diff --git a/.changeset/bulletin-deploy-0200.md b/.changeset/bulletin-deploy-0200.md
new file mode 100644
index 00000000..81359303
--- /dev/null
+++ b/.changeset/bulletin-deploy-0200.md
@@ -0,0 +1,22 @@
+---
+"playground-cli": patch
+---
+
+Update `bulletin-deploy` to 0.20.0.
+
+Fixes two crashes that ended a deploy after the content was already uploaded.
+One of them is a crash we hit in practice: `JSON.parse` on incoming RPC data was
+unguarded and threw inside the socket handler, where nothing upstream could
+catch it, killing the process mid-deploy. The other is `hasIPFS()` passing when
+`ipfs` is installed but was never initialised.
+
+Also brings, from 0.19.x: the storage-deposit floor for registering a name drops
+from a hardcoded 200 PAS to 5 PAS (measured cost is ~0.15), registers no longer
+revert when the chain moves between dry-run and inclusion, duplicate files in a
+bundle upload once instead of twice, an interrupted register no longer strands
+the commitment fee, Bulletin re-authorizes on an exhausted-but-unexpired quota,
+and deploying refuses to silently fall back to the public dev key when a stored
+session can't be read.
+
+Additive for us: `deploy()`'s signature is unchanged, every option we pass still
+exists, and the log banners the progress bar parses are intact.
diff --git a/.changeset/rfc0022-product-accounts.md b/.changeset/rfc0022-product-accounts.md
new file mode 100644
index 00000000..24953cf6
--- /dev/null
+++ b/.changeset/rfc0022-product-accounts.md
@@ -0,0 +1,32 @@
+---
+"playground-cli": minor
+---
+
+Fix QR pairing, and sign as the RFC-0022 product account.
+
+`playground login` has been unable to pair with current phones since
+mid-August: `@novasamatech/host-papp` 0.9.0 moved the pairing envelope from
+P-256/AES-GCM to X25519/ChaCha20-Poly1305, shrinking the device key from 65 to
+32 bytes. The handshake codec is fixed-width, so there was no graceful
+degrade — iOS reported "Something went wrong" and Android "invalid QR code".
+Moving to `@parity/product-sdk-terminal@0.10.0` (host-papp 0.10.0) puts the CLI
+back on the wire both shipping apps speak.
+
+The same release changes how the product account is derived. RFC-0022 places it
+at `//product//{productId}/{index}`, where the two `//product//{productId}`
+junctions are HARD — and a public key cannot cross a hard junction, so the
+account is now derived from a subtree key the wallet provides rather than from
+the session's root key locally.
+
+**Your product account address changes, and you must pair again.** Run
+`playground logout` and then `playground login`. Apps published from the old
+address stay owned by it; allowances and PGAS are re-granted at the next login.
+The new derivation is what current phones and the playground web app already
+use, so this brings the CLI back into agreement with them rather than away.
+
+Deploy also stops presenting a retry as progress. The phone-approval counter
+was counting signature *requests*, so a request that timed out and was re-sent
+appeared as the next step — and contradicted the "Phone approvals expected"
+plan, which counts operations. A deploy could print "step 2: Link content"
+while the plan said step 2 was the registry publish. Repeats are now labelled
+as retries, with the remedy worth checking when no prompt appeared at all.
diff --git a/CLAUDE.md b/CLAUDE.md
index 5c5d3b60..f8cc53fd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,6 +13,8 @@ pnpm typecheck
 pnpm test
 ```
 
+**🔴 `pnpm <script>` can exit BEFORE running the tool, and it looks like a pass.** pnpm 11 runs a deps-status check first; when that fails — most often `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` after bumping onto a freshly published release train — it prints a stack and exits non-zero **without invoking tsc/vitest at all**. Grepping the output for `error TS` then finds nothing and reads as a clean typecheck. This cost real bugs in Sept 2026: four type errors (a missed `await` in `identityGate.ts` that broke every gated command, the same in `DripScreen.tsx`, and two malformed allowance literals) all "passed" a typecheck that never ran, and shipped to a live phone test. **Check the exit code, or run the tool directly** — `./node_modules/.bin/tsc --noEmit`, `npx vitest run`. CI is unaffected (a non-zero exit fails the job either way); this is a local-verification trap only.
+
 `pnpm build` compiles with bun, which STRIPS types without checking them — it is NOT a type signal. The tsc baseline was burned to zero in June 2026 and `pnpm typecheck` (`tsc --noEmit`) now runs as a CI job, so any new type error fails the build — keep it at zero.
 
 **`.cdm/cdm.d.ts` and `.cdm/contracts.d.ts` are COMMITTED, and must stay so.** They are generated by `cdm install` and are the module augmentation that gives contract handles their real per-method signatures. Without them the registry handle is a bare `Contract<ContractDef>`, and every `.query()`/`.tx()` call site goes silently unchecked — that gap let the 7-arg `publish` regression and a `getMetadataUri` shape bug through, and it also produces the inverse trap (code that compiles locally and fails only in CI, because a structural interface can't match the un-augmented type). `.cdm/` was gitignored wholesale until Sept 2026; CI never ran `cdm install` (the `cdm` CLI is a global tool needing chain access, not a repo dep), so the `Typecheck` job was checking everything EXCEPT the contract calls. The rest of `.cdm/` stays ignored on purpose: `contracts/**/info.json` snapshots per-version contract addresses that we never read (addresses resolve live from the CDM meta-registry), so committing them would add a second, stale source of truth. **After any `cdm i`, commit the regenerated `.d.ts` files** — a stale one type-checks against the previous ABI, which is exactly the failure this prevents. The cdm-builder version skew is bridged through THREE cast seams: `asCloudStorageApi` in `src/utils/allowances/bulletin.ts` (the `TypedApi<Paseo_bulletin>` vs `BulletinTypedApi` codegen skew — two codegens of the same chain), plus `asCdmAssetHubApi`/`asCdmAssetHubDescriptor` and `asCdmRegistryContract` in `src/commands/contract.ts`. The asset-hub seams bridge the paseo-asset-hub `DotnsGateway`/descriptor shape drift between cdm-builder's pinned `@parity/product-sdk-descriptors` and our root's (the contract pipeline never touches DotnsGateway, so the cast is runtime-safe). `asCdmRegistryContract` was added when our root `@parity/product-sdk-contracts` reached `0.9.x`: `Contract.tx()` now resolves a `Result<TxResult, …>`, nominally unassignable to cdm-builder's older `RegistryContract` param — but the install-time registry is query-only (no signer wired in), so `.tx()` is never invoked through it and the cast is runtime-safe. At `cdm-builder@3.2.0` the pinned product-sdk moved up to `contracts@0.9.0` / `descriptors@0.7.0` while our root is `contracts@^0.9.2` / `descriptors@^0.8.0` — so the `.tx()` Result shape realigns (making `asCdmRegistryContract` likely redundant) while a descriptors minor gap (0.7 vs 0.8) remains. Before deleting any seam, remove it and run `pnpm typecheck`. If `lint:license` flags a file you authored, run `./scripts/check-license-headers.sh --fix` to prepend the standard Parity Apache-2.0 header (`SPDX-License-Identifier: Apache-2.0` + `Copyright (C) Parity Technologies (UK) Ltd.`, both lines required). The check script keeps shebangs on line 1 and places the header below them.
@@ -33,7 +35,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **`bulletin-deploy` (formerly `@parity/polkadot-app-deploy`) is pinned to an explicit version (`0.18.4` as of 2026-09-17; previously `0.15.0` — see the generations note above for why that was harmful), not `latest`.** A previous `latest` (0.6.8) had a WebSocket-heartbeat bug that tore chunk uploads down mid-flight. The pin avoids ever silently sliding onto a broken `latest`. When bumping, read release notes for changes to `deploy()`, DotNS methods, or the `DeployOptions` we use (`jsMerkle`, `signer`, `signerAddress`, `storageSigner`, `storageSignerAddress`, `mnemonic`, `rpc`, `attributes`). Newer releases now also export environment helpers (`loadEnvironments`, `resolveEndpoints`, etc.); we don't consume them — our env table lives in `src/config.ts::CONFIGS`. Do NOT downgrade below 0.8.3: 0.7.30-rc/0.8.0 changed storage routing to use the injected `signer` (so phone-mode chunk uploads would phone-sign and die with "message too big"), and 0.8.3 is the first release with the `storageSigner` slot-key escape hatch. The `0.8.3 → 0.9.0` bump (June 2026) was a code/API drop-in: index exports unchanged, `deploy()` signature unchanged, `DeployOptions` only additive, console log strings unchanged (so `src/utils/deploy/progress.ts`'s banner/`[N/M]` parser still matches), `storageSigner` routing precedence unchanged. It aligns polkadot-app-deploy onto `@novasamatech/host-papp@0.8.6` / `@parity/product-sdk-terminal@0.3.x` (collapsing the prior split tree onto our root line), and prefix-matches `dot-cli_SsoSessions*` in its SSO-session probe (still defused because we always pass explicit auth/signer/storageSigner). 0.9.0 also ships a `postinstall` (`patch-package || true`) bundling an `@novasamatech/sdk-statement@0.6.0` patch; we DENY that build script (`allowBuilds: polkadot-app-deploy: false` in `pnpm-workspace.yaml`) because our own pnpm patch on that exact package already applies the fix — pnpm 11 will hard-fail every `pnpm <script>` with `ERR_PNPM_IGNORED_BUILDS` if the entry is left undecided. The phone-tap-reduction (`transferToSignedInUser`, now shipped in 0.10.0 stable) is unreachable for us regardless: it activates only on polkadot-app-deploy's own signer-resolution (`resolve`) branch, and we always inject an explicit `signer`/`mnemonic`. The `0.9.0 → 0.10.0` bump (June 2026) was the same class of additive drop-in: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (`transferToSignedInUser`/`transferTo`), console log strings unchanged (progress parser still matches), `storageSigner` routing precedence unchanged; it moves polkadot-app-deploy's own subtree onto `@parity/product-sdk-terminal@^0.4.0` and still ships the denied `patch-package` postinstall. (Since our June 2026 terminal `^0.5.0` bump, pad's `^0.8.6` host-papp range dedupes onto our 0.8.7 — only its `product-sdk-terminal` stays at 0.4.0; see the `@novasamatech/*` bullet above.) The `0.10.0 → 0.11.0` bump (June 2026) is the same additive drop-in class: `src/index.ts` byte-identical (all exports unchanged), `deploy()` signature unchanged, `DeployOptions` only additive (`onPhoneSignaturePlan`/`confirmPhoneReady`, both optional and unused by us), banner/`[N/M]` log strings unchanged (progress parser still matches — the #70 0-based chunk renumber only touched prose lines the parser drops), `storageSigner` routing precedence unchanged (now via the `resolveStorageSigner` helper, precedence `storageSigner > signer > mnemonic > session-slot > pool`), terminal subtree still `^0.4.0` / host-papp override still `0.8.6` (dedup story intact), and still ships the denied `patch-package` postinstall. **0.11.0 FIXES the nonce-collision re-upload bug (paritytech/polkadot-app-deploy#946):** the `storeChunkedContent` nonce-collision loop and the phase-B GRANDPA re-upload loop now call `doReconnect()` on a `ChainHead disjointed`/connection error (commit `f519eed`, gated by `isConnectionError` + `reconnectionsUsed < MAX_RECONNECTIONS`), so a WS halt mid-re-upload now recovers instead of failing the deploy. (The pre-0.11.0 remedy — re-run the deploy, incremental upload skips already-stored chunks — is no longer needed for that failure mode.) The `0.11.0 → 0.13.1` bump (July 2026, part of #465) is the same additive drop-in class: `deploy()` signature + index exports unchanged, `DeployOptions` only additive (verified against every option we pass), `storageSigner` routing precedence unchanged, and pad still ships the denied `patch-package` postinstall (keep `allowBuilds: polkadot-app-deploy: false`). Its terminal subtree stays `^0.4.0` (its own split copy) and it no longer declares a direct `host-papp` dep. **0.13.x DROPS the `summit` environment from the bundled `environments.json`** — this is what forced the summit/w3s retirement (the `config.test.ts` divergence guard fails on any wired `CONFIGS` env missing upstream). ⚠️ The deploy log-string → progress-bar parser (`src/utils/deploy/progress.ts`) was NOT re-verified against 0.13.1's actual banner output (the bundled dist obscures the strings); the parser degrades gracefully (unknown banner → dropped, deploy still functions), so this is a cosmetic-only live-verify item. **The `0.13.1 → 0.15.0` bump (Aug 2026) RENAMED the npm package: `@parity/polkadot-app-deploy` stopped at 0.13.x, versions 0.14+ publish as `bulletin-deploy`** (update imports, the `allowBuilds` denial key, and `minimumReleaseAgeExclude` together when bumping). The bump was validated on `0.15.0-rc.2` and the pin moved to `0.15.0` stable the day upstream cut it — verified code-identical to rc.2 (git tag diff: version bump + an unshipped e2e script fix only; published dist byte-identical after normalizing tsup chunk hashes and the baked version string). Heads-up from that move: pnpm's min-age gate applies `minimumReleaseAgeExclude` when RESOLVING a version, but the lockfile-verification pass failed to honor the exclude for the PRERELEASE entry (`bulletin-deploy@0.15.0-rc.2` kept tripping `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` even while excluded; the stable `0.15.0` entry verifies fine) — if a young prerelease pin ever wedges installs like that again, rewrite the lockfile once with `pnpm install --config.minimumReleaseAge=0`, then confirm a plain `pnpm install` passes. 0.15 is the paseo-next-v2-wipe release: DotNS redeployed at new canonical addresses (owned by its `environments.json`, keyed by env id) and **the DotNS TLD went per-network** — `environments.json` gained a per-env `tld` field ("paseo" on paseo-next-v2; envs without one fall back to upstream `DEFAULT_TLD` "dot"), `deploy()` resolves the authoritative TLD on-chain at preflight (`DotnsProtocolRegistry.tld()`, dotns PR #218), and `parseDomainName(input, tld)` rejects wrong-TLD input. Our side: `ChainConfig.tld` + `getEnvTld()` in `src/config.ts` (divergence-guarded against upstream's catalog; the signing id `PLAYGROUND_PRODUCT_ID = "playground.dot"` is TLD-independent by convention and must NOT change), and `normalizeDomain(domain, tld)` mirrors the wrong-TLD rejection. API surface: `deploy()` signature + `DeployOptions` we pass unchanged (additive: `transferTo`, `contracts`, `bulletinEndpoints`/`assetHubEndpoints`, `publish`, `dumpCar`, …), banner titles (`Preflight`/`Storage`/`DotNS`/`DEPLOYMENT COMPLETE!`) and `[N/M]` chunk lines unchanged — verified against the 0.15 SOURCE this time; #1240 moved the `Domain:` echo to after the Preflight connect (prose the parser drops; test pins it). `storageSigner > signer > mnemonic > pool` routing precedence unchanged. Its subtree moved to `@parity/product-sdk-terminal@^0.5.1` (resolves 0.5.4) whose host-papp `^0.8.x` DEDUPES onto our 0.8.11 — one host-papp/statement-store tree, patches still apply; only `product-sdk-terminal` stays split (0.5.4 pad / 0.7.1 us). Still ships the denied `patch-package` postinstall (bundling the same sdk-statement@0.6.0 patch we carry). 0.15 also drops the `@parity/dotns-cli` subprocess path entirely (no references left), so the `[polkadot-app-deploy] @parity/dotns-cli not found` warning suppression in `src/index.ts` is now a dormant no-op; our own `playground dotns` passthrough keeps the direct dotns-cli dep.
