `@parity/product-sdk-terminal` (latest `0.8.2`, incl. the `dev` tag) pins `host-papp: ^0.8.9`, whose 0.x caret ceiling is 0.8.12, the last release of the old wire. Upstream is already fixed but UNRELEASED: product-sdk#362 (root cause), PR #364 (**merged** 2026-09-07, pin → exactly `0.10.0`; not 0.10.2, which needs PAPI 3). The release is deliberately held behind #168 / PR #366 (RFC-0022 product-account signing) so pairing-that-works doesn't ship alongside signing that doesn't. ⚠️ **#366 is a breaking change for us, not a drop-in** — see the RFC-0022 note in the accounts section. Existing sessions still sign fine; only NEW pairings break, which is why deploy tooling that uses local keys looks healthy. Unaffected: dev/`--suri` paths (`DEFAULT_MNEMONIC`, `DEV_PUBLISH_ACCOUNT`) never pair, so E2E publish legs are green throughout.
+- **✅ RESOLVED (2026-09-23): QR pairing works again on `@parity/product-sdk-terminal@^0.10.0`.** History, because the symptom is distinctive and may recur: `@novasamatech/host-papp@0.9.0` (2026-07-29) moved the SSO pairing envelope from **P-256/AES-GCM to X25519/ChaCha20-Poly1305**, shrinking the device encryption key from **65 to 32 bytes**. The handshake codec is fixed-width SCALE (`dist/sso/auth/scale/handshakeV2.js`: `PublicKeyCodec = Bytes(65)` at 0.8.x → `Bytes(32)` at 0.9.0+), so there is no graceful degrade — a 32-byte reader starts the metadata `Vec` 33 bytes early and dies on a garbage enum discriminant. Both shipping mobile apps moved mid-August 2026, and every terminal release up to 0.8.2 pinned `host-papp ^0.8.9` (0.x caret ceiling 0.8.12, the last release of the old wire), so `playground login` failed at scan time for ~5 weeks: iOS `PolkadotHandshakeProposal.init():66 - Failed to decode host data: unexpectedDecodedValue` → "Something went wrong"; Android the generic **"invalid QR code"**. Device-verified 2026-09-15 with an A/B pair of QRs identical except the key encoding: 65-byte → rejected, 32-byte → **"Device linked"**. Fixed upstream by product-sdk#364 (merged 2026-09-07, released in terminal 0.9.0) — but 0.9.x is **#364 WITHOUT #366**, which is a trap: pairing succeeds, then `checkMapping` fails forever because the phone mints PGAS to the RFC-0022 address while an unmigrated CLI checks the old one, and the UI reports it as transient. **Take 0.10.0 or newer, never 0.9.x** — 0.10.0 carries #364 and #366 together. Verify a candidate with `grep -c 'Bytes(32)' node_modules/@novasamatech/host-papp/dist/sso/auth/scale/handshakeV2.js` (expect non-zero) and by checking `deriveProductPublicKey` is async.
 
 ### Network / env
 
@@ -64,7 +64,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **The mobile's "Wallet account address" and "Candidate account address" debug rows are NOT reachable from the host.** They're sr25519 of mnemonic + `//wallet` and mnemonic + `//candidate` respectively (`feature/account/impl/.../RealAccountRepository.kt:166-173`, hard junctions). Hard derivations can't be reproduced from a public key, so the CLI never sees those SS58s. Don't try to surface a "wallet address that matches mobile" — it isn't possible without the mnemonic.
 - **🔴 `PLAYGROUND_PRODUCT_ID` MUST FOLLOW THE ENV TLD — it is `` `playground.${getEnvTld()}` `` (`config.ts`), NOT a fixed `.dot`.** The phone validates the product id against ITS OWN TLD and silently drops a mismatch (polkadot-android-community#123, root-caused by the Android team 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. **An earlier version of this note said the id was "TLD-independent by convention" and told you NOT to thread `getEnvTld` through it. That was wrong** — the phone decides, and playground-app already shipped the env-suffixed form (`defaultDotNsId`, commit `6e9337c`; it prints `product id : playground.paseo` at boot). The two strings MUST match exactly or the CLI and the app derive different H160s for the same human, splitting app ownership, XP and dedupe across two identities. ⚠️ Changing the TLD is an IDENTITY MIGRATION: every derived product account moves, and anything keyed on the old id — cached subtrees and the SDK allowance cache, both `~/.polkadot-apps/{productId}_*.json` — is simply not found under the new id (re-granted at next login, not corrupted). Android still flags their check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. With the env-suffixed id in place, #123 no longer blocks us — it still matters for `localhost:*` ids and for any consumer hardcoding `.dot`. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
 - **`AutoSigning` returns `NotAvailable` on current mobile builds** (measured 2026-09-15 via `@dotli/host-cli` against Android build 1026, alongside `BulletInAllowance` → `Allocated` on the same call). RFC-0010 says `AutoSigning` is the one resource that MUST be requested explicitly — but the wallet will not provision it today, and host-rust-core#343 records that the runtime consumes the capability only for `account.sign_vrf` anyway. So the "AutoSigning makes Bulletin chunk signing work under TrUAPI" plan in `docs-internal/2026-09-14-truapi-host-cli-signing.md` is blocked on BOTH a wallet change and #343. Do not assume it is merely a matter of adding the resource to `PLAYGROUND_RESOURCES`.
-- **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **The builder-identity gate is address-bound, so it resets across the RFC-0022 change — no impact today, but it will bite once builders exist.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so a competition membership recorded against the OLD H160 stops resolving and the user gets "Couldn't verify your builder status" on every deploy. Observed directly: a spike account derived the RFC-0022 way was gated out immediately. **Not a blocker for the #366 bump as of Sept 2026 — there are no joined builders to strand** (confirmed by the product owner), so the reset costs nothing right now. Re-evaluate before the bump if builders have joined by then, or if the gate's backing registry is ever populated ahead of a derivation change; the remedy would be a re-reveal flow or a registry-side remap. Keep in mind generally: anything keyed to the product H160 resets when the derivation changes, and the list below only enumerates the bindings checked at that time. **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
+- **✅ DONE (2026-09-23): the RFC-0022 product-account derivation landed** (product-sdk #366, released in `@parity/product-sdk-terminal@0.10.0`; we pin `^0.10.0`). A product account now lives at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — a public key cannot cross a hard junction, so the old three-SOFT-junction derivation off `session.rootAccountId` could never have matched a shipping host. What the migration actually required, recorded because the pre-merge predictions were partly wrong: (1) `deriveProductPublicKey(session, ref)` replaces the local math and is **async**, and so are `createSessionSignerForAccount` / `createSessionSigner`; (2) the parent is the product SUBTREE key, fetched from the wallet via `session.getProductSubtree` (consent-free) and cached by the SDK at `{appId}_ProductSubtrees.json` — it reaches the phone only on a cold cache; (3) `ProductAccountRef.derivationIndex` stayed a **plain number** (the predicted tagged `DerivationIndex` exists only inside `@parity/product-sdk-keys`, whose `deriveProductAccountPublicKey(subtree, {tag:"Index", value})` is the 2-arg form — **our root must be on `keys@^0.4.0`** — 0.3.x's signature is `(parentPublicKey, productId: string, derivationIndex: number)`, so the 2-arg call is a tsc error there, and if you bypass tsc it derives from junctions built out of a stringified object. `pnpm typecheck` catches it; a vitest-only run does not, because vitest transpiles without typechecking. 0.4.0 itself validates and throws on a bad subtree or an out-of-range index); (4) `ProductAccountRef.publicKey` is optional and we deliberately omit it, so the signer and the displayed address resolve through one cached path and cannot desync; (5) `deriveSessionAddresses` is async, rippling into `ConnectResult` / `LoginStatus` / `SessionHandle`. Test vectors are pinned at the primitive in `sessionSigner.test.ts` against **host-rust-core's own** cross-host vector (`tests/wasm_crypto_vectors.rs`, `product_account_and_entropy_vectors_match_mobile`, mirrored in product-sdk's `product-account.test.ts`) — never regenerate a fixture from our own output. ⚠️ Tests must MOCK `deriveProductPublicKey`/`createSessionSignerForAccount`: unmocked they hang waiting for a phone AND write a bogus key into the developer's real `~/.polkadot-apps` subtree cache, breaking their live session. Every product account address MOVED, so users pair again once (`playground logout` + `playground login`); the old address keeps anything already published under it.
 - **The playground product account is derived by exactly one function** (`src/utils/sessionSigner.ts::derivePlaygroundProductPublicKey`), called by both `createPlaygroundSessionSigner` (signer construction) and `auth.ts::deriveSessionAddresses` (display triple). The math is `deriveProductAccountPublicKey(rootAccountId, "playground.dot", 0)` from `@parity/product-sdk-keys`. Do NOT call `deriveProductAccountPublicKey` (or any helper that wraps it) on an already-product-derived SS58 — that yields a doubly-derived ghost account. The `productAccountDisplay` / `productAccountAddresses` helpers that used to live in `src/commands/login/identityLine.ts` had exactly this bug and were deleted; resist re-introducing them. A frozen-vector regression test in `src/utils/auth.test.ts` (`deriveSessionAddresses` block) locks the pubkey/H160 the playground-app expects.
 - **`SessionAddresses` triples are computed once in `auth.ts` and threaded through.** `ConnectResult`, `LoginStatus.success`, and `SessionHandle` all carry the `{ rootAddress, productAddress, productH160 }` bundle. `SessionHandle.address` is kept as a back-compat alias for `addresses.productAddress` because `signer.ts::resolveSigner` spreads the handle into `ResolvedSigner` and downstream deploy code (`signerMode.ts`, `playground.ts`, `registry.ts`, `DeployScreen.tsx`) reads `.address` for the signing key. UI code should prefer `addresses` so the root vs product distinction stays explicit.
 
diff --git a/package.json b/package.json
index 3c37d022..5aab7046 100644
--- a/package.json
+++ b/package.json
@@ -34,9 +34,9 @@
         "@parity/product-sdk-contracts": "^0.10.1",
         "@parity/product-sdk-descriptors": "^0.9.0",
         "@parity/product-sdk-host": "^0.15.1",
-        "@parity/product-sdk-keys": "^0.3.18",
+        "@parity/product-sdk-keys": "^0.4.0",
         "@parity/product-sdk-logger": "^0.1.1",
-        "@parity/product-sdk-terminal": "^0.7.1",
+        "@parity/product-sdk-terminal": "^0.10.0",
         "@parity/product-sdk-tx": "^0.4.1",
         "@parity/product-sdk-utils": "^0.1.1",
         "@polkadot-api/sdk-ink": "^0.7.0",
diff --git a/patches/@novasamatech__statement-store@0.8.11.patch b/patches/@novasamatech__statement-store@0.10.0.patch
similarity index 100%
rename from patches/@novasamatech__statement-store@0.8.11.patch
rename to patches/@novasamatech__statement-store@0.10.0.patch
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 411d81fe..fb5fee05 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,7 +11,7 @@ overrides:
 
 patchedDependencies:
   '@novasamatech/sdk-statement@0.6.0': 8c3ebcafda8bbcab4b31fddc74f035a5a1724c0f72eac32a0b46f51a5771e334
-  '@novasamatech/statement-store@0.8.11': 214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d
+  '@novasamatech/statement-store@0.10.0': 214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d
 
 importers:
 
@@ -45,14 +45,14 @@ importers:
         specifier: ^0.15.1
         version: 0.15.1(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-keys':
-        specifier: ^0.3.18
-        version: 0.3.18(esbuild@0.27.7)(rxjs@7.8.2)
+        specifier: ^0.4.0
+        version: 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger':
         specifier: ^0.1.1
         version: 0.1.1
       '@parity/product-sdk-terminal':
-        specifier: ^0.7.1
-        version: 0.7.1(esbuild@0.27.7)(rxjs@7.8.2)
+        specifier: ^0.10.0
+        version: 0.10.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-tx':
         specifier: ^0.4.1
         version: 0.4.1(esbuild@0.27.7)(rxjs@7.8.2)
@@ -947,15 +947,24 @@ packages:
   '@novasamatech/host-api-wrapper@0.8.9':
     resolution: {integrity: sha512-4ofzbg/9J78sGsvNX9nmei5dyE7nw7+LeYsXG6rURTBjy0LyPSmR8wCfMmxOGxUTTE7BnzIloNInC/3aksfktw==}
 
+  '@novasamatech/host-api@0.10.0':
+    resolution: {integrity: sha512-rDxroRcmXrGWE5sgwCcIak6SynwWDPHsjZzV00/kwMS/iFymqMB0mUqQPcU4p1yiatWqePHX4XoP3zh/qj608w==}
+
   '@novasamatech/host-api@0.8.11':
     resolution: {integrity: sha512-KCtM64As23VFmHQCK51rxtvxeR/7+XNol/JE3HYVRldubdlH8qxcFQg2vg2nPjNj5nRJGGy4bE47bkJLE62RRA==}
 
   '@novasamatech/host-api@0.8.9':
     resolution: {integrity: sha512-KPh81iVv3sQckq7/oyRpFF2uYBPXJD0+7cRuXO+lnWPAxQBXK1aNUQzSq+vJUHkcGRXJd0up/IlHJ4DMfQyUhQ==}
 
