From 5b9f22e9cff2f3c7d11e4bb827a672595894ed5f Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 09:44:45 +0200
Subject: [PATCH 01/17] refactor(host): adopt Rust TrUAPI runtime

Replace the Nova host-container, auth, and signing path with the worker-backed Rust core. Keep dotli responsible only for browser policy, persistence, UI, and physical chain transports.
---
 .env.example                                  |    4 -
 MIGRATION.md                                  |  101 ++
 README.md                                     |   14 +-
 THIRD_PARTY_NOTICES.md                        |    6 +-
 apps/host/src/main.ts                         |  138 +-
 apps/host/tests/e2e/fixtures/paired.ts        |    6 +-
 apps/host/tests/e2e/global-setup.ts           |    7 +-
 apps/host/tests/e2e/helpers/signing.ts        |   46 +-
 apps/host/tests/e2e/truapi.spec.ts            |   85 +-
 .../tests/functional/auth-subscribe.spec.ts   |   87 -
 apps/host/vite.config.ts                      |   97 +-
 apps/protocol/src/main.ts                     |   18 -
 bun.lock                                      |  103 +-
 docs/smoldot.md                               |   39 +-
 packages/auth/eslint.config.js                |   15 -
 packages/auth/package.json                    |   42 -
 packages/auth/src/account.ts                  |  103 --
 packages/auth/src/auth.ts                     |  565 ------
 packages/auth/src/shared-storage.ts           |  123 --
 packages/auth/src/signing.ts                  |  660 -------
 packages/auth/tests/account.test.ts           |   91 -
 packages/auth/tests/shared-storage.test.ts    |  163 --
 packages/auth/tsconfig.json                   |    7 -
 packages/auth/vitest.config.ts                |   28 -
 packages/config/src/config.ts                 |    3 -
 packages/config/src/network.ts                |   21 +-
 packages/config/tests/gateway-chains.test.ts  |   10 +-
 packages/protocol/src/auth-storage.ts         |   21 +-
 packages/protocol/src/client.ts               |   15 +-
 packages/protocol/src/messages.ts             |    1 -
 packages/protocol/tests/auth-storage.test.ts  |   20 +-
 packages/resolver/package.json                |    3 -
 packages/resolver/src/rpc-chain.ts            |   41 +-
 packages/resolver/tests/chains.test.ts        |   15 +
 packages/resolver/tests/rpc-chain.test.ts     |   48 +
 .../storage/src/scheduled-notifications.ts    |    2 +-
 packages/truapi-debug/DEBUG_PANEL.md          |   94 +-
 packages/truapi-debug/package.json            |    4 +-
 packages/truapi-debug/src/chain-decode.ts     |   45 +-
 packages/truapi-debug/src/chain-summary.ts    |    8 +-
 packages/truapi-debug/src/dotli-debug-bus.ts  |   21 +-
 .../truapi-debug/src/dotli-debug-types.ts     |   15 +-
 packages/truapi-debug/src/event-store.ts      |   53 +-
 packages/truapi-debug/src/index.ts            |    5 +-
 packages/truapi-debug/src/panel.ts            |   35 +-
 .../truapi-debug/src/system-explanations.ts   |  184 +-
 packages/truapi-debug/src/system-summary.ts   |   50 -
 packages/truapi-debug/src/timeline-layout.ts  |   34 +-
 packages/typescript-config/paths.json         |    1 -
 packages/ui/package.json                      |   13 +-
 packages/ui/src/allocation-modal.ts           |  341 ----
 packages/ui/src/bridge.ts                     | 1034 +++++++++--
 packages/ui/src/container.ts                  | 1584 -----------------
 packages/ui/src/host-callbacks/AuthState.ts   |   72 +
 packages/ui/src/host-callbacks/Chain.ts       |  130 ++
 .../ui/src/host-callbacks/FeatureSupported.ts |   14 +
 .../ui/src/host-callbacks/LocalStorage.ts     |   59 +
 packages/ui/src/host-callbacks/OpenUrl.ts     |   53 +
 packages/ui/src/host-callbacks/Preimage.ts    |  107 ++
 .../ui/src/host-callbacks/PromptPermission.ts |  127 ++
 .../ui/src/host-callbacks/PushNotification.ts |   60 +
 .../ui/src/host-callbacks/SessionStore.ts     |  251 +++
 packages/ui/src/host-callbacks/Theme.ts       |   22 +
 .../ui/src/host-callbacks/UserConfirmation.ts |  394 ++++
 packages/ui/src/host-callbacks/handlers.ts    |   60 +
 packages/ui/src/host-callbacks/rate-limit.ts  |   21 +
 .../ui/src/host-callbacks/result-stream.ts    |   92 +
 packages/ui/src/legacy-host-bridge.ts         |   67 +
 packages/ui/src/login-request-error.ts        |   35 +
 packages/ui/src/permission-modal.ts           |   35 +-
 packages/ui/src/permissions.ts                |  178 +-
 packages/ui/src/preimage-submit.ts            |  116 --
 packages/ui/src/runtime-config.ts             |   53 +
 packages/ui/src/scheduled-notifications.ts    |    9 +-
 packages/ui/src/statement-store-mapping.ts    |  177 --
 packages/ui/src/styles/signing.css            |  132 --
 packages/ui/src/styles/themes.css             |   42 -
 packages/ui/src/topbar.ts                     |  480 ++---
 packages/ui/src/wallet-queue.ts               |   31 -
 packages/ui/tests/allocation-modal.test.ts    |  181 --
 packages/ui/tests/bridge.test.ts              |  408 +++++
 packages/ui/tests/chain-callback.test.ts      |  139 ++
 packages/ui/tests/local-storage.test.ts       |   76 +
 packages/ui/tests/notification.test.ts        |  169 ++
 packages/ui/tests/nova-removal.test.ts        |   70 +
 packages/ui/tests/permission-modal.test.ts    |   32 +
 packages/ui/tests/permissions.test.ts         |  239 ++-
 packages/ui/tests/preimage.test.ts            |   74 +
 packages/ui/tests/runtime-config.test.ts      |   59 +
 packages/ui/tests/session-store.test.ts       |  314 ++++
 packages/ui/tests/theme.test.ts               |   45 +
 packages/ui/tests/topbar.test.ts              |  439 +++++
 packages/ui/tests/user-confirmation.test.ts   |  252 +++
 packages/ui/tests/wallet-queue.test.ts        |  111 --
 94 files changed, 5734 insertions(+), 5960 deletions(-)
 create mode 100644 MIGRATION.md
 delete mode 100644 apps/host/tests/functional/auth-subscribe.spec.ts
 delete mode 100644 packages/auth/eslint.config.js
 delete mode 100644 packages/auth/package.json
 delete mode 100644 packages/auth/src/account.ts
 delete mode 100644 packages/auth/src/auth.ts
 delete mode 100644 packages/auth/src/shared-storage.ts
 delete mode 100644 packages/auth/src/signing.ts
 delete mode 100644 packages/auth/tests/account.test.ts
 delete mode 100644 packages/auth/tests/shared-storage.test.ts
 delete mode 100644 packages/auth/tsconfig.json
 delete mode 100644 packages/auth/vitest.config.ts
 create mode 100644 packages/resolver/tests/chains.test.ts
 create mode 100644 packages/resolver/tests/rpc-chain.test.ts
 delete mode 100644 packages/ui/src/allocation-modal.ts
 delete mode 100644 packages/ui/src/container.ts
 create mode 100644 packages/ui/src/host-callbacks/AuthState.ts
 create mode 100644 packages/ui/src/host-callbacks/Chain.ts
 create mode 100644 packages/ui/src/host-callbacks/FeatureSupported.ts
 create mode 100644 packages/ui/src/host-callbacks/LocalStorage.ts
 create mode 100644 packages/ui/src/host-callbacks/OpenUrl.ts
 create mode 100644 packages/ui/src/host-callbacks/Preimage.ts
 create mode 100644 packages/ui/src/host-callbacks/PromptPermission.ts
 create mode 100644 packages/ui/src/host-callbacks/PushNotification.ts
 create mode 100644 packages/ui/src/host-callbacks/SessionStore.ts
 create mode 100644 packages/ui/src/host-callbacks/Theme.ts
 create mode 100644 packages/ui/src/host-callbacks/UserConfirmation.ts
 create mode 100644 packages/ui/src/host-callbacks/handlers.ts
 create mode 100644 packages/ui/src/host-callbacks/rate-limit.ts
 create mode 100644 packages/ui/src/host-callbacks/result-stream.ts
 create mode 100644 packages/ui/src/legacy-host-bridge.ts
 create mode 100644 packages/ui/src/login-request-error.ts
 delete mode 100644 packages/ui/src/preimage-submit.ts
 create mode 100644 packages/ui/src/runtime-config.ts
 delete mode 100644 packages/ui/src/statement-store-mapping.ts
 delete mode 100644 packages/ui/src/wallet-queue.ts
 delete mode 100644 packages/ui/tests/allocation-modal.test.ts
 create mode 100644 packages/ui/tests/bridge.test.ts
 create mode 100644 packages/ui/tests/chain-callback.test.ts
 create mode 100644 packages/ui/tests/local-storage.test.ts
 create mode 100644 packages/ui/tests/notification.test.ts
 create mode 100644 packages/ui/tests/nova-removal.test.ts
 create mode 100644 packages/ui/tests/permission-modal.test.ts
 create mode 100644 packages/ui/tests/preimage.test.ts
 create mode 100644 packages/ui/tests/runtime-config.test.ts
 create mode 100644 packages/ui/tests/session-store.test.ts
 create mode 100644 packages/ui/tests/theme.test.ts
 create mode 100644 packages/ui/tests/topbar.test.ts
 create mode 100644 packages/ui/tests/user-confirmation.test.ts
 delete mode 100644 packages/ui/tests/wallet-queue.test.ts

diff --git a/.env.example b/.env.example
index 37cb25e5..0306e47a 100644
--- a/.env.example
+++ b/.env.example
@@ -26,10 +26,6 @@ VITE_METRICS=
 # build time (see packages/sandbox-checker). Leave unset for normal builds.
 VITE_SANDBOX_CHECKER=
 
-# Set to "true" to use the smoldot light client for the statement store
-# chain. Defaults to false; enable in development for testing and feedback.
-VITE_SS_USE_SMOLDOT=
-
 # Optional relay chain spec override for the statement store people chain.
 # Chain-spec file name without `.json`, e.g. "westend-local". When unset,
 # the default Paseo relay chain is reused.
diff --git a/MIGRATION.md b/MIGRATION.md
new file mode 100644
index 00000000..5dec5443
--- /dev/null
+++ b/MIGRATION.md
@@ -0,0 +1,101 @@
+# dotli host layer migration to TrUAPI
+
+This document records the current dotli host cutover state. The old
+`@novasamatech/*` host-container path is no longer part of the runtime design:
+dotli launches products through the Rust-backed TrUAPI host bridge and keeps
+only its own `.dot` resolution/smoldot protocol outside that boundary.
+
+## Current integration
+
+dotli still has two protocol layers:
+
+1. Host-product API frames, handled by TrUAPI.
+2. dotli's internal host-smoldot protocol in `packages/protocol/`, which owns
+   `.dot` resolution and is not replaced by TrUAPI.
+
+The active launch path is `packages/ui/src/bridge.ts`:
+
+- imports `@parity/truapi-host/web` and
+  `@parity/truapi-host/worker-runtime?worker`;
+- starts a Web Worker that owns the `truapi-server` WASM core;
+- adapts typed dotli callbacks with `createWasmRawCallbacks(...)`;
+- calls `createWebWorkerProvider(new HostWorker(), rawCallbacks, { runtimeConfig })`;
+- supplies callbacks from `packages/ui/src/host-callbacks/handlers.ts`;
+- calls `createIframeHost(...)` with the product URL, sandbox policy, allowed
+  origin, and the worker-backed provider.
+
+Product frames enter the Rust core through the iframe `MessageChannel`.
+Account, signing, statement-store, SSO pairing, restore, and logout are
+core-owned and do not cross the JS host callback boundary as Nova-specific
+routes.
+
+## dotli callback boundary
+
+dotli still supplies platform primitives that are host policy or browser UI:
+
+| Area                      | Files                                                                                  |
+| ------------------------- | -------------------------------------------------------------------------------------- |
+| navigation                | `packages/ui/src/host-callbacks/OpenUrl.ts`                                            |
+| notifications             | `packages/ui/src/host-callbacks/PushNotification.ts`                                   |
+| device/remote permissions | `packages/ui/src/host-callbacks/PromptPermission.ts`, `packages/ui/src/permissions.ts` |
+| feature support           | `packages/ui/src/host-callbacks/FeatureSupported.ts`                                   |
+| product storage           | `packages/ui/src/host-callbacks/LocalStorage.ts`                                       |
+| session persistence       | `packages/ui/src/host-callbacks/SessionStore.ts`                                       |
+| pairing presentation      | `packages/ui/src/host-callbacks/AuthState.ts`                                          |
+| user confirmations        | `packages/ui/src/host-callbacks/UserConfirmation.ts`                                   |
+| preimage lookup UI        | `packages/ui/src/host-callbacks/Preimage.ts`                                           |
+| theme subscription        | `packages/ui/src/host-callbacks/Theme.ts`                                              |
+| chain backend connection  | `packages/ui/src/host-callbacks/Chain.ts`                                              |
+
+These callbacks must remain generic host primitives. They should not re-add
+Nova package imports, wallet-specific JS channels, or statement-store request
+routing that belongs inside the Rust core.
+
+## Dependencies
+
+`packages/ui/package.json` currently resolves the public TrUAPI package names
+through temporary npm aliases:
+
+```jsonc
+"@parity/truapi": "npm:@pgherveou2/truapi-dev@...",
+"@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@..."
+```
+
+This keeps standalone dotli installs and CI reproducible while the Rust core
+port is in review. TrUAPI's development and E2E Make targets run
+`bun run link:truapi` after building the local packages, so parent-repo work
+always exercises the current checkout instead of the npm artifacts.
+
+> **TODO(packaging):** publish `@parity/truapi` and
+> `@parity/truapi-host`, then replace the temporary aliases before merge.
+
+The runtime manifests and source must not depend on or import the removed
+`@novasamatech/*` runtime packages.
+
+## Nested dApps
+
+The old `setupNestedBridgeDetector` path created extra JS bridges for nested
+iframe sources. TrUAPI v1 does not create separate nested Rust runtimes,
+sessions, product identities, or storage namespaces. If nested traffic is
+forwarded later, it must use the shared top-level Rust core/provider context.
+
+The future usefulness of independent nested-product semantics is tracked in the
+parent TrUAPI design note `docs/design/host-contract-and-core-impl/I -
+nested-dapps.md`.
+
+## Non-TrUAPI dotli layers
+
+These areas remain dotli-owned and are intentionally outside the host-product
+replacement:
+
+- `apps/host/src/main.ts`: landing shell, `.dot` resolution, iframe mounting.
+- `apps/sandbox/src/main.ts`: content renderer.
+- `packages/protocol/`: smoldot protocol client/broker/session plumbing.
+- `packages/resolver/`: `.dot` name resolution.
+- `packages/content/` and `packages/storage/`: archive fetch and cache.
+- `packages/config/`, `packages/metrics/`, and `packages/shared/`: support
+  libraries.
+
+When auditing the migration, treat Nova runtime imports/dependencies as a
+regression, but do not confuse dotli's internal `packages/protocol/` with the
+removed host-product protocol.
diff --git a/README.md b/README.md
index a6abb74c..2ee0da81 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ Each product gets its own `<label>.app.paseo.li` origin, so versions of the same
 