 - **`polkadot-api` is `^2.2.1`** and effectively the only 2.x version in the runtime — keeping it a single instance is load-bearing. The lockfile contains `polkadot-api@1.x` only because `@parity/dotns-cli` declares it, and dotns-cli ships as a single fully-bundled `dist/cli.js` with all deps inlined — never resolved at runtime. The root was bumped `^2.1.6 → ^2.2.1` during #465: `cdm-builder@3.2.0`'s newer product-sdk pins pulled a second 2.x copy (`2.2.1`) alongside `2.1.6`, and in `src/commands/contract.ts` the cdm asset-hub client (2.2.1) met our descriptors (2.1.6) as "two different `P` types" (`error TS2345`). Aligning the root to `^2.2.1` collapses the 2.x line to one instance. If a future bump reintroduces a split, re-align the root the same way rather than casting around it.
 
-- **🔴 BROKEN IN THE FIELD (Sept 2026): QR pairing cannot succeed on ANY current phone build, and we cannot fix it from this repo.** `@novasamatech/host-papp@0.9.0` (published 2026-07-29) moved the SSO pairing envelope from **P-256 / AES-GCM to X25519 / ChaCha20-Poly1305**, shrinking the device encryption key from **65 to 32 bytes**. The handshake codec is fixed-width SCALE (`dist/sso/auth/scale/handshakeV2.js`: `PublicKeyCodec = Bytes(65)` at 0.8.x → `Bytes(32)` at 0.9.0+), so there is no graceful degrade — a 32-byte reader starts the metadata `Vec` 33 bytes early, still inside the key, and dies on a garbage enum discriminant. Both shipping mobile apps moved mid-August 2026. We resolve host-papp **0.8.11** (via `product-sdk-terminal@^0.7.1`) and still emit 65 bytes, so `playground login` fails at scan time: iOS logs `PolkadotHandshakeProposal.init():66 - Failed to decode host data: unexpectedDecodedValue` → `missingInput` → "Something went wrong"; Android shows the generic **"invalid QR code"**. Device-verified 2026-09-15 with an A/B pair of QRs identical except the key encoding: 65-byte → rejected, 32-byte → **"Device linked"**. `bulletin-deploy login` (host-papp 0.8.7) fails identically, so this is the shared dependency, not our code. **Do NOT try to fix this by bumping our own deps** — EVERY published `@parity/product-sdk-terminal` (latest `0.8.2`, incl. the `dev` tag) pins `host-papp: ^0.8.9`, whose 0.x caret ceiling is 0.8.12, the last release of the old wire. Upstream is already fixed but UNRELEASED: product-sdk#362 (root cause), PR #364 (**merged** 2026-09-07, pin → exactly `0.10.0`; not 0.10.2, which needs PAPI 3). The release is deliberately held behind #168 / PR #366 (RFC-0022 product-account signing) so pairing-that-works doesn't ship alongside signing that doesn't. ⚠️ **#366 is a breaking change for us, not a drop-in** — see the RFC-0022 note in the accounts section. Existing sessions still sign fine; only NEW pairings break, which is why deploy tooling that uses local keys looks healthy. Unaffected: dev/`--suri` paths (`DEFAULT_MNEMONIC`, `DEV_PUBLISH_ACCOUNT`) never pair, so E2E publish legs are green throughout.
+- **✅ RESOLVED (2026-09-23): QR pairing works again on `@parity/product-sdk-terminal@^0.10.0`.** History, because the symptom is distinctive and may recur: `@novasamatech/host-papp@0.9.0` (2026-07-29) moved the SSO pairing envelope from **P-256/AES-GCM to X25519/ChaCha20-Poly1305**, shrinking the device encryption key from **65 to 32 bytes**. The handshake codec is fixed-width SCALE (`dist/sso/auth/scale/handshakeV2.js`: `PublicKeyCodec = Bytes(65)` at 0.8.x → `Bytes(32)` at 0.9.0+), so there is no graceful degrade — a 32-byte reader starts the metadata `Vec` 33 bytes early and dies on a garbage enum discriminant. Both shipping mobile apps moved mid-August 2026, and every terminal release up to 0.8.2 pinned `host-papp ^0.8.9` (0.x caret ceiling 0.8.12, the last release of the old wire), so `playground login` failed at scan time for ~5 weeks: iOS `PolkadotHandshakeProposal.init():66 - Failed to decode host data: unexpectedDecodedValue` → "Something went wrong"; Android the generic **"invalid QR code"**. Device-verified 2026-09-15 with an A/B pair of QRs identical except the key encoding: 65-byte → rejected, 32-byte → **"Device linked"**. Fixed upstream by product-sdk#364 (merged 2026-09-07, released in terminal 0.9.0) — but 0.9.x is **#364 WITHOUT #366**, which is a trap: pairing succeeds, then `checkMapping` fails forever because the phone mints PGAS to the RFC-0022 address while an unmigrated CLI checks the old one, and the UI reports it as transient. **Take 0.10.0 or newer, never 0.9.x** — 0.10.0 carries #364 and #366 together. Verify a candidate with `grep -c 'Bytes(32)' node_modules/@novasamatech/host-papp/dist/sso/auth/scale/handshakeV2.js` (expect non-zero) and by checking `deriveProductPublicKey` is async.
 
 ### Network / env
 
@@ -64,7 +66,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **The mobile's "Wallet account address" and "Candidate account address" debug rows are NOT reachable from the host.** They're sr25519 of mnemonic + `//wallet` and mnemonic + `//candidate` respectively (`feature/account/impl/.../RealAccountRepository.kt:166-173`, hard junctions). Hard derivations can't be reproduced from a public key, so the CLI never sees those SS58s. Don't try to surface a "wallet address that matches mobile" — it isn't possible without the mnemonic.
 - **🔴 `PLAYGROUND_PRODUCT_ID` MUST FOLLOW THE ENV TLD — it is `` `playground.${getEnvTld()}` `` (`config.ts`), NOT a fixed `.dot`.** The phone validates the product id against ITS OWN TLD and silently drops a mismatch (polkadot-android-community#123, root-caused by the Android team 2026-09-16). `SsoSessionMessageMappers.kt:151` maps `ProductSubtreeRequest` with `ProductId.fromString(productId, tld).getOrThrow()` — the ONLY request mapper that re-validates the product id against the PHONE's own TLD (every sibling uses the non-throwing `fromStoredValue`). `productIdPattern` is `([a-z0-9-]+\.)+<tld>`, so a phone whose TLD is `paseo` rejects every `.dot` id; the throw escapes through `SsoSession.kt:97`, nothing is written back, and the host waits out its full 120-180 s deadline with no error. Their A/B on one session: `headless-playground.dot` → timeout, `headless-playground.testnet` → 2.9 s OK. **This is exactly why `playground login` hangs at "paired, finalizing" on the #366 branch.** Our `config.ts:285` product id is `playground.dot` while `config.ts:150` sets `tld: "paseo"` for the only wired env — so we are the failing case. **An earlier version of this note said the id was "TLD-independent by convention" and told you NOT to thread `getEnvTld` through it. That was wrong** — the phone decides, and playground-app already shipped the env-suffixed form (`defaultDotNsId`, commit `6e9337c`; it prints `product id : playground.paseo` at boot). The two strings MUST match exactly or the CLI and the app derive different H160s for the same human, splitting app ownership, XP and dedupe across two identities. ⚠️ Changing the TLD is an IDENTITY MIGRATION: every derived product account moves, and anything keyed on the old id — cached subtrees and the SDK allowance cache, both `~/.polkadot-apps/{productId}_*.json` — is simply not found under the new id (re-granted at next login, not corrupted). Android still flags their check as stricter than host-spec (`host-rust-core`'s `product_manifest.rs` treats `dim2.dot`, `dim2.paseo` and `dim2` as the same node) and note it also rejects every `localhost:*` id, so local dev servers cannot resolve a product account at all. With the env-suffixed id in place, #123 no longer blocks us — it still matters for `localhost:*` ids and for any consumer hardcoding `.dot`. **Two testing gotchas measured on our own handset (2026-09-16), both of which produce the SAME silent ~180 s timeout and are easily mistaken for each other:** (a) the phone's TLD really is `paseo` on a paseo-next-v2 pairing — `getProductSubtree("playground.paseo")` returns a valid 32-byte subtree while `playground.dot` / `playground.testnet` never answer; (b) **the mobile app must be OPEN AND IN THE FOREGROUND** — backgrounded, even the correct TLD times out silently (confirmed 3/5 runs succeeded, the 2 failures being backgrounded). Successful replies took anywhere from 3 s to 30 s, so the variance is the statement round trip, not the derivation — do not read a slow reply as a failure. When debugging any SSO round trip, rule out app state BEFORE concluding anything about the wire.
 - **`AutoSigning` returns `NotAvailable` on current mobile builds** (measured 2026-09-15 via `@dotli/host-cli` against Android build 1026, alongside `BulletInAllowance` → `Allocated` on the same call). RFC-0010 says `AutoSigning` is the one resource that MUST be requested explicitly — but the wallet will not provision it today, and host-rust-core#343 records that the runtime consumes the capability only for `account.sign_vrf` anyway. So the "AutoSigning makes Bulletin chunk signing work under TrUAPI" plan in `docs-internal/2026-09-14-truapi-host-cli-signing.md` is blocked on BOTH a wallet change and #343. Do not assume it is merely a matter of adding the resource to `PLAYGROUND_RESOURCES`.
-- **⚠️ INCOMING BREAKING CHANGE — RFC-0022 product-account derivation (product-sdk PR #366, open as of Sept 2026).** Our entire derivation is about to be declared WRONG upstream, and every product-account address changes with it. Today we soft-derive three junctions (`product` / `playground.dot` / `0`) from `session.rootAccountId`. RFC-0022 places a product account at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — and a public key cannot cross a hard junction, so the current approach could never have matched any shipping host. It failed CLOSED rather than silently: the wallet resolves an account *selector*, so it signed as the right account, but the wrong key drove the nonce lookup and everything PAPI computes around the signature. Concretely, #366: (1) `deriveProductAccountPublicKey(subtreePublicKey, derivationIndex)` replaces the 3-arg `(parentPublicKey, productId, derivationIndex)` form — the subtree key must come from the wallet via `session.getProductSubtree(productId)` (consent-free but needs the phone reachable; cached at `{appId}_ProductSubtrees.json`, mode 0600); (2) `createChainCode` is REMOVED; (3) `createSessionSignerForAccount` / `createSessionSigner` / `deriveProductPublicKey` all become ASYNC; (4) `derivationIndex` becomes a tagged `DerivationIndex` (`{tag:"Index",value}`); (5) requires host-papp ≥ 0.10.0. There is deliberately NO fallback to the old derivation. Our blast radius: `sessionSigner.ts:79,87`, and `deriveSessionAddresses` (`auth.ts:170`) goes async, which ripples into `ConnectResult` / `LoginStatus` / `SessionHandle` — all of which carry the address triple computed synchronously today. The frozen vectors at `auth.test.ts:433-434` (`5GGpUaN7…`, `0x47f68a08…`) pin the OLD address and MUST be regenerated against host-rust-core's cross-host vector, not against our own output (the upstream fixtures had exactly that bug). **Two things measured on a real handset (2026-09-15) that the bump will need.** (1) The `@novasamatech/statement-store` pnpm patch is STILL REQUIRED at `0.10.0` — the unpatched `console.error('Statement subscription error:', error)` is still at `dist/adapter/rpc.js:72` with byte-identical surrounding context, so the patch re-pins cleanly (version key + filename only). Dropping it makes the benign post-destroy `Error("Not connected")` teardown stack print after every successful `login`. (2) **`#364 alone is NOT a safe partial bump.** Built and run against an unmigrated CLI: pairing and login both succeed, allowances grant, then `checkMapping` fails permanently — the phone mints PGAS to its RFC-0022 address while we check the old-derivation address, so the accounts never match. Worse, the UI reports it as transient ("this usually resolves on its own… run `playground login` again"), which loops forever. Take #364 and #366 together or neither. **The builder-identity gate is address-bound, so it resets across the RFC-0022 change — no impact today, but it will bite once builders exist.** `enforceIdentityGate` (`src/commands/shared/gateOrNotice.ts`, called unconditionally at `commands/deploy/index.ts:176` and from `decentralize`, `deploy-all`, `mod`) derives `productH160` from the session and queries the identity registry for THAT address; only `status === "revealed"` proceeds. RFC-0022 changes the derived address, so a competition membership recorded against the OLD H160 stops resolving and the user gets "Couldn't verify your builder status" on every deploy. Observed directly: a spike account derived the RFC-0022 way was gated out immediately. **Not a blocker for the #366 bump as of Sept 2026 — there are no joined builders to strand** (confirmed by the product owner), so the reset costs nothing right now. Re-evaluate before the bump if builders have joined by then, or if the gate's backing registry is ever populated ahead of a derivation change; the remedy would be a re-reveal flow or a registry-side remap. Keep in mind generally: anything keyed to the product H160 resets when the derivation changes, and the list below only enumerates the bindings checked at that time. **Otherwise, the "stranded old address" hazard the upstream changeset warns about is NOT a real concern for us** (assessed 2026-09-15) — do not let it block the bump. Checked one by one: (a) the Bulletin slot authorization is granted to the SLOT account (`ss58Encode(slotSigner.publicKey)`, `allowances/bulletin.ts:146`), NOT the product account, so it is unaffected; (b) drip funds are testnet PAS and re-drippable; (c) `SmartContractAllowance` PGAS is re-minted on the next `playground login`, which also re-maps the new account via `AutoMapper`; (d) the `~/.polkadot/allowances.json` marker file the old docs described no longer exists (`allowances/marker.ts` is gone), so there is nothing to orphan; (e) `registry.publish` and DotNS ownership are the only bindings that would genuinely strand, and the window for them is empty — the Paseo Asset Hub **genesis reset** (product-sdk#322, Aug 2026) reaped the registry contract, and every path that records a PRODUCT address as owner (phone mode, or dev mode passing `claimedOwnerH160`) needs a working pairing, which has been broken since mid-August. Dev-mode publishes without a session record `DEV_PUBLISH_ADDRESS` (a local `seedToAccount(DEFAULT_MNEMONIC, "")` key, not a product account) and are untouched by the derivation change. The real cost of the bump is therefore code migration + test-vector regeneration, not user data loss.