+  '@novasamatech/host-papp@0.10.0':
+    resolution: {integrity: sha512-uhcYMTCBgU37oIlUfDnXbs8VoSnrVff2N3xYq5fT9b+FDa9oP83ALb75xmxTo4rtR9C/UrXjzG2NvPtJNfjBIA==}
+
   '@novasamatech/host-papp@0.8.11':
     resolution: {integrity: sha512-GBAE8oTGbvv4DDcByOdBO6Nu4JgPbfwRcOByS/jI9OR/DoYq4FdHlw0Q0h9X9ANZrtp97aayG2ryx+nDohqQ2w==}
 
+  '@novasamatech/scale@0.10.0':
+    resolution: {integrity: sha512-UJ1Jq0bUQ4p20BIuc079eZS7XouumNeheK1wojbiKNmoNQxFqsfRkJBYNQhIKWILKrI53FdP0D/uvby1Pl99Ew==}
+
   '@novasamatech/scale@0.8.11':
     resolution: {integrity: sha512-S9HpF77E4cUXvVpiGsBpCRB/HleIraInRrY1/RhUgsf61nLQNjMBqeBHENp0k82XZmnUVlaWhVx765UeHMqJGA==}
 
@@ -965,12 +974,21 @@ packages:
   '@novasamatech/sdk-statement@0.6.0':
     resolution: {integrity: sha512-NTqM+yS45iHgy87lVSWIpFozrTfCUWb7r4ZpsDtN1eFnfixXpDKpPXDWQsvPs+nh18r/jmoMgtlTjUltrS6mYQ==}
 
+  '@novasamatech/statement-store@0.10.0':
+    resolution: {integrity: sha512-+r+6Zw2xZHqEVc2F6Jn+i2fzPw7Nr0yqDV61Nodt2udL0suHPyEufZh9NUWZ45QcIiExYUgXxYyo5A4qEojqTg==}
+
   '@novasamatech/statement-store@0.8.11':
     resolution: {integrity: sha512-K2jlOLOaCM+oKkQpEJvTiDC9CNwNcBbcHXRaYvsUnnm4vrSZ38kwvz1dnEUhX54xC0Vruc+bZVSLaVSasFtkbw==}
 
+  '@novasamatech/storage-adapter@0.10.0':
+    resolution: {integrity: sha512-De1TovvHX59YO4VUI9Vid0ikGkC3FPOq0sVU6JL4nEO7AExCbGcnPuR9Uyc52DtYexgI8Of3SbcTb+KHfW6Zvw==}
+
   '@novasamatech/storage-adapter@0.8.11':
     resolution: {integrity: sha512-k/ji0bFy23p+pXaCfcpfY4t7tvT68red6fVn0jqUWuYC8hDOTT428psou83bU1qkaHbdWQFAu6B9uP4tNCAM/w==}
 
+  '@novasamatech/substrate-slot-sr25519-wasm@0.10.0':
+    resolution: {integrity: sha512-VZbHhRk7hDtkudefg0L23YijkrqVZHd139kZ+/KrBBTd7jUu19SRmQojGgu7nU2bz+fLRxTIUS4CTM/OOIc2Aw==}
+
   '@novasamatech/substrate-slot-sr25519-wasm@0.8.11':
     resolution: {integrity: sha512-Ix2SI583Zwf5I/Sv+DkfUpjSzW1oZpRIiEfbyrVkcj/YnNUmRCPbhzsiNlA3E5E1eIDzznCfxBGVPlQq6IIuNA==}
 
@@ -1223,6 +1241,9 @@ packages:
   '@parity/product-sdk-address@0.1.1':
     resolution: {integrity: sha512-sSymun3alNGdvawhdc0Ha0KEkuqMwBZui1bsUVeZIZRJAfWvQzrV1AVaf8aah5JFlcaRdg8FYyp7xL2eP+ZplA==}
 
+  '@parity/product-sdk-address@0.2.0':
+    resolution: {integrity: sha512-iOV/SwNfN/2V67+0QtJ55WbStv2af1g4ag9sRSzhGilGCq1jiyj+zcue8A44KSjEkt05P4oH7onvX99ObgcMSQ==}
+
   '@parity/product-sdk-chain-client@0.10.0':
     resolution: {integrity: sha512-aiHddqjqELg0kBMLv0FkRzrxnR1FbOKe36cPxshHckETcNpwN9vYPEZyQoKl4vf5UqXaivmoIUqFiQPKaDGVEA==}
 
@@ -1247,15 +1268,24 @@ packages:
   '@parity/product-sdk-host@0.15.1':
     resolution: {integrity: sha512-uvzfUBv+SiA87+Tv+queKdY/I0sCO2Y/N7DTUv3Iij3qNqZoaOBC33N+apP1BUSjdj8jSlxCuBxXUo4jslfh+w==}
 
+  '@parity/product-sdk-host@0.22.0':
+    resolution: {integrity: sha512-iJdHeTXmVuqZrMuC8HhL5dV+WSNJtQQgoxCqMcrb7MjkdjplCAuIyDgxISxVwRhCAL0HyTDFuc8+K/jdNWjVKw==}
+
   '@parity/product-sdk-keys@0.3.10':
     resolution: {integrity: sha512-59+WC0nFsvFMFgT2ksI9YfNCn6WunLe3/x3PtzJYax5v3xL52MnsAZKq4rRuutTLxDgXRVdufe5UHpB5dLPS0w==}
 
   '@parity/product-sdk-keys@0.3.18':
     resolution: {integrity: sha512-23wlsGWoIp7RujxZRFYhCm8kBnKhsMCSWWDovX/Hvzuduui/ickyxMhTA/vcebD0ZyuPInoZOilVO9aOKapIxw==}
 
+  '@parity/product-sdk-keys@0.4.0':
+    resolution: {integrity: sha512-fcyDiZiyV1cqSxHBjT/DGnOlAERbw9GeVYXkSaV0wZmHpr2O1vKni2EkFzv21a9IZVbFEZKHQ9kpq7aVFKbYFQ==}
+
   '@parity/product-sdk-local-storage@0.2.9':
     resolution: {integrity: sha512-O6rT8OJoD9H7LXkAhEDpHPj4qeTGt4j2wE8B2ST10riFkFjY/gCg6IQPeVuv2m3ALvsnU23xcJCxS80STQ+XkQ==}
 
+  '@parity/product-sdk-local-storage@0.3.12':
+    resolution: {integrity: sha512-OA8Cb9cCn1nDR/i2i8EEgFKRdDri517LzN+9LKmXB8vxL+UcN8aWQZJdRvha3mYmN/yw37I6SADYk9Evw3/yiA==}
+
   '@parity/product-sdk-local-storage@0.3.4':
     resolution: {integrity: sha512-oczxkxWXZa8+SCdb3lZwn2/18RPEfmZU3EdUFSvmVCQQzGnWB14vLk4Jf1AoXm0AFc93D4kE2dpAe3rvH9/o2A==}
 
@@ -1265,12 +1295,15 @@ packages:
   '@parity/product-sdk-signer@0.12.1':
     resolution: {integrity: sha512-PrWDsep8IC1Im3PR8t+UvEQgNmnCK2vHEWVjMC1Ze1QRfyFhPwSu9Gubi3arJP6m8N2J/hdWhInHPWgpmfLAGA==}
 
+  '@parity/product-sdk-signer@0.15.0':
+    resolution: {integrity: sha512-Xs1ebj4fCi8U2sWKdS6YwnS+MZginUX+6maEtuQRSeVP9N0EGijBCYq2YX1WOKgV7bur7urebksLdgDSQiqt8g==}
+
+  '@parity/product-sdk-terminal@0.10.0':
+    resolution: {integrity: sha512-fvo36sUMEUeUnM9yhbeD8WfQi+4HJw7YD3Lw7t9ZcQrZ4XTC28eviR+MP7RmY9hi2N5766IzxjWsW6YjvMhgGQ==}
+
   '@parity/product-sdk-terminal@0.5.4':
     resolution: {integrity: sha512-0dHMnqIR/KYxxqQW5Atinp1oWcKbyL3KvYwJouHUgDGUvNob5OdsMC7ew4edZbQxxqRz/WKygIGxVAh5EYiOLw==}
 
-  '@parity/product-sdk-terminal@0.7.1':
-    resolution: {integrity: sha512-aSYZF4Cm3oyN98DYjwTH712wNeXBzx2RDNOhjuQii1EQzu0a+ao8DiRlIZCXzHRoxj3RW2b9M5x4NUznpwmECQ==}
-
   '@parity/product-sdk-tx@0.2.14':
     resolution: {integrity: sha512-O0v6GL3WkOD5rZxHbakAylsYC0nbUPYTLoSNF3UoiSeO3Jqg6Cl2bRrjPDTD8msjkCO42Fz+umpmDbbAAG/XLg==}
 
@@ -1280,9 +1313,15 @@ packages:
   '@parity/product-sdk-utils@0.1.1':
     resolution: {integrity: sha512-vu/af1K7k7p0/aLKALrGVxz7K94xnY800DxmhnOhu6Hy4+y+8e9WHPecMjbYBBJby4FPMOkWLqEVRN/sk3Ucgw==}
 
+  '@parity/product-sdk-utils@0.2.0':
+    resolution: {integrity: sha512-Zhhh1EmSf9b+76F4nc9T/vD7KYRw4E0adYaD3CPVKaTsDT6uiN9+V/ejZ1pBjE0tnhJXu2deHky9mGA4U5tXdg==}
+
   '@parity/result@0.2.0':
     resolution: {integrity: sha512-QCrhYPeVVaPIjnlsfBIk5GHPRqfuCjy6MjqKkoCP4kwS1LIo5YtJCSFeB5mGtvMG7hiaRNl4lHQcd5YqDfJ1tQ==}
 
+  '@parity/truapi@0.18.0':
+    resolution: {integrity: sha512-q0Hgr9kX+ctHwd4JEuIs+q+l6YB1sJ/PwYOPuxzinZ2P1qudVNNvWj7Hxav8tJb0OO20CrGOrTolg6F5exZf1A==}
+
   '@parity/truapi@0.7.0':
     resolution: {integrity: sha512-xBGZP7/l74I0WGUnHgoFNYah+20I3JgykJ5pNUVsw3mQzNoCHuZSVJW6sUq7fzLvRF4wM2glPTPxUOiFKgfE9A==}
 
@@ -1547,6 +1586,9 @@ packages:
   '@polkadot-labs/hdkd-helpers@0.0.30':
     resolution: {integrity: sha512-qWmmD6ayj14RenDuDFfjF3sHS7ObqPzwIIMPcSVoDeKFSeQV7RY0HwyhC5CG4i6FoguMzak2dbtjYpNN5XQiwQ==}
 
+  '@polkadot-labs/hdkd-helpers@0.0.31':
+    resolution: {integrity: sha512-BjunfAAlR/sGmBUVIZxgHYTA712oD2YPQhKRRxb45BtGfxdKBjs10hZWqOFxZbq9N4pICXp/1oosGe04znyhvw==}
+
   '@polkadot-labs/hdkd@0.0.26':
     resolution: {integrity: sha512-9B+egs7pIwmaxi3X7XBbruxS40aVbcdI1iIqSxfSOf4+RS52E+sgd3MW/LECWrHSof2h4ngcdsXRrOl95FVV8g==}
 
@@ -3599,6 +3641,10 @@ packages:
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
+  nanoevents@10.0.0:
+    resolution: {integrity: sha512-PmIJ3BNxOzgVgnS1r/Pvyj6eZx/xUV2JCPogh0brD6smDIwjRlr1KBl9yoRX323PlfaNrBDDnfCgC9SL00OjSg==}
+    engines: {node: ^22.0.0 || ^24.0.0 || >=26.0.0}
+
   nanoevents@9.1.0:
     resolution: {integrity: sha512-Jd0fILWG44a9luj8v5kED4WI+zfkkgwKyRQKItTtlPfEsh7Lznfi1kr8/iZ+XAIss4Qq5GqRB0qtWbaz9ceO/A==}
     engines: {node: ^18.0.0 || >=20.0.0}
@@ -3613,6 +3659,11 @@ packages:
     engines: {node: ^18 || >=20}
     hasBin: true
 
+  nanoid@6.0.0:
+    resolution: {integrity: sha512-mkUH+rPkwU2qPadJ0oJZOjeZ5Mxn8Q1UhevwkTRWNuUZzyia3h4rhzK39hxaHTk0o2OxB8W2SQ6A8k23ZDi1pQ==}
+    engines: {node: ^22 || ^24 || >=26}
+    hasBin: true
+
   napi-build-utils@2.0.0:
     resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
 
@@ -6255,6 +6306,14 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/host-api@0.10.0':
+    dependencies:
+      '@novasamatech/scale': 0.10.0
+      nanoevents: 10.0.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      scale-ts: 1.6.1
+
   '@novasamatech/host-api@0.8.11':
     dependencies:
       '@novasamatech/scale': 0.8.11
@@ -6271,6 +6330,29 @@ snapshots:
       neverthrow: 8.2.0
       scale-ts: 1.6.1
 