 1. **Resolves** `.dot` names via an in-browser [smoldot](https://github.com/paritytech/smoldot) light client connected to Asset Hub Paseo, querying dotNS contracts.
 2. **Fetches** content from the [Bulletin Chain](https://github.com/paritytech/polkadot-bulletin-chain) via smoldot `bitswap_v1_get` JSON-RPC or an IPFS gateway.
-3. **Renders** the content in a sandboxed iframe with a full host-container bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
+3. **Renders** the content in a sandboxed iframe with the Rust-backed TrUAPI bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
 
 ```
 host-playground.paseo.li
@@ -116,7 +116,7 @@ On repeat visits, content renders instantly from the cache while it is resolved
 
 If a background re-resolution finds the on-chain CID has changed, dotli shows a **New version available** notification with a **Reload** action rather than swapping content silently.
 
-## Host-container bridge
+## TrUAPI bridge
 
 Loaded SPAs communicate with dotli through a postMessage-based protocol. The bridge exposes:
 
@@ -124,18 +124,16 @@ Loaded SPAs communicate with dotli through a postMessage-based protocol. The bri
 | ------------------------------ | ---------------------------------------------------------------------- |
 | `accountGet`                   | Derives a per-app public key via HDKD soft derivation                  |
 | `getLegacyAccounts`            | Returns non-derived (imported) accounts — always empty on the web host |
-| `signPayload` / `signRaw`      | Shows signing modals, delegates to host-papp session                   |
+| `signPayload` / `signRaw`      | Shows signing modals and routes signing through the active session     |
 | `chainConnection`              | Returns a smoldot-backed JsonRpcProvider for supported chains          |
 | `localStorageRead/Write/Clear` | Scoped `localStorage` per `.dot` domain                                |
 | `navigateTo`                   | Opens URLs in new tabs                                                 |
 | `featureSupported`             | Reports whether a feature is supported (e.g. a chain's genesis hash)   |
 | `connectionStatus`             | Streams auth state changes to the SPA                                  |
 
-### Nested dApp support
+### App iframe model
 
-dApps can embed other dApps via iframes (e.g. a marketplace app embedding a payments app). The host automatically detects nested dApps and creates separate bridges for each one, regardless of nesting depth.
-
-When the host receives a protocol message from an unknown iframe window, it dynamically creates a new container bridge targeting that window. The dApp SDK always sends to `window.top`, so all nested dApps communicate directly with the host — no relay needed.
+The host creates one TrUAPI bridge for the rendered product iframe. dApp-in-dApp iframes are opaque to the host and must use the top-level product's shared Rust core/provider context rather than separate host-created bridges.
 
 The app context uses `document.write()` to eliminate extra iframe nesting: when loaded inside a host iframe, the app replaces its own document with the dApp content so the dApp occupies the iframe directly.
 
@@ -174,7 +172,7 @@ The published tag on the [Releases page](https://github.com/paritytech/dotli/rel
 
 ## Debug panel
 
-dotli ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, host-papp SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
+dot.li ships a TrUAPI debug panel that aggregates host-side activity (boot/resolve/render/bridge events, TrUAPI host↔product messages, SSO/session events) into one time-aligned inspector. The panel chunk is dynamically imported, so users who never see it pay no download cost.
 
 In builds compiled with `VITE_APP_DEBUG=true` (local `bun run preview:debug`, and the staging dev deploys at `paseoli.dev` / `dotli.dev`) the panel auto-mounts collapsed. In staging/production it's off until you click **Open in debug mode** in the host Settings menu (or append `?debug=true` to any URL). The choice is sessionStorage-scoped — closing the tab clears it. Use `?debug=off` to silence it explicitly within the same session.
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 3005b7a6..df4d8895 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -12,7 +12,7 @@ compatible with this project's AGPL-3.0 outbound license. Build-time-only
 tooling under weak-copyleft (MPL-2.0) or source-available (FSL-1.1-MIT) terms is
 used to build the application and is not redistributed as part of it.
 
-> Generated from the resolved dependency tree (603 distinct third-party
+> Generated from the resolved dependency tree (595 distinct third-party
 > packages). Platform-specific binary packages (for example
 > `*-darwin-arm64`, `@esbuild/*`, `@rolldown/*`) reflect the build host;
 > other platforms resolve their own equivalents under the same licenses.
@@ -20,11 +20,11 @@ used to build the application and is not redistributed as part of it.
 
 ## MIT
 
-@apideck/better-ajv-errors, @babel/code-frame, @babel/compat-data, @babel/core, @babel/generator, @babel/helper-annotate-as-pure, @babel/helper-compilation-targets, @babel/helper-create-class-features-plugin, @babel/helper-create-regexp-features-plugin, @babel/helper-define-polyfill-provider, @babel/helper-globals, @babel/helper-member-expression-to-functions, @babel/helper-module-imports, @babel/helper-module-transforms, @babel/helper-optimise-call-expression, @babel/helper-plugin-utils, @babel/helper-remap-async-to-generator, @babel/helper-replace-supers, @babel/helper-skip-transparent-expression-wrappers, @babel/helper-string-parser, @babel/helper-validator-identifier, @babel/helper-validator-option, @babel/helper-wrap-function, @babel/helpers, @babel/parser, @babel/plugin-bugfix-firefox-class-in-computed-class-key, @babel/plugin-bugfix-safari-class-field-initializer-scope, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression, @babel/plugin-bugfix-safari-rest-destructuring-rhs-array, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly, @babel/plugin-proposal-private-property-in-object, @babel/plugin-syntax-import-assertions, @babel/plugin-syntax-import-attributes, @babel/plugin-syntax-unicode-sets-regex, @babel/plugin-transform-arrow-functions, @babel/plugin-transform-async-generator-functions, @babel/plugin-transform-async-to-generator, @babel/plugin-transform-block-scoped-functions, @babel/plugin-transform-block-scoping, @babel/plugin-transform-class-properties, @babel/plugin-transform-class-static-block, @babel/plugin-transform-classes, @babel/plugin-transform-computed-properties, @babel/plugin-transform-destructuring, @babel/plugin-transform-dotall-regex, @babel/plugin-transform-duplicate-keys, @babel/plugin-transform-duplicate-named-capturing-groups-regex, @babel/plugin-transform-dynamic-import, @babel/plugin-transform-explicit-resource-management, @babel/plugin-transform-exponentiation-operator, @babel/plugin-transform-export-namespace-from, @babel/plugin-transform-for-of, @babel/plugin-transform-function-name, @babel/plugin-transform-json-strings, @babel/plugin-transform-literals, @babel/plugin-transform-logical-assignment-operators, @babel/plugin-transform-member-expression-literals, @babel/plugin-transform-modules-amd, @babel/plugin-transform-modules-commonjs, @babel/plugin-transform-modules-systemjs, @babel/plugin-transform-modules-umd, @babel/plugin-transform-named-capturing-groups-regex, @babel/plugin-transform-new-target, @babel/plugin-transform-nullish-coalescing-operator, @babel/plugin-transform-numeric-separator, @babel/plugin-transform-object-rest-spread, @babel/plugin-transform-object-super, @babel/plugin-transform-optional-catch-binding, @babel/plugin-transform-optional-chaining, @babel/plugin-transform-parameters, @babel/plugin-transform-private-methods, @babel/plugin-transform-private-property-in-object, @babel/plugin-transform-property-literals, @babel/plugin-transform-regenerator, @babel/plugin-transform-regexp-modifiers, @babel/plugin-transform-reserved-words, @babel/plugin-transform-shorthand-properties, @babel/plugin-transform-spread, @babel/plugin-transform-sticky-regex, @babel/plugin-transform-template-literals, @babel/plugin-transform-typeof-symbol, @babel/plugin-transform-unicode-escapes, @babel/plugin-transform-unicode-property-regex, @babel/plugin-transform-unicode-regex, @babel/plugin-transform-unicode-sets-regex, @babel/preset-env, @babel/preset-modules, @babel/runtime, @babel/template, @babel/traverse, @babel/types, @commander-js/extra-typings, @ensdomains/content-hash, @esbuild/darwin-arm64, @eslint-community/eslint-utils, @eslint-community/regexpp, @eslint/js, @jridgewell/gen-mapping, @jridgewell/remapping, @jridgewell/resolve-uri, @jridgewell/source-map, @jridgewell/sourcemap-codec, @jridgewell/trace-mapping, @noble/ciphers, @noble/curves, @noble/hashes, @novasamatech/sdk-statement, @oxc-project/types, @polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider, @polkadot-api/json-rpc-provider-proxy, @polkadot-api/known-chains, @polkadot-api/logs-provider, @polkadot-api/merkleize-metadata, @polkadot-api/metadata-builders, @polkadot-api/metadata-compatibility, @polkadot-api/observable-client, @polkadot-api/pjs-signer, @polkadot-api/polkadot-signer, @polkadot-api/raw-client, @polkadot-api/signer, @polkadot-api/signers-common, @polkadot-api/sm-provider, @polkadot-api/smoldot, @polkadot-api/substrate-bindings, @polkadot-api/substrate-client, @polkadot-api/utils, @polkadot-api/wasm-executor, @polkadot-api/ws-middleware, @polkadot-api/ws-provider, @polkadot-labs/hdkd, @polkadot-labs/hdkd-helpers, @polkadot-labs/schnorrkel-wasm, @rolldown/binding-darwin-arm64, @rolldown/pluginutils, @rollup/plugin-babel, @rollup/plugin-node-resolve, @rollup/plugin-replace, @rollup/plugin-terser, @rollup/pluginutils, @rollup/rollup-darwin-arm64, @rx-state/core, @scure/base, @scure/sr25519, @sec-ant/readable-stream, @sentry-internal/browser-utils, @sentry-internal/feedback, @sentry-internal/replay, @sentry-internal/replay-canvas, @sentry/babel-plugin-component-annotate, @sentry/browser, @sentry/bundler-plugin-core, @sentry/core, @sentry/rollup-plugin, @sentry/vite-plugin, @sindresorhus/merge-streams, @standard-schema/spec, @turbo/darwin-arm64, @types/bun, @types/chai, @types/deep-eql, @types/esrecurse, @types/estree, @types/json-schema, @types/node, @types/normalize-package-data, @types/qrcode, @types/resolve, @types/trusted-types, @types/whatwg-mimetype, @types/ws, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/project-service, @typescript-eslint/scope-manager, @typescript-eslint/tsconfig-utils, @typescript-eslint/type-utils, @typescript-eslint/types, @typescript-eslint/typescript-estree, @typescript-eslint/utils, @typescript-eslint/visitor-keys, @vitest/expect, @vitest/mocker, @vitest/pretty-format, @vitest/runner, @vitest/snapshot, @vitest/spy, @vitest/utils, acorn, acorn-jsx, agent-base, ajv, ansi-regex, ansi-styles, array-buffer-byte-length, arraybuffer.prototype.slice, assertion-error, async, async-function, available-typed-arrays, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3, babel-plugin-polyfill-regenerator, balanced-match, brace-expansion, browserslist, buffer-from, buffer-image-size, bun-types, call-bind, call-bind-apply-helpers, call-bound, camelcase, chai, chalk, cli-cursor, cli-spinners, color-convert, color-name, commander, common-tags, convert-source-map, core-js-compat, cross-spawn, crypto-random-string, data-view-buffer, data-view-byte-length, data-view-byte-offset, debug, decamelize, deep-is, deepmerge, define-data-property, define-properties, detect-indent, dijkstrajs, dunder-proto, emoji-regex, es-abstract, es-define-property, es-errors, es-module-lexer, es-object-atoms, es-set-tostringtag, es-to-primitive, esbuild, escalade, escape-string-regexp, eslint, eslint-config-prettier, eslint-plugin-turbo, estree-walker, eta, execa, fast-deep-equal, fast-json-stable-stringify, fast-levenshtein, fdir, figures, file-entry-cache, find-up, flat-cache, for-each, fs-extra, fs.promises.exists, fsevents, function-bind, function.prototype.name, functions-have-names, generator-function, gensync, get-east-asian-width, get-intrinsic, get-proto, get-stream, get-symbol-description, get-tsconfig, globalthis, gopd, happy-dom, has-bigints, has-property-descriptors, has-proto, has-symbols, has-tostringtag, hasown, https-proxy-agent, ignore, imurmurhash, index-to-position, internal-slot, is-array-buffer, is-async-function, is-bigint, is-boolean-object, is-callable, is-core-module, is-data-view, is-date-object, is-extglob, is-finalizationregistry, is-fullwidth-code-point, is-generator-function, is-glob, is-interactive, is-map, is-module, is-negative-zero, is-number-object, is-obj, is-plain-obj, is-regex, is-regexp, is-set, is-shared-array-buffer, is-stream, is-string, is-symbol, is-typed-array, is-unicode-supported, is-weakmap, is-weakref, is-weakset, isarray, js-sha3, js-tokens, jsesc, json-buffer, json-schema-traverse, json-stable-stringify-without-jsonify, json5, jsonfile, jsonpointer, keyv, leven, levn, locate-path, lodash.debounce, lodash.sortby, log-symbols, magic-string, math-intrinsics, mimic-function, ms, nanoevents, nanoid, natural-compare, neverthrow, node-fetch, node-releases, npm-run-path, object-inspect, object-keys, object.assign, obug, onetime, optionator, ora, own-keys, p-limit, p-locate, p-try, parse-json, parse-ms, path-exists, path-key, path-parse, pathe, picomatch, pngjs, polkadot-api, possible-typed-array-names, postcss, prelude-ls, prettier, pretty-bytes, pretty-ms, progress, proxy-from-env, punycode, qrcode, read-pkg, reflect.getprototypeof, regenerate, regenerate-unicode-properties, regexp.prototype.flags, regexpu-core, regjsgen, require-directory, require-from-string, resolve, resolve-pkg-maps, restore-cursor, rolldown, rollup, rollup-plugin-esbuild, safe-array-concat, safe-push-apply, safe-regex-test, scale-ts, set-function-length, set-function-name, set-proto, shebang-command, shebang-regex, side-channel, side-channel-list, side-channel-map, side-channel-weakmap, smob, sort-keys, source-map-support, spdx-expression-parse, stackback, std-env, stdin-discarder, stop-iteration-iterator, string-width, string.prototype.matchall, string.prototype.trim, string.prototype.trimend, string.prototype.trimstart, strip-ansi, strip-comments, strip-final-newline, supports-preserve-symlinks-flag, tagged-tag, temp-dir, tempy, tinybench, tinyexec, tinyglobby, tinyrainbow, tr46, ts-api-utils, tsc-prog, turbo, type-check, typed-array-buffer, typed-array-byte-length, typed-array-byte-offset, typed-array-length, typescript-eslint, unbox-primitive, undici-types, unicode-canonical-property-names-ecmascript, unicode-match-property-ecmascript, unicode-match-property-value-ecmascript, unicode-property-aliases-ecmascript, unicorn-magic, unique-string, universalify, unplugin-utils, upath, update-browserslist-db, varint, vite, vite-plugin-pwa, vite-plugin-wasm, vitest, whatwg-mimetype, whatwg-url, which-boxed-primitive, which-builtin-type, which-collection, which-typed-array, why-is-node-running, word-wrap, workbox-background-sync, workbox-broadcast-update, workbox-build, workbox-cacheable-response, workbox-core, workbox-expiration, workbox-google-analytics, workbox-navigation-preload, workbox-precaching, workbox-range-requests, workbox-recipes, workbox-routing, workbox-strategies, workbox-streams, workbox-sw, workbox-window, wrap-ansi, write-json-file, write-package, ws, yargs, yocto-queue, yoctocolors
+@apideck/better-ajv-errors, @babel/code-frame, @babel/compat-data, @babel/core, @babel/generator, @babel/helper-annotate-as-pure, @babel/helper-compilation-targets, @babel/helper-create-class-features-plugin, @babel/helper-create-regexp-features-plugin, @babel/helper-define-polyfill-provider, @babel/helper-globals, @babel/helper-member-expression-to-functions, @babel/helper-module-imports, @babel/helper-module-transforms, @babel/helper-optimise-call-expression, @babel/helper-plugin-utils, @babel/helper-remap-async-to-generator, @babel/helper-replace-supers, @babel/helper-skip-transparent-expression-wrappers, @babel/helper-string-parser, @babel/helper-validator-identifier, @babel/helper-validator-option, @babel/helper-wrap-function, @babel/helpers, @babel/parser, @babel/plugin-bugfix-firefox-class-in-computed-class-key, @babel/plugin-bugfix-safari-class-field-initializer-scope, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression, @babel/plugin-bugfix-safari-rest-destructuring-rhs-array, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly, @babel/plugin-proposal-private-property-in-object, @babel/plugin-syntax-import-assertions, @babel/plugin-syntax-import-attributes, @babel/plugin-syntax-unicode-sets-regex, @babel/plugin-transform-arrow-functions, @babel/plugin-transform-async-generator-functions, @babel/plugin-transform-async-to-generator, @babel/plugin-transform-block-scoped-functions, @babel/plugin-transform-block-scoping, @babel/plugin-transform-class-properties, @babel/plugin-transform-class-static-block, @babel/plugin-transform-classes, @babel/plugin-transform-computed-properties, @babel/plugin-transform-destructuring, @babel/plugin-transform-dotall-regex, @babel/plugin-transform-duplicate-keys, @babel/plugin-transform-duplicate-named-capturing-groups-regex, @babel/plugin-transform-dynamic-import, @babel/plugin-transform-explicit-resource-management, @babel/plugin-transform-exponentiation-operator, @babel/plugin-transform-export-namespace-from, @babel/plugin-transform-for-of, @babel/plugin-transform-function-name, @babel/plugin-transform-json-strings, @babel/plugin-transform-literals, @babel/plugin-transform-logical-assignment-operators, @babel/plugin-transform-member-expression-literals, @babel/plugin-transform-modules-amd, @babel/plugin-transform-modules-commonjs, @babel/plugin-transform-modules-systemjs, @babel/plugin-transform-modules-umd, @babel/plugin-transform-named-capturing-groups-regex, @babel/plugin-transform-new-target, @babel/plugin-transform-nullish-coalescing-operator, @babel/plugin-transform-numeric-separator, @babel/plugin-transform-object-rest-spread, @babel/plugin-transform-object-super, @babel/plugin-transform-optional-catch-binding, @babel/plugin-transform-optional-chaining, @babel/plugin-transform-parameters, @babel/plugin-transform-private-methods, @babel/plugin-transform-private-property-in-object, @babel/plugin-transform-property-literals, @babel/plugin-transform-regenerator, @babel/plugin-transform-regexp-modifiers, @babel/plugin-transform-reserved-words, @babel/plugin-transform-shorthand-properties, @babel/plugin-transform-spread, @babel/plugin-transform-sticky-regex, @babel/plugin-transform-template-literals, @babel/plugin-transform-typeof-symbol, @babel/plugin-transform-unicode-escapes, @babel/plugin-transform-unicode-property-regex, @babel/plugin-transform-unicode-regex, @babel/plugin-transform-unicode-sets-regex, @babel/preset-env, @babel/preset-modules, @babel/runtime, @babel/template, @babel/traverse, @babel/types, @commander-js/extra-typings, @ensdomains/content-hash, @esbuild/darwin-arm64, @eslint-community/eslint-utils, @eslint-community/regexpp, @eslint/js, @jridgewell/gen-mapping, @jridgewell/remapping, @jridgewell/resolve-uri, @jridgewell/source-map, @jridgewell