+- **✅ DONE (2026-09-23): the RFC-0022 product-account derivation landed** (product-sdk #366, released in `@parity/product-sdk-terminal@0.10.0`; we pin `^0.10.0`). A product account now lives at `//product//{productId}/{derivationIndex}` where the two `//product//{productId}` junctions are **HARD** — a public key cannot cross a hard junction, so the old three-SOFT-junction derivation off `session.rootAccountId` could never have matched a shipping host. What the migration actually required, recorded because the pre-merge predictions were partly wrong: (1) `deriveProductPublicKey(session, ref)` replaces the local math and is **async**, and so are `createSessionSignerForAccount` / `createSessionSigner`; (2) the parent is the product SUBTREE key, fetched from the wallet via `session.getProductSubtree` (consent-free) and cached by the SDK at `{appId}_ProductSubtrees.json` — it reaches the phone only on a cold cache; (3) `ProductAccountRef.derivationIndex` stayed a **plain number** (the predicted tagged `DerivationIndex` exists only inside `@parity/product-sdk-keys`, whose `deriveProductAccountPublicKey(subtree, {tag:"Index", value})` is the 2-arg form — **our root must be on `keys@^0.4.0`** — 0.3.x's signature is `(parentPublicKey, productId: string, derivationIndex: number)`, so the 2-arg call is a tsc error there, and if you bypass tsc it derives from junctions built out of a stringified object. `pnpm typecheck` catches it; a vitest-only run does not, because vitest transpiles without typechecking. 0.4.0 itself validates and throws on a bad subtree or an out-of-range index); (4) `ProductAccountRef.publicKey` is optional and we deliberately omit it, so the signer and the displayed address resolve through one cached path and cannot desync; (5) `deriveSessionAddresses` is async, rippling into `ConnectResult` / `LoginStatus` / `SessionHandle`. Test vectors are pinned at the primitive in `sessionSigner.test.ts` against **host-rust-core's own** cross-host vector (`tests/wasm_crypto_vectors.rs`, `product_account_and_entropy_vectors_match_mobile`, mirrored in product-sdk's `product-account.test.ts`) — never regenerate a fixture from our own output. ⚠️ Tests must MOCK `deriveProductPublicKey`/`createSessionSignerForAccount`: unmocked they hang waiting for a phone AND write a bogus key into the developer's real `~/.polkadot-apps` subtree cache, breaking their live session. Every product account address MOVED, so users pair again once (`playground logout` + `playground login`); the old address keeps anything already published under it.
 - **The playground product account is derived by exactly one function** (`src/utils/sessionSigner.ts::derivePlaygroundProductPublicKey`), called by both `createPlaygroundSessionSigner` (signer construction) and `auth.ts::deriveSessionAddresses` (display triple). The math is `deriveProductAccountPublicKey(rootAccountId, "playground.dot", 0)` from `@parity/product-sdk-keys`. Do NOT call `deriveProductAccountPublicKey` (or any helper that wraps it) on an already-product-derived SS58 — that yields a doubly-derived ghost account. The `productAccountDisplay` / `productAccountAddresses` helpers that used to live in `src/commands/login/identityLine.ts` had exactly this bug and were deleted; resist re-introducing them. A frozen-vector regression test in `src/utils/auth.test.ts` (`deriveSessionAddresses` block) locks the pubkey/H160 the playground-app expects.
 - **`SessionAddresses` triples are computed once in `auth.ts` and threaded through.** `ConnectResult`, `LoginStatus.success`, and `SessionHandle` all carry the `{ rootAddress, productAddress, productH160 }` bundle. `SessionHandle.address` is kept as a back-compat alias for `addresses.productAddress` because `signer.ts::resolveSigner` spreads the handle into `ResolvedSigner` and downstream deploy code (`signerMode.ts`, `playground.ts`, `registry.ts`, `DeployScreen.tsx`) reads `.address` for the signing key. UI code should prefer `addresses` so the root vs product distinction stays explicit.
 
@@ -75,7 +77,7 @@ These aren't self-evident from reading the code and have bitten us before. Treat
 - **The statement-store (SSS) allowance is a 1-day renewable resource and is the CHANNEL for every phone interaction**, not a signing permission. `session.createTransaction` / `signRaw` / `requestResourceAllocation` all travel as statements on the People chain; the host's locally derived SSS account needs an on-chain ring slot to submit them. The slot is granted at QR login (the only flow with a direct WebSocket channel) and lapses ~2-3 days later (1-day period + `StmtStoreGraceWindow` of 2 days, runtime PR individuality#1022). It CANNOT be renewed remotely: the renewal request itself rides SSS (circular dependency), so the only remedy is `playground logout` + `playground login`. There is NO on-chain query for SSS ring membership. When expired, the adapter logs `NoAllowanceError` to console.error but never rejects, so calls hang for the SDK's 180s queue timeout (observed on host-papp 0.7.9; 0.8.x has no `NoAllowanceError` symbol — it has `AllowanceError` with reason codes — so the expired-SSS log line needs live re-verification on 0.8 and the fast-fail match strings may need extending). Defenses: `sessionSigner.ts::wrapSignerWithSssFastFail` (intercepts the log line, rejects in ~200ms with the logout/login message) and `loginStamp.ts` + deploy preflight (warn-only when the recorded login is >2 days old; the stamp lives at `~/.polkadot-apps/dot-cli_LoginStamp.json` so logout clears it). Don't add a "renew SSS on error" path: it cannot work.
 - **`getSessionSigner()` returns an adapter that keeps the Node event loop alive.** Every caller must invoke the returned `destroy()` when done. Forgetting it manifests as `playground <cmd>` hanging after the work visibly finishes.
 - **`requestResourceAllocation` comes from `@parity/product-sdk-terminal/host`** (the `./host` subpath — it is still NOT re-exported at the package root as of 0.3.1). The old CLI-local shim (`src/utils/allowances/host.ts`) is gone; only the playground's resource set + display helpers remain in `src/utils/allowances/resources.ts`. `@parity/product-sdk-host`'s `requestResourceAllocation` is the in-container variant (browser globals required) and won't work from the CLI. Note the resource tag spelling on this path is still `BulletInAllowance` (capital I) — the `BulletinAllowance` rename in host-api 0.8 was only in the in-container protocol, not host-papp's SSO codec.
-- **`checkMapping` must read `Revive.OriginalAccount` at `{ at: "best" }`** (`src/utils/account/mapping.ts`). PAPI's default `at: "finalized"` lags 13-14 blocks (~80 s on paseo-next-v2, measured live 2026-06-11) behind the best head the phone's in-block PGAS-claim confirmation refers to, so a finalized-head read seconds after a grant deterministically reported a freshly-mapped account as "NOT mapped" at login. The login call site additionally passes a bounded retry (`attempts`) to absorb cross-node block propagation right after a grant. The read goes through `getUnsafeApi()` as defence-in-depth against future descriptor staleness — but note there is NO actual descriptor drift today: typed reads of this entry were verified working live at `@parity/product-sdk-descriptors@0.6.0` on 2026-06-11, and the "Incompatible runtime entry" claim that circulated during that debugging traced back to a hypothetical code comment, never an observed error. Don't cite descriptor drift as fact without a reproduced error.
+- **`checkMapping` must read `Revive.OriginalAccount` at `{ at: "best" }`** (`src/utils/account/mapping.ts`). PAPI's default `at: "finalized"` lags 13-14 blocks (~80 s on paseo-next-v2, measured live 2026-06-11) behind the best head the phone's in-block PGAS-claim confirmation refers to, so a finalized-head read seconds after a grant deterministically reported a freshly-mapped account as "NOT mapped" at login. The login call site additionally passes a bounded retry (`attempts`) to absorb cross-node block propagation right after a grant. The read goes through `getUnsafeApi()` as defence-in-depth against future descriptor staleness — but note there is NO actual descriptor drift today: typed reads of this entry were verified working live at `@parity/product-sdk-descriptors@0.6.0` on 2026-06-11, and the "Incompatible runtime entry" claim that circulated during that debugging traced back to a hypothetical code comment, never an observed error. Don't cite descriptor drift as fact without a reproduced error. **Mapping is NOT required to CALL a contract — `checkMapping` returning false is the normal state for a plain Substrate signer, not a fault.** Every `AccountId32` already has a deterministic H160 with no storage lookup: an account whose last 12 bytes are all `0xEE` uses its first 20 bytes, everything else is `keccak256(accountId)[12..32]` (`deriveH160` in `@parity/product-sdk-address`, mirroring pallet-revive's `AccountId32Mapper`). `env::caller()` is that derived address. `Revive.OriginalAccount` is the REVERSE map (H160 → AccountId32), written by `map_account`, and exists only because keccak is not invertible — it is needed when something must credit the full account FROM an address, not to call. Verified 2026-09-24: the dev publish account `5DfhGyQd…` has no `OriginalAccount` entry and zero PGAS, yet its keccak-derived `0x35Cdb23f…` is recorded on-chain as the owner of apps it published. Corollary: **contract fees can be paid in PAS — PGAS is not required**, so do not diagnose a rejected extrinsic as "needs PGAS" or "needs mapping" without evidence (both were wrongly blamed for the E2E `Invalid.Payment`; see the task list).
 - **Every RFC-0010 allowance call goes through `productScopedAdapter` (`src/utils/allowances/resources.ts`) — never hand the raw `dot-cli` adapter to the SDK's host allowance helpers.** The SDK sends `callingProductId: adapter.appId` on the wire and the phone derives every per-product artifact from it; for `SmartContractAllowance` it MINTS PGAS ON-CHAIN to `/product/<callingProductId>/<dest>`. With the raw adapter id the 50-PGAS claim landed on `dot-cli/0` (created + auto-mapped THAT account) while the CLI signs/deploys/checks as `playground.dot/0`, which stayed unmapped — root-caused on paseo-next-v2, 2026-06-11. Scoping moves the SDK allowance cache to `~/.polkadot-apps/playground.dot_AllowanceKeys.json` (existing users re-grant once, single dialog). The signer side already had this split (`createSessionSignerForAccount` takes an explicit productId); drop the wrapper only if product-sdk-terminal grows a `callingProductId` option.
 - **Allowance grant markers live at `~/.polkadot/allowances.json`** (`src/utils/allowances/marker.ts`), mode 0600, sibling to `accounts.json`. RFC-0010 has no on-chain query for allowance status, so we persist `{ env: { ss58Address: { resourceTag: { grantedAt, source } } } }` after a successful host grant. Slot-account private keys for Bulletin / Statement Store live separately in `~/.polkadot/allowance-keys.json` (`src/utils/allowances/slotKeys.ts`), also mode 0600. A marker alone isn't enough to skip `playground login` for slot resources — confirm the matching key exists too. Markers and keys are isolated per env. Keep `source: "host"` as the only value emitted from production code.
 - **Bulletin IS requested through mobile resource allocation in `playground login`** (since `fb2b9e2`, v0.28.0). `PLAYGROUND_RESOURCES` (`src/utils/allowances/resources.ts`) bundles `BulletInAllowance` + `SmartContractAllowance` into ONE `requestResourceAllocation` call so the user sees a single approval dialog. Slot allocation, key caching (`~/.polkadot-apps/<appId>_AllowanceKeys.json`), and slot-signer construction all live in `@parity/product-sdk-terminal/host` now; the CLI side is `getBulletinAllowanceSigner` / `getCachedBulletinAllowanceSigner` / `cachedBulletinSlotAuthorization` in `src/utils/allowances/bulletin.ts`. Usability is existence + non-expiry only (`isAuthorizationActive`: `status.authorized && status.expiration > currentBlock`), NOT a quota gate, and we never request an `Increase` (see the Allowances invariant on soft limits). Per-resource outcomes are `Allocated` / `Rejected` (user declined on the phone) / `NotAvailable` (the wallet could not provision it at all, e.g. an out-of-date mobile build or a full on-chain slot ring); these need DIFFERENT remedies and must not be conflated. `describeAllocationFailure` in `resources.ts` splits them (re-approve vs update-the-app), and `summarizeOutcomes` buckets them. `NotAvailable` is the exact failure mode that got `StatementStoreAllowance` dropped from the request set (`11d6a07`); Bulletin can't be dropped because it is actually consumed. The pre-`fb2b9e2` helpers (`bulletinAuthorizationHelp`, `bulletinAuthorizationUrl`, `hasUsableBulletinSlotAuthorization`, `hasSlotAccountKey`) and the locally-generated-slot-key approach are GONE; do not resurrect them.