+  '@novasamatech/host-papp@0.10.0(esbuild@0.27.7)':
+    dependencies:
+      '@noble/ciphers': 2.2.0
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@novasamatech/host-api': 0.10.0
+      '@novasamatech/scale': 0.10.0
+      '@novasamatech/statement-store': 0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/storage-adapter': 0.10.0
+      '@polkadot-api/utils': 0.4.0
+      '@polkadot-labs/hdkd-helpers': 0.0.31
+      nanoevents: 10.0.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+      rxjs: 7.8.2
+      scale-ts: 1.6.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - supports-color
+      - utf-8-validate
+
   '@novasamatech/host-papp@0.8.11(esbuild@0.27.7)':
     dependencies:
       '@noble/ciphers': 2.2.0
@@ -6278,7 +6360,7 @@ snapshots:
       '@noble/hashes': 2.2.0
       '@novasamatech/host-api': 0.8.11
       '@novasamatech/scale': 0.8.11
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/statement-store': 0.8.11(esbuild@0.27.7)(rxjs@7.8.2)
       '@novasamatech/storage-adapter': 0.8.11
       '@polkadot-api/utils': 0.4.0
       '@polkadot-labs/hdkd-helpers': 0.0.30
@@ -6294,6 +6376,11 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/scale@0.10.0':
+    dependencies:
+      '@polkadot-api/utils': 0.4.0
+      scale-ts: 1.6.1
+
   '@novasamatech/scale@0.8.11':
     dependencies:
       '@polkadot-api/utils': 0.4.0
@@ -6316,7 +6403,31 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@novasamatech/statement-store@0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@novasamatech/statement-store@0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@noble/ciphers': 2.2.0
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@novasamatech/scale': 0.10.0
+      '@novasamatech/sdk-statement': 0.6.0(patch_hash=8c3ebcafda8bbcab4b31fddc74f035a5a1724c0f72eac32a0b46f51a5771e334)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/substrate-slot-sr25519-wasm': 0.10.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+      '@polkadot-api/substrate-client': 0.7.0
+      '@polkadot-labs/hdkd-helpers': 0.0.31
+      '@polkadot-labs/schnorrkel-wasm': 0.0.9
+      '@scure/sr25519': 2.2.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+      scale-ts: 1.6.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
+  '@novasamatech/statement-store@0.8.11(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/hashes': 2.2.0
@@ -6339,11 +6450,18 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/storage-adapter@0.10.0':
+    dependencies:
+      nanoevents: 10.0.0
+      neverthrow: 8.2.0
+
   '@novasamatech/storage-adapter@0.8.11':
     dependencies:
       nanoevents: 9.1.0
       neverthrow: 8.2.0
 
+  '@novasamatech/substrate-slot-sr25519-wasm@0.10.0': {}
+
   '@novasamatech/substrate-slot-sr25519-wasm@0.8.11': {}
 
   '@opentelemetry/api-logs@0.220.0':
@@ -6743,6 +6861,11 @@ snapshots:
       '@noble/hashes': 1.8.0
       '@polkadot-api/substrate-bindings': 0.12.0
 
+  '@parity/product-sdk-address@0.2.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+
   '@parity/product-sdk-chain-client@0.10.0(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-descriptors': 0.9.0(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6847,6 +6970,23 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-host@0.22.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-errors': 0.2.0
+      '@parity/product-sdk-logger': 0.1.1
+      '@parity/result': 0.2.0
+      '@parity/truapi': 0.18.0
+      '@polkadot-api/json-rpc-provider': 0.2.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-keys@0.3.10(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-address': 0.1.1
@@ -6883,6 +7023,23 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-keys@0.4.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-address': 0.2.0
+      '@parity/product-sdk-crypto': 0.1.1
+      '@parity/product-sdk-local-storage': 0.3.12(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-utils': 0.2.0
+      '@polkadot-labs/hdkd': 0.0.28
+      '@polkadot-labs/hdkd-helpers': 0.0.30
+      '@scure/sr25519': 2.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-local-storage@0.2.9(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-host': 0.10.2(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6896,6 +7053,17 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-local-storage@0.3.12(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-host': 0.22.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-logger': 0.1.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-local-storage@0.3.4(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-host': 0.15.1(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6925,15 +7093,33 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@parity/product-sdk-terminal@0.5.4(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@parity/product-sdk-signer@0.15.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-address': 0.2.0
+      '@parity/product-sdk-errors': 0.2.0
+      '@parity/product-sdk-host': 0.22.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-keys': 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-logger': 0.1.1
+      '@parity/result': 0.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
+  '@parity/product-sdk-terminal@0.10.0(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/curves': 2.2.0
       '@noble/hashes': 2.2.0
-      '@novasamatech/host-papp': 0.8.11(esbuild@0.27.7)
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
-      '@novasamatech/storage-adapter': 0.8.11
+      '@novasamatech/host-papp': 0.10.0(esbuild@0.27.7)
+      '@novasamatech/statement-store': 0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/storage-adapter': 0.10.0
+      '@parity/product-sdk-keys': 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger': 0.1.1
+      '@parity/product-sdk-signer': 0.15.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@polkadot-api/substrate-bindings': 0.20.3
       '@polkadot-api/utils': 0.4.0
       '@polkadot-api/ws-provider': 0.9.1(rxjs@7.8.2)
@@ -6950,17 +7136,15 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@parity/product-sdk-terminal@0.7.1(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@parity/product-sdk-terminal@0.5.4(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/curves': 2.2.0
       '@noble/hashes': 2.2.0
       '@novasamatech/host-papp': 0.8.11(esbuild@0.27.7)
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/statement-store': 0.8.11(esbuild@0.27.7)(rxjs@7.8.2)
       '@novasamatech/storage-adapter': 0.8.11
-      '@parity/product-sdk-keys': 0.3.18(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger': 0.1.1
-      '@parity/product-sdk-signer': 0.12.1(esbuild@0.27.7)(rxjs@7.8.2)
       '@polkadot-api/substrate-bindings': 0.20.3
       '@polkadot-api/utils': 0.4.0
       '@polkadot-api/ws-provider': 0.9.1(rxjs@7.8.2)
@@ -7012,8 +7196,19 @@ snapshots:
       '@noble/hashes': 1.8.0
       '@parity/product-sdk-logger': 0.1.1
 
+  '@parity/product-sdk-utils@0.2.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      '@parity/product-sdk-logger': 0.1.1
+
   '@parity/result@0.2.0': {}
 
+  '@parity/truapi@0.18.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      neverthrow: 8.2.0
+      scale-ts: 1.6.1
+
   '@parity/truapi@0.7.0':
     dependencies:
       '@noble/hashes': 2.2.0
@@ -7567,6 +7762,14 @@ snapshots:
       '@scure/sr25519': 1.0.0
       scale-ts: 1.6.1
 
+  '@polkadot-labs/hdkd-helpers@0.0.31':
+    dependencies:
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@scure/base': 2.2.0
+      '@scure/sr25519': 2.2.0
+      scale-ts: 1.6.1
+
   '@polkadot-labs/hdkd@0.0.26':
     dependencies:
       '@polkadot-labs/hdkd-helpers': 0.0.30
@@ -10031,12 +10234,16 @@ snapshots:
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
+  nanoevents@10.0.0: {}
+
   nanoevents@9.1.0: {}
 
   nanoid@3.3.12: {}
 
   nanoid@5.1.11: {}
 
+  nanoid@6.0.0: {}
+
   napi-build-utils@2.0.0: {}
 
   negotiator@1.0.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 842143db..940b96ad 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -28,20 +28,20 @@ minimumReleaseAgeExclude:
   # Drop once it ages past the min-age window.
   - "bulletin-deploy@0.18.4"
   - "@parity/dotns-cli@0.8.0"
-  # The @novasamatech/* 0.8.11 family (pulled transitively by
-  # @parity/product-sdk-terminal@^0.6.2 → host-papp@^0.8.9, which resolves to the
-  # 0.8.11 line) publishes the stable tag the same day; the min-age gate would
+  # The @novasamatech/* 0.10.0 family (pulled transitively by
+  # @parity/product-sdk-terminal@^0.10.0 → host-papp 0.10.0, pinned EXACT)
+  # publishes the stable tag the same day; the min-age gate would
   # otherwise pin us to the older prerelease line. We opt these onto the stable
   # line explicitly — they come from the vetted triangle-js-sdks source.
   # host-papp pins statement-store exact, so the whole family must move together.
   # Drop these once the version naturally ages past the min-age window.
-  - "@novasamatech/host-papp@0.8.11"
-  - "@novasamatech/host-api@0.8.11"
-  - "@novasamatech/host-api-wrapper@0.8.11"
-  - "@novasamatech/statement-store@0.8.11"
-  - "@novasamatech/storage-adapter@0.8.11"
-  - "@novasamatech/scale@0.8.11"
-  - "@novasamatech/substrate-slot-sr25519-wasm@0.8.11"
+  - "@novasamatech/host-papp@0.10.0"
+  - "@novasamatech/host-api@0.10.0"
+  - "@novasamatech/host-api-wrapper@0.10.0"
+  - "@novasamatech/statement-store@0.10.0"
+  - "@novasamatech/storage-adapter@0.10.0"
+  - "@novasamatech/scale@0.10.0"
+  - "@novasamatech/substrate-slot-sr25519-wasm@0.10.0"
   - '@parity/cdm-builder@5.0.1'
   - '@parity/cdm-codegen@0.6.26'
   - '@parity/cdm-env@2.4.0'
@@ -54,7 +54,12 @@ minimumReleaseAgeExclude:
   - '@parity/product-sdk-local-storage@0.3.4'
   - '@parity/product-sdk-signer@0.12.1'
   - '@parity/product-sdk-tx@0.4.1'
-  - '@parity/product-sdk-terminal@0.7.1'
+  - '@parity/product-sdk-terminal@0.10.0'
+  - '@parity/product-sdk-host@0.22.0'
+  - '@parity/product-sdk-keys@0.4.0'
+  - '@parity/product-sdk-local-storage@0.3.12'
+  - '@parity/product-sdk-signer@0.15.0'
+  - '@parity/product-sdk-utils@0.2.0'
 
 overrides:
   # dotns-cli ships a broken publish manifest (file:.papi/descriptors missing
@@ -75,5 +80,5 @@ overrides:
 patchedDependencies:
   # PATCH(playground-cli) — local-only fixes pending upstream. See CLAUDE.md
   # "Two local pnpm patches remain" for what each one does.
-  "@novasamatech/statement-store@0.8.11": "patches/@novasamatech__statement-store@0.8.11.patch"
+  "@novasamatech/statement-store@0.10.0": "patches/@novasamatech__statement-store@0.10.0.patch"
   "@novasamatech/sdk-statement@0.6.0": "patches/@novasamatech__sdk-statement@0.6.0.patch"
diff --git a/src/utils/auth.connect.test.ts b/src/utils/auth.connect.test.ts
index 1380edcb..4e705c1d 100644
--- a/src/utils/auth.connect.test.ts
+++ b/src/utils/auth.connect.test.ts
@@ -45,11 +45,29 @@ vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
         ...actual,
         createTerminalAdapter: createTerminalAdapterMock,
         waitForSessions: waitForSessionsMock,
+        // RFC-0022: the product account is derived from a subtree key the
+        // WALLET owns, which the SDK fetches over the statement store and
+        // caches on disk under the default storage dir. Unmocked, these tests
+        // would hang waiting for a phone and write a bogus key into the real
+        // ~/.polkadot-apps subtree cache — corrupting the developer's live
+        // session. Any 32-byte value works here; the address math itself is
+        // pinned in sessionSigner.test.ts against host-rust-core's vector.
+        deriveProductPublicKey: deriveProductPublicKeyMock,
+        createSessionSignerForAccount: createSessionSignerForAccountMock,
     };
 });
 
 // waitForLogin records the login stamp with its default storage dir; mock it
 // so tests never write to the real ~/.polkadot-apps.
+const { deriveProductPublicKeyMock, createSessionSignerForAccountMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(async () => new Uint8Array(32).fill(0x5a)),
+    createSessionSignerForAccountMock: vi.fn(async () => ({
+        publicKey: new Uint8Array(32).fill(0x5a),
+        signTx: async () => new Uint8Array(),
+        signBytes: async () => new Uint8Array(),
+    })),
+}));
+
 const { recordLoginStampMock } = vi.hoisted(() => ({
     recordLoginStampMock: vi.fn(async () => undefined),
 }));
diff --git a/src/utils/auth.test.ts b/src/utils/auth.test.ts
index 769337da..9d0542d0 100644
--- a/src/utils/auth.test.ts
+++ b/src/utils/auth.test.ts
@@ -20,7 +20,7 @@
  * verify the patterns used rather than the full integration.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -36,6 +36,32 @@ import type { UserSession } from "@parity/product-sdk-terminal";
 import { DAPP_ID } from "../config.js";
 import { INCOMPLETE_SESSION_MESSAGE } from "./sessionSigner.js";
 
+/**
+ * host-rust-core cross-host vector (tests/wasm_crypto_vectors.rs,
+ * `product_account_and_entropy_vectors_match_mobile`) — the product account at
+ * index 0. Mirrored upstream in product-sdk's `product-account.test.ts`, and
+ * pinned directly in sessionSigner.test.ts. Used here so the SS58/H160 below
+ * descend from a value the MOBILE computes, not from our own output.
+ */
+const HOST_VECTOR_ACCOUNT = Uint8Array.from(
+    "1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c"
+        .match(/.{2}/g)!
+        .map((b) => Number.parseInt(b, 16)),
+);
+
+const { deriveProductPublicKeyMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(),
+}));
+
+// RFC-0022: the product account descends from a subtree key only the wallet
+// can produce. The SDK fetches it over the statement store and caches it on
+// disk under the default storage dir, so an unmocked call would hang waiting
+// for a phone and write a bogus key into the real ~/.polkadot-apps cache.
+vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
+    const actual = await importOriginal<typeof import("@parity/product-sdk-terminal")>();
+    return { ...actual, deriveProductPublicKey: deriveProductPublicKeyMock };
+});
+
 describe("subscribe-before-assignment pattern", () => {
     /**
      * Simulates the bug where `const unsub = obs.subscribe(cb)` fires
@@ -418,6 +444,10 @@ describe("deriveSessionAddresses", () => {
         0x20, 0x7a,
     ]);
 