/sourcemap-codec, @jridgewell/trace-mapping, @noble/ciphers, @noble/curves, @noble/hashes, @oxc-project/types, @polkadot-api/cli, @polkadot-api/codegen, @polkadot-api/ink-contracts, @polkadot-api/json-rpc-provider, @polkadot-api/json-rpc-provider-proxy, @polkadot-api/known-chains, @polkadot-api/logs-provider, @polkadot-api/merkleize-metadata, @polkadot-api/metadata-builders, @polkadot-api/metadata-compatibility, @polkadot-api/observable-client, @polkadot-api/pjs-signer, @polkadot-api/polkadot-signer, @polkadot-api/raw-client, @polkadot-api/signer, @polkadot-api/signers-common, @polkadot-api/sm-provider, @polkadot-api/smoldot, @polkadot-api/substrate-bindings, @polkadot-api/substrate-client, @polkadot-api/utils, @polkadot-api/wasm-executor, @polkadot-api/ws-middleware, @polkadot-api/ws-provider, @polkadot-labs/hdkd, @polkadot-labs/hdkd-helpers, @polkadot-labs/schnorrkel-wasm, @rolldown/binding-darwin-arm64, @rolldown/pluginutils, @rollup/plugin-babel, @rollup/plugin-node-resolve, @rollup/plugin-replace, @rollup/plugin-terser, @rollup/pluginutils, @rollup/rollup-darwin-arm64, @rx-state/core, @scure/base, @scure/sr25519, @sec-ant/readable-stream, @sentry-internal/browser-utils, @sentry-internal/feedback, @sentry-internal/replay, @sentry-internal/replay-canvas, @sentry/babel-plugin-component-annotate, @sentry/browser, @sentry/bundler-plugin-core, @sentry/core, @sentry/rollup-plugin, @sentry/vite-plugin, @sindresorhus/merge-streams, @standard-schema/spec, @turbo/darwin-arm64, @types/bun, @types/chai, @types/deep-eql, @types/esrecurse, @types/estree, @types/json-schema, @types/node, @types/normalize-package-data, @types/qrcode, @types/resolve, @types/trusted-types, @types/whatwg-mimetype, @types/ws, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/project-service, @typescript-eslint/scope-manager, @typescript-eslint/tsconfig-utils, @typescript-eslint/type-utils, @typescript-eslint/types, @typescript-eslint/typescript-estree, @typescript-eslint/utils, @typescript-eslint/visitor-keys, @vitest/expect, @vitest/mocker, @vitest/pretty-format, @vitest/runner, @vitest/snapshot, @vitest/spy, @vitest/utils, acorn, acorn-jsx, agent-base, ajv, ansi-regex, ansi-styles, array-buffer-byte-length, arraybuffer.prototype.slice, assertion-error, async, async-function, available-typed-arrays, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3, babel-plugin-polyfill-regenerator, balanced-match, brace-expansion, browserslist, buffer-from, buffer-image-size, bun-types, call-bind, call-bind-apply-helpers, call-bound, camelcase, chai, chalk, cli-cursor, cli-spinners, color-convert, color-name, commander, common-tags, convert-source-map, core-js-compat, cross-spawn, crypto-random-string, data-view-buffer, data-view-byte-length, data-view-byte-offset, debug, decamelize, deep-is, deepmerge, define-data-property, define-properties, detect-indent, dijkstrajs, dunder-proto, emoji-regex, es-abstract, es-define-property, es-errors, es-module-lexer, es-object-atoms, es-set-tostringtag, es-to-primitive, esbuild, escalade, escape-string-regexp, eslint, eslint-config-prettier, eslint-plugin-turbo, estree-walker, eta, execa, fast-deep-equal, fast-json-stable-stringify, fast-levenshtein, fdir, figures, file-entry-cache, find-up, flat-cache, for-each, fs-extra, fs.promises.exists, fsevents, function-bind, function.prototype.name, functions-have-names, generator-function, gensync, get-east-asian-width, get-intrinsic, get-proto, get-stream, get-symbol-description, get-tsconfig, globalthis, gopd, happy-dom, has-bigints, has-property-descriptors, has-proto, has-symbols, has-tostringtag, hasown, https-proxy-agent, ignore, imurmurhash, index-to-position, internal-slot, is-array-buffer, is-async-function, is-bigint, is-boolean-object, is-callable, is-core-module, is-data-view, is-date-object, is-extglob, is-finalizationregistry, is-fullwidth-code-point, is-generator-function, is-glob, is-interactive, is-map, is-module, is-negative-zero, is-number-object, is-obj, is-plain-obj, is-regex, is-regexp, is-set, is-shared-array-buffer, is-stream, is-string, is-symbol, is-typed-array, is-unicode-supported, is-weakmap, is-weakref, is-weakset, isarray, js-sha3, js-tokens, jsesc, json-buffer, json-schema-traverse, json-stable-stringify-without-jsonify, json5, jsonfile, jsonpointer, keyv, leven, levn, locate-path, lodash.debounce, lodash.sortby, log-symbols, magic-string, math-intrinsics, mimic-function, ms, nanoevents, nanoid, natural-compare, neverthrow, node-fetch, node-releases, npm-run-path, object-inspect, object-keys, object.assign, obug, onetime, optionator, ora, own-keys, p-limit, p-locate, p-try, parse-json, parse-ms, path-exists, path-key, path-parse, pathe, picomatch, pngjs, polkadot-api, possible-typed-array-names, postcss, prelude-ls, prettier, pretty-bytes, pretty-ms, progress, proxy-from-env, punycode, qrcode, read-pkg, reflect.getprototypeof, regenerate, regenerate-unicode-properties, regexp.prototype.flags, regexpu-core, regjsgen, require-directory, require-from-string, resolve, resolve-pkg-maps, restore-cursor, rolldown, rollup, rollup-plugin-esbuild, safe-array-concat, safe-push-apply, safe-regex-test, scale-ts, set-function-length, set-function-name, set-proto, shebang-command, shebang-regex, side-channel, side-channel-list, side-channel-map, side-channel-weakmap, smob, sort-keys, source-map-support, spdx-expression-parse, stackback, std-env, stdin-discarder, stop-iteration-iterator, string-width, string.prototype.matchall, string.prototype.trim, string.prototype.trimend, string.prototype.trimstart, strip-ansi, strip-comments, strip-final-newline, supports-preserve-symlinks-flag, tagged-tag, temp-dir, tempy, tinybench, tinyexec, tinyglobby, tinyrainbow, tr46, ts-api-utils, tsc-prog, turbo, type-check, typed-array-buffer, typed-array-byte-length, typed-array-byte-offset, typed-array-length, typescript-eslint, unbox-primitive, undici-types, unicode-canonical-property-names-ecmascript, unicode-match-property-ecmascript, unicode-match-property-value-ecmascript, unicode-property-aliases-ecmascript, unicorn-magic, unique-string, universalify, unplugin-utils, upath, update-browserslist-db, varint, vite, vite-plugin-pwa, vite-plugin-wasm, vitest, whatwg-mimetype, whatwg-url, which-boxed-primitive, which-builtin-type, which-collection, which-typed-array, why-is-node-running, word-wrap, workbox-background-sync, workbox-broadcast-update, workbox-build, workbox-cacheable-response, workbox-core, workbox-expiration, workbox-google-analytics, workbox-navigation-preload, workbox-precaching, workbox-range-requests, workbox-recipes, workbox-routing, workbox-strategies, workbox-streams, workbox-sw, workbox-window, wrap-ansi, write-json-file, write-package, ws, yargs, yocto-queue, yoctocolors
 
 ## Apache-2.0
 
-@eslint/config-array, @eslint/config-helpers, @eslint/core, @eslint/object-schema, @eslint/plugin-kit, @humanfs/core, @humanfs/node, @humanfs/types, @humanwhocodes/module-importer, @humanwhocodes/retry, @novasamatech/host-api, @novasamatech/host-container, @novasamatech/host-papp, @novasamatech/scale, @novasamatech/statement-store, @novasamatech/storage-adapter, @novasamatech/substrate-slot-sr25519-wasm, @playwright/test, @trickfilm400/rollup-plugin-off-main-thread, baseline-browser-mapping, cborg, detect-libc, ejs, eslint-visitor-keys, expect-type, fake-indexeddb, filelist, human-signals, jake, jsqr, playwright, playwright-core, rxjs, spdx-correct, typescript, validate-npm-package-license
+@eslint/config-array, @eslint/config-helpers, @eslint/core, @eslint/object-schema, @eslint/plugin-kit, @humanfs/core, @humanfs/node, @humanfs/types, @humanwhocodes/module-importer, @humanwhocodes/retry, @playwright/test, @trickfilm400/rollup-plugin-off-main-thread, baseline-browser-mapping, cborg, detect-libc, ejs, eslint-visitor-keys, expect-type, fake-indexeddb, filelist, human-signals, jake, jsqr, playwright, playwright-core, rxjs, spdx-correct, typescript, validate-npm-package-license
 
 ## Apache-2.0 OR MIT
 
diff --git a/apps/host/src/main.ts b/apps/host/src/main.ts
index 14704c33..c79bea00 100644
--- a/apps/host/src/main.ts
+++ b/apps/host/src/main.ts
@@ -65,9 +65,10 @@ import type {
   ManifestResult,
   RootManifest,
 } from "@dotli/resolver/manifest";
-import { BASE_DOMAIN, DEBUG, SITE_ID } from "@dotli/config/config";
+import { BASE_DOMAIN, DEBUG, SITE_ID, isLocalhost } from "@dotli/config/config";
 import { log } from "@dotli/shared/log";
 import { serializeError } from "@dotli/shared/errors";
+import { dotNsUrl } from "@dotli/shared/dotns-url";
 import { escapeHtml, isValidDotLabel } from "@dotli/shared/html";
 import { isMobileDevice } from "@dotli/shared/device";
 import { showNotification } from "@dotli/ui/notification";
@@ -164,6 +165,21 @@ if (m.enabled && typeof PerformanceObserver !== "undefined") {
 }
 
 const T0 = performance.now();
+const DOTLI_PRODUCT_ID_PARAM = "dotliProductId";
+
+function parseLocalProductIdOverride(): string | undefined {
+  if (!isLocalhost) {
+    return undefined;
+  }
+  const value = new URLSearchParams(window.location.search).get(
+    DOTLI_PRODUCT_ID_PARAM,
+  );
+  if (value === null || value.trim() === "") {
+    return undefined;
+  }
+  const productId = value.trim();
+  return dotNsUrl.isProductIdentifier(productId) ? productId : undefined;
+}
 
 /**
  * Parse a localhost proxy URL from the path.
@@ -193,8 +209,8 @@ function parseLocalhostUrl(): string | null {
   const host = match[1];
   const rest = match[2] || "";
   // Strip every reserved host-URL param so they do not leak into the
-  // proxied product. Covers the five settings axes, the sandbox contract's
-  // host-only signals (`fullReset`, `v`), and the Playwright auth hook.
+  // proxied product. Covers the settings axes and the sandbox contract's
+  // host-only signals (`fullReset`, `v`).
   const productSearch = new URLSearchParams(window.location.search);
   for (const k of RESERVED_HOST_PARAMS) {
     productSearch.delete(k);
@@ -211,7 +227,7 @@ const RESERVED_HOST_PARAMS = [
   "skipWorkerCache",
   "fullReset",
   "v",
-  "initAuthSubscribe",
+  DOTLI_PRODUCT_ID_PARAM,
 ] as const;
 
 /**
@@ -679,71 +695,6 @@ async function runBackgroundRevalidate(
   }
 }
 
-interface AuthSubscribeApi {
-  backend: string;
-  subscribeAll: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<{ count: number; isComplete: boolean }>;
-  subscribeAny: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<{ count: number; isComplete: boolean }>;
-}
-
-function hexToBytes(s: string): Uint8Array {
-  const h = s.startsWith("0x") ? s.slice(2) : s;
-  const bytes = new Uint8Array(h.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(h.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-
-async function runAuthSubscribeHook(chainBackend: string): Promise<void> {
-  log.warn("[dot.li auth-subscribe] init auth + statement store");
-  const authMod = await import("@dotli/auth/auth");
-  await authMod.initAuth();
-  const store = await authMod.onStatementStoreReady();
-
-  type Filter = { matchAll: Uint8Array[] } | { matchAny: Uint8Array[] };
-
-  function subscribeFor(
-    filter: Filter,
-    timeoutMs: number,
-  ): Promise<{ count: number; isComplete: boolean }> {
-    return new Promise((resolve) => {
-      let count = 0;
-      let lastIsComplete = false;
-      const unsub = store.subscribeStatements(filter, (page) => {
-        count += page.statements.length;
-        lastIsComplete = page.isComplete;
-        return undefined;
-      });
-      setTimeout(() => {
-        unsub();
-        resolve({ count, isComplete: lastIsComplete });
-      }, timeoutMs);
-    });
-  }
-
-  const api: AuthSubscribeApi = {
-    backend: chainBackend,
-    subscribeAll: (topicsHex, timeoutMs) =>
-      subscribeFor({ matchAll: topicsHex.map(hexToBytes) }, timeoutMs),
-    subscribeAny: (topicsHex, timeoutMs) =>
-      subscribeFor({ matchAny: topicsHex.map(hexToBytes) }, timeoutMs),
-  };
-
-  (
-    window as unknown as { __dotliAuthSubscribe: AuthSubscribeApi }
-  ).__dotliAuthSubscribe = api;
-  log.warn(
-    `[dot.li auth-subscribe] window.__dotliAuthSubscribe ready (backend=${chainBackend})`,
-  );
-  document.title = "dotli-auth-subscribe-ready";
-}
-
 /** Best-effort `localStorage.getItem`, returning null on Safari-private-mode failure. */
 function readRawLocalStorage(key: string): string | null {
   try {
@@ -1038,21 +989,11 @@ async function main(): Promise<void> {
     });
   }
 
-  // Auth-subscribe hook: when `?initAuthSubscribe=1` is in the URL,
-  // initialize the auth module and statement-store, expose
-  // `window.__dotliAuthSubscribe` for the Playwright spec, then bail out
-  // before the normal landing/.dot flow runs. The protocol iframe
-  // pre-warm above is what makes `createRemoteChainProvider(...)` work
-  // for the smoldot statement-store path, so this branch sits AFTER the
-  // pre-warm.
-  if (
-    new URLSearchParams(window.location.search).get("initAuthSubscribe") === "1"
-  ) {
-    await runAuthSubscribeHook(chainBackend);
-    return;
-  }
+  const bridgeModulePromise = import("@dotli/ui/bridge");
+  const bridgeModule = await bridgeModulePromise;
+  bridgeModule.initBridgeEventListeners();
 
-  // Initialize top bar UI (auth is lazy-loaded inside topbar when needed)
+  // Initialize top bar UI.
   const t0 = performance.now();
   initTopBar();
   log.warn(`[dot.li perf] initTopBar() done (${dur(t0)})`);
@@ -1065,6 +1006,7 @@ async function main(): Promise<void> {
   });
 
   const label = parseDotLabel();
+  const productIdOverride = parseLocalProductIdOverride();
 
   if (label === null && previewTargetUrl !== null) {
     const host = new URL(previewTargetUrl).host;
@@ -1077,13 +1019,17 @@ async function main(): Promise<void> {
       urlBar.innerHTML = `<div class="topbar-url-pill localhost-pill" id="url-pill"><svg class="localhost-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg><span class="topbar-url-text"><span class="dot-domain">${escapeHtml(host)}</span></span></div>`;
     }
 
-    const { renderIframe } = await import("@dotli/ui/bridge");
-    await renderIframe(previewTargetUrl, host);
-    history.replaceState(
-      null,
-      "",
-      `/__preview?url=${encodeURIComponent(previewTargetUrl)}`,
-    );
+    const { renderIframe } = await bridgeModulePromise;
+    await renderIframe(previewTargetUrl, host, {
+      productId: productIdOverride,
+    });
+    const nextSearch = new URLSearchParams({
+      url: previewTargetUrl,
+    });
+    if (productIdOverride !== undefined) {
+      nextSearch.set(DOTLI_PRODUCT_ID_PARAM, productIdOverride);
+    }
+    history.replaceState(null, "", `/__preview?${nextSearch.toString()}`);
     document.title = `${host} — ${SITE_ID}`;
     performance.mark("dotli:main:end");
     return;
@@ -1112,15 +1058,21 @@ async function main(): Promise<void> {
       urlBar.innerHTML = `<div class="topbar-url-pill localhost-pill" id="url-pill"><svg class="localhost-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg><span class="topbar-url-text"><span class="dot-domain">${escapeHtml(host)}</span></span></div>`;
     }
 
-    const { renderIframe } = await import("@dotli/ui/bridge");
-    await renderIframe(localhostUrl, host);
+    const { renderIframe } = await bridgeModulePromise;
+    await renderIframe(localhostUrl, host, { productId: productIdOverride });
 
     shieldVerified = true;
     bindTopbarAutoHide();
     setupTopbarAutoHide();
 
     // Deep path was forwarded to the product iframe, so strip it so the URL bar doesn't show a stale path
-    history.replaceState(null, "", "/" + host);
+    history.replaceState(
+      null,
+      "",
+      productIdOverride === undefined
+        ? "/" + host
+        : `/${host}?${DOTLI_PRODUCT_ID_PARAM}=${encodeURIComponent(productIdOverride)}`,
+    );
     document.title = `${host} — ${SITE_ID}`;
     performance.mark("dotli:main:end");
     emitDotliDebugEvent({
diff --git a/apps/host/tests/e2e/fixtures/paired.ts b/apps/host/tests/e2e/fixtures/paired.ts
index 87d6fa76..877a7871 100644
--- a/apps/host/tests/e2e/fixtures/paired.ts
+++ b/apps/host/tests/e2e/fixtures/paired.ts
@@ -30,12 +30,12 @@ function startAutoAllow(page: Page): () => void {
       try {
         const allow = page.getByRole("button", { name: "Allow", exact: true });
         const visible = await allow
-          .first()
+          .last()
           .isVisible({ timeout: POLL_MS })
           .catch(() => false);
         if (visible) {
           await allow
-            .first()
+            .last()
             .click({ timeout: 2_000 })
             .catch(() => {});
         } else {
@@ -118,7 +118,7 @@ export const test = base.extend<
         if (
           type === "error" ||
           type === "warning" ||
-          /\[dotli|\[dot\.li|host-papp|statement.store|signing/i.test(text)
+          /\[dotli|\[dot\.li|statement.store|signing/i.test(text)
         ) {
           const isFullText =
             type === "error" ||
diff --git a/apps/host/tests/e2e/global-setup.ts b/apps/host/tests/e2e/global-setup.ts
index aac8aa5d..fd9157d2 100644
--- a/apps/host/tests/e2e/global-setup.ts
+++ b/apps/host/tests/e2e/global-setup.ts
@@ -28,7 +28,10 @@ const BOT_NETWORK = requiredEnv("SIGNER_BOT_NETWORK");
 // Local-dev knobs. Defaults are fine because they don't depend on
 // external services.
 const PORT = process.env.PORT ?? "5173";
-const HOST = process.env.E2E_HOST ?? "host-playground";
+// Pairing only needs the host shell and protocol iframe. Loading the
+// host-playground product here can open product permission modals before the
+// auth button is clicked, so keep global auth setup on the bare host origin.
+const AUTH_HOST = process.env.E2E_AUTH_HOST ?? "localhost";
 
 function requiredEnv(name: string): string {
   const value = process.env[name];
@@ -139,7 +142,7 @@ async function pairOnce(
   });
 
   try {
-    await page.goto(`http://${HOST}.localhost:${PORT}/`, { timeout: 60_000 });
+    await page.goto(`http://${AUTH_HOST}:${PORT}/`, { timeout: 60_000 });
     await page
       .getByRole("button", { name: "Switch to Gateway" })
       .click({ timeout: 5_000 })
diff --git a/apps/host/tests/e2e/helpers/signing.ts b/apps/host/tests/e2e/helpers/signing.ts
index a23437c7..d10bab77 100644
--- a/apps/host/tests/e2e/helpers/signing.ts
+++ b/apps/host/tests/e2e/helpers/signing.ts
@@ -6,15 +6,16 @@ import { expect, type Page, type Frame, type Locator } from "@playwright/test";
 type PageLike = Page | Frame;
 
 /**
- * Click run-<testId>, click through dot.li's host-side dialogs (Allow/Sign),
- * wait for the log entry to resolve. The bot signs automatically once the
- * SignRequest hits the Statement Store, so no per-tx approval flow is needed.
+ * Click run-<testId>, handle non-permission host dialogs, and wait for the log
+ * entry to resolve. The worker fixture owns every "Allow" click; keeping one
+ * permission driver avoids concurrent clicks when host dialogs overlap. The
+ * bot signs automatically once the SignRequest hits the Statement Store.
  */
 export async function runWebSignedTest(
   hostPage: Page,
   productFrame: PageLike,
   testId: string,
-  dialogButtons: string | string[],
+  manualDialogButtons: readonly string[],
   opts: { timeoutMs?: number; preClickDelayMs?: number } = {},