diff --git a/package.json b/package.json
index 3c37d022..52991806 100644
--- a/package.json
+++ b/package.json
@@ -34,15 +34,15 @@
         "@parity/product-sdk-contracts": "^0.10.1",
         "@parity/product-sdk-descriptors": "^0.9.0",
         "@parity/product-sdk-host": "^0.15.1",
-        "@parity/product-sdk-keys": "^0.3.18",
+        "@parity/product-sdk-keys": "^0.4.0",
         "@parity/product-sdk-logger": "^0.1.1",
-        "@parity/product-sdk-terminal": "^0.7.1",
+        "@parity/product-sdk-terminal": "^0.10.0",
         "@parity/product-sdk-tx": "^0.4.1",
         "@parity/product-sdk-utils": "^0.1.1",
         "@polkadot-api/sdk-ink": "^0.7.0",
         "@scure/sr25519": "^2.2.0",
         "@sentry/node": "^9.47.1",
-        "bulletin-deploy": "0.18.4",
+        "bulletin-deploy": "0.20.0",
         "commander": "^12.0.0",
         "ink": "^5.2.1",
         "polkadot-api": "^2.2.1",
diff --git a/patches/@novasamatech__statement-store@0.8.11.patch b/patches/@novasamatech__statement-store@0.10.0.patch
similarity index 100%
rename from patches/@novasamatech__statement-store@0.8.11.patch
rename to patches/@novasamatech__statement-store@0.10.0.patch
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 411d81fe..c2a13608 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,7 +11,7 @@ overrides:
 
 patchedDependencies:
   '@novasamatech/sdk-statement@0.6.0': 8c3ebcafda8bbcab4b31fddc74f035a5a1724c0f72eac32a0b46f51a5771e334
-  '@novasamatech/statement-store@0.8.11': 214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d
+  '@novasamatech/statement-store@0.10.0': 214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d
 
 importers:
 
@@ -45,14 +45,14 @@ importers:
         specifier: ^0.15.1
         version: 0.15.1(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-keys':
-        specifier: ^0.3.18
-        version: 0.3.18(esbuild@0.27.7)(rxjs@7.8.2)
+        specifier: ^0.4.0
+        version: 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger':
         specifier: ^0.1.1
         version: 0.1.1
       '@parity/product-sdk-terminal':
-        specifier: ^0.7.1
-        version: 0.7.1(esbuild@0.27.7)(rxjs@7.8.2)
+        specifier: ^0.10.0
+        version: 0.10.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-tx':
         specifier: ^0.4.1
         version: 0.4.1(esbuild@0.27.7)(rxjs@7.8.2)
@@ -69,8 +69,8 @@ importers:
         specifier: ^9.47.1
         version: 9.47.1
       bulletin-deploy:
-        specifier: 0.18.4
-        version: 0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
+        specifier: 0.20.0
+        version: 0.20.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3)
       commander:
         specifier: ^12.0.0
         version: 12.1.0
@@ -947,15 +947,24 @@ packages:
   '@novasamatech/host-api-wrapper@0.8.9':
     resolution: {integrity: sha512-4ofzbg/9J78sGsvNX9nmei5dyE7nw7+LeYsXG6rURTBjy0LyPSmR8wCfMmxOGxUTTE7BnzIloNInC/3aksfktw==}
 
+  '@novasamatech/host-api@0.10.0':
+    resolution: {integrity: sha512-rDxroRcmXrGWE5sgwCcIak6SynwWDPHsjZzV00/kwMS/iFymqMB0mUqQPcU4p1yiatWqePHX4XoP3zh/qj608w==}
+
   '@novasamatech/host-api@0.8.11':
     resolution: {integrity: sha512-KCtM64As23VFmHQCK51rxtvxeR/7+XNol/JE3HYVRldubdlH8qxcFQg2vg2nPjNj5nRJGGy4bE47bkJLE62RRA==}
 
   '@novasamatech/host-api@0.8.9':
     resolution: {integrity: sha512-KPh81iVv3sQckq7/oyRpFF2uYBPXJD0+7cRuXO+lnWPAxQBXK1aNUQzSq+vJUHkcGRXJd0up/IlHJ4DMfQyUhQ==}
 
+  '@novasamatech/host-papp@0.10.0':
+    resolution: {integrity: sha512-uhcYMTCBgU37oIlUfDnXbs8VoSnrVff2N3xYq5fT9b+FDa9oP83ALb75xmxTo4rtR9C/UrXjzG2NvPtJNfjBIA==}
+
   '@novasamatech/host-papp@0.8.11':
     resolution: {integrity: sha512-GBAE8oTGbvv4DDcByOdBO6Nu4JgPbfwRcOByS/jI9OR/DoYq4FdHlw0Q0h9X9ANZrtp97aayG2ryx+nDohqQ2w==}
 
+  '@novasamatech/scale@0.10.0':
+    resolution: {integrity: sha512-UJ1Jq0bUQ4p20BIuc079eZS7XouumNeheK1wojbiKNmoNQxFqsfRkJBYNQhIKWILKrI53FdP0D/uvby1Pl99Ew==}
+
   '@novasamatech/scale@0.8.11':
     resolution: {integrity: sha512-S9HpF77E4cUXvVpiGsBpCRB/HleIraInRrY1/RhUgsf61nLQNjMBqeBHENp0k82XZmnUVlaWhVx765UeHMqJGA==}
 
@@ -965,12 +974,21 @@ packages:
   '@novasamatech/sdk-statement@0.6.0':
     resolution: {integrity: sha512-NTqM+yS45iHgy87lVSWIpFozrTfCUWb7r4ZpsDtN1eFnfixXpDKpPXDWQsvPs+nh18r/jmoMgtlTjUltrS6mYQ==}
 
+  '@novasamatech/statement-store@0.10.0':
+    resolution: {integrity: sha512-+r+6Zw2xZHqEVc2F6Jn+i2fzPw7Nr0yqDV61Nodt2udL0suHPyEufZh9NUWZ45QcIiExYUgXxYyo5A4qEojqTg==}
+
   '@novasamatech/statement-store@0.8.11':
     resolution: {integrity: sha512-K2jlOLOaCM+oKkQpEJvTiDC9CNwNcBbcHXRaYvsUnnm4vrSZ38kwvz1dnEUhX54xC0Vruc+bZVSLaVSasFtkbw==}
 
+  '@novasamatech/storage-adapter@0.10.0':
+    resolution: {integrity: sha512-De1TovvHX59YO4VUI9Vid0ikGkC3FPOq0sVU6JL4nEO7AExCbGcnPuR9Uyc52DtYexgI8Of3SbcTb+KHfW6Zvw==}
+
   '@novasamatech/storage-adapter@0.8.11':
     resolution: {integrity: sha512-k/ji0bFy23p+pXaCfcpfY4t7tvT68red6fVn0jqUWuYC8hDOTT428psou83bU1qkaHbdWQFAu6B9uP4tNCAM/w==}
 
+  '@novasamatech/substrate-slot-sr25519-wasm@0.10.0':
+    resolution: {integrity: sha512-VZbHhRk7hDtkudefg0L23YijkrqVZHd139kZ+/KrBBTd7jUu19SRmQojGgu7nU2bz+fLRxTIUS4CTM/OOIc2Aw==}
+
   '@novasamatech/substrate-slot-sr25519-wasm@0.8.11':
     resolution: {integrity: sha512-Ix2SI583Zwf5I/Sv+DkfUpjSzW1oZpRIiEfbyrVkcj/YnNUmRCPbhzsiNlA3E5E1eIDzznCfxBGVPlQq6IIuNA==}
 
@@ -1223,6 +1241,9 @@ packages:
   '@parity/product-sdk-address@0.1.1':
     resolution: {integrity: sha512-sSymun3alNGdvawhdc0Ha0KEkuqMwBZui1bsUVeZIZRJAfWvQzrV1AVaf8aah5JFlcaRdg8FYyp7xL2eP+ZplA==}
 
+  '@parity/product-sdk-address@0.2.0':
+    resolution: {integrity: sha512-iOV/SwNfN/2V67+0QtJ55WbStv2af1g4ag9sRSzhGilGCq1jiyj+zcue8A44KSjEkt05P4oH7onvX99ObgcMSQ==}
+
   '@parity/product-sdk-chain-client@0.10.0':
     resolution: {integrity: sha512-aiHddqjqELg0kBMLv0FkRzrxnR1FbOKe36cPxshHckETcNpwN9vYPEZyQoKl4vf5UqXaivmoIUqFiQPKaDGVEA==}
 
@@ -1247,15 +1268,24 @@ packages:
   '@parity/product-sdk-host@0.15.1':
     resolution: {integrity: sha512-uvzfUBv+SiA87+Tv+queKdY/I0sCO2Y/N7DTUv3Iij3qNqZoaOBC33N+apP1BUSjdj8jSlxCuBxXUo4jslfh+w==}
 
+  '@parity/product-sdk-host@0.22.0':
+    resolution: {integrity: sha512-iJdHeTXmVuqZrMuC8HhL5dV+WSNJtQQgoxCqMcrb7MjkdjplCAuIyDgxISxVwRhCAL0HyTDFuc8+K/jdNWjVKw==}
+
   '@parity/product-sdk-keys@0.3.10':
     resolution: {integrity: sha512-59+WC0nFsvFMFgT2ksI9YfNCn6WunLe3/x3PtzJYax5v3xL52MnsAZKq4rRuutTLxDgXRVdufe5UHpB5dLPS0w==}
 
   '@parity/product-sdk-keys@0.3.18':
     resolution: {integrity: sha512-23wlsGWoIp7RujxZRFYhCm8kBnKhsMCSWWDovX/Hvzuduui/ickyxMhTA/vcebD0ZyuPInoZOilVO9aOKapIxw==}
 
+  '@parity/product-sdk-keys@0.4.0':
+    resolution: {integrity: sha512-fcyDiZiyV1cqSxHBjT/DGnOlAERbw9GeVYXkSaV0wZmHpr2O1vKni2EkFzv21a9IZVbFEZKHQ9kpq7aVFKbYFQ==}
+
   '@parity/product-sdk-local-storage@0.2.9':
     resolution: {integrity: sha512-O6rT8OJoD9H7LXkAhEDpHPj4qeTGt4j2wE8B2ST10riFkFjY/gCg6IQPeVuv2m3ALvsnU23xcJCxS80STQ+XkQ==}
 
+  '@parity/product-sdk-local-storage@0.3.12':
+    resolution: {integrity: sha512-OA8Cb9cCn1nDR/i2i8EEgFKRdDri517LzN+9LKmXB8vxL+UcN8aWQZJdRvha3mYmN/yw37I6SADYk9Evw3/yiA==}
+
   '@parity/product-sdk-local-storage@0.3.4':
     resolution: {integrity: sha512-oczxkxWXZa8+SCdb3lZwn2/18RPEfmZU3EdUFSvmVCQQzGnWB14vLk4Jf1AoXm0AFc93D4kE2dpAe3rvH9/o2A==}
 
@@ -1265,12 +1295,15 @@ packages:
   '@parity/product-sdk-signer@0.12.1':
     resolution: {integrity: sha512-PrWDsep8IC1Im3PR8t+UvEQgNmnCK2vHEWVjMC1Ze1QRfyFhPwSu9Gubi3arJP6m8N2J/hdWhInHPWgpmfLAGA==}
 
+  '@parity/product-sdk-signer@0.15.0':
+    resolution: {integrity: sha512-Xs1ebj4fCi8U2sWKdS6YwnS+MZginUX+6maEtuQRSeVP9N0EGijBCYq2YX1WOKgV7bur7urebksLdgDSQiqt8g==}
+
+  '@parity/product-sdk-terminal@0.10.0':
+    resolution: {integrity: sha512-fvo36sUMEUeUnM9yhbeD8WfQi+4HJw7YD3Lw7t9ZcQrZ4XTC28eviR+MP7RmY9hi2N5766IzxjWsW6YjvMhgGQ==}
+
   '@parity/product-sdk-terminal@0.5.4':
     resolution: {integrity: sha512-0dHMnqIR/KYxxqQW5Atinp1oWcKbyL3KvYwJouHUgDGUvNob5OdsMC7ew4edZbQxxqRz/WKygIGxVAh5EYiOLw==}
 
-  '@parity/product-sdk-terminal@0.7.1':
-    resolution: {integrity: sha512-aSYZF4Cm3oyN98DYjwTH712wNeXBzx2RDNOhjuQii1EQzu0a+ao8DiRlIZCXzHRoxj3RW2b9M5x4NUznpwmECQ==}
-
   '@parity/product-sdk-tx@0.2.14':
     resolution: {integrity: sha512-O0v6GL3WkOD5rZxHbakAylsYC0nbUPYTLoSNF3UoiSeO3Jqg6Cl2bRrjPDTD8msjkCO42Fz+umpmDbbAAG/XLg==}
 
@@ -1280,9 +1313,15 @@ packages:
   '@parity/product-sdk-utils@0.1.1':
     resolution: {integrity: sha512-vu/af1K7k7p0/aLKALrGVxz7K94xnY800DxmhnOhu6Hy4+y+8e9WHPecMjbYBBJby4FPMOkWLqEVRN/sk3Ucgw==}
 
+  '@parity/product-sdk-utils@0.2.0':
+    resolution: {integrity: sha512-Zhhh1EmSf9b+76F4nc9T/vD7KYRw4E0adYaD3CPVKaTsDT6uiN9+V/ejZ1pBjE0tnhJXu2deHky9mGA4U5tXdg==}
+
   '@parity/result@0.2.0':
     resolution: {integrity: sha512-QCrhYPeVVaPIjnlsfBIk5GHPRqfuCjy6MjqKkoCP4kwS1LIo5YtJCSFeB5mGtvMG7hiaRNl4lHQcd5YqDfJ1tQ==}
 
+  '@parity/truapi@0.18.0':
+    resolution: {integrity: sha512-q0Hgr9kX+ctHwd4JEuIs+q+l6YB1sJ/PwYOPuxzinZ2P1qudVNNvWj7Hxav8tJb0OO20CrGOrTolg6F5exZf1A==}
+
   '@parity/truapi@0.7.0':
     resolution: {integrity: sha512-xBGZP7/l74I0WGUnHgoFNYah+20I3JgykJ5pNUVsw3mQzNoCHuZSVJW6sUq7fzLvRF4wM2glPTPxUOiFKgfE9A==}
 
@@ -1547,6 +1586,9 @@ packages:
   '@polkadot-labs/hdkd-helpers@0.0.30':
     resolution: {integrity: sha512-qWmmD6ayj14RenDuDFfjF3sHS7ObqPzwIIMPcSVoDeKFSeQV7RY0HwyhC5CG4i6FoguMzak2dbtjYpNN5XQiwQ==}
 
+  '@polkadot-labs/hdkd-helpers@0.0.31':
+    resolution: {integrity: sha512-BjunfAAlR/sGmBUVIZxgHYTA712oD2YPQhKRRxb45BtGfxdKBjs10hZWqOFxZbq9N4pICXp/1oosGe04znyhvw==}
+
   '@polkadot-labs/hdkd@0.0.26':
     resolution: {integrity: sha512-9B+egs7pIwmaxi3X7XBbruxS40aVbcdI1iIqSxfSOf4+RS52E+sgd3MW/LECWrHSof2h4ngcdsXRrOl95FVV8g==}
 
@@ -2337,8 +2379,8 @@ packages:
   buffer@6.0.3:
     resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
 
-  bulletin-deploy@0.18.4:
-    resolution: {integrity: sha512-I9bHoAv3ZmGg+JATldYvgKVqi+d76byrrk6dBX9u4OTeF2cFIYB/VOGHtpwrlHJQdMNc2dQaT+tbIZDIqPLmhg==}
+  bulletin-deploy@0.20.0:
+    resolution: {integrity: sha512-opk+ptQpCGsWqSepyaOieLjrphjeyrnyq9cuhRcLsi9vBvvzFL6p5Q4gNMRxRb7nznrxz2ZmERcOS29zlnrpkg==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -3599,6 +3641,10 @@ packages:
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
+  nanoevents@10.0.0:
+    resolution: {integrity: sha512-PmIJ3BNxOzgVgnS1r/Pvyj6eZx/xUV2JCPogh0brD6smDIwjRlr1KBl9yoRX323PlfaNrBDDnfCgC9SL00OjSg==}
+    engines: {node: ^22.0.0 || ^24.0.0 || >=26.0.0}
+
   nanoevents@9.1.0:
     resolution: {integrity: sha512-Jd0fILWG44a9luj8v5kED4WI+zfkkgwKyRQKItTtlPfEsh7Lznfi1kr8/iZ+XAIss4Qq5GqRB0qtWbaz9ceO/A==}
     engines: {node: ^18.0.0 || >=20.0.0}
@@ -3613,6 +3659,11 @@ packages:
     engines: {node: ^18 || >=20}
     hasBin: true
 
+  nanoid@6.0.0:
+    resolution: {integrity: sha512-mkUH+rPkwU2qPadJ0oJZOjeZ5Mxn8Q1UhevwkTRWNuUZzyia3h4rhzK39hxaHTk0o2OxB8W2SQ6A8k23ZDi1pQ==}
+    engines: {node: ^22 || ^24 || >=26}
+    hasBin: true
+
   napi-build-utils@2.0.0:
     resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
 
@@ -6255,6 +6306,14 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/host-api@0.10.0':
+    dependencies:
+      '@novasamatech/scale': 0.10.0
+      nanoevents: 10.0.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      scale-ts: 1.6.1
+
   '@novasamatech/host-api@0.8.11':
     dependencies:
       '@novasamatech/scale': 0.8.11
@@ -6271,6 +6330,29 @@ snapshots:
       neverthrow: 8.2.0
       scale-ts: 1.6.1
 
+  '@novasamatech/host-papp@0.10.0(esbuild@0.27.7)':
+    dependencies:
+      '@noble/ciphers': 2.2.0
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@novasamatech/host-api': 0.10.0
+      '@novasamatech/scale': 0.10.0
+      '@novasamatech/statement-store': 0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/storage-adapter': 0.10.0
+      '@polkadot-api/utils': 0.4.0
+      '@polkadot-labs/hdkd-helpers': 0.0.31
+      nanoevents: 10.0.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+      rxjs: 7.8.2
+      scale-ts: 1.6.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - supports-color
+      - utf-8-validate
+
   '@novasamatech/host-papp@0.8.11(esbuild@0.27.7)':
     dependencies:
       '@noble/ciphers': 2.2.0
@@ -6278,7 +6360,7 @@ snapshots:
       '@noble/hashes': 2.2.0
       '@novasamatech/host-api': 0.8.11