+    beforeEach(() => {
+        deriveProductPublicKeyMock.mockResolvedValue(HOST_VECTOR_ACCOUNT);
+    });
+
     function fakeSession(rootBytes: Uint8Array): UserSession {
         // `deriveSessionAddresses` only reads `session.rootAccountId`.
         // The full UserSession type carries signer callbacks we don't
@@ -425,9 +455,9 @@ describe("deriveSessionAddresses", () => {
         return { rootAccountId: rootBytes } as unknown as UserSession;
     }
 
-    it("matches the playground-app's published product address + H160 for a known root", () => {
+    it("matches the playground-app's published product address + H160 for a known root", async () => {
         const session = fakeSession(TEST_ROOT_BYTES);
-        const addresses = deriveSessionAddresses(session);
+        const addresses = await deriveSessionAddresses(session);
 
         expect(addresses.rootAddress).toBe(TEST_ROOT_SS58);
         // Regenerated when PLAYGROUND_PRODUCT_ID moved from `playground.dot` to
@@ -446,13 +476,13 @@ describe("deriveSessionAddresses", () => {
         // ⚠️ These are OLD-derivation values. When RFC-0022 (product-sdk #366)
         // lands, the derivation itself changes and they must be re-verified
         // against the app's boot banner, not just regenerated again.
-        expect(addresses.productAddress).toBe("5DoVmDX98xjw2XyHPpABgDuDJ2qFLGoTFwfzaiUEdW3a4M8e");
-        expect(addresses.productH160).toBe("0xb1ced7e7a64966ae0dc346eea7dcf66f823ccdca");
+        expect(addresses.productAddress).toBe("5ChZBnBw9eDQUMBhnXUKrGMdK5MTfGrca3T1xZZtBQhW8eis");
+        expect(addresses.productH160).toBe("0x47ab1defff8b02d4345d98896a064cd0e6800309");
     });
 
-    it("returns a product address distinct from the root — guards against double-derivation", () => {
+    it("returns a product address distinct from the root — guards against double-derivation", async () => {
         const session = fakeSession(TEST_ROOT_BYTES);
-        const addresses = deriveSessionAddresses(session);
+        const addresses = await deriveSessionAddresses(session);
 
         // If someone ever re-introduces a productAccountDisplay-style
         // helper that takes addresses.productAddress as input and runs
@@ -464,22 +494,29 @@ describe("deriveSessionAddresses", () => {
         expect(addresses.productAddress).not.toBe(addresses.rootAddress);
     });
 
-    it("derives the H160 from the same pubkey as the product SS58", () => {
-        // Two different rootAccountIds → different product SS58s → and
-        // the H160 must change in lock-step with the SS58. A regression
-        // that derived H160 off the root (or off a doubly-derived
-        // pubkey) would either keep the H160 constant when the root
-        // moves or break the ss58↔h160 pairing.
-        const a = deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
-        const b = deriveSessionAddresses(fakeSession(ALT_ROOT_BYTES));
+    it("derives the H160 from the same pubkey as the product SS58", async () => {
+        // The H160 must move in lock-step with the product SS58. A regression
+        // that derived the H160 off the ROOT (or off a doubly-derived pubkey)
+        // would either hold the H160 constant while the product account moved,
+        // or break the ss58 <-> h160 pairing.
+        //
+        // Since RFC-0022 the product account descends from the wallet's
+        // SUBTREE key, not from `rootAccountId`, so varying the root proves
+        // nothing here — we vary what actually drives the derivation.
+        deriveProductPublicKeyMock.mockResolvedValueOnce(HOST_VECTOR_ACCOUNT);
+        const a = await deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
+        deriveProductPublicKeyMock.mockResolvedValueOnce(ALT_ROOT_BYTES);
+        const b = await deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
 
         expect(a.productAddress).not.toBe(b.productAddress);
         expect(a.productH160).not.toBe(b.productH160);
         expect(b.productH160).toMatch(/^0x[0-9a-f]{40}$/);
     });
 
-    it("reports stale sessions without a root account public key", () => {
-        expect(() => deriveSessionAddresses(fakeSession(new Uint8Array()))).toThrow(
+    it("reports stale sessions without a root account public key", async () => {
+        // Now async (RFC-0022 fetches the subtree), so the guard surfaces as a
+        // rejection rather than a synchronous throw.
+        await expect(deriveSessionAddresses(fakeSession(new Uint8Array()))).rejects.toThrow(
             INCOMPLETE_SESSION_MESSAGE,
         );
     });
diff --git a/src/utils/auth.ts b/src/utils/auth.ts
index 3f3505ba..1b7941be 100644
--- a/src/utils/auth.ts
+++ b/src/utils/auth.ts
@@ -144,7 +144,7 @@ function newestSession(sessions: UserSession[]): UserSession {
     return sessions[sessions.length - 1];
 }
 
-function createPlaygroundSigner(session: UserSession): PolkadotSigner {
+async function createPlaygroundSigner(session: UserSession): Promise<PolkadotSigner> {
     return createPlaygroundSessionSigner(session, {
         productId: PLAYGROUND_PRODUCT_ID,
         derivationIndex: 0,
@@ -167,9 +167,9 @@ function createPlaygroundSigner(session: UserSession): PolkadotSigner {
  *
  * @internal
  */
-export function deriveSessionAddresses(session: UserSession): SessionAddresses {
+export async function deriveSessionAddresses(session: UserSession): Promise<SessionAddresses> {
     const rootBytes = sessionRootPublicKey(session);
-    const productPubkey = derivePlaygroundProductPublicKey(rootBytes, {
+    const productPubkey = await derivePlaygroundProductPublicKey(session, {
         productId: PLAYGROUND_PRODUCT_ID,
         derivationIndex: 0,
     });
@@ -187,9 +187,9 @@ function sessionRemoteAddress(session: UserSession): string | null {
     return accountId.length === 32 ? ss58Encode(accountId) : null;
 }
 
-function sessionLogoutAddress(session: UserSession): string {
+async function sessionLogoutAddress(session: UserSession): Promise<string> {
     try {
-        return deriveSessionAddresses(session).productAddress;
+        return (await deriveSessionAddresses(session)).productAddress;
     } catch {
         return sessionRemoteAddress(session) ?? "(stored session)";
     }
@@ -238,7 +238,7 @@ export async function connect(): Promise<ConnectResult> {
     }
 
     if (sessions.length > 0) {
-        const addresses = deriveSessionAddresses(newestSession(sessions));
+        const addresses = await deriveSessionAddresses(newestSession(sessions));
         // The "existing" result carries plain address data only — the
         // adapter is not part of it, so this is the last place that can
         // release it. Leaking it keeps a statement-store WebSocket +
@@ -359,7 +359,7 @@ export async function waitForLogin(
         if (authenticated) {
             const sessions = await loadSessions(adapter, 3000);
             if (sessions.length > 0) {
-                const addresses = deriveSessionAddresses(newestSession(sessions));
+                const addresses = await deriveSessionAddresses(newestSession(sessions));
                 address = addresses.productAddress;
                 // Do NOT prune older sessions here by calling
                 // `adapter.sessions.disconnect`. It submits a `Disconnected`
@@ -458,8 +458,8 @@ export async function getSessionSigner(): Promise<SessionHandle | null> {
     }
 
     const session = newestSession(sessions);
-    const signer = createPlaygroundSigner(session);
-    const addresses = deriveSessionAddresses(session);
+    const signer = await createPlaygroundSigner(session);
+    const addresses = await deriveSessionAddresses(session);
 
     let destroyed = false;
     const destroy = () => {
@@ -528,7 +528,7 @@ export async function findSession(): Promise<LogoutHandle | null> {
         return null;
     }
     const session = newestSession(sessions);
-    const address = sessionLogoutAddress(session);
+    const address = await sessionLogoutAddress(session);
     return { adapter, address, session };
 }
 
diff --git a/src/utils/productAccount.test.ts b/src/utils/productAccount.test.ts
deleted file mode 100644
index 6395ee3c..00000000
--- a/src/utils/productAccount.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (C) Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: Apache-2.0
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { describe, expect, it } from "vitest";
-import { ss58Encode } from "@parity/product-sdk-address";
-import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
-import { PLAYGROUND_PRODUCT_ID } from "../config.js";
-
-describe("product account integration", () => {
-    it("derives a stable SS58 address for playground.dot / index 0 from a fixed root", () => {
-        const root = new Uint8Array(32).fill(0);
-        const pubkey = deriveProductAccountPublicKey(root, PLAYGROUND_PRODUCT_ID, 0);
-        const address = ss58Encode(pubkey);
-        // The algorithm is locked by upstream frozen vectors in @parity/product-sdk-keys;
-        // here we only assert that wiring (config + sdk import + ss58Encode) does
-        // not silently produce an empty/malformed address.
-        expect(typeof address).toBe("string");
-        expect(address.length).toBeGreaterThan(40);
-        expect(pubkey.length).toBe(32);
-    });
-});
diff --git a/src/utils/sessionSigner.test.ts b/src/utils/sessionSigner.test.ts
index a553833f..a97d887f 100644
--- a/src/utils/sessionSigner.test.ts
+++ b/src/utils/sessionSigner.test.ts
@@ -15,7 +15,7 @@
 
 import { describe, expect, test, vi } from "vitest";
 import { ss58Encode } from "@parity/product-sdk-address";
-import { seedToAccount } from "@parity/product-sdk-keys";
+import { deriveProductAccountPublicKey, seedToAccount } from "@parity/product-sdk-keys";
 import type { UserSession } from "@parity/product-sdk-terminal";
 import type { PolkadotSigner } from "polkadot-api";
 import { PLAYGROUND_PRODUCT_ID, getEnvTld } from "../config.js";
@@ -27,8 +27,53 @@ import {
     wrapSignerWithSssFastFail,
 } from "./sessionSigner.js";
 
+const { deriveProductPublicKeyMock, createSessionSignerForAccountMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(),
+    createSessionSignerForAccountMock: vi.fn(),
+}));
+
+// RFC-0022 derives the product account from a subtree key only the WALLET can
+// produce. The SDK fetches it over the statement store and caches it on disk
+// under the default storage dir — so an unmocked call here would hang waiting
+// for a phone AND write a bogus key into the developer's real
+// ~/.polkadot-apps subtree cache, breaking their live session. We mock the SDK
+// boundary and assert what WE control (which productId/index we ask for); the
+// derivation math itself is pinned below against host-rust-core's vector.
+vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
+    const actual = await importOriginal<typeof import("@parity/product-sdk-terminal")>();
+    return {
+        ...actual,
+        deriveProductPublicKey: deriveProductPublicKeyMock,
+        createSessionSignerForAccount: createSessionSignerForAccountMock,
+    };
+});
+
 const DEV_PHRASE = "bottom drive obey lake curtain smoke basket hold race lonely fit walk";
 
+/**
+ * host-rust-core cross-host vector (tests/wasm_crypto_vectors.rs,
+ * `product_account_and_entropy_vectors_match_mobile`): the product SUBTREE
+ * public key for `//product//myapp.dot` off entropy 0xab x 16, and the account
+ * it yields at index 0. Copied from the host's own fixtures — never
+ * regenerated from our output.
+ */
+const HOST_VECTOR_SUBTREE = hexToBytes(
+    "4a4c063de30994d4341f1effa157ded4e0b340b2e657f238bef3f930faba192b",
+);
+const HOST_VECTOR_ACCOUNT = hexToBytes(
+    "1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c",
+);
+
+function hexToBytes(hex: string): Uint8Array {
+    return Uint8Array.from(hex.match(/.{2}/g)!.map((b) => Number.parseInt(b, 16)));
+}
+
+function toHex(bytes: Uint8Array): string {
+    return `0x${Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")}`;
+}
+
 // Stand-in for the mobile's SSO handshake response. `rootAccountId` is
 // `deriveRootAccount()` on the mobile = the bare-mnemonic keypair pubkey.
 // `remoteAccount.accountId` is the wallet's currently-selected substrate
@@ -58,53 +103,78 @@ describe("createPlaygroundSessionSigner", () => {
     // As long as all three pin the same `(rootPubKey, productId, 0)` triple they
     // yield byte-identical SS58 strings. This is the regression guard.
     // ────────────────────────────────────────────────────────────────────────
-    test("login signer address === deploy signer address === playground-app address", () => {
+    test("asks the SDK for the playground product id at index 0", async () => {
         const session = fakeSession({ rootAccountId: root.publicKey });
+        deriveProductPublicKeyMock.mockResolvedValue(HOST_VECTOR_ACCOUNT);
 
-        const cliSigner = createPlaygroundSessionSigner(session, {
+        const key = await derivePlaygroundProductPublicKey(session, {
             productId: PLAYGROUND_PRODUCT_ID,
             derivationIndex: 0,
         });
-        const cliAddress = ss58Encode(cliSigner.publicKey);
-
-        // What the deployed playground-app gets back from the mobile (mobile
-        // computes this exact derivation from the same mnemonic).
-        const mobileDerived = seedToAccount(DEV_PHRASE, `/product/${PLAYGROUND_PRODUCT_ID}/0`);
-        const playgroundAppAddress = ss58Encode(mobileDerived.publicKey);
 