 ): Promise<"success" | "error"> {
   const timeoutMs = opts.timeoutMs ?? 90_000;
@@ -33,12 +34,17 @@ export async function runWebSignedTest(
   console.log(`[signed] ${testId}: clicking run`);
   await btn.click();
 
-  const buttons = Array.isArray(dialogButtons)
-    ? dialogButtons
-    : [dialogButtons];
-  void clickHostDialogs(hostPage, buttons, 60_000, preClickDelayMs).catch(
-    () => {},
-  );
+  const dialogController = new AbortController();
+  const dialogTask =
+    manualDialogButtons.length > 0
+      ? clickHostDialogs(
+          hostPage,
+          manualDialogButtons,
+          60_000,
+          preClickDelayMs,
+          dialogController.signal,
+        ).catch(() => {})
+      : Promise.resolve();
 
   const result = await waitForLogResult(
     entries,
@@ -46,6 +52,8 @@ export async function runWebSignedTest(
     testId,
     timeoutMs,
   );
+  dialogController.abort();
+  await dialogTask;
   if (result === "error") {
     // On failure, dump the visible buttons on the host page. Invaluable for
     // diagnosing modal selector mismatches when the bot signs but Playwright
@@ -66,12 +74,8 @@ export async function runWebSignedTest(
 }
 
 /**
- * Drive dot.li host-side dialogs through their lifecycle. Different signing
- * operations show different gates: PreimageSubmit / StatementSubmit /
- * ChainSubmit each show an "Allow" modal the first time they're invoked
- * in a session, and the actual signing confirmation shows a "Sign" button.
- * Some flows show two modals in sequence (e.g. "Allow" permission, then
- * "Sign" confirmation); some show one or none.
+ * Drive non-permission host dialogs through their lifecycle. Permission
+ * "Allow" modals are handled exclusively by the worker fixture.
  *
  * Strategy: poll for any of `buttonNames` to be visible. When one is, click
  * it. Keep polling until either no expected button has appeared for
@@ -81,16 +85,17 @@ export async function runWebSignedTest(
  */
 async function clickHostDialogs(
   page: Page,
-  buttonNames: string[],
+  buttonNames: readonly string[],
   timeoutMs: number,
   preClickDelayMs: number,
+  signal: AbortSignal,
 ): Promise<void> {
   const deadline = Date.now() + timeoutMs;
   const idleStopMs = 5_000; // declare done if no button appears for this long
   let lastSeenAt = Date.now();
   const seen = new Set<string>();
 
-  while (Date.now() < deadline) {
+  while (!signal.aborted && Date.now() < deadline) {
     if (Date.now() - lastSeenAt > idleStopMs && seen.size > 0) {
       // We've handled at least one dialog and nothing new has shown for a
       // while, so assume the flow has moved past the modal phase.
@@ -99,7 +104,7 @@ async function clickHostDialogs(
 
     let clickedThisPass = false;
     for (const name of buttonNames) {
-      const btn = page.getByRole("button", { name, exact: true }).first();
+      const btn = page.getByRole("button", { name, exact: true }).last();
       const visible = await btn.isVisible({ timeout: 250 }).catch(() => false);
       if (!visible) continue;
 
@@ -126,6 +131,9 @@ async function clickHostDialogs(
     }
   }
 
+  if (signal.aborted) {
+    return;
+  }
   if (seen.size === 0) {
     console.log(
       `[signed] no host dialog appeared (looked for: ${buttonNames.join(", ")})`,
diff --git a/apps/host/tests/e2e/truapi.spec.ts b/apps/host/tests/e2e/truapi.spec.ts
index 2904ba4d..a922c7c0 100644
--- a/apps/host/tests/e2e/truapi.spec.ts
+++ b/apps/host/tests/e2e/truapi.spec.ts
@@ -4,6 +4,7 @@
 import { test, expect } from "./fixtures/paired";
 import {
   waitForPlaygroundReady,
+  runTestExpectError,
   runTestExpectSuccess,
 } from "./helpers/run-test";
 import { runWebSignedTest } from "./helpers/signing";
@@ -77,21 +78,20 @@ test.describe("dot.li > host-playground.dot", () => {
   });
 
   // Each allocation triggers an "Allow" modal on the host that the user
-  // approves. The bot is auto-paired so the modal click is what the suite
-  // drives via runWebSignedTest with a single-button list.
+  // approves. The bot is auto-paired and the worker fixture accepts the modal.
 
   test.describe("Allowances", () => {
     test("StatementStore Allowance", async ({ pairedPage, productFrame }) => {
       // Given
-      test.setTimeout(60_000);
+      test.setTimeout(120_000);
 
       // When
       const status = await runWebSignedTest(
         pairedPage,
         productFrame,
         "allowances-statement-store",
-        ["Allow"],
-        { timeoutMs: 30_000 },
+        [],
+        { timeoutMs: 90_000 },
       );
 
       // Then
@@ -100,15 +100,15 @@ test.describe("dot.li > host-playground.dot", () => {
 
     test("Bulletin Allowance", async ({ pairedPage, productFrame }) => {
       // Given
-      test.setTimeout(60_000);
+      test.setTimeout(120_000);
 
       // When
       const status = await runWebSignedTest(
         pairedPage,
         productFrame,
         "allowances-bulletin",
-        ["Allow"],
-        { timeoutMs: 30_000 },
+        [],
+        { timeoutMs: 90_000 },
       );
 
       // Then
@@ -117,15 +117,15 @@ test.describe("dot.li > host-playground.dot", () => {
 
     test("Smart-Contract Allowance", async ({ pairedPage, productFrame }) => {
       // Given
-      test.setTimeout(60_000);
+      test.setTimeout(120_000);
 
       // When
       const status = await runWebSignedTest(
         pairedPage,
         productFrame,
         "allowances-smart-contract",
-        ["Allow"],
-        { timeoutMs: 30_000 },
+        [],
+        { timeoutMs: 90_000 },
       );
 
       // Then
@@ -134,15 +134,15 @@ test.describe("dot.li > host-playground.dot", () => {
 
     test("All Allowances", async ({ pairedPage, productFrame }) => {
       // Given
-      test.setTimeout(60_000);
+      test.setTimeout(120_000);
 
       // When
       const status = await runWebSignedTest(
         pairedPage,
         productFrame,
         "allowances-all",
-        ["Allow"],
-        { timeoutMs: 30_000 },
+        [],
+        { timeoutMs: 90_000 },
       );
 
       // Then
@@ -189,7 +189,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-remote",
-        ["Allow"],
+        [],
         { timeoutMs: 30_000 },
       );
 
@@ -206,7 +206,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-webrtc",
-        ["Allow"],
+        [],
         { timeoutMs: 30_000 },
       );
 
@@ -223,7 +223,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-chain-submit",
-        ["Allow"],
+        [],
         { timeoutMs: 30_000 },
       );
 
@@ -240,7 +240,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-preimage-submit",
-        ["Allow"],
+        [],
         { timeoutMs: 30_000 },
       );
 
@@ -257,7 +257,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-statement-submit",
-        ["Allow"],
+        [],
         { timeoutMs: 30_000 },
       );
 
@@ -267,25 +267,17 @@ test.describe("dot.li > host-playground.dot", () => {
   });
 
   test.describe("Statements", () => {
-    test("Create Proof", async ({ productFrame }) => {
-      await runTestExpectSuccess(productFrame, "statement-store-create-proof");
-    });
-
-    test("Submit", async ({ pairedPage, productFrame }) => {
-      // Given
-      test.setTimeout(120_000);
-
-      // When
-      const status = await runWebSignedTest(
-        pairedPage,
+    test("Create Proof Authorized", async ({ productFrame }) => {
+      await runTestExpectSuccess(
         productFrame,
-        "statement-store-submit",
-        ["Allow", "Sign"],
-        { timeoutMs: 60_000, preClickDelayMs: 1_000 },
+        "statement-store-create-proof-authorized",
       );
+    });
 
-      // Then
-      expect(status).toBe("success");
+    test("Legacy Submit Is Unavailable", async ({ productFrame }) => {
+      // The legacy card asks the host to sign for a caller-selected account.
+      // The Rust runtime intentionally exposes only its authorized proof path.
+      await runTestExpectError(productFrame, "statement-store-submit", 60_000);
     });
 
     test("Subscribe Match All", async ({ productFrame }) => {
@@ -315,7 +307,16 @@ test.describe("dot.li > host-playground.dot", () => {
     });
 
     test("In-App", async ({ productFrame }) => {
-      await runTestExpectSuccess(productFrame, "navigate-internal");
+      const button = productFrame.locator(
+        '[data-testid="run-navigate-internal"]',
+      );
+      await expect(button).toBeVisible();
+      await button.click();
+      await expect
+        .poll(() => productFrame.url())
+        .toContain("/page?id=hello#fragment=something");
+      await productFrame.getByRole("link", { name: "Back to tests" }).click();
+      await waitForPlaygroundReady(productFrame);
     });
   });
 
@@ -369,8 +370,8 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "preimage-factory",
-        ["Allow", "Sign"],
-        { timeoutMs: 60_000, preClickDelayMs: 1_000 },
+        [],
+        { timeoutMs: 60_000 },
       );
 
       // Then
@@ -386,8 +387,8 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "preimage-submit",
-        ["Allow", "Sign"],
-        { timeoutMs: 60_000, preClickDelayMs: 1_000 },
+        [],
+        { timeoutMs: 60_000 },
       );
 
       // Then
@@ -413,8 +414,8 @@ test.describe("dot.li > host-playground.dot", () => {
       const status = await runWebSignedTest(
         pairedPage,
         productFrame,
-        "sign-raw",
-        ["Allow", "Sign"],
+        "wallet-sign-message",
+        ["Sign"],
         { timeoutMs: 120_000, preClickDelayMs: 1_000 },
       );
 
diff --git a/apps/host/tests/functional/auth-subscribe.spec.ts b/apps/host/tests/functional/auth-subscribe.spec.ts
deleted file mode 100644
index 8b12c3b0..00000000
--- a/apps/host/tests/functional/auth-subscribe.spec.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Auth statement-subscription smoke test.
- *
- * Seeds the chain backend, loads the host with `?initAuthSubscribe=1` to install
- * `window.__dotliAuthSubscribe`, then calls `subscribeAll([], TIMEOUT)` and expects at
- * least one statement back. `matchAll: []` is the "match-everything" filter
- * (vacuous truth, every statement satisfies the empty conjunction).
- *
- * Pinned to `rpc-gateway`. This is a pipeline smoke test, not a smoldot
- * cold-sync test. The smoldot variants take ~240s each and add no signal
- * beyond what `loading` and `resolution` already cover.
- */
-
-import { expect } from "@playwright/test";
-import { test } from "./helpers/shared-mode-reset";
-import { seedBackend } from "./fixtures/settings";
-
-interface SubscribeResult {
-  count: number;
-  isComplete: boolean;
-}
-
-interface AuthSubscribeApi {
-  backend: string;
-  subscribeAll: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<SubscribeResult>;
-  subscribeAny: (
-    topicsHex: string[],
-    timeoutMs: number,
-  ) => Promise<SubscribeResult>;
-}
-
-declare global {
-  interface Window {
-    __dotliAuthSubscribe?: AuthSubscribeApi;
-  }
-}
-
-const PORT = process.env.COMBO_PORT ?? "5173";
-const HOST_URL = `http://e2e-ss.localhost:${PORT}/?initAuthSubscribe=1`;
-const SUBSCRIBE_TIMEOUT_MS = 30_000;
-
-test(`As a product subscribing via __dotliAuthSubscribe.subscribeAll([], ${String(SUBSCRIBE_TIMEOUT_MS)}ms), I receive at least one statement back over rpc-gateway`, async ({
-  page,
-}) => {
-  test.setTimeout(SUBSCRIBE_TIMEOUT_MS + 30_000);
-
-  page.on("console", (msg) => {
-    const text = msg.text();
-    if (
-      msg.type() === "error" ||
-      msg.type() === "warning" ||
-      text.includes("[dotli ss]") ||
-      text.includes("[dot.li auth]") ||
-      text.includes("[dot.li auth-subscribe]")
-    ) {
-      // eslint-disable-next-line no-console
-      console.log(`[${msg.type()}] ${text}`);
-    }
-  });
-
-  // Given
-  await seedBackend(page, "rpc-gateway");
-  await page.goto(HOST_URL, { waitUntil: "domcontentloaded" });
-  await expect(page).toHaveTitle("dotli-auth-subscribe-ready", {
-    timeout: 30_000,
-  });
-
-  // When
-  const result = await page.evaluate(async (timeoutMs) => {
-    if (!window.__dotliAuthSubscribe) {
-      throw new Error("__dotliAuthSubscribe not installed");
-    }
-    return window.__dotliAuthSubscribe.subscribeAll([], timeoutMs);
-  }, SUBSCRIBE_TIMEOUT_MS);
-
-  // Then
-  expect(
-    result.count,
-    `expected >=1 statement via subscribeStatements(matchAll: []) within ${String(SUBSCRIBE_TIMEOUT_MS)}ms (backend: rpc-gateway)`,
-  ).toBeGreaterThan(0);
-});
diff --git a/apps/host/vite.config.ts b/apps/host/vite.config.ts
index abeb5c52..747e3800 100644
--- a/apps/host/vite.config.ts
+++ b/apps/host/vite.config.ts
@@ -3,9 +3,15 @@
 
 import { sentryVitePlugin } from "@sentry/vite-plugin";
 import { defineConfig, type Plugin } from "vite";
-import { readFileSync, readdirSync } from "node:fs";
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+} from "node:fs";
 import { execSync } from "node:child_process";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import wasm from "vite-plugin-wasm";
 import { VitePWA } from "vite-plugin-pwa";
 import { prodNoAnalyticsAliases } from "../../packages/metrics/src/prod-no-analytics-aliases";
@@ -309,6 +315,60 @@ function previewCoepHeaders(): Plugin {
   };
 }
 
+/**
+ * The Rust core worker dynamically imports
+ * `./wasm/web/truapi_server.js` relative to its emitted worker asset. Vite
+ * treats that path as a runtime dynamic import, so copy wasm-pack's generated
+ * web bundle beside the worker under `assets/wasm/web/`.
+ */
+function copyTruapiWasmWebBundle(): Plugin {
+  return {
+    name: "copy-truapi-wasm-web-bundle",
+    apply: "build",
+    writeBundle() {
+      const source = findTruapiWasmWebBundle();
+      const targetParent = resolve(import.meta.dirname, OUT_DIR, "assets/wasm");
+      const target = resolve(targetParent, "web");
+      mkdirSync(targetParent, { recursive: true });
+      cpSync(source, target, { recursive: true });
+      console.log("Copied TrUAPI WASM web bundle -> assets/wasm/web/\n");
+    },
+  };
+}
+
+function findTruapiWasmWebBundle(): string {
+  const packageRelative = "node_modules/@parity/truapi-host/dist/wasm/web";
+  const checked: string[] = [];
+  for (const candidate of truapiWasmWebBundleCandidates(packageRelative)) {
+    checked.push(candidate);
+    if (existsSync(resolve(candidate, "truapi_server.js"))) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    [
+      "Missing TrUAPI WASM web bundle.",
+      "Run `make wasm` from the TrUAPI repo root before building dotli.",
+      `Checked: ${checked.join(", ")}`,
+    ].join(" "),
+  );
+}
+
+function truapiWasmWebBundleCandidates(packageRelative: string): string[] {
+  const candidates: string[] = [];
+  for (let dir = import.meta.dirname; ; dir = dirname(dir)) {
+    candidates.push(resolve(dir, packageRelative));
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+  }
+  candidates.push(
+    resolve(import.meta.dirname, "../../packages/ui", packageRelative),
+  );
+  return [...new Set(candidates)];
+}
+
 /**
  * Sentry sourcemap upload. Skipped when metrics are off (runtime SDK is aliased to a
  * no-op, nothing to attribute) and locally without SENTRY_AUTH_TOKEN
@@ -340,14 +400,15 @@ export default defineConfig({
     preconnectBootnodes(),
     preloadCriticalAssets(),
     previewCoepHeaders(),
+    copyTruapiWasmWebBundle(),
     sentry(),
     // Host shell PWA. Scope-locked to the host origin (myapp.dot.li). The
     // protocol iframe on host.dot.li and the app iframe on *.app.dot.li are
-    // cross-origin and outside this SW's reach by design. Smoldot.wasm lives
-    // in the protocol build; browser HTTP cache (immutable, hashed filename)
-    // already prevents redownload on revisit, so the precache list excludes
-    // wasm entirely. `registerType: "prompt"` defers update activation to
-    // the user via workbox-window in src/pwa.ts.
+    // cross-origin and outside this SW's reach by design. The Rust TrUAPI core
+    // wasm-pack bundle uses stable filenames, so its JS glue and `.wasm` must
+    // be precached together; mixing old glue with a freshly served `.wasm`
+    // fails during instantiation. `registerType: "prompt"` defers update
+    // activation to the user via workbox-window in src/pwa.ts.
     VitePWA({
       injectRegister: false,
       registerType: "prompt",
@@ -372,13 +433,17 @@ export default defineConfig({
         ],
       },
       workbox: {
-        globPatterns: ["**/*.{js,css,html,svg,png,ico}"],
+        globPatterns: ["**/*.{js,css,html,svg,png,ico,wasm}"],
+        // VitePWA's default treats every file under `assets/` as
+        // hash-versioned. The copied wasm-pack bundle keeps stable filenames,
+        // so let Workbox attach content revisions to those entries.
+        dontCacheBustURLsMatching: /^assets\/(?!wasm\/web\/)/,
         cleanupOutdatedCaches: true,
         // skipWaiting/clientsClaim stay false: prompt-style updates require
         // the waiting SW to sit idle until the user opts in.
         skipWaiting: false,
         clientsClaim: false,
-        maximumFileSizeToCacheInBytes: 5 * 1024 * 1024,
+        maximumFileSizeToCacheInBytes: 16 * 1024 * 1024,
         // Bypass the SW for /__preview so nginx's COEP/COOP/CORP headers
         // reach the browser.
         navigateFallbackDenylist: [/^\/__preview(\?|$|\/)/],
@@ -395,7 +460,6 @@ export default defineConfig({
       "@dotli/resolver": resolve(PACKAGES, "resolver/src"),
       "@dotli/protocol": resolve(PACKAGES, "protocol/src"),
       "@dotli/content": resolve(PACKAGES, "content/src"),
-      "@dotli/auth": resolve(PACKAGES, "auth/src"),
       "@dotli/ui": resolve(PACKAGES, "ui/src"),
       "@dotli/sandbox-checker": SANDBOX_CHECKER_SRC,
     },
@@ -412,8 +476,8 @@ export default defineConfig({
     __POLKADOT_API_VERSIONS__: JSON.stringify(
       collectDirectScopedDeps("@polkadot-api/"),
     ),
-    __NOVASAMATECH_VERSIONS__: JSON.stringify(
-      collectDirectScopedDeps("@novasamatech/"),
+    __PARITY_TRUAPI_VERSIONS__: JSON.stringify(
+      collectDirectScopedDeps("@parity/truapi"),
     ),
   },
   optimizeDeps: {
@@ -424,15 +488,6 @@ export default defineConfig({
     modulePreload: { polyfill: false },
     outDir: OUT_DIR,
     sourcemap: "hidden",
-    rollupOptions: {
-      output: {
-        manualChunks(id) {
-          if (id.includes("@novasamatech/scale")) {
-            return "nova-scale";
-          }
-        },
-      },
-    },
   },
   server: {
     headers: {
diff --git a/apps/protocol/src/main.ts b/apps/protocol/src/main.ts
index 5b10bc1f..c64a416b 100644
--- a/apps/protocol/src/main.ts
+++ b/apps/protocol/src/main.ts
@@ -79,14 +79,12 @@ import {
 import {
   buildSharedAuthStorageKey,
   buildSharedModeStorageKey,
-  hasStoredSharedAuthSession,
   isSharedAuthOriginAllowed,
   isSharedAuthRequestMethod,
   isSharedAuthSiteId,
   isSharedModeRequestMethod,
   isValidSharedAuthKey,
   isValidSharedModeKey,
-  SHARED_AUTH_SESSION_KEY,
 } from "@dotli/protocol/auth-storage";
 import {
   isProtocolEnvelope,
@@ -961,22 +959,6 @@ function handleSharedAuthRequest(
   assertSharedAuthOrigin(origin);
 
   switch (request.method) {
-    case "authHasSession": {
-      const payload = request.payload as ProtocolRequestMap["authHasSession"];