       '@novasamatech/scale': 0.8.11
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/statement-store': 0.8.11(esbuild@0.27.7)(rxjs@7.8.2)
       '@novasamatech/storage-adapter': 0.8.11
       '@polkadot-api/utils': 0.4.0
       '@polkadot-labs/hdkd-helpers': 0.0.30
@@ -6294,6 +6376,11 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/scale@0.10.0':
+    dependencies:
+      '@polkadot-api/utils': 0.4.0
+      scale-ts: 1.6.1
+
   '@novasamatech/scale@0.8.11':
     dependencies:
       '@polkadot-api/utils': 0.4.0
@@ -6316,7 +6403,31 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@novasamatech/statement-store@0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@novasamatech/statement-store@0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@noble/ciphers': 2.2.0
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@novasamatech/scale': 0.10.0
+      '@novasamatech/sdk-statement': 0.6.0(patch_hash=8c3ebcafda8bbcab4b31fddc74f035a5a1724c0f72eac32a0b46f51a5771e334)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/substrate-slot-sr25519-wasm': 0.10.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+      '@polkadot-api/substrate-client': 0.7.0
+      '@polkadot-labs/hdkd-helpers': 0.0.31
+      '@polkadot-labs/schnorrkel-wasm': 0.0.9
+      '@scure/sr25519': 2.2.0
+      nanoid: 6.0.0
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+      scale-ts: 1.6.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
+  '@novasamatech/statement-store@0.8.11(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/hashes': 2.2.0
@@ -6339,11 +6450,18 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@novasamatech/storage-adapter@0.10.0':
+    dependencies:
+      nanoevents: 10.0.0
+      neverthrow: 8.2.0
+
   '@novasamatech/storage-adapter@0.8.11':
     dependencies:
       nanoevents: 9.1.0
       neverthrow: 8.2.0
 
+  '@novasamatech/substrate-slot-sr25519-wasm@0.10.0': {}
+
   '@novasamatech/substrate-slot-sr25519-wasm@0.8.11': {}
 
   '@opentelemetry/api-logs@0.220.0':
@@ -6743,6 +6861,11 @@ snapshots:
       '@noble/hashes': 1.8.0
       '@polkadot-api/substrate-bindings': 0.12.0
 
+  '@parity/product-sdk-address@0.2.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+
   '@parity/product-sdk-chain-client@0.10.0(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-descriptors': 0.9.0(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6847,6 +6970,23 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-host@0.22.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-errors': 0.2.0
+      '@parity/product-sdk-logger': 0.1.1
+      '@parity/result': 0.2.0
+      '@parity/truapi': 0.18.0
+      '@polkadot-api/json-rpc-provider': 0.2.0
+      '@polkadot-api/substrate-bindings': 0.20.3
+      neverthrow: 8.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-keys@0.3.10(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-address': 0.1.1
@@ -6883,6 +7023,23 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-keys@0.4.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-address': 0.2.0
+      '@parity/product-sdk-crypto': 0.1.1
+      '@parity/product-sdk-local-storage': 0.3.12(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-utils': 0.2.0
+      '@polkadot-labs/hdkd': 0.0.28
+      '@polkadot-labs/hdkd-helpers': 0.0.30
+      '@scure/sr25519': 2.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-local-storage@0.2.9(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-host': 0.10.2(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6896,6 +7053,17 @@ snapshots:
       - supports-color
       - utf-8-validate
 
+  '@parity/product-sdk-local-storage@0.3.12(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-host': 0.22.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-logger': 0.1.1
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
   '@parity/product-sdk-local-storage@0.3.4(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@parity/product-sdk-host': 0.15.1(esbuild@0.27.7)(rxjs@7.8.2)
@@ -6925,15 +7093,33 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@parity/product-sdk-terminal@0.5.4(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@parity/product-sdk-signer@0.15.0(esbuild@0.27.7)(rxjs@7.8.2)':
+    dependencies:
+      '@parity/product-sdk-address': 0.2.0
+      '@parity/product-sdk-errors': 0.2.0
+      '@parity/product-sdk-host': 0.22.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-keys': 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
+      '@parity/product-sdk-logger': 0.1.1
+      '@parity/result': 0.2.0
+      polkadot-api: 2.2.1(esbuild@0.27.7)(rxjs@7.8.2)
+    transitivePeerDependencies:
+      - bufferutil
+      - esbuild
+      - rxjs
+      - supports-color
+      - utf-8-validate
+
+  '@parity/product-sdk-terminal@0.10.0(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/curves': 2.2.0
       '@noble/hashes': 2.2.0
-      '@novasamatech/host-papp': 0.8.11(esbuild@0.27.7)
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
-      '@novasamatech/storage-adapter': 0.8.11
+      '@novasamatech/host-papp': 0.10.0(esbuild@0.27.7)
+      '@novasamatech/statement-store': 0.10.0(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/storage-adapter': 0.10.0
+      '@parity/product-sdk-keys': 0.4.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger': 0.1.1
+      '@parity/product-sdk-signer': 0.15.0(esbuild@0.27.7)(rxjs@7.8.2)
       '@polkadot-api/substrate-bindings': 0.20.3
       '@polkadot-api/utils': 0.4.0
       '@polkadot-api/ws-provider': 0.9.1(rxjs@7.8.2)
@@ -6950,17 +7136,15 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@parity/product-sdk-terminal@0.7.1(esbuild@0.27.7)(rxjs@7.8.2)':
+  '@parity/product-sdk-terminal@0.5.4(esbuild@0.27.7)(rxjs@7.8.2)':
     dependencies:
       '@noble/ciphers': 2.2.0
       '@noble/curves': 2.2.0
       '@noble/hashes': 2.2.0
       '@novasamatech/host-papp': 0.8.11(esbuild@0.27.7)
-      '@novasamatech/statement-store': 0.8.11(patch_hash=214e0c2859afdec395fa98c68c3e5a05e01f2a4ddca8164b8f780b22cccded8d)(esbuild@0.27.7)(rxjs@7.8.2)
+      '@novasamatech/statement-store': 0.8.11(esbuild@0.27.7)(rxjs@7.8.2)
       '@novasamatech/storage-adapter': 0.8.11
-      '@parity/product-sdk-keys': 0.3.18(esbuild@0.27.7)(rxjs@7.8.2)
       '@parity/product-sdk-logger': 0.1.1
-      '@parity/product-sdk-signer': 0.12.1(esbuild@0.27.7)(rxjs@7.8.2)
       '@polkadot-api/substrate-bindings': 0.20.3
       '@polkadot-api/utils': 0.4.0
       '@polkadot-api/ws-provider': 0.9.1(rxjs@7.8.2)
@@ -7012,8 +7196,19 @@ snapshots:
       '@noble/hashes': 1.8.0
       '@parity/product-sdk-logger': 0.1.1
 
+  '@parity/product-sdk-utils@0.2.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      '@parity/product-sdk-logger': 0.1.1
+
   '@parity/result@0.2.0': {}
 
+  '@parity/truapi@0.18.0':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      neverthrow: 8.2.0
+      scale-ts: 1.6.1
+
   '@parity/truapi@0.7.0':
     dependencies:
       '@noble/hashes': 2.2.0
@@ -7567,13 +7762,21 @@ snapshots:
       '@scure/sr25519': 1.0.0
       scale-ts: 1.6.1
 
+  '@polkadot-labs/hdkd-helpers@0.0.31':
+    dependencies:
+      '@noble/curves': 2.2.0
+      '@noble/hashes': 2.2.0
+      '@scure/base': 2.2.0
+      '@scure/sr25519': 2.2.0
+      scale-ts: 1.6.1
+
   '@polkadot-labs/hdkd@0.0.26':
     dependencies:
       '@polkadot-labs/hdkd-helpers': 0.0.30
 
   '@polkadot-labs/hdkd@0.0.28':
     dependencies:
-      '@polkadot-labs/hdkd-helpers': 0.0.30
+      '@polkadot-labs/hdkd-helpers': 0.0.31
 
   '@polkadot-labs/schnorrkel-wasm@0.0.9': {}
 
@@ -8527,7 +8730,7 @@ snapshots:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
-  bulletin-deploy@0.18.4(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
+  bulletin-deploy@0.20.0(@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1))(@polkadot/api@16.5.6)(@polkadot/util@14.0.3)(esbuild@0.27.7)(rxjs@7.8.2)(typescript@5.9.3):
     dependencies:
       '@ipld/car': 5.4.3
       '@ipld/dag-pb': 4.1.5
@@ -10031,12 +10234,16 @@ snapshots:
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
+  nanoevents@10.0.0: {}
+
   nanoevents@9.1.0: {}
 
   nanoid@3.3.12: {}
 
   nanoid@5.1.11: {}
 
+  nanoid@6.0.0: {}
+
   napi-build-utils@2.0.0: {}
 
   negotiator@1.0.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 842143db..38b3c56e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -26,22 +26,22 @@ minimumReleaseAgeExclude:
   # progress parser matches are unchanged; then confirmed live — a deploy that
   # previously reverted at startingPrice now completes storage + DotNS.
   # Drop once it ages past the min-age window.
-  - "bulletin-deploy@0.18.4"
+  - "bulletin-deploy@0.20.0"
   - "@parity/dotns-cli@0.8.0"
-  # The @novasamatech/* 0.8.11 family (pulled transitively by
-  # @parity/product-sdk-terminal@^0.6.2 → host-papp@^0.8.9, which resolves to the
-  # 0.8.11 line) publishes the stable tag the same day; the min-age gate would
+  # The @novasamatech/* 0.10.0 family (pulled transitively by
+  # @parity/product-sdk-terminal@^0.10.0 → host-papp 0.10.0, pinned EXACT)
+  # publishes the stable tag the same day; the min-age gate would
   # otherwise pin us to the older prerelease line. We opt these onto the stable
   # line explicitly — they come from the vetted triangle-js-sdks source.
   # host-papp pins statement-store exact, so the whole family must move together.
   # Drop these once the version naturally ages past the min-age window.
-  - "@novasamatech/host-papp@0.8.11"
-  - "@novasamatech/host-api@0.8.11"
-  - "@novasamatech/host-api-wrapper@0.8.11"
-  - "@novasamatech/statement-store@0.8.11"
-  - "@novasamatech/storage-adapter@0.8.11"
-  - "@novasamatech/scale@0.8.11"
-  - "@novasamatech/substrate-slot-sr25519-wasm@0.8.11"
+  - "@novasamatech/host-papp@0.10.0"
+  - "@novasamatech/host-api@0.10.0"
+  - "@novasamatech/host-api-wrapper@0.10.0"
+  - "@novasamatech/statement-store@0.10.0"
+  - "@novasamatech/storage-adapter@0.10.0"
+  - "@novasamatech/scale@0.10.0"
+  - "@novasamatech/substrate-slot-sr25519-wasm@0.10.0"
   - '@parity/cdm-builder@5.0.1'
   - '@parity/cdm-codegen@0.6.26'
   - '@parity/cdm-env@2.4.0'
@@ -54,7 +54,12 @@ minimumReleaseAgeExclude:
   - '@parity/product-sdk-local-storage@0.3.4'
   - '@parity/product-sdk-signer@0.12.1'
   - '@parity/product-sdk-tx@0.4.1'
-  - '@parity/product-sdk-terminal@0.7.1'
+  - '@parity/product-sdk-terminal@0.10.0'
+  - '@parity/product-sdk-host@0.22.0'
+  - '@parity/product-sdk-keys@0.4.0'
+  - '@parity/product-sdk-local-storage@0.3.12'
+  - '@parity/product-sdk-signer@0.15.0'
+  - '@parity/product-sdk-utils@0.2.0'
 
 overrides:
   # dotns-cli ships a broken publish manifest (file:.papi/descriptors missing
@@ -75,5 +80,5 @@ overrides:
 patchedDependencies:
   # PATCH(playground-cli) — local-only fixes pending upstream. See CLAUDE.md
   # "Two local pnpm patches remain" for what each one does.
-  "@novasamatech/statement-store@0.8.11": "patches/@novasamatech__statement-store@0.8.11.patch"
+  "@novasamatech/statement-store@0.10.0": "patches/@novasamatech__statement-store@0.10.0.patch"
   "@novasamatech/sdk-statement@0.6.0": "patches/@novasamatech__sdk-statement@0.6.0.patch"
diff --git a/sentry/backup-dashboards.sh b/sentry/backup-dashboards.sh
index c336c976..3c16adbc 100755
--- a/sentry/backup-dashboards.sh
+++ b/sentry/backup-dashboards.sh
@@ -6,7 +6,10 @@
 
 set -euo pipefail
 
-TOKEN=$(security find-generic-password -s sentry-api-token -w)
+# Keychain item is `sentry-api-token-playground`; `sentry-api-token` is the
+# historical name and is kept as a fallback for older machines.
+TOKEN=$(security find-generic-password -s sentry-api-token-playground -w 2>/dev/null \
+    || security find-generic-password -s sentry-api-token -w)
 BASE="https://de.sentry.io/api/0/organizations/paritytech"
 
 # Known dashboard IDs. Append new IDs after creating new dashboards.
diff --git a/sentry/create-dashboard.py b/sentry/create-dashboard.py
index 26a45a2b..0683c0b9 100755
--- a/sentry/create-dashboard.py
+++ b/sentry/create-dashboard.py
@@ -10,6 +10,10 @@
 
 import json
 import subprocess
+
+# Keychain item holding the Sentry API token. `sentry-api-token` was the
+# original name and no longer exists on current machines.