-        expect(cliAddress).toEqual(playgroundAppAddress);
+        expect(deriveProductPublicKeyMock).toHaveBeenCalledWith(session, {
+            productId: PLAYGROUND_PRODUCT_ID,
+            derivationIndex: 0,
+        });
+        expect(key).toBe(HOST_VECTOR_ACCOUNT);
     });
 
-    test("signer.publicKey is the derived product account, not the wallet account", () => {
+    /**
+     * The signer must NOT be handed a pre-computed `publicKey`. Supplying one
+     * would let the signing key and the address we display drift apart if the
+     * two were ever derived by different paths; omitting it makes the SDK
+     * resolve both through the same cached subtree. The pre-RFC-0022 bug was
+     * the extreme version of this — the signer used
+     * `session.remoteAccount.accountId` (the WALLET account), so the chain saw
+     * a different `From` than the funded, allowance-granted product account.
+     */
+    test("builds the signer without pinning a publicKey, so it cannot desync", async () => {
         const session = fakeSession({
             rootAccountId: root.publicKey,
             remoteAccountId: new Uint8Array(32).fill(7),
         });
-        const signer = createPlaygroundSessionSigner(session, {
-            productId: PLAYGROUND_PRODUCT_ID,
-            derivationIndex: 0,
-        });
-        const expected = derivePlaygroundProductPublicKey(root.publicKey, {
+        createSessionSignerForAccountMock.mockResolvedValue({
+            publicKey: HOST_VECTOR_ACCOUNT,
+            signTx: async () => new Uint8Array(),
+            signBytes: async () => new Uint8Array(),
+        } as unknown as PolkadotSigner);
+
+        const signer = await createPlaygroundSessionSigner(session, {
             productId: PLAYGROUND_PRODUCT_ID,
             derivationIndex: 0,
         });
 
-        // The pre-fix bug set signer.publicKey from session.remoteAccount.accountId
-        // (the user's wallet account), not the product-derived account. The chain
-        // would see the wallet as From — different from the funded / allowance-
-        // granted product account. This guard ensures we never slip back.
-        expect(signer.publicKey).toEqual(expected);
+        const [passedSession, passedRef] = createSessionSignerForAccountMock.mock.calls[0];
+        expect(passedSession).toBe(session);
+        expect(passedRef).toEqual({ productId: PLAYGROUND_PRODUCT_ID, derivationIndex: 0 });
+        expect(passedRef).not.toHaveProperty("publicKey");
+        expect(signer.publicKey).toEqual(HOST_VECTOR_ACCOUNT);
         expect(ss58Encode(signer.publicKey)).not.toEqual(ss58Encode(new Uint8Array(32).fill(7)));
     });
 
-    test("throws the friendly message when rootAccountId is missing", () => {
-        const session = fakeSession({ rootAccountId: undefined });
-        expect(() =>
-            createPlaygroundSessionSigner(session, {
-                productId: PLAYGROUND_PRODUCT_ID,
-                derivationIndex: 0,
-            }),
-        ).toThrow(INCOMPLETE_SESSION_MESSAGE);
+    /**
+     * Cross-host agreement, pinned at the primitive rather than through our
+     * own composition — a fixture regenerated from the code it checks is
+     * worthless.
+     *
+     * Both values come from host-rust-core's `tests/wasm_crypto_vectors.rs`
+     * (`product_account_and_entropy_vectors_match_mobile`), mirrored upstream
+     * in product-sdk's `product-account.test.ts`. They are what the MOBILE
+     * computes, so if this fails the CLI and the phone would derive different
+     * accounts for the same person.
+     *
+     * Note the subtree is keyed by product id: it is `//product//{productId}`
+     * with HARD junctions, which is why a public key can no longer cross it
+     * and the wallet has to hand us the subtree.
+     */
+    test("derives the mobile-matched account from the host's cross-host vector", () => {
+        const account = deriveProductAccountPublicKey(HOST_VECTOR_SUBTREE, {
+            tag: "Index",
+            value: 0,
+        });
+        expect(toHex(account)).toBe(
+            "0x1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c",
+        );
     });
 
     test("playground product id follows the environment TLD", () => {
diff --git a/src/utils/sessionSigner.ts b/src/utils/sessionSigner.ts
index c5e6abaf..7571ccee 100644
--- a/src/utils/sessionSigner.ts
+++ b/src/utils/sessionSigner.ts
@@ -34,9 +34,9 @@
  * this CLI).
  */
 
-import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
 import {
     createSessionSignerForAccount,
+    deriveProductPublicKey,
     type ProductAccountRef,
     type UserSession,
 } from "@parity/product-sdk-terminal";
@@ -57,34 +57,42 @@ export function sessionRootPublicKey(session: UserSession): Uint8Array {
 }
 
 /**
- * Soft-derive the product account public key off a wallet root.
+ * Derive the playground product account public key (RFC-0022).
  *
- * This is the single source of truth for product-account math in the CLI.
- * Both `createPlaygroundSessionSigner` (which feeds the key to the SDK
- * signer) and `auth.ts::deriveSessionAddresses` (which builds the display
- * triple for `playground login`) go through here so a future change to
- * derivation params can't silently desync the signer from what we print.
+ * It used to be three SOFT junctions (`product`/`playground.dot`/`0`) off
+ * `session.rootAccountId`, computed locally with no network. RFC-0022 makes
+ * `//product//{productId}` two HARD junctions, and a public key cannot cross a
+ * hard junction — so the parent must be the product SUBTREE key, which only
+ * the wallet can produce (`session.getProductSubtree`; consent-free, and the
+ * SDK caches it at `{appId}_ProductSubtrees.json`, reaching the phone only on
+ * a cold cache).
  *
- * sr25519 soft derivation is composable on public keys alone, so deriving
- * from `rootAccountId` locally produces the SAME public key the mobile
- * derives privately via `mnemonic + "/product/...{idx}"`. Algorithm
- * parity with mobile/desktop is locked by the frozen vectors in
- * `@parity/product-sdk-keys`'s `product-account.test.ts` and by the
- * `deriveSessionAddresses` block in `src/utils/auth.test.ts`.
+ * Three consequences worth knowing:
+ *   - it takes a SESSION, not a root public key;
+ *   - it is ASYNC, and on a cold cache it needs the phone reachable;
+ *   - the address differs from the pre-RFC-0022 one, so every product account
+ *     moved when this landed (see the migration note in CLAUDE.md).
+ *
+ * `deriveProductPublicKey` is the SDK's single source of truth for this math,
+ * so we delegate rather than re-derive. Cross-host agreement (CLI vs phone) is
+ * pinned at the primitive in `sessionSigner.test.ts` against host-rust-core's
+ * own vector — never against our own output.
  */
-export function derivePlaygroundProductPublicKey(
-    rootAccountId: Uint8Array,
+export async function derivePlaygroundProductPublicKey(
+    session: UserSession,
     ref: Pick<ProductAccountRef, "productId" | "derivationIndex">,
-): Uint8Array {
-    return deriveProductAccountPublicKey(rootAccountId, ref.productId, ref.derivationIndex);
+): Promise<Uint8Array> {
+    return deriveProductPublicKey(session, ref);
 }
 
-export function createPlaygroundSessionSigner(
+export async function createPlaygroundSessionSigner(
     session: UserSession,
     ref: Pick<ProductAccountRef, "productId" | "derivationIndex">,
-): PolkadotSigner {
-    const publicKey = derivePlaygroundProductPublicKey(sessionRootPublicKey(session), ref);
-    return wrapSignerWithSssFastFail(createSessionSignerForAccount(session, { ...ref, publicKey }));
+): Promise<PolkadotSigner> {
+    // `publicKey` omitted on purpose: the SDK fetches the subtree and derives
+    // it through the same cached path as the display address, so the signer and
+    // what we print cannot desync.
+    return wrapSignerWithSssFastFail(await createSessionSignerForAccount(session, ref));
 }
 
 export const SESSION_EXPIRED_MESSAGE =
diff --git a/src/utils/signer.ts b/src/utils/signer.ts
index 3bb48d5a..28c4d468 100644
--- a/src/utils/signer.ts
+++ b/src/utils/signer.ts
@@ -40,8 +40,7 @@ export interface ResolvedSigner {
     /**
      * The session's root / product / H160 triple. Present for QR/mobile
      * sessions (forwarded from `SessionHandle`); absent for local dev/SURI
-     * signers. Consumed by `resolveSignerSetup` to pick the `userSessionH160`
-     * used for the deploy summary's dev-ownership warning
+     * signers. Consumed by `resolveSignerSetup` to pick the `claimedOwnerH160`
      * for dev-mode playground publish.
      */
     addresses?: SessionAddresses;

From dac81625a769174cbed3b968c8ac5d560812ad82 Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Thu, 24 Sep 2026 08:58:43 +0800
Subject: [PATCH 09/10] =?UTF-8?q?fix(auth):=20complete=20the=200.10.0=20mi?=
 =?UTF-8?q?gration=20=E2=80=94=20async=20ripple,=20allowance=20shape,=20ex?=
 =?UTF-8?q?piry=20path?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four defects found by running the migrated binary end to end against a real
phone. All of them passed the unit suite and a clean build; the first two were
hidden because `pnpm exec tsc` was exiting inside pnpm's deps-status check
(the release-age policy) before tsc ran, so a grep for "error TS" reported a
clean typecheck that never happened. Run tsc directly.

  - identityGate.ts read `.productH160` off a Promise, so every gated command
    (deploy, deploy-all, mod, decentralize) refused with "Couldn't verify your
    builder status" on a healthy chain.
  - DripScreen.tsx had the same missed await.
  - The SmartContractAllowance destination was a bare `0` instead of the
    tagged `{tag:"Index",value:0}`, in two places. The grant still succeeds on
    the phone, so it looks fine — but the SDK sub-keys its allowance cache by
    destination, and an untagged value takes the `Raw` branch and hexes
    `undefined`, so every later read died with "undefined is not an object
    (evaluating 'bytes.length')" and login reported "allowances ✕". Latent
    before 0.10.0, which started reading that key.
  - `wrapSignerWithSssFastFail` only detected the pre-0.10 expiry shape (a
    `console.error` line plus a hang). 0.10.0 REJECTS with
    `AllowanceExpiredError` instead, so the wrapper stopped producing the one
    message that carries the remedy — re-pairing, because a renewal request
    would travel over the expired channel. It now handles both, keeps the
    original as `cause`, and matches by name as well as `instanceof` (a pnpm
    tree can hold two copies of the SDK, where `instanceof` silently fails).

Deploy also stops presenting a retry as progress. The phone-approval counter
counted signature REQUESTS, so a timed-out request re-sent as "step 2" read as
forward progress and contradicted the plan above it, which counts operations.
Observed live: "step 1: Link content" then "step 2: Link content" while the
plan said step 2 was the registry publish, and four prompts arrived for a
two-approval deploy.

Verified against a real session: pairing, login, allowances, mapping, the
identity gate, phone signing, deploy, and re-publish of an app owned by the
product account (which also confirms v2 republish authorization).
---
 .changeset/rfc0022-product-accounts.md      |  7 ++
 src/commands/deploy/index.ts                | 35 +++++++++-
 src/commands/deploy/signRequest.test.ts     | 71 ++++++++++++++++++++
 src/commands/drip/DripScreen.tsx            |  2 +-
 src/utils/allowances/resources.test.ts      | 19 +++++-
 src/utils/allowances/resources.ts           | 10 ++-
 src/utils/allowances/smartContracts.test.ts |  2 +-
 src/utils/allowances/smartContracts.ts      |  4 +-
 src/utils/identity/identityGate.ts          |  2 +-
 src/utils/sessionSigner.test.ts             | 74 ++++++++++++++++++++-
 src/utils/sessionSigner.ts                  | 49 ++++++++++++--
 11 files changed, 258 insertions(+), 17 deletions(-)
 create mode 100644 src/commands/deploy/signRequest.test.ts

diff --git a/.changeset/rfc0022-product-accounts.md b/.changeset/rfc0022-product-accounts.md
index 4d5a6d72..24953cf6 100644
--- a/.changeset/rfc0022-product-accounts.md
+++ b/.changeset/rfc0022-product-accounts.md
@@ -23,3 +23,10 @@ the session's root key locally.
 address stay owned by it; allowances and PGAS are re-granted at the next login.
 The new derivation is what current phones and the playground web app already
 use, so this brings the CLI back into agreement with them rather than away.
+
+Deploy also stops presenting a retry as progress. The phone-approval counter
+was counting signature *requests*, so a request that timed out and was re-sent
+appeared as the next step — and contradicted the "Phone approvals expected"
+plan, which counts operations. A deploy could print "step 2: Link content"
+while the plan said step 2 was the registry publish. Repeats are now labelled
+as retries, with the remedy worth checking when no prompt appeared at all.
diff --git a/src/commands/deploy/index.ts b/src/commands/deploy/index.ts
index 20b5943e..763081e1 100644
--- a/src/commands/deploy/index.ts
+++ b/src/commands/deploy/index.ts
@@ -745,6 +745,37 @@ function runInteractive(ctx: {
 