-      assertSharedAuthSiteId(payload.siteId);
-      const value = localStorage.getItem(
-        buildSharedAuthStorageKey(payload.siteId, SHARED_AUTH_SESSION_KEY),
-      );
-      respond({
-        namespace: "dotli:protocol",
-        kind: "response",
-        id: request.id,
-        ok: true,
-        result: hasStoredSharedAuthSession(value),
-      });
-      return;
-    }
-
     case "authStorageRead": {
       const payload = request.payload as ProtocolRequestMap["authStorageRead"];
       assertSharedAuthSiteId(payload.siteId);
diff --git a/bun.lock b/bun.lock
index 51490ec4..97e510bc 100644
--- a/bun.lock
+++ b/bun.lock
@@ -94,37 +94,6 @@
         "vite-plugin-wasm": "^3.5.0",
       },
     },
-    "packages/auth": {
-      "name": "@dotli/auth",
-      "version": "0.6.0",
-      "dependencies": {
-        "@dotli/config": "workspace:*",
-        "@dotli/metrics": "workspace:*",
-        "@dotli/protocol": "workspace:*",
-        "@dotli/resolver": "workspace:*",
-        "@dotli/shared": "workspace:*",
-        "@noble/hashes": "^2.2.0",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
-        "@novasamatech/sdk-statement": "^0.6.0",
-        "@novasamatech/statement-store": "0.8.9",
-        "@novasamatech/storage-adapter": "0.8.9",
-        "@scure/sr25519": "^2.2.0",
-        "neverthrow": "^8.2.0",
-        "polkadot-api": "^2.1.6",
-        "scale-ts": "^1.6.1",
-      },
-      "devDependencies": {
-        "@dotli/eslint-config": "workspace:*",
-        "@dotli/typescript-config": "workspace:*",
-        "@scure/sr25519": "^2.2.0",
-        "eslint": "^10.5.0",
-        "happy-dom": "^20.10.3",
-        "typescript": "~6.0.3",
-        "vite": "^8.0.16",
-        "vitest": "^4.1.8",
-      },
-    },
     "packages/config": {
       "name": "@dotli/config",
       "version": "0.6.0",
@@ -227,12 +196,9 @@
         "@noble/hashes": "^2.2.0",
         "@polkadot-api/json-rpc-provider": "^0.2.0",
         "@polkadot-api/json-rpc-provider-proxy": "^0.4.0",
-        "@polkadot-api/signer": "^0.3.3",
         "@polkadot-api/substrate-bindings": "0.20.3",
         "@polkadot-api/substrate-client": "0.7.0",
         "@polkadot-api/utils": "0.4.0",
-        "@polkadot-labs/hdkd": "^0.0.28",
-        "@polkadot-labs/hdkd-helpers": "^0.0.30",
         "polkadot-api": "^2.1.6",
         "smoldot": "^3.1.4",
       },
@@ -298,10 +264,8 @@
       "name": "@dotli/truapi-debug",
       "version": "0.6.0",
       "dependencies": {
+        "@dotli/config": "workspace:*",
         "@dotli/shared": "workspace:*",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-container": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
         "nanoevents": "^9.1.0",
       },
       "devDependencies": {
@@ -328,13 +292,12 @@
         "@dotli/shared": "workspace:*",
         "@dotli/storage": "workspace:*",
         "@dotli/truapi-debug": "workspace:*",
+        "@noble/ciphers": "^2.2.0",
         "@noble/hashes": "^2.2.0",
-        "@novasamatech/host-api": "0.8.9",
-        "@novasamatech/host-container": "0.8.9",
-        "@novasamatech/host-papp": "0.8.9",
-        "@novasamatech/sdk-statement": "^0.6.0",
-        "@novasamatech/statement-store": "0.8.9",
+        "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
+        "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
         "@polkadot-api/json-rpc-provider": "^0.2.0",
+        "@scure/base": "^2.2.0",
         "neverthrow": "^8.2.0",
         "polkadot-api": "^2.1.6",
         "qrcode": "^1.5.4",
@@ -350,11 +313,9 @@
         "vitest": "^4.1.8",
       },
       "peerDependencies": {
-        "@dotli/auth": "workspace:*",
         "@dotli/resolver": "workspace:*",
       },
       "optionalPeers": [
-        "@dotli/auth",
         "@dotli/resolver",
       ],
     },
@@ -550,8 +511,6 @@
 
     "@commander-js/extra-typings": ["@commander-js/extra-typings@15.0.0", "", { "peerDependencies": { "commander": "~15.0.0" } }, "sha512-yeJlba62xqmkgELUsn7356MEnzLLu/fw2x4lofFqGnXh6YysRdEs2BaLeLtg1+KU0AXvMeqQvTTp+3hBEBK+EA=="],
 
-    "@dotli/auth": ["@dotli/auth@workspace:packages/auth"],
-
     "@dotli/config": ["@dotli/config@workspace:packages/config"],
 
     "@dotli/content": ["@dotli/content@workspace:packages/content"],
@@ -694,27 +653,13 @@
 
     "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
 
-    "@noble/curves": ["@noble/curves@2.2.0", "", { "dependencies": { "@noble/hashes": "2.2.0" } }, "sha512-T/BoHgFXirb0ENSPBquzX0rcjXeM6Lo892a2jlYJkqk83LqZx0l1Of7DzlKJ6jkpvMrkHSnAcgb5JegL8SeIkQ=="],
-
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
-    "@novasamatech/host-api": ["@novasamatech/host-api@0.8.9", "", { "dependencies": { "@novasamatech/scale": "0.8.9", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "scale-ts": "1.6.1" } }, "sha512-KPh81iVv3sQckq7/oyRpFF2uYBPXJD0+7cRuXO+lnWPAxQBXK1aNUQzSq+vJUHkcGRXJd0up/IlHJ4DMfQyUhQ=="],
-
-    "@novasamatech/host-container": ["@novasamatech/host-container@0.8.9", "", { "dependencies": { "@noble/hashes": "2.2.0", "@novasamatech/host-api": "0.8.9", "@polkadot-api/substrate-client": "^0.7.0", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2" } }, "sha512-zcBVTvmxxhD8DOlxJZ9r85TjUYsyEh/MjicZcd2SfY7oJOPg6r/cMh8byO3rhrAtP7QsvRIRg0hjTQHGCneSog=="],
-
-    "@novasamatech/host-papp": ["@novasamatech/host-papp@0.8.9", "", { "dependencies": { "@noble/ciphers": "2.2.0", "@noble/curves": "2.2.0", "@noble/hashes": "2.2.0", "@novasamatech/host-api": "0.8.9", "@novasamatech/scale": "0.8.9", "@novasamatech/statement-store": "0.8.9", "@novasamatech/storage-adapter": "0.8.9", "@polkadot-api/utils": "^0.4.0", "@polkadot-labs/hdkd-helpers": "^0.0.30", "nanoevents": "9.1.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2", "rxjs": "^7.8.2", "scale-ts": "1.6.1" } }, "sha512-Z1iENq/nn3e1P/4Mj0SS98yqO7tD8841G3xNGqO+O7tSnEjxDY4keS4uy4Rhx5hYIIRcUxe3xe1g/kUbJWVa+g=="],
-
-    "@novasamatech/scale": ["@novasamatech/scale@0.8.9", "", { "dependencies": { "@polkadot-api/utils": "^0.4.0", "scale-ts": "1.6.1" } }, "sha512-/Gt0KwfdkQZGyqd7e8YApx/QPMj/WDFrFYYOW5qxNWlbDpSUmYqNX+D1LECSokXw1vqE2m+ydBmNsAwyhJCLuQ=="],
-
-    "@novasamatech/sdk-statement": ["@novasamatech/sdk-statement@0.6.0", "", { "dependencies": { "@polkadot-api/substrate-bindings": "0.20.1", "@polkadot-api/utils": "^0.4.0", "polkadot-api": "^2.0.2" } }, "sha512-NTqM+yS45iHgy87lVSWIpFozrTfCUWb7r4ZpsDtN1eFnfixXpDKpPXDWQsvPs+nh18r/jmoMgtlTjUltrS6mYQ=="],
-
-    "@novasamatech/statement-store": ["@novasamatech/statement-store@0.8.9", "", { "dependencies": { "@noble/ciphers": "2.2.0", "@noble/hashes": "2.2.0", "@novasamatech/scale": "0.8.9", "@novasamatech/sdk-statement": "^0.6.0", "@novasamatech/substrate-slot-sr25519-wasm": "0.8.9", "@polkadot-api/substrate-bindings": "^0.20.3", "@polkadot-api/substrate-client": "^0.7.0", "@polkadot-labs/hdkd-helpers": "^0.0.30", "@polkadot-labs/schnorrkel-wasm": "0.0.9", "@scure/sr25519": "2.2.0", "nanoid": "5.1.11", "neverthrow": "^8.2.0", "polkadot-api": ">=2", "scale-ts": "1.6.1" } }, "sha512-MCx9ah9vVoetU1+7BTU/85gUiUjirNqky4yy6ydKiYLgLAjMiRsGW02rjlngJ+4tnE0Xy3euuJcCI8FjOwMoSA=="],
+    "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
 
-    "@novasamatech/storage-adapter": ["@novasamatech/storage-adapter@0.8.9", "", { "dependencies": { "nanoevents": "^9.1.0", "neverthrow": "^8.2.0" } }, "sha512-JXo6mfx0x9dZJzevKYD9MK6WxvlH5N9lBQegcSvWt3wpIniDriEUN8gmyJRkdbDdTZLwhmw1VM6mukM+RhJw1A=="],
+    "@parity/truapi": ["@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f", "", { "dependencies": { "@noble/hashes": "^2.2.0", "neverthrow": "^8.2.0", "scale-ts": "^1.6.1" } }, "sha512-wjdhSmf2k84kNse9H6ewn/Nw025XnODMElDqkK9UTh8hrcCdA0w1fJGKez5PEH3ljQb8DT2Qo6U3VDEKO7QwpA=="],
 
-    "@novasamatech/substrate-slot-sr25519-wasm": ["@novasamatech/substrate-slot-sr25519-wasm@0.8.9", "", {}, "sha512-Y8tkYq7h9gGn0WwtxrdCjGBUdG+nVXEDzKDo+5WXe+MZI+kTc2zmhlaxXWe3f/gzqNktxKGEkJXyokB8b21buA=="],
-
-    "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
+    "@parity/truapi-host": ["@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f", "", { "dependencies": { "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f" } }, "sha512-veBQxEQ3Ecq1Jd6VHfF1eRIps/X051X2CNBml89eVCSjNDwGI7rD7cfj0UJRiYMoKC7PxmF5UxpHn9eULmtaKA=="],
 
     "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
 
@@ -766,12 +711,6 @@
 
     "@polkadot-api/ws-provider": ["@polkadot-api/ws-provider@0.9.0", "", { "dependencies": { "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/json-rpc-provider-proxy": "0.4.0", "@polkadot-api/utils": "0.4.0" }, "peerDependencies": { "rxjs": ">=7.8.0" } }, "sha512-czTLgHEJPqx+6t5sb5OJpXDaSmbDTr8zYngBdUI47QYqcNB225zo/GdYakiNiGThtxVp1MLK7QsNXcT6XgqQNQ=="],
 
-    "@polkadot-labs/hdkd": ["@polkadot-labs/hdkd@0.0.28", "", { "dependencies": { "@polkadot-labs/hdkd-helpers": "~0.0.29" } }, "sha512-LpdqtQRpcgZQ5Mr8J0ddMA5ZufsbI4W3KuJkVdoYMnSmWs4179LigDb1rTYAOtyCg2jWUjf7rWP0mGxQQvNrHw=="],
-
-    "@polkadot-labs/hdkd-helpers": ["@polkadot-labs/hdkd-helpers@0.0.30", "", { "dependencies": { "@noble/curves": "^2.2.0", "@noble/hashes": "^2.2.0", "@scure/base": "^2.2.0", "@scure/sr25519": "^1.0.0", "scale-ts": "^1.6.1" } }, "sha512-qWmmD6ayj14RenDuDFfjF3sHS7ObqPzwIIMPcSVoDeKFSeQV7RY0HwyhC5CG4i6FoguMzak2dbtjYpNN5XQiwQ=="],
-
-    "@polkadot-labs/schnorrkel-wasm": ["@polkadot-labs/schnorrkel-wasm@0.0.9", "", {}, "sha512-MWO28z29OgKihdXjybvbuECASAIu52KZfBMFNZtK7jeyoFvA8ZrpJzYxPgFaBIsk1hHM488q7EXHckaMnZ1xng=="],
-
     "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.3", "", { "os": "android", "cpu": "arm64" }, "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw=="],
 
     "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA=="],
@@ -868,8 +807,6 @@
 
     "@scure/base": ["@scure/base@2.2.0", "", {}, "sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg=="],
 
-    "@scure/sr25519": ["@scure/sr25519@2.2.0", "", { "dependencies": { "@noble/curves": "~2.2.0", "@noble/hashes": "~2.2.0" } }, "sha512-UTOZb6Hzw44REQdl2SWNBhBFIoqOIhMLNIz3zYyVQLbqdshhuyuuxYoibKHlDg9oqdwdCHQe5LkTsevugPpUbw=="],
-
     "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
 
     "@sentry-internal/browser-utils": ["@sentry-internal/browser-utils@10.57.0", "", { "dependencies": { "@sentry/core": "10.57.0" } }, "sha512-tXObp954rMTSYKlbftjVXHtNl4t/6ssks3jkqyzmKb+PDPWzabGQO7sWwqVuTjT8Kx/8A3FmriS1bGmqxiJy3A=="],
@@ -1306,7 +1243,7 @@
 
     "is-shared-array-buffer": ["is-shared-array-buffer@1.0.4", "", { "dependencies": { "call-bound": "^1.0.3" } }, "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A=="],
 
-    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+    "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
 
     "is-string": ["is-string@1.1.1", "", { "dependencies": { "call-bound": "^1.0.3", "has-tostringtag": "^1.0.2" } }, "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA=="],
 
@@ -1406,7 +1343,7 @@
 
     "nanoevents": ["nanoevents@9.1.0", "", {}, "sha512-Jd0fILWG44a9luj8v5kED4WI+zfkkgwKyRQKItTtlPfEsh7Lznfi1kr8/iZ+XAIss4Qq5GqRB0qtWbaz9ceO/A=="],
 
-    "nanoid": ["nanoid@5.1.11", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg=="],
+    "nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
 
     "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
 
@@ -1642,7 +1579,7 @@
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-fest": ["type-fest@5.7.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg=="],
+    "type-fest": ["type-fest@0.16.0", "", {}, "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg=="],
 
     "typed-array-buffer": ["typed-array-buffer@1.0.3", "", { "dependencies": { "call-bound": "^1.0.3", "es-errors": "^1.3.0", "is-typed-array": "^1.1.14" } }, "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw=="],
 
@@ -1796,16 +1733,12 @@
 
     "@multiformats/sha3/multiformats": ["multiformats@9.9.0", "", {}, "sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg=="],
 
-    "@novasamatech/sdk-statement/@polkadot-api/substrate-bindings": ["@polkadot-api/substrate-bindings@0.20.1", "", { "dependencies": { "@noble/hashes": "^2.2.0", "@polkadot-api/utils": "0.4.0", "@scure/base": "^2.0.0", "scale-ts": "^1.6.1" } }, "sha512-AU7uUqSFt6nH8wrD7DJZkmrFs1QjLeA/Z4Qmf03ExUqsKDQ893pPjbQU2qAaPvWzDmaJotT8B8DENRqEUt8ruw=="],
-
     "@polkadot-api/cli/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
 
     "@polkadot-api/cli/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
 
     "@polkadot-api/smoldot/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
 
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519": ["@scure/sr25519@1.0.0", "", { "dependencies": { "@noble/curves": "~2.0.0", "@noble/hashes": "~2.0.0" } }, "sha512-b+uhK5akMINXZP95F3gJGcb5CMKYxf+q55fwMl0GoBwZDbWolmGNi1FrBSwuaZX5AhqS2byHiAueZgtDNpot2A=="],
-
     "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
     "@sentry/bundler-plugin-core/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
@@ -1822,8 +1755,12 @@
 
     "buffer-image-size/@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
 
+    "execa/is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+
     "filelist/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
+    "get-stream/is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+
     "hosted-git-info/lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
 
     "node-fetch/whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],
@@ -1840,16 +1777,12 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "postcss/nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
+    "read-pkg/type-fest": ["type-fest@5.7.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg=="],
 
     "rollup-plugin-esbuild/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
 
     "source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "tempy/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
-
-    "tempy/type-fest": ["type-fest@0.16.0", "", {}, "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg=="],
-
     "workbox-build/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
     "workbox-build/pretty-bytes": ["pretty-bytes@5.6.0", "", {}, "sha512-FFw039TmrBqFK8ma/7OL3sDz/VytdtJr044/QUJtH0wK9lb9jLq9tJyIxUwtQJHwar2BqtiA4iCWSwo9JLkzFg=="],
@@ -1862,10 +1795,6 @@
 
     "@apideck/better-ajv-errors/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519/@noble/curves": ["@noble/curves@2.0.1", "", { "dependencies": { "@noble/hashes": "2.0.1" } }, "sha512-vs1Az2OOTBiP4q0pwjW5aF0xp9n4MxVrmkFBxc6EKZc6ddYx5gaZiAsZoq0uRRXWbi3AT/sBqn05eRPtn1JCPw=="],
-
-    "@polkadot-labs/hdkd-helpers/@scure/sr25519/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
-
     "filelist/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
 
     "node-fetch/whatwg-url/tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],
diff --git a/docs/smoldot.md b/docs/smoldot.md
index 58d5e81e..ebdab5f4 100644
--- a/docs/smoldot.md
+++ b/docs/smoldot.md
@@ -12,14 +12,18 @@ dotli embeds the [smoldot](https://github.com/smol-dot/smoldot) Polkadot light c
 
 ## Where smoldot lives
 
-In default config, exactly one smoldot client runs per session, owned by the protocol iframe.
+The protocol iframe owns the resolver and sandbox-facing smoldot client. When
+the host backend is set to Light Client, the host shell also starts a smoldot
+client for Rust-core `chain.connect` requests.
 
 | Origin | Purpose | Triggered by |
 |---|---|---|
-| Protocol iframe (`host.localhost`, production `paseo.li`) | Domain resolution (Asset Hub query to CID), bitswap content fetching, Bulletin Paseo preimage submission | `apps/protocol/src/main.ts` (direct/shared-worker submodes) and `apps/protocol/src/protocol-shared-worker.ts` |
-| Host shell (user's destination domain, e.g. `foo.dot`) | None today, except an opt-in path: People chain auth when `VITE_SS_USE_SMOLDOT=true` | `packages/auth/src/auth.ts:210` (`getPeopleChainProvider()`, opt-in only) |
+| Protocol iframe (`host.localhost`, production `paseo.li`) | Domain resolution (Asset Hub query to CID), chain RPC brokering, bitswap content fetching | `apps/protocol/src/main.ts` (direct/shared-worker submodes) and `apps/protocol/src/protocol-shared-worker.ts` |
+| Host shell (user's destination domain, e.g. `foo.dot`) | Rust-core chain access for auth, product requests, and Bulletin submission when Light Client is selected | `packages/ui/src/host-callbacks/Chain.ts` |
 
-The protocol-iframe smoldot is constructed via the singletons in `packages/resolver/src/smoldot.ts`. The opt-in People-chain path on the host shell still spins up a second smoldot at the user's origin, gated by the `VITE_SS_USE_SMOLDOT` env flag.
+Both origins construct smoldot through the singletons in
+`packages/resolver/src/smoldot.ts`. RPC Gateway mode routes Rust-core requests
+to configured WebSocket endpoints and does not start the host-shell client.
 
 ## Smoldot factories
 
@@ -38,12 +42,13 @@ Five chain factories ship in `packages/resolver/src/smoldot.ts`.
 |---|---|---|---|
 | `getRelayChain()` | Paseo relay | Required parent for the parachains below | `PASEO_RELAY_GENESIS` (`config.ts:83`) |
 | `getDappAssetHubChain()` | Asset Hub Paseo | Domain resolution and product queries (single shared chain) | `ASSET_HUB_PASEO_GENESIS` (`config.ts:85`) |
-| `getBulletinChain()` | Bulletin Paseo | Preimage submission via `TransactionStorage.store` | `BULLETIN_PASEO_GENESIS` (`config.ts:87`) |
-| `getPeopleChain()` | People (chain spec selected by `SS_PEOPLE_CHAIN`, currently `next-people-paseo`) | Statement-store auth | not in `SUPPORTED_GENESIS_HASHES` |
+| `getBulletinChain()` | Bulletin Paseo | Content reads and Rust-core preimage submission | active network config |
+| `getPeopleChain()` | People | Statement-store auth | active network config |
 
 There is exactly one Asset Hub chain (`getDappAssetHubChain()`, `smoldot.ts:519`), shared by the resolver and every dApp session through the `ChainBroker`. The broker opens a single follow that is never removed mid-read. The resolver reads through a local broker session (`broker.getLocalProvider(genesis)`, object-wire), and dApp connections attach as remote sessions on the same follow. This replaced the earlier resolver/product chain split. In that split the resolver's chain was released once the CID was cached, so the first dApp connection releasing that follow mid-read produced the `ChainHead disjointed` load failure.
 
-`SUPPORTED_GENESIS_HASHES` (`config.ts:90`) contains relay, Asset Hub, and Bulletin. People chain is not in the set today, which is why the host shell still spins up its own smoldot for it under `VITE_SS_USE_SMOLDOT=true`.
+`getActiveSupportedGenesisHashes()` contains the active network's relay, Asset
+Hub, Bulletin, and People chains.
 
 ## Protocol modes
 
@@ -57,7 +62,10 @@ The host shell selects the submode from `chainBackend` at `apps/host/src/main.ts
 
 ## Talking to a chain
 
-Code in `packages/ui`, `packages/auth`, and `apps/host` must not import `@dotli/resolver/{smoldot,bulletin,chains,resolve}`. Use the cross-origin seam exposed by `@dotli/protocol/client`:
+Sandbox-facing consumers use the cross-origin seam exposed by
+`@dotli/protocol/client`. The host's Rust-core `chain.connect` callback is the
+exception: it imports `@dotli/resolver/chains` and
+`@dotli/resolver/rpc-chain` to honor the selected backend.
 