+_KEYCHAIN_ITEM = "sentry-api-token-playground"
 import sys
 import urllib.error
 import urllib.request
@@ -21,7 +25,7 @@ def main() -> int:
         return 2
 
     token = subprocess.check_output(
-        ["security", "find-generic-password", "-s", "sentry-api-token", "-w"]
+        ["security", "find-generic-password", "-s", _KEYCHAIN_ITEM, "-w"]
     ).decode().strip()
 
     with open(sys.argv[1]) as f:
diff --git a/sentry/patch-dashboard.py b/sentry/patch-dashboard.py
index 5a769d1f..03c8cb13 100755
--- a/sentry/patch-dashboard.py
+++ b/sentry/patch-dashboard.py
@@ -19,6 +19,10 @@
 
 import json
 import subprocess
+
+# Keychain item holding the Sentry API token. `sentry-api-token` was the
+# original name and no longer exists on current machines.
+_KEYCHAIN_ITEM = "sentry-api-token-playground"
 import sys
 import urllib.error
 import urllib.request
@@ -31,7 +35,7 @@
 
 def get_token() -> str:
     return subprocess.check_output(
-        ["security", "find-generic-password", "-s", "sentry-api-token", "-w"]
+        ["security", "find-generic-password", "-s", _KEYCHAIN_ITEM, "-w"]
     ).decode().strip()
 
 
diff --git a/src/commands/deploy/index.ts b/src/commands/deploy/index.ts
index 20b5943e..763081e1 100644
--- a/src/commands/deploy/index.ts
+++ b/src/commands/deploy/index.ts
@@ -745,6 +745,37 @@ function runInteractive(ctx: {
 
 // ── Output helpers ───────────────────────────────────────────────────────────
 
+/**
+ * Render a phone signature request, distinguishing a RETRY from progress.
+ *
+ * The `step` on the event counts signature REQUESTS, not operations: when a
+ * request times out (the usual cause is the phone app not being in the
+ * foreground, which shows no prompt at all) it is re-sent with the next number.
+ * Printing that number made a stall look like progress — worse, it contradicted
+ * the "Phone approvals expected" plan above it, which numbers OPERATIONS. Seen
+ * live: `step 1: Link content` followed by `step 2: Link content`, while the
+ * plan said step 2 would be the registry publish.
+ *
+ * So we key off the label instead and say plainly when we are re-sending, plus
+ * the one remedy that actually fixes it.
+ */
+const phoneSignAttempts = new Map<string, number>();
+
+export function formatSignRequest(label: string): string {
+    const attempt = (phoneSignAttempts.get(label) ?? 0) + 1;
+    phoneSignAttempts.set(label, attempt);
+    if (attempt === 1) return `  📱 Approve on your phone: ${label}\n`;
+    return (
+        `  📱 No response yet — re-sent to your phone (attempt ${attempt}): ${label}\n` +
+        `     If no prompt appeared, open the Polkadot app and keep it in the foreground.\n`
+    );
+}
+
+/** Test seam: the attempt counter is module state, so tests must reset it. */
+export function resetSignRequestAttempts(): void {
+    phoneSignAttempts.clear();
+}
+
 function logHeadlessEvent(event: DeployEvent) {
     if (event.kind === "phase-start") {
         process.stdout.write(`▸ ${event.phase}…\n`);
@@ -755,9 +786,7 @@ function logHeadlessEvent(event: DeployEvent) {
     } else if (event.kind === "storage-event" && event.event.kind === "chunk-progress") {
         process.stdout.write(`  chunk ${event.event.current}/${event.event.total}\n`);
     } else if (event.kind === "signing" && event.event.kind === "sign-request") {
-        process.stdout.write(
-            `  📱 Approve on your phone (step ${event.event.step}): ${event.event.label}\n`,
-        );
+        process.stdout.write(formatSignRequest(event.event.label));
     } else if (event.kind === "error") {
         process.stderr.write(`  ✖ ${event.phase}: ${event.message}\n`);
     }
diff --git a/src/commands/deploy/signRequest.test.ts b/src/commands/deploy/signRequest.test.ts
new file mode 100644
index 00000000..0b04a6ae
--- /dev/null
+++ b/src/commands/deploy/signRequest.test.ts
@@ -0,0 +1,71 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { beforeEach, describe, expect, it } from "vitest";
+import { formatSignRequest, resetSignRequestAttempts } from "./index.js";
+
+beforeEach(() => {
+    resetSignRequestAttempts();
+});
+
+describe("formatSignRequest", () => {
+    it("announces the first request plainly", () => {
+        const line = formatSignRequest("Link content (DotNS setContenthash)");
+        expect(line).toContain("Approve on your phone");
+        expect(line).toContain("Link content (DotNS setContenthash)");
+        expect(line).not.toMatch(/attempt/i);
+    });
+
+    /**
+     * The bug this replaces, observed live: the event's `step` counts signature
+     * REQUESTS, so a timed-out attempt re-sent as "step 2" read as progress —
+     * and contradicted the "Phone approvals expected" plan above it, which
+     * numbers OPERATIONS. A deploy printed `step 1: Link content` then
+     * `step 2: Link content` while the plan said step 2 was the registry
+     * publish, and the user approved four prompts for a two-approval deploy.
+     */
+    it("calls a repeat of the same operation a retry, not the next step", () => {
+        const label = "Link content (DotNS setContenthash)";
+        formatSignRequest(label);
+        const second = formatSignRequest(label);
+
+        expect(second).toMatch(/attempt 2/);
+        expect(second).toMatch(/re-sent/i);
+        // Must not imply forward progress.
+        expect(second).not.toMatch(/step 2/);
+    });
+
+    it("keeps counting further retries of the same operation", () => {
+        const label = "Publish to Playground registry";
+        formatSignRequest(label);
+        formatSignRequest(label);
+        expect(formatSignRequest(label)).toMatch(/attempt 3/);
+    });
+
+    it("treats a different operation as a fresh request", () => {
+        formatSignRequest("Link content (DotNS setContenthash)");
+        const other = formatSignRequest("Publish to Playground registry");
+
+        expect(other).toContain("Approve on your phone");
+        expect(other).not.toMatch(/attempt/i);
+    });
+
+    /** The one remedy worth surfacing when no prompt showed up at all. */
+    it("tells the user what to check when a prompt never appeared", () => {
+        const label = "Link content (DotNS setContenthash)";
+        formatSignRequest(label);
+        expect(formatSignRequest(label)).toMatch(/foreground/i);
+    });
+});
diff --git a/src/commands/drip/DripScreen.tsx b/src/commands/drip/DripScreen.tsx
index 483325ae..330c6112 100644
--- a/src/commands/drip/DripScreen.tsx
+++ b/src/commands/drip/DripScreen.tsx
@@ -90,7 +90,7 @@ export function DripScreen({ onDone }: { onDone: (outcome: DripOutcome) => void
             // single source of the product address used across the CLI.
             let recipient: string | null;
             try {
-                recipient = deriveSessionAddresses(handle.session).productAddress;
+                recipient = (await deriveSessionAddresses(handle.session)).productAddress;
             } catch {
                 recipient = null;
             }
diff --git a/src/utils/allowances/resources.test.ts b/src/utils/allowances/resources.test.ts
index 970cbecf..97cfe861 100644
--- a/src/utils/allowances/resources.test.ts
+++ b/src/utils/allowances/resources.test.ts
@@ -42,8 +42,19 @@ describe("PLAYGROUND_RESOURCES", () => {
             "BulletInAllowance",
             "SmartContractAllowance",
         ]);
+        // The destination must be the TAGGED form. A bare `0` grants fine on
+        // the phone, so the failure is invisible at grant time — but the SDK
+        // sub-keys its allowance cache by destination, and an untagged value
+        // takes the `Raw` branch and hexes `undefined`, so every later read
+        // throws `undefined is not an object (evaluating 'bytes.length')` and
+        // `playground login` reports "allowances ✕" on a healthy account.
+        // `tsc` DOES reject the bare number, so this test is belt-and-braces
+        // rather than the only guard — but run tsc directly, not through
+        // `pnpm exec`: if pnpm's deps-status check fails first (e.g. the
+        // release-age policy), it exits before tsc runs and an unwary grep for
+        // "error TS" reports a clean typecheck that never happened.
         const sc = PLAYGROUND_RESOURCES.find((r) => r.tag === "SmartContractAllowance");
-        expect(sc?.value).toBe(0);
+        expect(sc?.value).toEqual({ tag: "Index", value: 0 });
     });
 });
 
@@ -53,7 +64,7 @@ describe("summarizeOutcomes", () => {
         const resources: typeof PLAYGROUND_RESOURCES = [
             { tag: "BulletInAllowance", value: undefined },
             { tag: "StatementStoreAllowance", value: undefined },
-            { tag: "SmartContractAllowance", value: 0 },
+            { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
         ];
         const summary = summarizeOutcomes([allocated, rejected, notAvailable], resources);
         expect(summary.granted.map((r) => r.tag)).toEqual(["BulletInAllowance"]);
@@ -77,7 +88,9 @@ describe("describeResource", () => {
 
 describe("describeAllocationFailure", () => {
     const bulletin: typeof PLAYGROUND_RESOURCES = [{ tag: "BulletInAllowance", value: undefined }];
-    const sc: typeof PLAYGROUND_RESOURCES = [{ tag: "SmartContractAllowance", value: 0 }];
+    const sc: typeof PLAYGROUND_RESOURCES = [
+        { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
+    ];
 
     test("returns null when nothing failed", () => {
         const summary = summarizeOutcomes([allocated], bulletin);
diff --git a/src/utils/allowances/resources.ts b/src/utils/allowances/resources.ts
index 9faf5296..0641332b 100644
--- a/src/utils/allowances/resources.ts
+++ b/src/utils/allowances/resources.ts
@@ -88,7 +88,15 @@ export function productScopedAdapter<A extends { appId: string }>(adapter: A): A
  */
 export const PLAYGROUND_RESOURCES: AllocatableResource[] = [
     { tag: "BulletInAllowance", value: undefined },
-    { tag: "SmartContractAllowance", value: 0 },
+    // The destination is a TAGGED union (`Index` | `Raw`), not a bare number.
+    // A bare `0` still reaches the phone and grants correctly, so the grant
+    // looks fine — but the SDK sub-keys its allowance cache by destination
+    // (`cacheKey` -> `smartContractDest`), and an untagged value falls through
+    // to the `Raw` branch and hexes `undefined`. Every later cache read then
+    // dies with `undefined is not an object (evaluating 'bytes.length')`,
+    // which surfaces as `playground login` reporting "allowances ✕" on a
+    // perfectly healthy account. Index 0 is the default product account.
+    { tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } },
 ];
 
 export interface AllocationSummary {
diff --git a/src/utils/allowances/smartContracts.test.ts b/src/utils/allowances/smartContracts.test.ts
index 4fde29cd..589053df 100644
--- a/src/utils/allowances/smartContracts.test.ts
+++ b/src/utils/allowances/smartContracts.test.ts
@@ -90,7 +90,7 @@ describe("ensureSmartContractAllowance", () => {
         expect(requestResourceAllocationMock).toHaveBeenCalledWith(
             expect.anything(),
             expect.anything(),
-            [{ tag: "SmartContractAllowance", value: 0 }],
+            [{ tag: "SmartContractAllowance", value: { tag: "Index", value: 0 } }],
         );
     });
 
diff --git a/src/utils/allowances/smartContracts.ts b/src/utils/allowances/smartContracts.ts
index dc90b1f9..6220758e 100644
--- a/src/utils/allowances/smartContracts.ts
+++ b/src/utils/allowances/smartContracts.ts
@@ -23,7 +23,9 @@ import { productScopedAdapter } from "./resources.js";
 
 const SMART_CONTRACT_ALLOWANCE: AllocatableResource = {
     tag: "SmartContractAllowance",
-    value: 0,
+    // Tagged destination, not a bare number — see PLAYGROUND_RESOURCES in
+    // resources.ts for what an untagged value breaks in the SDK's cache.
+    value: { tag: "Index", value: 0 },
 };
 
 export interface SmartContractAllowanceOptions {
diff --git a/src/utils/auth.connect.test.ts b/src/utils/auth.connect.test.ts
index 1380edcb..4e705c1d 100644
--- a/src/utils/auth.connect.test.ts
+++ b/src/utils/auth.connect.test.ts
@@ -45,11 +45,29 @@ vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
         ...actual,
         createTerminalAdapter: createTerminalAdapterMock,
         waitForSessions: waitForSessionsMock,
+        // RFC-0022: the product account is derived from a subtree key the
+        // WALLET owns, which the SDK fetches over the statement store and
+        // caches on disk under the default storage dir. Unmocked, these tests
+        // would hang waiting for a phone and write a bogus key into the real
+        // ~/.polkadot-apps subtree cache — corrupting the developer's live
+        // session. Any 32-byte value works here; the address math itself is
+        // pinned in sessionSigner.test.ts against host-rust-core's vector.
+        deriveProductPublicKey: deriveProductPublicKeyMock,
+        createSessionSignerForAccount: createSessionSignerForAccountMock,
     };
 });
 
 // waitForLogin records the login stamp with its default storage dir; mock it
 // so tests never write to the real ~/.polkadot-apps.
+const { deriveProductPublicKeyMock, createSessionSignerForAccountMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(async () => new Uint8Array(32).fill(0x5a)),
+    createSessionSignerForAccountMock: vi.fn(async () => ({
+        publicKey: new Uint8Array(32).fill(0x5a),
+        signTx: async () => new Uint8Array(),
+        signBytes: async () => new Uint8Array(),
+    })),
+}));
+
 const { recordLoginStampMock } = vi.hoisted(() => ({
     recordLoginStampMock: vi.fn(async () => undefined),
 }));
diff --git a/src/utils/auth.test.ts b/src/utils/auth.test.ts
index 769337da..9d0542d0 100644
--- a/src/utils/auth.test.ts
+++ b/src/utils/auth.test.ts
@@ -20,7 +20,7 @@
  * verify the patterns used rather than the full integration.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -36,6 +36,32 @@ import type { UserSession } from "@parity/product-sdk-terminal";
 import { DAPP_ID } from "../config.js";
 import { INCOMPLETE_SESSION_MESSAGE } from "./sessionSigner.js";
 
+/**
+ * host-rust-core cross-host vector (tests/wasm_crypto_vectors.rs,
+ * `product_account_and_entropy_vectors_match_mobile`) — the product account at
+ * index 0. Mirrored upstream in product-sdk's `product-account.test.ts`, and
+ * pinned directly in sessionSigner.test.ts. Used here so the SS58/H160 below
+ * descend from a value the MOBILE computes, not from our own output.
+ */
+const HOST_VECTOR_ACCOUNT = Uint8Array.from(
+    "1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c"
+        .match(/.{2}/g)!