 // ── Output helpers ───────────────────────────────────────────────────────────
 
+/**
+ * Render a phone signature request, distinguishing a RETRY from progress.
+ *
+ * The `step` on the event counts signature REQUESTS, not operations: when a
+ * request times out (the usual cause is the phone app not being in the
+ * foreground, which shows no prompt at all) it is re-sent with the next number.
+ * Printing that number made a stall look like progress — worse, it contradicted
+ * the "Phone approvals expected" plan above it, which numbers OPERATIONS. Seen
+ * live: `step 1: Link content` followed by `step 2: Link content`, while the
+ * plan said step 2 would be the registry publish.
+ *
+ * So we key off the label instead and say plainly when we are re-sending, plus
+ * the one remedy that actually fixes it.
+ */
+const phoneSignAttempts = new Map<string, number>();
+
+export function formatSignRequest(label: string): string {
+    const attempt = (phoneSignAttempts.get(label) ?? 0) + 1;
+    phoneSignAttempts.set(label, attempt);
+    if (attempt === 1) return `  📱 Approve on your phone: ${label}\n`;
+    return (
+        `  📱 No response yet — re-sent to your phone (attempt ${attempt}): ${label}\n` +
+        `     If no prompt appeared, open the Polkadot app and keep it in the foreground.\n`
+    );
+}
+
+/** Test seam: the attempt counter is module state, so tests must reset it. */
+export function resetSignRequestAttempts(): void {
+    phoneSignAttempts.clear();
+}
+
 function logHeadlessEvent(event: DeployEvent) {
     if (event.kind === "phase-start") {
         process.stdout.write(`▸ ${event.phase}…\n`);
@@ -755,9 +786,7 @@ function logHeadlessEvent(event: DeployEvent) {
     } else if (event.kind === "storage-event" && event.event.kind === "chunk-progress") {
         process.stdout.write(`  chunk ${event.event.current}/${event.event.total}\n`);
     } else if (event.kind === "signing" && event.event.kind === "sign-request") {
-        process.stdout.write(
-            `  📱 Approve on your phone (step ${event.event.step}): ${event.event.label}\n`,
-        );
+        process.stdout.write(formatSignRequest(event.event.label));
     } else if (event.kind === "error") {
         process.stderr.write(`  ✖ ${event.phase}: ${event.message}\n`);
     }
diff --git a/src/commands/deploy/signRequest.test.ts b/src/commands/deploy/signRequest.test.ts
new file mode 100644
index 00000000..0b04a6ae
--- /dev/null
+++ b/src/commands/deploy/signRequest.test.ts
@@ -0,0 +1,71 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { beforeEach, describe, expect, it } from "vitest";
+import { formatSignRequest, resetSignRequestAttempts } from "./index.js";
+
+beforeEach(() => {
+    resetSignRequestAttempts();
+});
+
+describe("formatSignRequest", () => {
+    it("announces the first request plainly", () => {
+        const line = formatSignRequest("Link content (DotNS setContenthash)");
+        expect(line).toContain("Approve on your phone");
+        expect(line).toContain("Link content (DotNS setContenthash)");
+        expect(line).not.toMatch(/attempt/i);
+    });
+
+    /**
+     * The bug this replaces, observed live: the event's `step` counts signature
+     * REQUESTS, so a timed-out attempt re-sent as "step 2" read as progress —
+     * and contradicted the "Phone approvals expected" plan above it, which
+     * numbers OPERATIONS. A deploy printed `step 1: Link content` then
+     * `step 2: Link content` while the plan said step 2 was the registry
+     * publish, and the user approved four prompts for a two-approval deploy.
+     */
+    it("calls a repeat of the same operation a retry, not the next step", () => {
+        const label = "Link content (DotNS setContenthash)";
+        formatSignRequest(label);
+        const second = formatSignRequest(label);
+
+        expect(second).toMatch(/attempt 2/);
+        expect(second).toMatch(/re-sent/i);
+        // Must not imply forward progress.
+        expect(second).not.toMatch(/step 2/);
+    });
+
+    it("keeps counting further retries of the same operation", () => {
+        const label = "Publish to Playground registry";
+        formatSignRequest(label);
+        formatSignRequest(label);
+        expect(formatSignRequest(label)).toMatch(/attempt 3/);
+    });
+
+    it("treats a different operation as a fresh request", () => {
+        formatSignRequest("Link content (DotNS setContenthash)");
+        const other = formatSignRequest("Publish to Playground registry");
+
+        expect(other).toContain("Approve on your phone");
+        expect(other).not.toMatch(/attempt/i);
+    });
+
+    /** The one remedy worth surfacing when no prompt showed up at all. */
+    it("tells the user what to check when a prompt never appeared", () => {
+        const label = "Link content (DotNS setContenthash)";
+        formatSignRequest(label);
+        expect(formatSignRequest(label)).toMatch(/foreground/i);
+    });
+});
diff --git a/src/commands/drip/DripScreen.tsx b/src/commands/drip/DripScreen.tsx
index 483325ae..330c6112 100644
--- a/src/commands/drip/DripScreen.tsx
+++ b/src/commands/drip/DripScreen.tsx
@@ -90,7 +90,7 @@ export function DripScreen({ onDone }: { onDone: (outcome: DripOutcome) => void
             // single source of the product address used across the CLI.
             let recipient: string | null;
             try {
-                recipient = deriveSessionAddresses(handle.session).productAddress;
+                recipient = (await deriveSessionAddresses(handle.session)).productAddress;
             } catch {
                 recipient = null;
             }
diff --git a/src/utils/allowances/resources.test.ts b/src/utils/allowances/resources.test.ts
index 970cbecf..97cfe861 100644
--- a/src/utils/allowances/resources.test.ts
+++ b/src/utils/allowances/resources.test.ts
@@ -42,8 +42,19 @@ describe("PLAYGROUND_RESOURCES", () => {
             "BulletInAllowance",
             "SmartContractAllowance",
         ]);
+        // The destination must be the TAGGED form. A bare `0` grants fine on
+        // the phone, so the failure is invisible at grant time — but the SDK
+        // sub-keys its allowance cache by destination, and an untagged value
+        // takes the `Raw` branch and hexes `undefined`, so every later read
+        // throws `undefined is not an object (evaluating 'bytes.length')` and
+        // `playground login` reports "allowances ✕" on a healthy account.
+        // `tsc` DOES reject the bare number, so this test is belt-and-braces
+        // rather than the only guard — but run tsc directly, not through
+        // `pnpm exec`: if pnpm's deps-status check fails first (e.g. the
+        // release-age policy), it exits before tsc runs and an unwary grep for
+        // "error TS" reports a clean typecheck that never happened.
         const sc = PLAYGROUND_RESOURCES.find((r) => r.tag === "SmartContractAllowance");
-        expect(sc?.value).toBe(0);
+        expect(sc?.value).toEqual({ tag: "Index", value: 0 });
     });
 });
 
@@ -53,7 +64,7 @@ describe("summarizeOutcomes", () => {
         const resources: typeof PLAYGROUND_RESOURCES = [
             { tag: "BulletInAllowance", value: undefined },
             { tag: "StatementStoreAllowance", value: undefined },
-            { tag: "SmartContractAllowance", value: 0 },
+            { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
         ];
         const summary = summarizeOutcomes([allocated, rejected, notAvailable], resources);
         expect(summary.granted.map((r) => r.tag)).toEqual(["BulletInAllowance"]);
@@ -77,7 +88,9 @@ describe("describeResource", () => {
 
 describe("describeAllocationFailure", () => {
     const bulletin: typeof PLAYGROUND_RESOURCES = [{ tag: "BulletInAllowance", value: undefined }];
-    const sc: typeof PLAYGROUND_RESOURCES = [{ tag: "SmartContractAllowance", value: 0 }];
+    const sc: typeof PLAYGROUND_RESOURCES = [
+        { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
+    ];
 
     test("returns null when nothing failed", () => {
         const summary = summarizeOutcomes([allocated], bulletin);
diff --git a/src/utils/allowances/resources.ts b/src/utils/allowances/resources.ts
index 9faf5296..0641332b 100644
--- a/src/utils/allowances/resources.ts
+++ b/src/utils/allowances/resources.ts
@@ -88,7 +88,15 @@ export function productScopedAdapter<A extends { appId: string }>(adapter: A): A
  */
 export const PLAYGROUND_RESOURCES: AllocatableResource[] = [
     { tag: "BulletInAllowance", value: undefined },
-    { tag: "SmartContractAllowance", value: 0 },
+    // The destination is a TAGGED union (`Index` | `Raw`), not a bare number.
+    // A bare `0` still reaches the phone and grants correctly, so the grant
+    // looks fine — but the SDK sub-keys its allowance cache by destination
+    // (`cacheKey` -> `smartContractDest`), and an untagged value falls through
+    // to the `Raw` branch and hexes `undefined`. Every later cache read then
+    // dies with `undefined is not an object (evaluating 'bytes.length')`,
+    // which surfaces as `playground login` reporting "allowances ✕" on a
+    // perfectly healthy account. Index 0 is the default product account.
+    { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
 ];
 
 export interface AllocationSummary {
diff --git a/src/utils/allowances/smartContracts.test.ts b/src/utils/allowances/smartContracts.test.ts
index 4fde29cd..589053df 100644
--- a/src/utils/allowances/smartContracts.test.ts
+++ b/src/utils/allowances/smartContracts.test.ts
@@ -90,7 +90,7 @@ describe("ensureSmartContractAllowance", () => {
         expect(requestResourceAllocationMock).toHaveBeenCalledWith(
             expect.anything(),
             expect.anything(),
-            [{ tag: "SmartContractAllowance", value: 0 }],
+            [{ tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } }],
         );
     });
 
diff --git a/src/utils/allowances/smartContracts.ts b/src/utils/allowances/smartContracts.ts
index dc90b1f9..6220758e 100644
--- a/src/utils/allowances/smartContracts.ts
+++ b/src/utils/allowances/smartContracts.ts
@@ -23,7 +23,9 @@ import { productScopedAdapter } from "./resources.js";
 
 const SMART_CONTRACT_ALLOWANCE: AllocatableResource = {
     tag: "SmartContractAllowance",
-    value: 0,
+    // Tagged destination, not a bare number — see PLAYGROUND_RESOURCES in
+    // resources.ts for what an untagged value breaks in the SDK's cache.
+    value: { tag: "Index", value: 0 },
 };
 
 export interface SmartContractAllowanceOptions {
diff --git a/src/utils/identity/identityGate.ts b/src/utils/identity/identityGate.ts
index e7fd3478..39c59030 100644
--- a/src/utils/identity/identityGate.ts
+++ b/src/utils/identity/identityGate.ts
@@ -134,7 +134,7 @@ export async function checkIdentityGate(
 
     let productH160: `0x${string}`;
     try {
-        productH160 = deriveSessionAddresses(handle.session).productH160;
+        productH160 = (await deriveSessionAddresses(handle.session)).productH160;
     } catch (err) {
         return { status: "unverifiable", detail: describe(err) };
     } finally {
diff --git a/src/utils/sessionSigner.test.ts b/src/utils/sessionSigner.test.ts
index a97d887f..c9a224a7 100644
--- a/src/utils/sessionSigner.test.ts
+++ b/src/utils/sessionSigner.test.ts
@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { describe, expect, test, vi } from "vitest";
+import { describe, expect, it, test, vi } from "vitest";
 import { ss58Encode } from "@parity/product-sdk-address";
 import { deriveProductAccountPublicKey, seedToAccount } from "@parity/product-sdk-keys";
 import type { UserSession } from "@parity/product-sdk-terminal";
@@ -21,6 +21,7 @@ import type { PolkadotSigner } from "polkadot-api";
 import { PLAYGROUND_PRODUCT_ID, getEnvTld } from "../config.js";
 import {
     INCOMPLETE_SESSION_MESSAGE,
+    isAllowanceExpired,
     SESSION_EXPIRED_MESSAGE,
     createPlaygroundSessionSigner,
     derivePlaygroundProductPublicKey,
@@ -300,3 +301,74 @@ describe("wrapSignerWithSssFastFail", () => {
         );
     });
 });
+
+describe("expired statement-store allowance", () => {
+    /**
+     * The SDK changed shape under us. Up to 0.8.x an expired SSS allowance was
+     * logged to `console.error` and the signing promise never settled; since
+     * 0.10.0 `requestSignedTransaction` throws `AllowanceExpiredError`
+     * instead. The wrapper must turn BOTH into SESSION_EXPIRED_MESSAGE,
+     * because that message carries the only remedy — the renewal request would
+     * itself travel over the expired channel, so re-pairing is the only way
+     * out. A raw SDK error tells the user nothing they can act on.
+     */
+    // `signTx` takes 4-5 args in the real signature; the wrapper forwards them
+    // opaquely, so the test calls through a loose alias rather than building
+    // throwaway extrinsic arguments that nothing reads.
+    const callSignTx = (s: PolkadotSigner): Promise<Uint8Array> =>
+        (s.signTx as unknown as (...a: unknown[]) => Promise<Uint8Array>)({});
+
+    function fakeSigner(signTx: () => Promise<Uint8Array>): PolkadotSigner {
+        return {
+            publicKey: new Uint8Array(32).fill(1),
+            signTx,
+            signBytes: signTx,
+        } as unknown as PolkadotSigner;
+    }
+
+    it("maps a thrown AllowanceExpiredError to the re-pair message", async () => {
+        const err = new Error("statement store allowance expired");
+        err.name = "AllowanceExpiredError";
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw err;
+            }),
+        );
+
+        await expect(callSignTx(signer)).rejects.toThrow(SESSION_EXPIRED_MESSAGE);
+    });
+
+    it("keeps the original error as the cause, so the detail is not lost", async () => {
+        const err = new Error("statement store allowance expired");
+        err.name = "AllowanceExpiredError";
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw err;
+            }),
+        );
+
+        await callSignTx(signer).catch((caught: Error) => {
+            expect(caught.cause).toBe(err);
+        });
+    });
+
+    it("passes unrelated signing failures through untouched", async () => {
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw new Error("message too big");
+            }),
+        );
+
+        await expect(callSignTx(signer)).rejects.toThrow("message too big");
+    });
+
+    /** `instanceof` is unreliable across duplicate copies in a pnpm tree. */
+    it("recognises the error by name, not only by instanceof", () => {
+        const byName = new Error("nope");
+        byName.name = "AllowanceExpiredError";
+        expect(isAllowanceExpired(byName)).toBe(true);
+        expect(isAllowanceExpired(new Error("something else"))).toBe(false);
+        expect(isAllowanceExpired("not an error")).toBe(false);
+        expect(isAllowanceExpired(undefined)).toBe(false);
+    });
+});
diff --git a/src/utils/sessionSigner.ts b/src/utils/sessionSigner.ts
index 7571ccee..acb74ed1 100644
--- a/src/utils/sessionSigner.ts
+++ b/src/utils/sessionSigner.ts
@@ -35,6 +35,7 @@
  */
 
 import {
+    AllowanceExpiredError,
     createSessionSignerForAccount,
     deriveProductPublicKey,
     type ProductAccountRef,
@@ -100,17 +101,39 @@ export const SESSION_EXPIRED_MESSAGE =
     "and cannot be renewed remotely (renewal requests travel over the expired channel). " +
     'Run "playground logout" and then "playground login" to pair again.';
 