 ```ts
 import { createRemoteChainProvider } from "@dotli/protocol/client";
@@ -74,7 +82,7 @@ const client = createClient(provider); // polkadot-api
 
 Resolution helpers are pre-built: `resolveDotNameRemote(label)` and `resolveOwnerRemote(label)` at `client.ts:525` and `client.ts:537`. Call these instead of the resolver's local equivalents.
 
-For Bulletin Paseo preimage submission, use `submitPreimageRemote(value)` (`client.ts:543`). The protocol iframe runs the full submit flow (build extrinsic, sign with the test signer, watch until included) against its bulletin chain. Consumers never hold key material.
+Bulletin preimage submission is built, signed, and submitted entirely by the Rust core (`truapi-server`), which routes its `TransactionStorage.store` traffic through the host `chain.connect` callback like any other chain access. The host only provides `PreimageHost.lookupPreimage` for content retrieval; it no longer builds or signs the transaction.
 
 ## Persistence
 
@@ -91,15 +99,13 @@ Pre-cutover host-side smoldot may have left an IndexedDB chain DB at the user's
 
 ## Owner-only APIs
 
-These resolver-package exports are owner-only and must not be imported outside `apps/protocol/`:
+These resolver-package exports are owner-only and must not be imported outside
+`apps/protocol/`, except for the host chain callback described above:
 
 - `smoldot.ts`: `getSmoldot`, `getSmoldotDirect`, `terminateSmoldot`, `onSmoldotFatal`, `onConnectionIssue`, `getRelayChain`, `getBulletinChain`, `getPeopleChain`, `getDappAssetHubChain`, `getDappAssetHubProvider`, `makeNonRemovingChain`, `getPeopleChainProvider`
-- `bulletin.ts`: `ensureBulletinClient`, `submitPreimageTransaction`, `getTestSigner`
-- `chains.ts`: `createChainProvider`, `isChainSupported`
+- `chains.ts`: `createChainProvider`, `isChainSupported` (host chain callback only)
 - `resolve.ts` re-exports of `getSmoldot`, `getSmoldotDirect`, `getRelayChain`, `onConnectionIssue` plus the chain-touching helpers `resolveDotName`, `resolveOwner`, `waitForAssetHubFinalized`, `destroyResolverClient`, and `setResolverAssetHubProvider` (the bootstrap seam that points the resolver's Asset Hub reads at the broker's local session)
 
-Enforced by `packages/ui/tests/owner-boundary.contract.test.ts`, which currently bans `@dotli/resolver/bulletin` imports in `packages/ui/src/`, `packages/auth/src/`, and `apps/host/src/`. The remaining reach-in is `packages/auth/src/auth.ts:24` (`getPeopleChainProvider`), gated by `VITE_SS_USE_SMOLDOT` and out of scope for this change.
-
 ## Adding a new chain
 
 Steps to make a parachain reachable through the protocol iframe. The sequence below is inferred from the existing layout (relay, Asset Hub, Bulletin), and has not been exercised end-to-end in this branch.
@@ -109,9 +115,10 @@ Steps to make a parachain reachable through the protocol iframe. The sequence be
 3. Add a `get<Name>Chain()` factory in `packages/resolver/src/smoldot.ts`. Mirror `getBulletinChain`. Set `potentialRelayChains` correctly.
 4. Add the chain's genesis hash as a `0x…` constant in `packages/config/src/config.ts`. Include it in `SUPPORTED_GENESIS_HASHES`.
 5. Wire the factory into `createChainProvider` in `packages/resolver/src/chains.ts` so the protocol iframe routes the genesis hash to the new chain.
-6. Consumer code calls `createRemoteChainProvider(<your-genesis>)` from `@dotli/protocol/client`. No host-side smoldot required.
+6. Sandbox consumers call `createRemoteChainProvider(<your-genesis>)` from `@dotli/protocol/client`; Rust-core access uses the host `chain.connect` callback.
 
-Steps 4 and 5 are what makes a chain reachable from the host shell across the postMessage seam. Skip them and the host either crashes with `"Unsupported chain"` or silently spins up its own smoldot. This is the current People chain situation.
+Steps 4 and 5 make a chain reachable from both the protocol broker and the
+host callback. Skip them and the request fails with `"Unsupported chain"`.
 