+        .map((b) => Number.parseInt(b, 16)),
+);
+
+const { deriveProductPublicKeyMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(),
+}));
+
+// RFC-0022: the product account descends from a subtree key only the wallet
+// can produce. The SDK fetches it over the statement store and caches it on
+// disk under the default storage dir, so an unmocked call would hang waiting
+// for a phone and write a bogus key into the real ~/.polkadot-apps cache.
+vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
+    const actual = await importOriginal<typeof import("@parity/product-sdk-terminal")>();
+    return { ...actual, deriveProductPublicKey: deriveProductPublicKeyMock };
+});
+
 describe("subscribe-before-assignment pattern", () => {
     /**
      * Simulates the bug where `const unsub = obs.subscribe(cb)` fires
@@ -418,6 +444,10 @@ describe("deriveSessionAddresses", () => {
         0x20, 0x7a,
     ]);
 
+    beforeEach(() => {
+        deriveProductPublicKeyMock.mockResolvedValue(HOST_VECTOR_ACCOUNT);
+    });
+
     function fakeSession(rootBytes: Uint8Array): UserSession {
         // `deriveSessionAddresses` only reads `session.rootAccountId`.
         // The full UserSession type carries signer callbacks we don't
@@ -425,9 +455,9 @@ describe("deriveSessionAddresses", () => {
         return { rootAccountId: rootBytes } as unknown as UserSession;
     }
 
-    it("matches the playground-app's published product address + H160 for a known root", () => {
+    it("matches the playground-app's published product address + H160 for a known root", async () => {
         const session = fakeSession(TEST_ROOT_BYTES);
-        const addresses = deriveSessionAddresses(session);
+        const addresses = await deriveSessionAddresses(session);
 
         expect(addresses.rootAddress).toBe(TEST_ROOT_SS58);
         // Regenerated when PLAYGROUND_PRODUCT_ID moved from `playground.dot` to
@@ -446,13 +476,13 @@ describe("deriveSessionAddresses", () => {
         // ⚠️ These are OLD-derivation values. When RFC-0022 (product-sdk #366)
         // lands, the derivation itself changes and they must be re-verified
         // against the app's boot banner, not just regenerated again.
-        expect(addresses.productAddress).toBe("5DoVmDX98xjw2XyHPpABgDuDJ2qFLGoTFwfzaiUEdW3a4M8e");
-        expect(addresses.productH160).toBe("0xb1ced7e7a64966ae0dc346eea7dcf66f823ccdca");
+        expect(addresses.productAddress).toBe("5ChZBnBw9eDQUMBhnXUKrGMdK5MTfGrca3T1xZZtBQhW8eis");
+        expect(addresses.productH160).toBe("0x47ab1defff8b02d4345d98896a064cd0e6800309");
     });
 
-    it("returns a product address distinct from the root — guards against double-derivation", () => {
+    it("returns a product address distinct from the root — guards against double-derivation", async () => {
         const session = fakeSession(TEST_ROOT_BYTES);
-        const addresses = deriveSessionAddresses(session);
+        const addresses = await deriveSessionAddresses(session);
 
         // If someone ever re-introduces a productAccountDisplay-style
         // helper that takes addresses.productAddress as input and runs
@@ -464,22 +494,29 @@ describe("deriveSessionAddresses", () => {
         expect(addresses.productAddress).not.toBe(addresses.rootAddress);
     });
 
-    it("derives the H160 from the same pubkey as the product SS58", () => {
-        // Two different rootAccountIds → different product SS58s → and
-        // the H160 must change in lock-step with the SS58. A regression
-        // that derived H160 off the root (or off a doubly-derived
-        // pubkey) would either keep the H160 constant when the root
-        // moves or break the ss58↔h160 pairing.
-        const a = deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
-        const b = deriveSessionAddresses(fakeSession(ALT_ROOT_BYTES));
+    it("derives the H160 from the same pubkey as the product SS58", async () => {
+        // The H160 must move in lock-step with the product SS58. A regression
+        // that derived the H160 off the ROOT (or off a doubly-derived pubkey)
+        // would either hold the H160 constant while the product account moved,
+        // or break the ss58 <-> h160 pairing.
+        //
+        // Since RFC-0022 the product account descends from the wallet's
+        // SUBTREE key, not from `rootAccountId`, so varying the root proves
+        // nothing here — we vary what actually drives the derivation.
+        deriveProductPublicKeyMock.mockResolvedValueOnce(HOST_VECTOR_ACCOUNT);
+        const a = await deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
+        deriveProductPublicKeyMock.mockResolvedValueOnce(ALT_ROOT_BYTES);
+        const b = await deriveSessionAddresses(fakeSession(TEST_ROOT_BYTES));
 
         expect(a.productAddress).not.toBe(b.productAddress);
         expect(a.productH160).not.toBe(b.productH160);
         expect(b.productH160).toMatch(/^0x[0-9a-f]{40}$/);
     });
 
-    it("reports stale sessions without a root account public key", () => {
-        expect(() => deriveSessionAddresses(fakeSession(new Uint8Array()))).toThrow(
+    it("reports stale sessions without a root account public key", async () => {
+        // Now async (RFC-0022 fetches the subtree), so the guard surfaces as a
+        // rejection rather than a synchronous throw.
+        await expect(deriveSessionAddresses(fakeSession(new Uint8Array()))).rejects.toThrow(
             INCOMPLETE_SESSION_MESSAGE,
         );
     });
diff --git a/src/utils/auth.ts b/src/utils/auth.ts
index 3f3505ba..1b7941be 100644
--- a/src/utils/auth.ts
+++ b/src/utils/auth.ts
@@ -144,7 +144,7 @@ function newestSession(sessions: UserSession[]): UserSession {
     return sessions[sessions.length - 1];
 }
 
-function createPlaygroundSigner(session: UserSession): PolkadotSigner {
+async function createPlaygroundSigner(session: UserSession): Promise<PolkadotSigner> {
     return createPlaygroundSessionSigner(session, {
         productId: PLAYGROUND_PRODUCT_ID,
         derivationIndex: 0,
@@ -167,9 +167,9 @@ function createPlaygroundSigner(session: UserSession): PolkadotSigner {
  *
  * @internal
  */
-export function deriveSessionAddresses(session: UserSession): SessionAddresses {
+export async function deriveSessionAddresses(session: UserSession): Promise<SessionAddresses> {
     const rootBytes = sessionRootPublicKey(session);
-    const productPubkey = derivePlaygroundProductPublicKey(rootBytes, {
+    const productPubkey = await derivePlaygroundProductPublicKey(session, {
         productId: PLAYGROUND_PRODUCT_ID,
         derivationIndex: 0,
     });
@@ -187,9 +187,9 @@ function sessionRemoteAddress(session: UserSession): string | null {
     return accountId.length === 32 ? ss58Encode(accountId) : null;
 }
 
-function sessionLogoutAddress(session: UserSession): string {
+async function sessionLogoutAddress(session: UserSession): Promise<string> {
     try {
-        return deriveSessionAddresses(session).productAddress;
+        return (await deriveSessionAddresses(session)).productAddress;
     } catch {
         return sessionRemoteAddress(session) ?? "(stored session)";
     }
@@ -238,7 +238,7 @@ export async function connect(): Promise<ConnectResult> {
     }
 
     if (sessions.length > 0) {
-        const addresses = deriveSessionAddresses(newestSession(sessions));
+        const addresses = await deriveSessionAddresses(newestSession(sessions));
         // The "existing" result carries plain address data only — the
         // adapter is not part of it, so this is the last place that can
         // release it. Leaking it keeps a statement-store WebSocket +
@@ -359,7 +359,7 @@ export async function waitForLogin(
         if (authenticated) {
             const sessions = await loadSessions(adapter, 3000);
             if (sessions.length > 0) {
-                const addresses = deriveSessionAddresses(newestSession(sessions));
+                const addresses = await deriveSessionAddresses(newestSession(sessions));
                 address = addresses.productAddress;
                 // Do NOT prune older sessions here by calling
                 // `adapter.sessions.disconnect`. It submits a `Disconnected`
@@ -458,8 +458,8 @@ export async function getSessionSigner(): Promise<SessionHandle | null> {
     }
 
     const session = newestSession(sessions);
-    const signer = createPlaygroundSigner(session);
-    const addresses = deriveSessionAddresses(session);
+    const signer = await createPlaygroundSigner(session);
+    const addresses = await deriveSessionAddresses(session);
 
     let destroyed = false;
     const destroy = () => {
@@ -528,7 +528,7 @@ export async function findSession(): Promise<LogoutHandle | null> {
         return null;
     }
     const session = newestSession(sessions);
-    const address = sessionLogoutAddress(session);
+    const address = await sessionLogoutAddress(session);
     return { adapter, address, session };
 }
 
diff --git a/src/utils/identity/identityGate.ts b/src/utils/identity/identityGate.ts
index e7fd3478..39c59030 100644
--- a/src/utils/identity/identityGate.ts
+++ b/src/utils/identity/identityGate.ts
@@ -134,7 +134,7 @@ export async function checkIdentityGate(
 
     let productH160: `0x${string}`;
     try {
-        productH160 = deriveSessionAddresses(handle.session).productH160;
+        productH160 = (await deriveSessionAddresses(handle.session)).productH160;
     } catch (err) {
         return { status: "unverifiable", detail: describe(err) };
     } finally {
diff --git a/src/utils/productAccount.test.ts b/src/utils/productAccount.test.ts
deleted file mode 100644
index 6395ee3c..00000000
--- a/src/utils/productAccount.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (C) Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: Apache-2.0
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { describe, expect, it } from "vitest";
-import { ss58Encode } from "@parity/product-sdk-address";
-import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
-import { PLAYGROUND_PRODUCT_ID } from "../config.js";
-
-describe("product account integration", () => {
-    it("derives a stable SS58 address for playground.dot / index 0 from a fixed root", () => {
-        const root = new Uint8Array(32).fill(0);
-        const pubkey = deriveProductAccountPublicKey(root, PLAYGROUND_PRODUCT_ID, 0);
-        const address = ss58Encode(pubkey);
-        // The algorithm is locked by upstream frozen vectors in @parity/product-sdk-keys;
-        // here we only assert that wiring (config + sdk import + ss58Encode) does
-        // not silently produce an empty/malformed address.
-        expect(typeof address).toBe("string");
-        expect(address.length).toBeGreaterThan(40);
-        expect(pubkey.length).toBe(32);
-    });
-});
diff --git a/src/utils/sessionSigner.test.ts b/src/utils/sessionSigner.test.ts
index a553833f..c9a224a7 100644
--- a/src/utils/sessionSigner.test.ts
+++ b/src/utils/sessionSigner.test.ts
@@ -13,22 +13,68 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { describe, expect, test, vi } from "vitest";
+import { describe, expect, it, test, vi } from "vitest";
 import { ss58Encode } from "@parity/product-sdk-address";
-import { seedToAccount } from "@parity/product-sdk-keys";
+import { deriveProductAccountPublicKey, seedToAccount } from "@parity/product-sdk-keys";
 import type { UserSession } from "@parity/product-sdk-terminal";
 import type { PolkadotSigner } from "polkadot-api";
 import { PLAYGROUND_PRODUCT_ID, getEnvTld } from "../config.js";
 import {
     INCOMPLETE_SESSION_MESSAGE,
+    isAllowanceExpired,
     SESSION_EXPIRED_MESSAGE,
     createPlaygroundSessionSigner,
     derivePlaygroundProductPublicKey,
     wrapSignerWithSssFastFail,
 } from "./sessionSigner.js";
 
+const { deriveProductPublicKeyMock, createSessionSignerForAccountMock } = vi.hoisted(() => ({
+    deriveProductPublicKeyMock: vi.fn(),
+    createSessionSignerForAccountMock: vi.fn(),
+}));
+
+// RFC-0022 derives the product account from a subtree key only the WALLET can
+// produce. The SDK fetches it over the statement store and caches it on disk
+// under the default storage dir — so an unmocked call here would hang waiting
+// for a phone AND write a bogus key into the developer's real
+// ~/.polkadot-apps subtree cache, breaking their live session. We mock the SDK
+// boundary and assert what WE control (which productId/index we ask for); the
+// derivation math itself is pinned below against host-rust-core's vector.
+vi.mock("@parity/product-sdk-terminal", async (importOriginal) => {
+    const actual = await importOriginal<typeof import("@parity/product-sdk-terminal")>();
+    return {
+        ...actual,
+        deriveProductPublicKey: deriveProductPublicKeyMock,
+        createSessionSignerForAccount: createSessionSignerForAccountMock,
+    };
+});
+
 const DEV_PHRASE = "bottom drive obey lake curtain smoke basket hold race lonely fit walk";
 
+/**
+ * host-rust-core cross-host vector (tests/wasm_crypto_vectors.rs,
+ * `product_account_and_entropy_vectors_match_mobile`): the product SUBTREE
+ * public key for `//product//myapp.dot` off entropy 0xab x 16, and the account
+ * it yields at index 0. Copied from the host's own fixtures — never
+ * regenerated from our output.
+ */
+const HOST_VECTOR_SUBTREE = hexToBytes(
+    "4a4c063de30994d4341f1effa157ded4e0b340b2e657f238bef3f930faba192b",
+);
+const HOST_VECTOR_ACCOUNT = hexToBytes(
+    "1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c",
+);
+
+function hexToBytes(hex: string): Uint8Array {
+    return Uint8Array.from(hex.match(/.{2}/g)!.map((b) => Number.parseInt(b, 16)));
+}
+
+function toHex(bytes: Uint8Array): string {
+    return `0x${Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")}`;
+}
+
 // Stand-in for the mobile's SSO handshake response. `rootAccountId` is
 // `deriveRootAccount()` on the mobile = the bare-mnemonic keypair pubkey.
 // `remoteAccount.accountId` is the wallet's currently-selected substrate
@@ -58,53 +104,78 @@ describe("createPlaygroundSessionSigner", () => {
     // As long as all three pin the same `(rootPubKey, productId, 0)` triple they
     // yield byte-identical SS58 strings. This is the regression guard.
     // ────────────────────────────────────────────────────────────────────────
-    test("login signer address === deploy signer address === playground-app address", () => {
+    test("asks the SDK for the playground product id at index 0", async () => {
         const session = fakeSession({ rootAccountId: root.publicKey });
+        deriveProductPublicKeyMock.mockResolvedValue(HOST_VECTOR_ACCOUNT);
 
-        const cliSigner = createPlaygroundSessionSigner(session, {
+        const key = await derivePlaygroundProductPublicKey(session, {
             productId: PLAYGROUND_PRODUCT_ID,
             derivationIndex: 0,
         });
-        const cliAddress = ss58Encode(cliSigner.publicKey);
 
-        // What the deployed playground-app gets back from the mobile (mobile
-        // computes this exact derivation from the same mnemonic).