+/**
+ * Whether an error means the statement-store allowance has lapsed.
+ *
+ * Name-based as well as `instanceof`, deliberately: a pnpm tree can hold more
+ * than one copy of the SDK, and `instanceof` across copies silently returns
+ * false. Getting this wrong loses the actionable message, so it fails safe
+ * toward recognising the error.
+ */
+export function isAllowanceExpired(err: unknown): boolean {
+    if (err instanceof AllowanceExpiredError) return true;
+    if (!(err instanceof Error)) return false;
+    return (
+        err.name === "AllowanceExpiredError" || err.constructor?.name === "AllowanceExpiredError"
+    );
+}
+
 /**
  * Fast-fail for expired statement-store (SSS) allowances.
  *
  * Phone signing rides the statement store: `session.createTransaction` /
  * `session.signRaw` submit a statement on the People chain that the phone
  * subscribes to. The SSS allowance is a 1-day renewable resource (plus a
- * grace window, ~2-3 days total after login). When it lapses, the
- * statement-store adapter logs `NoAllowanceError` to `console.error` but
- * does NOT reject the promise — the signing call hangs for the SDK's 180s
- * queue timeout while the outer transaction watcher gives up at 90s with a
- * misleading "transaction watcher silent" error, times 3 retries.
+ * grace window, ~2-3 days total after login), and it cannot be renewed
+ * remotely, so the only remedy is re-pairing.
+ *
+ * There are TWO expiry shapes to catch, because the SDK changed:
+ *   - since product-sdk-terminal 0.10.0 it REJECTS with
+ *     `AllowanceExpiredError`, handled in the catch below;
+ *   - before that the statement-store adapter logged `NoAllowanceError` to
+ *     `console.error` and did NOT reject — the call hung for the SDK's 180s
+ *     queue timeout while the outer watcher gave up at 90s with a misleading
+ *     "transaction watcher silent" error, times 3 retries. The console
+ *     interception still covers that, and any path that still only logs.
  *
  * This wrapper intercepts `console.error` for the duration of each signing
  * call, detects the NoAllowanceError line, and rejects within ~200ms with an
@@ -160,6 +183,22 @@ export function wrapSignerWithSssFastFail(signer: PolkadotSigner): PolkadotSigne
                         }, 200);
                     }),
                 ]);
+            } catch (err) {
+                // Since product-sdk-terminal 0.10.0 the SDK REJECTS with
+                // `AllowanceExpiredError` instead of logging `NoAllowanceError`
+                // and hanging, so the console interception above never fires on
+                // the primary expiry path. Without this branch the user gets a
+                // raw SDK error instead of the one message that states the only
+                // remedy (logout + login — the renewal request itself would
+                // travel over the expired channel).
+                //
+                // Matched by name as well as `instanceof`: duplicate copies of
+                // the package in a pnpm tree make `instanceof` unreliable, and
+                // failing open here would lose the remedy.
+                if (isAllowanceExpired(err)) {
+                    throw new Error(SESSION_EXPIRED_MESSAGE, { cause: err });
+                }
+                throw err;
             } finally {
                 // Both arms are settled or abandoned here: the interval must
                 // die (it would otherwise keep the event loop alive — see

From 0a634ea823e0e24c060c7c0bd4b4fbd5052fc193 Mon Sep 17 00:00:00 2001
From: Reinhard Hatko <reinhard@parity.io>
Date: Mon, 28 Sep 2026 13:15:51 +0200
Subject: [PATCH 10/10] chore(deps): bulletin-deploy 0.20.0, plus session
 findings and a tooling fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bulletin-deploy 0.18.4 -> 0.20.0. Verified against paseo-next-v2 with a
dev-signer deploy of a NEW domain (bd-0200-devtest.paseo): build, chunk
upload, DotNS register, playground publish, owner recorded as the dev signer,
and the deployed URL returns HTTP 200. The HTTP check is the part that
matters — a deploy reporting success has never been sufficient evidence that
the CAR was parseable.

0.20.0 fixes a crash we actually hit: `JSON.parse` on incoming RPC data was
unguarded and threw inside the socket handler where nothing upstream could
catch it, killing the process mid-deploy. That is the
`SyntaxError: JSON Parse error: Unexpected EOF` at `_onMessage` seen during a
template deploy. 0.19.x additionally drops the storage-deposit floor for
registering a name from a hardcoded 200 PAS to 5 PAS, stops registers
reverting when the chain moves between dry-run and inclusion, and uploads
duplicate bundle files once instead of twice.

Checked per the invariant before pinning: `deploy()`'s signature is unchanged,
every `DeployOptions` field we pass still exists, the phase banners and `[N/M]`
chunk lines the progress parser matches are intact, and the `patch-package`
postinstall is still shipped (so the `allowBuilds` denial stays).

CLAUDE.md gains two notes from this session:

  - `pnpm <script>` can exit in its deps-status check BEFORE running the tool,
    which looks like a pass if you grep the output for "error TS". That is how
    four type errors reached a live phone test. Check the exit code or run the
    binary directly.
  - Mapping is not required to CALL a contract, and `checkMapping` returning
    false is normal for a plain Substrate signer. Every AccountId32 has a
    deterministic H160; `Revive.OriginalAccount` is only the reverse map.
    Contract fees can be paid in PAS, so neither PGAS nor mapping should be
    blamed for a rejected extrinsic without evidence — both were, wrongly.

The sentry scripts looked up keychain item `sentry-api-token`, which does not
exist; the real one is `sentry-api-token-playground`. All three would have
failed for anyone following the documented backup-before-change workflow.
---
 .changeset/bulletin-deploy-0200.md | 22 ++++++++++++++++++++++
 CLAUDE.md                          |  4 +++-
 package.json                       |  2 +-
 pnpm-lock.yaml                     | 12 ++++++------
 pnpm-workspace.yaml                |  2 +-
 sentry/backup-dashboards.sh        |  5 ++++-
 sentry/create-dashboard.py         |  6 +++++-
 sentry/patch-dashboard.py          |  6 +++++-
 8 files changed, 47 insertions(+), 12 deletions(-)
 create mode 100644 .changeset/bulletin-deploy-0200.md