 ## Related
 
diff --git a/packages/auth/eslint.config.js b/packages/auth/eslint.config.js
deleted file mode 100644
index 46d277e7..00000000
--- a/packages/auth/eslint.config.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { config } from "@dotli/eslint-config/vite";
-
-export default [
-  ...config,
-  {
-    languageOptions: {
-      parserOptions: {
-        tsconfigRootDir: import.meta.dirname,
-      },
-    },
-  },
-];
diff --git a/packages/auth/package.json b/packages/auth/package.json
deleted file mode 100644
index a8d758a1..00000000
--- a/packages/auth/package.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "name": "@dotli/auth",
-  "private": true,
-  "license": "AGPL-3.0-only",
-  "version": "0.6.0",
-  "type": "module",
-  "exports": {
-    "./*": "./src/*"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit",
-    "lint": "bunx eslint src/",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@dotli/eslint-config": "workspace:*",
-    "@dotli/typescript-config": "workspace:*",
-    "@scure/sr25519": "^2.2.0",
-    "eslint": "^10.5.0",
-    "happy-dom": "^20.10.3",
-    "typescript": "~6.0.3",
-    "vite": "^8.0.16",
-    "vitest": "^4.1.8"
-  },
-  "dependencies": {
-    "@dotli/config": "workspace:*",
-    "@dotli/metrics": "workspace:*",
-    "@dotli/protocol": "workspace:*",
-    "@dotli/resolver": "workspace:*",
-    "@dotli/shared": "workspace:*",
-    "@noble/hashes": "^2.2.0",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
-    "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/statement-store": "0.8.9",
-    "@novasamatech/storage-adapter": "0.8.9",
-    "@scure/sr25519": "^2.2.0",
-    "neverthrow": "^8.2.0",
-    "polkadot-api": "^2.1.6",
-    "scale-ts": "^1.6.1"
-  }
-}
diff --git a/packages/auth/src/account.ts b/packages/auth/src/account.ts
deleted file mode 100644
index 11ebb5ce..00000000
--- a/packages/auth/src/account.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Product account derivation for dot.li.
-//
-// Derives a product-specific public key from the user's root public key
-// using HDKD soft derivation through junctions ['product', dotDomain, derivationIndex].
-// Mirrors context__desktop/src/domains/product/account/service.ts
-
-import { HDKD } from "@scure/sr25519";
-import { blake2b } from "@noble/hashes/blake2.js";
-import type { CodecType, ProductAccountId } from "@novasamatech/host-api";
-import { EXECUTABLE_KINDS } from "@dotli/shared/executables";
-import { AccountId } from "polkadot-api";
-import { str, u64 } from "scale-ts";
-
-const JUNCTION_ID_LEN = 32;
-const NUMERIC_JUNCTION_RE = /^\d+$/;
-
-const createChainCode = (code: string): Uint8Array => {
-  const encoded = NUMERIC_JUNCTION_RE.test(code)
-    ? u64.enc(BigInt(code))
-    : str.enc(code);
-  if (encoded.length > JUNCTION_ID_LEN) {
-    return blake2b(encoded, { dkLen: JUNCTION_ID_LEN });
-  }
-
-  const chainCode = new Uint8Array(JUNCTION_ID_LEN);
-  chainCode.set(encoded);
-  return chainCode;
-};
-
-export const deriveProductPublicKey = (
-  rootPublicKey: Uint8Array,
-  productId: string,
-  derivationIndex: number,
-): Uint8Array => {
-  const junctions = ["product", productId, String(derivationIndex)];
-
-  return junctions.reduce((publicKey, junction) => {
-    return HDKD.publicSoft(publicKey, createChainCode(junction));
-  }, rootPublicKey);
-};
-
-const EXECUTABLE_SUBNAME_PREFIX = new RegExp(
-  `^(?:${EXECUTABLE_KINDS.join("|")})\\.`,
-  "i",
-);
-
-export const stripExecutableSubname = (productId: string): string => {
-  const withoutSubname = productId.replace(EXECUTABLE_SUBNAME_PREFIX, "");
-  const isValidBaseName = withoutSubname.split(".").length >= 2;
-  return isValidBaseName ? withoutSubname : productId;
-};
-
-/**
- * Normalize a `[productId, derivationIndex]` tuple by stripping the executable
- * subname, so every executable of a product resolves to one derived account.
- * Mirrors polkadot-desktop `productAccountService.normalizeProductAccountId`.
- */
-export const normalizeProductAccountId = (
-  productAccountId: CodecType<typeof ProductAccountId>,
-): CodecType<typeof ProductAccountId> => [
-  stripExecutableSubname(productAccountId[0]),
-  productAccountId[1],
-];
-
-const ss58Codec = AccountId();
-
-/**
- * SS58-encode a 32-byte public key with the substrate-generic prefix (42).
- *
- * Matches the format the wallet uses when it hands a `signer` string back
- * to legacy-aware products, so byte-for-byte string comparison works for
- * `signPayloadWithLegacyAccount` and `signRawWithLegacyAccount` round-trips.
- */
-export const productPublicKeyToAddress = (publicKey: Uint8Array): string =>
-  ss58Codec.dec(publicKey);
-
-/**
- * Inverse of `productPublicKeyToAddress`: decode an SS58 address string back to
- * its 32-byte public key. Used to turn a legacy account's `signer` address
- * (the wire format products send) into the `AccountId` bytes host-papp's
- * `signRawLegacy` expects. Throws on a malformed address.
- */
-export const productAddressToPublicKey = (address: string): Uint8Array =>
-  ss58Codec.enc(address);
-
-// NOTE: Uncomment when derived product accounts get their own network
-// allowance (quota) on People Chain. Currently only the root session account
-// has allowance, so createProof signs with the root ssSecret directly.
-// Once per-product allowance is supported, use this in handleStatementStoreCreateProof
-// to sign with the product-derived key instead.
-// export const deriveProductSecretKey = (
-//   rootSecret: Uint8Array,
-//   productId: string,
-//   derivationIndex: number,
-// ): Uint8Array => {
-//   const junctions = ["product", productId, String(derivationIndex)];
-//   return junctions.reduce((secret, junction) => {
-//     return HDKD.secretSoft(secret, createChainCode(junction));
-//   }, rootSecret);
-// };
diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
deleted file mode 100644
index 98d63704..00000000
--- a/packages/auth/src/auth.ts
+++ /dev/null
@@ -1,565 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Authentication for dot.li via the Polkadot App (host-papp).
-//
-// Wraps @novasamatech/host-papp for QR-code-based pairing with the Polkadot App.
-// Provides a simple pub-sub interface for the top bar UI.
-
-import {
-  createPappAdapter,
-  type AllowanceService,
-  type PappAdapter,
-  type PairingStatus,
-  type Identity,
-  type UserSession,
-} from "@novasamatech/host-papp";
-import { createSharedAuthStorageAdapter } from "./shared-storage";
-import {
-  createLazyClient,
-  createPapiStatementStoreAdapter,
-  type StatementStoreAdapter,
-} from "@novasamatech/statement-store";
-import type { Statement } from "@novasamatech/sdk-statement";
-import { toHex } from "@novasamatech/host-api";
-import { getWsProvider } from "polkadot-api/ws";
-import { createRemoteChainProvider } from "@dotli/protocol/client";
-import { ok, ResultAsync, type Result } from "neverthrow";
-import { SITE_ID } from "@dotli/config/config";
-import { getActiveServicesConfig } from "@dotli/config/network";
-import { getBackend } from "@dotli/config/mode";
-import { log } from "@dotli/shared/log";
-import { m } from "@dotli/metrics/metrics";
-import * as S from "@dotli/metrics/spans";
-import { SHARED_AUTH_SESSION_KEY } from "@dotli/protocol/auth-storage";
-
-declare const __DOTLI_VERSION__: string | undefined;
-
-export type AuthState =
-  | { status: "idle" }
-  | { status: "pairing"; payload: string }
-  | { status: "attesting" }
-  | { status: "authenticated"; session: UserSession; identity: Identity | null }
-  | { status: "error"; message: string };
-
-type AuthListener = (state: AuthState) => void;
-
-let adapter: PappAdapter | null = null;
-let sharedStorage: ReturnType<typeof createSharedAuthStorageAdapter> | null =
-  null;
-let statementStoreInstance: StatementStoreAdapter | null = null;
-let storeReadyResolvers: ((store: StatementStoreAdapter) => void)[] = [];
-let currentState: AuthState = { status: "idle" };
-let identitySub: { unsubscribe: () => void } | null = null;
-const listeners = new Set<AuthListener>();
-
-function setState(state: AuthState): void {
-  log.warn("[dot.li auth]", state.status, state);
-  currentState = state;
-  for (const fn of listeners) {
-    fn(state);
-  }
-}
-
-export function getAuthState(): AuthState {
-  return currentState;
-}
-
-export function onAuthStateChange(fn: AuthListener): () => void {
-  listeners.add(fn);
-  return () => listeners.delete(fn);
-}
-
-export function getStatementStore(): StatementStoreAdapter | null {
-  return statementStoreInstance;
-}
-
-export function getAllowanceService(): AllowanceService | null {
-  return adapter?.allowance ?? null;
-}
-
-export function onStatementStoreReady(): Promise<StatementStoreAdapter> {
-  if (statementStoreInstance) {
-    return Promise.resolve(statementStoreInstance);
-  }
-  return new Promise((resolve) => {
-    storeReadyResolvers.push(resolve);
-  });
-}
-
-export async function readSessionSecret(
-  sessionId: string,
-): Promise<Uint8Array | null> {
-  if (!adapter) {
-    return null;
-  }
-  const result = await adapter.secrets.read(sessionId);
-  if (result.isErr() || !result.value) {
-    return null;
-  }
-  return result.value.ssSecret;
-}
-
-let initialized = false;
-
-function toHexSafe(value: unknown): string {
-  if (value instanceof Uint8Array) {
-    return toHex(value);
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  return String(value);
-}
-
-function logStatement(prefix: string, stmt: Statement): void {
-  const keys = Object.keys(stmt);
-  log.warn(`${prefix} keys:`, keys);
-  if (stmt.channel !== undefined) {
-    log.warn(`${prefix} channel:`, stmt.channel);
-  }
-  if (stmt.topics !== undefined) {
-    log.warn(`${prefix} topics:`, stmt.topics);
-  }
-  if (stmt.data !== undefined) {
-    log.warn(
-      `${prefix} data (${String(stmt.data.length)} bytes):`,
-      toHexSafe(stmt.data),
-    );
-  }
-}
-
-function createLoggingStatementStore(
-  inner: StatementStoreAdapter,
-  queryTimeoutMs: number,
-): StatementStoreAdapter {
-  return {
-    queryStatements(filter) {
-      // sdk-statement's getStatements implements "query" as a subscribe that
-      // waits for an event with `data.remaining === 0`. Smoldot only emits the
-      // statement_statement notification when fresh statements arrive via
-      // gossip, never as an empty-initial-page sentinel, so for a topic
-      // with no statements the query hangs forever. That leaves
-      // session.init() stuck in 'initialization' and silently queues every
-      // subsequent submitRequestMessage. Race against a short timeout
-      // resolving to [] so init can proceed. The parallel subscribe still
-      // delivers new statements normally.
-      const inner$: Promise<Result<Statement[], Error>> = Promise.resolve(
-        inner.queryStatements(filter),
-      );
-      const timeout$ = new Promise<Result<Statement[], Error>>((resolve) => {
-        setTimeout(() => {
-          resolve(ok([]));
-        }, queryTimeoutMs);
-      });
-      return new ResultAsync<Statement[], Error>(
-        Promise.race([inner$, timeout$]),
-      );
-    },
-    subscribeStatements(filter, callback) {
-      const topics = "matchAll" in filter ? filter.matchAll : filter.matchAny;
-      log.warn(
-        "[dotli ss] subscribeStatements called, topics count:",
-        topics.length,
-      );
-      for (let i = 0; i < topics.length; i++) {
-        log.warn(
-          `[dotli ss]   topic[${String(i)}] (${String(topics[i].length)} bytes):`,
-          toHexSafe(topics[i]),
-        );
-      }
-      return inner.subscribeStatements(filter, (page) => {
-        log.warn(
-          "[dotli ss] >>> RECEIVED",
-          page.statements.length,
-          "statements (isComplete:",
-          page.isComplete,
-          ")",
-        );
-        for (let i = 0; i < page.statements.length; i++) {
-          logStatement(`[dotli ss]   stmt[${String(i)}]`, page.statements[i]);
-        }
-        return callback(page);
-      });
-    },
-    submitStatement(statement) {
-      log.warn("[dotli ss] submitStatement called");
-      logStatement("[dotli ss]  ", statement);
-      const result = inner.submitStatement(statement);
-      result.map(() => {
-        log.warn("[dotli ss] submitStatement OK");
-      });
-      result.mapErr((e: Error) => {
-        if (e.message.toLowerCase().includes("expiry too low")) {
-          log.warn(
-            "[dotli ss] submitStatement ExpiryTooLow (non-critical):",
-            e.message,
-          );
-        } else {
-          log.error("[dotli ss] submitStatement ERROR:", e);
-        }
-      });
-      return result;
-    },
-  };
-}
-
-interface NavigatorUAData {
-  getHighEntropyValues(
-    hints: string[],
-  ): Promise<{ platform?: string; platformVersion?: string }>;
-}
-
-function getPlatformTypeFromUserAgent(): string {
-  const agent = navigator.userAgent;
-  if (agent.includes("Win")) {
-    return "Windows";
-  }
-  if (agent.includes("Mac")) {
-    return "macOS";
-  }
-  if (agent.includes("Linux")) {
-    return "Linux";
-  }
-  return "Unknown";
-}
-
-async function getPlatformInfo(): Promise<{
-  platformType: string;
-  platformVersion?: string;
-}> {
-  const ua = (navigator as { userAgentData?: NavigatorUAData }).userAgentData;
-  if (ua === undefined) {
-    return { platformType: getPlatformTypeFromUserAgent() };
-  }
-  try {
-    const hints = await ua.getHighEntropyValues([
-      "platform",
-      "platformVersion",
-    ]);
-    return {
-      platformType: hints.platform ?? getPlatformTypeFromUserAgent(),
-      platformVersion: hints.platformVersion ?? undefined,
-    };
-  } catch (err: unknown) {
-    log.warn("[dot.li auth] Failed to read platform hints:", err);
-    return { platformType: getPlatformTypeFromUserAgent() };
-  }
-}
-
-export async function initAuth(): Promise<void> {
-  if (initialized) {
-    return;
-  }
-  initialized = true;
-
-  const siteId = SITE_ID;
-  const storage = createSharedAuthStorageAdapter(siteId);
-  sharedStorage = storage;
-  // Statement-store transport tracks the main Backend. smoldot variants
-  // route through the protocol bridge. `rpc-gateway` uses the WS provider
-  // directly.
-  const useSmoldotForAuth = getBackend() !== "rpc-gateway";
-  // Auth people chain endpoint resolved against the active network's services
-  // config. The smoldot path routes through the protocol bridge by genesis.
-  // The WS path dials the first RPC endpoint configured for the active people chain.
-  const people = getActiveServicesConfig().people;
-  let peopleProvider;
-  let peopleRpcEndpoint: string | null = null;
-  if (useSmoldotForAuth) {
-    const remote = createRemoteChainProvider(people.genesis);
-    if (remote === null) {
-      throw new Error(
-        "[dot.li auth] Protocol bridge does not support People Paseo chain",
-      );
-    }
-    peopleProvider = remote;
-  } else {
-    if (people.rpcs.length === 0) {
-      throw new Error(
-        "[dot.li auth] Active network has no public People RPC endpoint",
-      );
-    }
-    peopleRpcEndpoint = people.rpcs[0];
-    peopleProvider = getWsProvider([peopleRpcEndpoint], {
-      heartbeatTimeout: 120_000, // the default 40s is too aggressive through tunnels
-    });
-  }
-  const lazyClient = createLazyClient(peopleProvider);
-  if (peopleRpcEndpoint !== null) {
-    m.setDefaults({ people_rpc_endpoint: peopleRpcEndpoint });
-  }
-
-  // Short timeout for the smoldot path covers its empty-topic hang. WS is a
-  // generous upper bound that should never trip in practice.
-  const queryStatementsTimeoutMs = useSmoldotForAuth ? 3_000 : 30_000;
-  const rawStatementStore = createPapiStatementStoreAdapter(lazyClient);
-  const statementStore = createLoggingStatementStore(
-    rawStatementStore,
-    queryStatementsTimeoutMs,
-  );
-  statementStoreInstance = statementStore;
-  for (const resolve of storeReadyResolvers) {
-    resolve(statementStore);
-  }
-  storeReadyResolvers = [];
-
-  const platformInfo = await getPlatformInfo();
-
-  adapter = createPappAdapter({
-    appId: siteId,
-    hostMetadata: {
-      hostName: "Polkadot Web",
-      hostIcon: "https://dot.li/dotli.png",
-      hostVersion:
-        typeof __DOTLI_VERSION__ === "string" ? __DOTLI_VERSION__ : undefined,
-      ...platformInfo,
-    },
-    adapters: { lazyClient, statementStore, storage },
-  });
-
-  // Check for the existing session
-  const stopRestore = m.timer(S.AUTH_SESSION_RESTORE);
-  const sessions = adapter.sessions.sessions.read();
-  if (sessions.length > 0) {
-    resolveIdentityAndSetAuth(sessions[0]);
-  }
-  stopRestore();
-  m.breadcrumb("Auth module loaded");
-
-  // Subscribe to session changes (handles reconnects). When an authenticated
-  // session disappears — whether from the Log Out button or a phone-initiated
-  // disconnect — this is the single place that runs the local teardown, so both
-  // paths reset identically.
-  adapter.sessions.sessions.subscribe((sessions: UserSession[]) => {
-    if (sessions.length > 0 && currentState.status !== "authenticated") {
-      resolveIdentityAndSetAuth(sessions[0]);
-    } else if (
-      sessions.length === 0 &&
-      currentState.status === "authenticated"
-    ) {
-      const { session } = currentState;
-      identitySub?.unsubscribe();
-      identitySub = null;
-      setState({ status: "idle" });
-      void teardownAfterDisconnect(session);
-    }
-  });
-}
-
-async function teardownAfterDisconnect(session: UserSession): Promise<void> {
-  if (sharedStorage) {
-    await Promise.all([
-      sharedStorage.clear(`UserSecretsV2_${session.id}`),
-      sharedStorage.clear(`AllowanceKeys_${session.id}`),
-      sharedStorage.clear("DeviceIdentity"),
-    ]);
-  }
-  adapter?.sso.abortAuthentication();
-}
-
-function resolveIdentityAndSetAuth(session: UserSession): void {
-  if (!adapter) {
-    return;
-  }
-
-  // Drop any previous watch so a stale subscription can't write into a new
-  // session's state.
-  identitySub?.unsubscribe();
-  identitySub = null;
-
-  setState({ status: "authenticated", session, identity: null });
-
-  const accountId = Array.from(session.remoteAccount.accountId)
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-
-  identitySub = adapter.identity.watchIdentity(`0x${accountId}`).subscribe({
-    next: (identity) => {
-      if (
-        identity &&
-        currentState.status === "authenticated" &&