-        const mobileDerived = seedToAccount(DEV_PHRASE, `/product/${PLAYGROUND_PRODUCT_ID}/0`);
-        const playgroundAppAddress = ss58Encode(mobileDerived.publicKey);
-
-        expect(cliAddress).toEqual(playgroundAppAddress);
+        expect(deriveProductPublicKeyMock).toHaveBeenCalledWith(session, {
+            productId: PLAYGROUND_PRODUCT_ID,
+            derivationIndex: 0,
+        });
+        expect(key).toBe(HOST_VECTOR_ACCOUNT);
     });
 
-    test("signer.publicKey is the derived product account, not the wallet account", () => {
+    /**
+     * The signer must NOT be handed a pre-computed `publicKey`. Supplying one
+     * would let the signing key and the address we display drift apart if the
+     * two were ever derived by different paths; omitting it makes the SDK
+     * resolve both through the same cached subtree. The pre-RFC-0022 bug was
+     * the extreme version of this — the signer used
+     * `session.remoteAccount.accountId` (the WALLET account), so the chain saw
+     * a different `From` than the funded, allowance-granted product account.
+     */
+    test("builds the signer without pinning a publicKey, so it cannot desync", async () => {
         const session = fakeSession({
             rootAccountId: root.publicKey,
             remoteAccountId: new Uint8Array(32).fill(7),
         });
-        const signer = createPlaygroundSessionSigner(session, {
-            productId: PLAYGROUND_PRODUCT_ID,
-            derivationIndex: 0,
-        });
-        const expected = derivePlaygroundProductPublicKey(root.publicKey, {
+        createSessionSignerForAccountMock.mockResolvedValue({
+            publicKey: HOST_VECTOR_ACCOUNT,
+            signTx: async () => new Uint8Array(),
+            signBytes: async () => new Uint8Array(),
+        } as unknown as PolkadotSigner);
+
+        const signer = await createPlaygroundSessionSigner(session, {
             productId: PLAYGROUND_PRODUCT_ID,
             derivationIndex: 0,
         });
 
-        // The pre-fix bug set signer.publicKey from session.remoteAccount.accountId
-        // (the user's wallet account), not the product-derived account. The chain
-        // would see the wallet as From — different from the funded / allowance-
-        // granted product account. This guard ensures we never slip back.
-        expect(signer.publicKey).toEqual(expected);
+        const [passedSession, passedRef] = createSessionSignerForAccountMock.mock.calls[0];
+        expect(passedSession).toBe(session);
+        expect(passedRef).toEqual({ productId: PLAYGROUND_PRODUCT_ID, derivationIndex: 0 });
+        expect(passedRef).not.toHaveProperty("publicKey");
+        expect(signer.publicKey).toEqual(HOST_VECTOR_ACCOUNT);
         expect(ss58Encode(signer.publicKey)).not.toEqual(ss58Encode(new Uint8Array(32).fill(7)));
     });
 
-    test("throws the friendly message when rootAccountId is missing", () => {
-        const session = fakeSession({ rootAccountId: undefined });
-        expect(() =>
-            createPlaygroundSessionSigner(session, {
-                productId: PLAYGROUND_PRODUCT_ID,
-                derivationIndex: 0,
-            }),
-        ).toThrow(INCOMPLETE_SESSION_MESSAGE);
+    /**
+     * Cross-host agreement, pinned at the primitive rather than through our
+     * own composition — a fixture regenerated from the code it checks is
+     * worthless.
+     *
+     * Both values come from host-rust-core's `tests/wasm_crypto_vectors.rs`
+     * (`product_account_and_entropy_vectors_match_mobile`), mirrored upstream
+     * in product-sdk's `product-account.test.ts`. They are what the MOBILE
+     * computes, so if this fails the CLI and the phone would derive different
+     * accounts for the same person.
+     *
+     * Note the subtree is keyed by product id: it is `//product//{productId}`
+     * with HARD junctions, which is why a public key can no longer cross it
+     * and the wallet has to hand us the subtree.
+     */
+    test("derives the mobile-matched account from the host's cross-host vector", () => {
+        const account = deriveProductAccountPublicKey(HOST_VECTOR_SUBTREE, {
+            tag: "Index",
+            value: 0,
+        });
+        expect(toHex(account)).toBe(
+            "0x1c1ae478b564572f806ffa6352b4273d612beb01610b19f4e5bf444521cd5b5c",
+        );
     });
 
     test("playground product id follows the environment TLD", () => {
@@ -230,3 +301,74 @@ describe("wrapSignerWithSssFastFail", () => {
         );
     });
 });
+
+describe("expired statement-store allowance", () => {
+    /**
+     * The SDK changed shape under us. Up to 0.8.x an expired SSS allowance was
+     * logged to `console.error` and the signing promise never settled; since
+     * 0.10.0 `requestSignedTransaction` throws `AllowanceExpiredError`
+     * instead. The wrapper must turn BOTH into SESSION_EXPIRED_MESSAGE,
+     * because that message carries the only remedy — the renewal request would
+     * itself travel over the expired channel, so re-pairing is the only way
+     * out. A raw SDK error tells the user nothing they can act on.
+     */
+    // `signTx` takes 4-5 args in the real signature; the wrapper forwards them
+    // opaquely, so the test calls through a loose alias rather than building
+    // throwaway extrinsic arguments that nothing reads.
+    const callSignTx = (s: PolkadotSigner): Promise<Uint8Array> =>
+        (s.signTx as unknown as (...a: unknown[]) => Promise<Uint8Array>)({});
+
+    function fakeSigner(signTx: () => Promise<Uint8Array>): PolkadotSigner {
+        return {
+            publicKey: new Uint8Array(32).fill(1),
+            signTx,
+            signBytes: signTx,
+        } as unknown as PolkadotSigner;
+    }
+
+    it("maps a thrown AllowanceExpiredError to the re-pair message", async () => {
+        const err = new Error("statement store allowance expired");
+        err.name = "AllowanceExpiredError";
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw err;
+            }),
+        );
+
+        await expect(callSignTx(signer)).rejects.toThrow(SESSION_EXPIRED_MESSAGE);
+    });
+
+    it("keeps the original error as the cause, so the detail is not lost", async () => {
+        const err = new Error("statement store allowance expired");
+        err.name = "AllowanceExpiredError";
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw err;
+            }),
+        );
+
+        await callSignTx(signer).catch((caught: Error) => {
+            expect(caught.cause).toBe(err);
+        });
+    });
+
+    it("passes unrelated signing failures through untouched", async () => {
+        const signer = wrapSignerWithSssFastFail(
+            fakeSigner(async () => {
+                throw new Error("message too big");
+            }),
+        );
+
+        await expect(callSignTx(signer)).rejects.toThrow("message too big");
+    });
+
+    /** `instanceof` is unreliable across duplicate copies in a pnpm tree. */
+    it("recognises the error by name, not only by instanceof", () => {
+        const byName = new Error("nope");
+        byName.name = "AllowanceExpiredError";
+        expect(isAllowanceExpired(byName)).toBe(true);
+        expect(isAllowanceExpired(new Error("something else"))).toBe(false);
+        expect(isAllowanceExpired("not an error")).toBe(false);
+        expect(isAllowanceExpired(undefined)).toBe(false);
+    });
+});
diff --git a/src/utils/sessionSigner.ts b/src/utils/sessionSigner.ts
index c5e6abaf..acb74ed1 100644
--- a/src/utils/sessionSigner.ts
+++ b/src/utils/sessionSigner.ts
@@ -34,9 +34,10 @@
  * this CLI).
  */
 
-import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
 import {
+    AllowanceExpiredError,
     createSessionSignerForAccount,
+    deriveProductPublicKey,
     type ProductAccountRef,
     type UserSession,
 } from "@parity/product-sdk-terminal";
@@ -57,34 +58,42 @@ export function sessionRootPublicKey(session: UserSession): Uint8Array {
 }
 
 /**
- * Soft-derive the product account public key off a wallet root.
+ * Derive the playground product account public key (RFC-0022).
  *
- * This is the single source of truth for product-account math in the CLI.
- * Both `createPlaygroundSessionSigner` (which feeds the key to the SDK
- * signer) and `auth.ts::deriveSessionAddresses` (which builds the display
- * triple for `playground login`) go through here so a future change to
- * derivation params can't silently desync the signer from what we print.
+ * It used to be three SOFT junctions (`product`/`playground.dot`/`0`) off
+ * `session.rootAccountId`, computed locally with no network. RFC-0022 makes
+ * `//product//{productId}` two HARD junctions, and a public key cannot cross a
+ * hard junction — so the parent must be the product SUBTREE key, which only
+ * the wallet can produce (`session.getProductSubtree`; consent-free, and the
+ * SDK caches it at `{appId}_ProductSubtrees.json`, reaching the phone only on
+ * a cold cache).
  *
- * sr25519 soft derivation is composable on public keys alone, so deriving
- * from `rootAccountId` locally produces the SAME public key the mobile
- * derives privately via `mnemonic + "/product/...{idx}"`. Algorithm
- * parity with mobile/desktop is locked by the frozen vectors in
- * `@parity/product-sdk-keys`'s `product-account.test.ts` and by the
- * `deriveSessionAddresses` block in `src/utils/auth.test.ts`.
+ * Three consequences worth knowing:
+ *   - it takes a SESSION, not a root public key;
+ *   - it is ASYNC, and on a cold cache it needs the phone reachable;
+ *   - the address differs from the pre-RFC-0022 one, so every product account
+ *     moved when this landed (see the migration note in CLAUDE.md).
+ *
+ * `deriveProductPublicKey` is the SDK's single source of truth for this math,
+ * so we delegate rather than re-derive. Cross-host agreement (CLI vs phone) is
+ * pinned at the primitive in `sessionSigner.test.ts` against host-rust-core's
+ * own vector — never against our own output.
  */
-export function derivePlaygroundProductPublicKey(
-    rootAccountId: Uint8Array,
+export async function derivePlaygroundProductPublicKey(
+    session: UserSession,
     ref: Pick<ProductAccountRef, "productId" | "derivationIndex">,
-): Uint8Array {
-    return deriveProductAccountPublicKey(rootAccountId, ref.productId, ref.derivationIndex);
+): Promise<Uint8Array> {
+    return deriveProductPublicKey(session, ref);
 }
 
-export function createPlaygroundSessionSigner(
+export async function createPlaygroundSessionSigner(
     session: UserSession,
     ref: Pick<ProductAccountRef, "productId" | "derivationIndex">,
-): PolkadotSigner {
-    const publicKey = derivePlaygroundProductPublicKey(sessionRootPublicKey(session), ref);
-    return wrapSignerWithSssFastFail(createSessionSignerForAccount(session, { ...ref, publicKey }));
+): Promise<PolkadotSigner> {
+    // `publicKey` omitted on purpose: the SDK fetches the subtree and derives
+    // it through the same cached path as the display address, so the signer and
+    // what we print cannot desync.
+    return wrapSignerWithSssFastFail(await createSessionSignerForAccount(session, ref));
 }
 
 export const SESSION_EXPIRED_MESSAGE =
@@ -92,17 +101,39 @@ export const SESSION_EXPIRED_MESSAGE =
     "and cannot be renewed remotely (renewal requests travel over the expired channel). " +
     'Run "playground logout" and then "playground login" to pair again.';
 
+/**
+ * Whether an error means the statement-store allowance has lapsed.
+ *
+ * Name-based as well as `instanceof`, deliberately: a pnpm tree can hold more
+ * than one copy of the SDK, and `instanceof` across copies silently returns
+ * false. Getting this wrong loses the actionable message, so it fails safe
+ * toward recognising the error.
+ */
+export function isAllowanceExpired(err: unknown): boolean {
+    if (err instanceof AllowanceExpiredError) return true;
+    if (!(err instanceof Error)) return false;
+    return (
+        err.name === "AllowanceExpiredError" || err.constructor?.name === "AllowanceExpiredError"
+    );
+}
+
 /**
  * Fast-fail for expired statement-store (SSS) allowances.
  *
  * Phone signing rides the statement store: `session.createTransaction` /
  * `session.signRaw` submit a statement on the People chain that the phone
  * subscribes to. The SSS allowance is a 1-day renewable resource (plus a
- * grace window, ~2-3 days total after login). When it lapses, the
- * statement-store adapter logs `NoAllowanceError` to `console.error` but
- * does NOT reject the promise — the signing call hangs for the SDK's 180s
- * queue timeout while the outer transaction watcher gives up at 90s with a
- * misleading "transaction watcher silent" error, times 3 retries.
+ * grace window, ~2-3 days total after login), and it cannot be renewed
+ * remotely, so the only remedy is re-pairing.
+ *
+ * There are TWO expiry shapes to catch, because the SDK changed:
+ *   - since product-sdk-terminal 0.10.0 it REJECTS with
+ *     `AllowanceExpiredError`, handled in the catch below;
+ *   - before that the statement-store adapter logged `NoAllowanceError` to
+ *     `console.error` and did NOT reject — the call hung for the SDK's 180s
+ *     queue timeout while the outer watcher gave up at 90s with a misleading
+ *     "transaction watcher silent" error, times 3 retries. The console
+ *     interception still covers that, and any path that still only logs.
  *
  * This wrapper intercepts `console.error` for the duration of each signing
  * call, detects the NoAllowanceError line, and rejects within ~200ms with an
@@ -152,6 +183,22 @@ export function wrapSignerWithSssFastFail(signer: PolkadotSigner): PolkadotSigne
                         }, 200);
                     }),
                 ]);
+            } catch (err) {
+                // Since product-sdk-terminal 0.10.0 the SDK REJECTS with
+                // `AllowanceExpiredError` instead of logging `NoAllowanceError`
+                // and hanging, so the console interception above never fires on
+                // the primary expiry path. Without this branch the user gets a
+                // raw SDK error instead of the one message that states the only
+                // remedy (logout + login — the renewal request itself would
+                // travel over the expired channel).
+                //
+                // Matched by name as well as `instanceof`: duplicate copies of
+                // the package in a pnpm tree make `instanceof` unreliable, and
+                // failing open here would lose the remedy.
+                if (isAllowanceExpired(err)) {
+                    throw new Error(SESSION_EXPIRED_MESSAGE, { cause: err });
+                }
+                throw err;
             } finally {
                 // Both arms are settled or abandoned here: the interval must
                 // die (it would otherwise keep the event loop alive — see
diff --git a/src/utils/signer.ts b/src/utils/signer.ts
index 3bb48d5a..28c4d468 100644
--- a/src/utils/signer.ts
+++ b/src/utils/signer.ts
@@ -40,8 +40,7 @@ export interface ResolvedSigner {
     /**
      * The session's root / product / H160 triple. Present for QR/mobile
      * sessions (forwarded from `SessionHandle`); absent for local dev/SURI
-     * signers. Consumed by `resolveSignerSetup` to pick the `userSessionH160`
-     * used for the deploy summary's dev-ownership warning
+     * signers. Consumed by `resolveSignerSetup` to pick the `claimedOwnerH160`
      * for dev-mode playground publish.
      */
     addresses?: SessionAddresses;