diff --git a/.changeset/bulletin-deploy-0200.md b/.changeset/bulletin-deploy-0200.md
new file mode 100644
index 00000000..81359303
--- /dev/null
+++ b/.changeset/bulletin-deploy-0200.md
@@ -0,0 +1,22 @@
+---
+"playground-cli": patch
+---
+
+Update `bulletin-deploy` to 0.20.0.
+
+Fixes two crashes that ended a deploy after the content was already uploaded.
+One of them is a crash we hit in practice: `JSON.parse` on incoming RPC data was
+unguarded and threw inside the socket handler, where nothing upstream could
+catch it, killing the process mid-deploy. The other is `hasIPFS()` passing when
+`ipfs` is installed but was never initialised.
+
+Also brings, from 0.19.x: the storage-deposit floor for registering a name drops
+from a hardcoded 200 PAS to 5 PAS (measured cost is ~0.15), registers no longer
+revert when the chain moves between dry-run and inclusion, duplicate files in a
+bundle upload once instead of twice, an interrupted register no longer strands
+the commitment fee, Bulletin re-authorizes on an exhausted-but-unexpired quota,
+and deploying refuses to silently fall back to the public dev key when a stored
+session can't be read.
+
+Additive for us: `deploy()`'s signature is unchanged, every option we pass still
+exists, and the log banners the progress bar parses are intact.
diff --git a/CLAUDE.md b/CLAUDE.md
index 64e3d528..f8cc53fd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,6 +13,8 @@ pnpm typecheck
 pnpm test
 ```
 
+**🔴 `pnpm <script>` can exit BEFORE running the tool, and it looks like a pass.** pnpm 11 runs a deps-status check first; when that fails — most often `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` after bumping onto a freshly published release train — it prints a stack and exits non-zero **without invoking tsc/vitest at all**. Grepping the output for `error TS` then finds nothing and reads as a clean typecheck. This cost real bugs in Sept 2026: four type errors (a missed `await` in `identityGate.ts` that broke every gated command, the same in `DripScreen.tsx`, and two malformed allowance literals) all "passed" a typecheck that never ran, and shipped to a live phone test. **Check the exit code, or run the tool directly** — `./node_modules/.bin/tsc --noEmit`, `npx vitest run`. CI is unaffected (a non-zero exit fails the job either way); this is a local-verification trap only.
+
 `pnpm build` compiles with bun, which STRIPS types without checking them — it is NOT a type signal. The tsc baseline was burned to zero in June 2026 and `pnpm typecheck` (`tsc --noEmit`) now runs as a CI job, so any new type error fails the build — keep it at zero.
 
 **`.cdm/cdm.d.ts` and `.cdm/contracts.d.ts` are COMMITTED, and must stay so.** They are generated by `cdm install` and are the module augmentation that gives contract handles their real per-method signatures. Without them the registry handle is a bare `Contract<ContractDef>`, and every `.query()`/`.tx()` call site goes silently unchecked — that gap let the 7-arg `publish` regression and a `getMetadataUri` shape bug through, and it also produces the inverse trap (code that compiles locally and fails only in CI, because a structural interface can't match the un-augmented type). `.cdm/` was gitignored wholesale until Sept 2026; CI never ran `cdm install` (the `cdm` CLI is a global tool needing chain access, not a repo dep), so the `Typecheck` job was checking everything EXCEPT the contract calls. The rest of `.cdm/` stays ignored on purpose: `contracts/**/info.json` snapshots per-version contract addresses that we never read (addresses resolve live from the CDM meta-registry), so committing them would add a second, stale source of truth. **After any `cdm i`, commit the regenerated `.d.ts` files** — a stale one type-checks against the previous ABI, which is exactly the failure this prevents. The cdm-builder version skew is bridged through THREE cast seams: `asCloudStorageApi` in `src/utils/allowances/bulletin.ts` (the `TypedApi<Paseo_bulletin>` vs `BulletinTypedApi` codegen skew — two codegens of the same chain), plus `asCdmAssetHubApi`/`asCdmAssetHubDescriptor` and `asCdmRegistryContract` in `src/commands/contract.ts`. The asset-hub seams bridge the paseo-asset-hub `DotnsGateway`/descriptor shape drift between cdm-builder's pinned `@parity/product-sdk-descriptors` and our root's (the contract pipeline never touches DotnsGateway, so the cast is runtime-safe). `asCdmRegistryContract` was added when our root `@parity/product-sdk-contracts` reached `0.9.x`: `Contract.tx()` now resolves a `Result<TxResult, …>`, nominally unassignable to cdm-builder's older `RegistryContract` param — but the install-time registry is query-only (no signer wired in), so `.tx()` is never invoked through it and the cast is runtime-safe. At `cdm-builder@3.2.0` the pinned product-sdk moved up to `contracts@0.9.0` / `descriptors@0.7.0` while our root is `contracts@^0.9.2` / `descriptors@^0.8.0` — so the `.tx()` Result shape realigns (making `asCdmRegistryContract` likely redundant) while a descriptors minor gap (0.7 vs 0.8) remains. Before deleting any seam, remove it and run `pnpm typecheck`. If `lint:license` flags a file you authored, run `./scripts/check-license-headers.sh --fix` to prepend the standard Parity Apache-2.0 header (`SPDX-License-Identifier: Apache-2.0` + `Copyright (C) Parity Technologies (UK) Ltd.`, both lines required). The check script keeps shebangs on line 1 and places the header below them.
@@ -75,7 +77,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **The statement-store (SSS) allowance is a 1-day renewable resource and is the CHANNEL for every phone interaction**, not a signing permission. `session.createTransaction` / `signRaw` / `requestResourceAllocation` all travel as statements on the People chain; the host's locally derived SSS account needs an on-chain ring slot to submit them. The slot is granted at QR login (the only flow with a direct WebSocket channel) and lapses ~2-3 days later (1-day period + `StmtStoreGraceWindow` of 2 days, runtime PR individuality#1022). It CANNOT be renewed remotely: the renewal request itself rides SSS (circular dependency), so the only remedy is `playground logout` + `playground login`. There is NO on-chain query for SSS ring membership. When expired, the adapter logs `NoAllowanceError` to console.error but never rejects, so calls hang for the SDK's 180s queue timeout (observed on host-papp 0.7.9; 0.8.x has no `NoAllowanceError` symbol — it has `AllowanceError` with reason codes — so the expired-SSS log line needs live re-verification on 0.8 and the fast-fail match strings may need extending). Defenses: `sessionSigner.ts::wrapSignerWithSssFastFail` (intercepts the log line, rejects in ~200ms with the logout/login message) and `loginStamp.ts` + deploy preflight (warn-only when the recorded login is >2 days old; the stamp lives at `~/.polkadot-apps/dot-cli_LoginStamp.json` so logout clears it). Don't add a "renew SSS on error" path: it cannot work.
 - **`getSessionSigner()` returns an adapter that keeps the Node event loop alive.** Every caller must invoke the returned `destroy()` when done. Forgetting it manifests as `playground <cmd>` hanging after the work visibly finishes.
 - **`requestResourceAllocation` comes from `@parity/product-sdk-terminal/host`** (the `./host` subpath — it is still NOT re-exported at the package root as of 0.3.1). The old CLI-local shim (`src/utils/allowances/host.ts`) is gone; only the playground's resource set + display helpers remain in `src/utils/allowances/resources.ts`. `@parity/product-sdk-host`'s `requestResourceAllocation` is the in-container variant (browser globals required) and won't work from the CLI. Note the resource tag spelling on this path is still `BulletInAllowance` (capital I) — the `BulletinAllowance` rename in host-api 0.8 was only in the in-container protocol, not host-papp's SSO codec.
-- **`checkMapping` must read `Revive.OriginalAccount` at `{ at: "best" }`** (`src/utils/account/mapping.ts`). PAPI's default `at: "finalized"` lags 13-14 blocks (~80 s on paseo-next-v2, measured live 2026-06-11) behind the best head the phone's in-block PGAS-claim confirmation refers to, so a finalized-head read seconds after a grant deterministically reported a freshly-mapped account as "NOT mapped" at login. The login call site additionally passes a bounded retry (`attempts`) to absorb cross-node block propagation right after a grant. The read goes through `getUnsafeApi()` as defence-in-depth against future descriptor staleness — but note there is NO actual descriptor drift today: typed reads of this entry were verified working live at `@parity/product-sdk-descriptors@0.6.0` on 2026-06-11, and the "Incompatible runtime entry" claim that circulated during that debugging traced back to a hypothetical code comment, never an observed error. Don't cite descriptor drift as fact without a reproduced error.
+- **`checkMapping` must read `Revive.OriginalAccount` at `{ at: "best" }`** (`src/utils/account/mapping.ts`). PAPI's default `at: "finalized"` lags 13-14 blocks (~80 s on paseo-next-v2, measured live 2026-06-11) behind the best head the phone's in-block PGAS-claim confirmation refers to, so a finalized-head read seconds after a grant deterministically reported a freshly-mapped account as "NOT mapped" at login. The login call site additionally passes a bounded retry (`attempts`) to absorb cross-node block propagation right after a grant. The read goes through `getUnsafeApi()` as defence-in-depth against future descriptor staleness — but note there is NO actual descriptor drift today: typed reads of this entry were verified working live at `@parity/product-sdk-descriptors@0.6.0` on 2026-06-11, and the "Incompatible runtime entry" claim that circulated during that debugging traced back to a hypothetical code comment, never an observed error. Don't cite descriptor drift as fact without a reproduced error. **Mapping is NOT required to CALL a contract — `checkMapping` returning false is the normal state for a plain Substrate signer, not a fault.** Every `AccountId32` already has a deterministic H160 with no storage lookup: an account whose last 12 bytes are all `0xEE` uses its first 20 bytes, everything else is `keccak256(accountId)[12..32]` (`deriveH160` in `@parity/product-sdk-address`, mirroring pallet-revive's `AccountId32Mapper`). `env::caller()` is that derived address. `Revive.OriginalAccount` is the REVERSE map (H160 → AccountId32), written by `map_account`, and exists only because keccak is not invertible — it is needed when something must credit the full account FROM an address, not to call. Verified 2026-09-24: the dev publish account `5DfhGyQd…` has no `OriginalAccount` entry and zero PGAS, yet its keccak-derived `0x35Cdb23f…` is recorded on-chain as the owner of apps it published. Corollary: **contract fees can be paid in PAS — PGAS is not required**, so do not diagnose a rejected extrinsic as "needs PGAS" or "needs mapping" without evidence (both were wrongly blamed for the E2E `Invalid.Payment`; see the task list).
 - **Every RFC-0010 allowance call goes through `productScopedAdapter` (`src/utils/allowances/resources.ts`) — never hand the raw `dot-cli` adapter to the SDK's host allowance helpers.** The SDK sends `callingProductId: adapter.appId` on the wire and the phone derives every per-product artifact from it; for `SmartContractAllowance` it MINTS PGAS ON-CHAIN to `/product/<callingProductId>/<dest>`. With the raw adapter id the 50-PGAS claim landed on `dot-cli/0` (created + auto-mapped THAT account) while the CLI signs/deploys/checks as `playground.dot/0`, which stayed unmapped — root-caused on paseo-next-v2, 2026-06-11. Scoping moves the SDK allowance cache to `~/.polkadot-apps/playground.dot_AllowanceKeys.json` (existing users re-grant once, single dialog). The signer side already had this split (`createSessionSignerForAccount` takes an explicit productId); drop the wrapper only if product-sdk-terminal grows a `callingProductId` option.
 - **Allowance grant markers live at `~/.polkadot/allowances.json`** (`src/utils/allowances/marker.ts`), mode 0600, sibling to `accounts.json`. RFC-0010 has no on-chain query for allowance status, so we persist `{ env: { ss58Address: { resourceTag: { grantedAt, source } } } }` after a successful host grant. Slot-account private keys for Bulletin / Statement Store live separately in `~/.polkadot/allowance-keys.json` (`src/utils/allowances/slotKeys.ts`), also mode 0600. A marker alone isn't enough to skip `playground login` for slot resources — confirm the matching key exists too. Markers and keys are isolated per env. Keep `source: "host"` as the only value emitted from production code.
 - **Bulletin IS requested through mobile resource allocation in `playground login`** (since `fb2b9e2`, v0.28.0). `PLAYGROUND_RESOURCES` (`src/utils/allowances/resources.ts`) bundles `BulletInAllowance` + `SmartContractAllowance` into ONE `requestResourceAllocation` call so the user sees a single approval dialog. Slot allocation, key caching (`~/.polkadot-apps/<appId>_AllowanceKeys.json`), and slot-signer construction all live in `@parity/product-sdk-terminal/host` now; the CLI side is `getBulletinAllowanceSigner` / `getCachedBulletinAllowanceSigner` / `cachedBulletinSlotAuthorization` in `src/utils/allowances/bulletin.ts`. Usability is existence + non-expiry only (`isAuthorizationActive`: `status.authorized && status.expiration > currentBlock`), NOT a quota gate, and we never request an `Increase` (see the Allowances invariant on soft limits). Per-resource outcomes are `Allocated` / `Rejected` (user declined on the phone) / `NotAvailable` (the wallet could not provision it at all, e.g. an out-of-date mobile build or a full on-chain slot ring); these need DIFFERENT remedies and must not be conflated. `describeAllocationFailure` in `resources.ts` splits them (re-approve vs update-the-app), and `summarizeOutcomes` buckets them. `NotAvailable` is the exact failure mode that got `StatementStoreAllowance` dropped from the request set (`11d6a07`); Bulletin can't be dropped because it is actually consumed. The pre-`fb2b9e2` helpers (`bulletinAuthorizationHelp`, `bulletinAuthorizationUrl`, `hasUsableBulletinSlotAuthorization`, `hasSlotAccountKey`) and the locally-generated-slot-key approach are GONE; do not resurrect them.
diff --git a/package.json b/package.json
index 5aab7046..52991806 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
         "@polkadot-api/sdk-ink": "^0.7.0",
         "@scure/sr25519": "^2.2.0",
         "@sentry/node": "^9.47.1",
-        "bulletin-deploy": "0.18.4",
+        "bulletin-deploy": "0.20.0",
         "commander": "^12.0.0",
         "ink": "^5.2.1",
         "polkadot-api": "^2.2.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fb5fee05..c2a13608 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -69,8 +69,8 @@ importers:
         specifier: ^9.47.1
         version: 9.47.1
       bulletin-deploy:
-        specifier: 0.18.4
-        version: 0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
+        specifier: 0.20.0
+        version: 0.20.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
       commander:
         specifier: ^12.0.0
         version: 12.1.0
@@ -2379,8 +2379,8 @@ packages:
   buffer@6.0.3:
     resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
 
-  bulletin-deploy@0.18.4:
-    resolution: {integrity: sha512-I9bHoAv3ZmGg+JATldYvgKVqi+d76byrrk6dBX9u4OTeF2cFIYB/VOGHtpwrlHJQdMNc2dQaT+tbIZDIqPLmhg==}
+  bulletin-deploy@0.20.0:
+    resolution: {integrity: sha512-opk+ptQpCGsWqSepyaOieLjrphjeyrnyq9cuhRcLsi9vBvvzFL6p5Q4gNMRxRb7nznrxz2ZmERcOS29zlnrpkg==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -7776,7 +7776,7 @@ snapshots:
 
   '@polkadot-labs/hdkd@0.0.28':
     dependencies:
-      '@polkadot-labs/hdkd-helpers': 0.0.30
+      '@polkadot-labs/hdkd-helpers': 0.0.31
 
   '@polkadot-labs/schnorrkel-wasm@0.0.9': {}
 
@@ -8730,7 +8730,7 @@ snapshots:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
-  bulletin-deploy@0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
+  bulletin-deploy@0.20.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
     dependencies:
       '@ipld/car': 5.4.3
       '@ipld/dag-pb': 4.1.5
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 940b96ad..38b3c56e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -26,7 +26,7 @@ minimumReleaseAgeExclude:
   # progress parser matches are unchanged; then confirmed live — a deploy that
   # previously reverted at startingPrice now completes storage + DotNS.
   # Drop once it ages past the min-age window.
-  - "bulletin-deploy@0.18.4"
+  - "bulletin-deploy@0.20.0"
   - "@parity/dotns-cli@0.8.0"
   # The @novasamatech/* 0.10.0 family (pulled transitively by
   # @parity/product-sdk-terminal@^0.10.0 → host-papp 0.10.0, pinned EXACT)
diff --git a/sentry/backup-dashboards.sh b/sentry/backup-dashboards.sh
index c336c976..3c16adbc 100755
--- a/sentry/backup-dashboards.sh
+++ b/sentry/backup-dashboards.sh
@@ -6,7 +6,10 @@
 
 set -euo pipefail
 
-TOKEN=$(security find-generic-password -s sentry-api-token -w)
+# Keychain item is `sentry-api-token-playground`; `sentry-api-token` is the
+# historical name and is kept as a fallback for older machines.
+TOKEN=$(security find-generic-password -s sentry-api-token-playground -w 2>/dev/null \
+    || security find-generic-password -s sentry-api-token -w)
 BASE="https://de.sentry.io/api/0/organizations/paritytech"
 
 # Known dashboard IDs. Append new IDs after creating new dashboards.
diff --git a/sentry/create-dashboard.py b/sentry/create-dashboard.py
index 26a45a2b..0683c0b9 100755
--- a/sentry/create-dashboard.py
+++ b/sentry/create-dashboard.py
@@ -10,6 +10,10 @@
 
 import json
 import subprocess
+
+# Keychain item holding the Sentry API token. `sentry-api-token` was the
+# original name and no longer exists on current machines.
+_KEYCHAIN_ITEM = "sentry-api-token-playground"
 import sys
 import urllib.error
 import urllib.request
@@ -21,7 +25,7 @@ def main() -> int:
         return 2
 
     token = subprocess.check_output(
-        ["security", "find-generic-password", "-s", "sentry-api-token", "-w"]
+        ["security", "find-generic-password", "-s", _KEYCHAIN_ITEM, "-w"]
     ).decode().strip()
 
     with open(sys.argv[1]) as f:
diff --git a/sentry/patch-dashboard.py b/sentry/patch-dashboard.py
index 5a769d1f..03c8cb13 100755
--- a/sentry/patch-dashboard.py
+++ b/sentry/patch-dashboard.py
@@ -19,6 +19,10 @@
 
 import json
 import subprocess
+
+# Keychain item holding the Sentry API token. `sentry-api-token` was the
+# original name and no longer exists on current machines.
+_KEYCHAIN_ITEM = "sentry-api-token-playground"
 import sys
 import urllib.error
 import urllib.request
@@ -31,7 +35,7 @@
 
 def get_token() -> str:
     return subprocess.check_output(
-        ["security", "find-generic-password", "-s", "sentry-api-token", "-w"]
+        ["security", "find-generic-password", "-s", _KEYCHAIN_ITEM, "-w"]
     ).decode().strip()