-        currentState.session.id === session.id
-      ) {
-        setState({ status: "authenticated", session, identity });
-      }
-    },
-    error: (err: unknown) => {
-      log.warn("[dot.li] Failed to resolve identity:", err);
-    },
-  });
-}
-
-/**
- * Pick up the first available session from the adapter.
- * Used as a fallback after pairing/attestation finishes.
- */
-function pickUpSession(): void {
-  if (!adapter) {
-    return;
-  }
-  if (currentState.status === "authenticated") {
-    return;
-  }
-
-  const sessions = adapter.sessions.sessions.read();
-  if (sessions.length > 0) {
-    resolveIdentityAndSetAuth(sessions[0]);
-  }
-}
-
-let unsubPairing: (() => void) | null = null;
-
-export function startPairing(): void {
-  if (!adapter) {
-    return;
-  }
-
-  // Show spinner immediately (don't wait for subscription callback)
-  setState({ status: "pairing", payload: "" });
-
-  // Clean up previous subscription (without aborting the adapter)
-  unsubPairing?.();
-  unsubPairing = null;
-
-  unsubPairing = adapter.sso.pairingStatus.subscribe(
-    (status: PairingStatus) => {
-      log.warn("[dot.li auth] pairingStatus:", status.step, status);
-      switch (status.step) {
-        case "initial":
-          setState({ status: "pairing", payload: "" });
-          break;
-        case "pairing":
-          setState({ status: "pairing", payload: status.payload });
-          break;
-        case "pending":
-          // Setup work in progress (attestation etc.). Show the spinner.
-          if (currentState.status !== "authenticated") {
-            setState({ status: "attesting" });
-          }
-          break;
-        case "pairingError":
-          setState({ status: "error", message: status.message });
-          break;
-        case "finished":
-          // Pairing and attestation both done, session is persisted.
-          // sessions.subscribe() is the primary pickup path, but call
-          // pickUpSession() here as a fallback.
-          if (currentState.status !== "authenticated") {
-            setState({ status: "attesting" });
-          }
-          pickUpSession();
-          break;
-        case "none":
-          break;
-      }
-    },
-  );
-
-  adapter.sso.authenticate().then(
-    (result) => {
-      log.warn("[dot.li auth] authenticate() resolved:", result);
-      if (result.isOk() && result.value) {
-        // authenticate() resolved successfully, session is now persisted.
-        // Pick up via sessions subscription or fallback here.
-        pickUpSession();
-      } else if (result.isErr()) {
-        log.error("[dot.li auth] authenticate() error:", result.error);
-        // Only show error if we're still in an active auth flow (not idle/authenticated)
-        if (
-          currentState.status !== "authenticated" &&
-          currentState.status !== "idle"
-        ) {
-          setState({ status: "error", message: result.error.message });
-        }
-      }
-    },
-    (err) => {
-      log.error("[dot.li auth] authenticate() rejected:", err);
-    },
-  );
-}
-
-export function abortPairing(): void {
-  // Unsubscribe first to prevent status callbacks from firing during abort
-  unsubPairing?.();
-  unsubPairing = null;
-
-  if (adapter) {
-    adapter.sso.abortAuthentication();
-  }
-
-  // Reset to idle so the UI is clean
-  if (currentState.status !== "authenticated") {
-    setState({ status: "idle" });
-  }
-}
-
-export async function disconnect(): Promise<void> {
-  if (!adapter) {
-    return;
-  }
-  if (currentState.status !== "authenticated") {
-    return;
-  }
-
-  const session = currentState.session;
-
-  // Notify the peer and let host-papp tear down its own session state,
-  // best-effort. Removing the session drives the sessions subscription, which
-  // runs the shared local teardown (secrets, allowance, device-identity
-  // rotation, in-memory reset) — the same path a phone-initiated disconnect
-  // takes.
-  await adapter.sessions.disconnect(session);
-  await sharedStorage?.clear(SHARED_AUTH_SESSION_KEY);
-}
-
-// Keep this union aligned with the host-API wire codec (`LoginResult`),
-// which is `"success" | "alreadyConnected" | "rejected"`.
-export type LoginFlowResult = "success" | "alreadyConnected" | "rejected";
-
-/**
- * Open the login flow on behalf of a product and resolve once auth settles.
- *
- * Products reach this through `handleRequestLogin` in the container. We
- * dispatch a DOM event so the topbar (which owns the QR pairing modal) can
- * open the UI without this module pulling in any DOM.
- */
-export function requestLogin(
-  reason: string | undefined,
-  label?: string,
-): Promise<LoginFlowResult> {
-  if (currentState.status === "authenticated") {
-    return Promise.resolve("alreadyConnected");
-  }
-
-  return new Promise((resolve) => {
-    // Dispatch first so the topbar transitions us out of `idle` before
-    // the subscription is installed. That way any post-subscribe
-    // `idle` callback is unambiguously a user cancellation.
-    window.dispatchEvent(
-      new CustomEvent("dotli:request-login", { detail: { reason, label } }),
-    );
-
-    const unsubscribe = onAuthStateChange((state) => {
-      if (state.status === "authenticated") {
-        unsubscribe();
-        resolve("success");
-      } else if (state.status === "error" || state.status === "idle") {
-        unsubscribe();
-        resolve("rejected");
-      }
-    });
-  });
-}
-
-export function shortenName(identity: Identity): string {
-  if (identity.fullUsername !== null && identity.fullUsername.length > 0) {
-    const parts = identity.fullUsername.split(" ");
-    if (parts.length === 1) {
-      return identity.fullUsername.slice(0, 2);
-    }
-    return parts[0].charAt(0) + parts[1].charAt(0);
-  }
-  return identity.liteUsername.slice(0, 2);
-}
diff --git a/packages/auth/src/shared-storage.ts b/packages/auth/src/shared-storage.ts
deleted file mode 100644
index f61a23a9..00000000
--- a/packages/auth/src/shared-storage.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import type { SiteId } from "@dotli/config/config";
-import {
-  clearSharedAuthStorage,
-  readSharedAuthStorage,
-  subscribeSharedAuthStorage,
-  writeSharedAuthStorage,
-} from "@dotli/protocol/client";
-import type { StorageAdapter } from "@novasamatech/storage-adapter";
-import { fromPromise } from "neverthrow";
-
-type StorageListener = (value: string | null) => unknown;
-
-function toError(error: unknown): Error {
-  return error instanceof Error ? error : new Error(String(error));
-}
-
-/**
- * Storage adapter backed by the shared host-window localStorage (on
- * `host.<root-domain>`) instead of the per-subdomain localStorage.
- *
- * - All read/write/clear calls proxy through the protocol iframe.
- * - In-process subscribers receive updates from same-tab writes via a
- *   local emit in the write/clear pipeline.
- * - Cross-tab subscribers on the same root domain receive updates via the
- *   protocol client's `subscribeSharedAuthStorage`, which is driven by a
- *   `BroadcastChannel` running inside the host iframe. This preserves the
- *   cross-tab contract of the upstream `@novasamatech/storage-adapter`
- *   `createLocalStorageAdapter`, which used the `storage` event.
- */
-export function createSharedAuthStorageAdapter(siteId: SiteId): StorageAdapter {
-  const listeners = new Map<string, Set<StorageListener>>();
-  let broadcastUnsubscribe: (() => void) | null = null;
-
-  function emit(key: string, value: string | null): void {
-    const callbacks = listeners.get(key);
-    if (!callbacks) {
-      return;
-    }
-    for (const callback of callbacks) {
-      callback(value);
-    }
-  }
-
-  function ensureBroadcastSubscription(): void {
-    if (broadcastUnsubscribe !== null) {
-      return;
-    }
-    broadcastUnsubscribe = subscribeSharedAuthStorage((change) => {
-      // Scope per-root-domain: ignore notifications from a different siteId.
-      // This is already enforced in the host iframe (which only accepts its
-      // own SITE_ID), but we filter defensively here too.
-      if (change.siteId !== siteId) {
-        return;
-      }
-      emit(change.key, change.value);
-    });
-  }
-
-  return {
-    read(key) {
-      return fromPromise(readSharedAuthStorage(siteId, key), toError);
-    },
-    write(key, value) {
-      // The iframe on `host.<root>` is the authoritative store: after a
-      // write resolves, read back through the iframe before firing the
-      // local `emit`. Trusting the local `value` we just tried to write
-      // would let a same-tab subscriber observe an update that the
-      // upstream storage quietly rejected (quota, validation, etc.). The
-      // cross-tab BroadcastChannel listener handles other tabs. Here we
-      // reconcile this tab against the source of truth.
-      return fromPromise(
-        writeSharedAuthStorage(siteId, key, value),
-        toError,
-      ).map(() => {
-        void readSharedAuthStorage(siteId, key).then(
-          (actual) => {
-            emit(key, actual);
-          },
-          () => {
-            // Read-back failed, so fall back to the value we intended.
-            // The subsequent write or subscription tick will reconcile.
-            emit(key, value);
-          },
-        );
-      });
-    },
-    clear(key) {
-      return fromPromise(clearSharedAuthStorage(siteId, key), toError).map(
-        () => {
-          void readSharedAuthStorage(siteId, key).then(
-            (actual) => {
-              emit(key, actual);
-            },
-            () => {
-              emit(key, null);
-            },
-          );
-        },
-      );
-    },
-    subscribe(key, callback) {
-      ensureBroadcastSubscription();
-
-      const callbacks = listeners.get(key) ?? new Set<StorageListener>();
-      callbacks.add(callback);
-      listeners.set(key, callbacks);
-
-      return () => {
-        const current = listeners.get(key);
-        if (!current) {
-          return;
-        }
-        current.delete(callback);
-        if (current.size === 0) {
-          listeners.delete(key);
-        }
-      };
-    },
-  };
-}
diff --git a/packages/auth/src/signing.ts b/packages/auth/src/signing.ts
deleted file mode 100644
index 31b5818f..00000000
--- a/packages/auth/src/signing.ts
+++ /dev/null
@@ -1,660 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Signing confirmation modals for dot.li (vanilla DOM).
-//
-// Bridges host-container's `{ account, payload }` request to host-papp's
-// `{ productAccountId, ...payload }` shape (host-api 0.7.6+). host-papp
-// derives the signing secret on the wallet side from the product account
-// tuple, so the host only forwards the tuple, with no address conversion or
-// local derivation. The modal displays the tuple itself ("my-app.dot / 0")
-// rather than a derived address. Computing the address would mean
-// duplicating the wallet's derivation logic for display only.
-
-import {
-  CreateTransactionErr,
-  SigningErr,
-  enumValue,
-  toHex,
-} from "@novasamatech/host-api";
-import { log } from "@dotli/shared/log";
-import type { UserSession } from "@novasamatech/host-papp";
-import { productPublicKeyToAddress } from "./account";
-
-export interface SigningResult {
-  signature: `0x${string}`;
-  signedTransaction?: `0x${string}`;
-}
-
-export interface ContainerSignPayloadRequest {
-  account: [string, number];
-  payload: {
-    blockHash: `0x${string}`;
-    blockNumber: `0x${string}`;
-    era: `0x${string}`;
-    genesisHash: `0x${string}`;
-    method: `0x${string}`;
-    nonce: `0x${string}`;
-    specVersion: `0x${string}`;
-    tip: `0x${string}`;
-    transactionVersion: `0x${string}`;
-    signedExtensions: string[];
-    version: number;
-    assetId: `0x${string}` | undefined;
-    metadataHash: `0x${string}` | undefined;
-    mode: number | undefined;
-    withSignedTransaction: boolean | undefined;
-  };
-}
-
-export interface ContainerSignRawRequest {
-  account: [string, number];
-  payload:
-    | { tag: "Bytes"; value: Uint8Array }
-    | { tag: "Payload"; value: string };
-}
-
-export interface ContainerCreateTransactionPayload {
-  signer: [string, number];
-  genesisHash: Uint8Array;
-  callData: Uint8Array;
-  extensions: { id: string; extra: Uint8Array; additionalSigned: Uint8Array }[];
-  txExtVersion: number;
-}
-
-/**
- * Legacy-account variant of `ContainerCreateTransactionPayload`. The signer is
- * a raw 32-byte public key (host-api `AccountId = Bytes(32)`) rather than the
- * `[dotNsIdentifier, derivationIndex]` product tuple, matching host-papp's
- * `LegacyTransaction = GenericTxPayloadV1(AccountId)`.
- */
-export interface ContainerCreateTransactionLegacyPayload {
-  signer: Uint8Array;
-  genesisHash: Uint8Array;
-  callData: Uint8Array;
-  extensions: { id: string; extra: Uint8Array; additionalSigned: Uint8Array }[];
-  txExtVersion: number;
-}
-
-/** Timeout for the wallet to respond (ms). Covers WS drops and unresponsive wallets. */
-const SIGN_TIMEOUT_MS = 300_000; // 300 seconds
-
-class SignTimeoutError extends Error {
-  constructor() {
-    super("Wallet did not respond in time — the connection may have dropped.");
-    this.name = "SignTimeoutError";
-  }
-}
-
-/** Race a thenable against a timeout. Clears the timer on settlement. */
-function withTimeout<T>(thenable: PromiseLike<T>, ms: number): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new SignTimeoutError());
-    }, ms);
-    const cleanup = (): void => {
-      clearTimeout(timer);
-    };
-    Promise.resolve(thenable).then(
-      (v) => {
-        cleanup();
-        resolve(v);
-      },
-      (e: unknown) => {
-        cleanup();
-        reject(e instanceof Error ? e : new Error(String(e)));
-      },
-    );
-  });
-}
-
-function createModalDOM(
-  title: string,
-  fields: { label: string; value: string; mono?: boolean }[],
-): {
-  backdrop: HTMLDivElement;
-  signBtn: HTMLButtonElement;
-  cancelBtn: HTMLButtonElement;
-} {
-  const backdrop = document.createElement("div");
-  backdrop.className = "signing-modal-backdrop";
-
-  const modal = document.createElement("div");
-  modal.className = "signing-modal";
-
-  const heading = document.createElement("h2");
-  heading.textContent = title;
-  modal.appendChild(heading);
-
-  const fieldsContainer = document.createElement("div");
-  fieldsContainer.className = "signing-fields";
-
-  for (const field of fields) {
-    const group = document.createElement("div");
-    group.className = "signing-field";
-
-    const label = document.createElement("div");
-    label.className = "signing-field-label";
-    label.textContent = field.label;
-    group.appendChild(label);
-
-    const value = document.createElement("div");
-    value.className = "signing-field-value";
-    if (field.mono === true) {
-      value.classList.add("mono");
-    }
-    value.textContent = field.value;
-    group.appendChild(value);
-
-    fieldsContainer.appendChild(group);
-  }
-  modal.appendChild(fieldsContainer);
-
-  const footer = document.createElement("div");
-  footer.className = "signing-modal-footer";
-
-  const cancelBtn = document.createElement("button");
-  cancelBtn.className = "signing-btn-cancel";
-  cancelBtn.textContent = "Cancel";
-  footer.appendChild(cancelBtn);
-
-  const signBtn = document.createElement("button");
-  signBtn.className = "signing-btn-sign";
-  signBtn.textContent = "Sign";
-  footer.appendChild(signBtn);
-
-  modal.appendChild(footer);
-  backdrop.appendChild(modal);
-  document.body.appendChild(backdrop);
-
-  return { backdrop, signBtn, cancelBtn };
-}
-
-function removeModal(backdrop: HTMLDivElement): void {
-  backdrop.remove();
-}
-
-/**
- * Sign-payload modal.
- *
- * Receives the calling product's `[dotNsIdentifier, derivationIndex]` tuple,
- * which is what host-papp requires. The modal displays the tuple as the
- * "Signer" line. The wallet derives and signs with the matching secret on
- * its side.
- */
-export function showSignPayloadModal(
-  session: UserSession,
-  payload: ContainerSignPayloadRequest["payload"],
-  appLabel: string,
-  productAccountId: [string, number],
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${productAccountId[0]} / ${String(productAccountId[1])}`;
-
-    log.warn("[dot.li signing] signPayload request received:", {
-      appLabel,
-      productAccountId,
-      genesisHash: payload.genesisHash,
-      method: payload.method.slice(0, 40) + "...",
-      mode: payload.mode,
-      withSignedTransaction: payload.withSignedTransaction,
-      metadataHash: payload.metadataHash,
-      assetId: payload.assetId,
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Genesis Hash", value: payload.genesisHash, mono: true },
-      { label: "Call Data", value: payload.method, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled signPayload");
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      const signRequest = { productAccountId, ...payload };
-      log.warn("[dot.li signing] dispatching signPayload to session:", {
-        productAccountId,
-        method: signRequest.method.slice(0, 40) + "...",
-        mode: signRequest.mode,
-        withSignedTransaction: signRequest.withSignedTransaction,
-      });
-
-      void withTimeout(session.signPayload(signRequest), SIGN_TIMEOUT_MS).then(
-        (result) => {
-          result.match(
-            ({ signature, signedTransaction }) => {
-              log.warn("[dot.li signing] signPayload SUCCESS:", {
-                signature: toHex(signature).slice(0, 20) + "...",
-                hasSignedTx: !!signedTransaction,
-              });
-              removeModal(backdrop);
-              resolve({
-                signature: toHex(signature),
-                signedTransaction: signedTransaction
-                  ? typeof signedTransaction === "string"
-                    ? signedTransaction
-                    : toHex(signedTransaction)
-                  : undefined,
-              });
-            },
-            (e) => {
-              log.error("[dot.li signing] signPayload FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signPayload timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/** Sign-raw counterpart of `showSignPayloadModal`; see that function for rationale. */
-export function showSignRawModal(
-  session: UserSession,
-  data: ContainerSignRawRequest["payload"],
-  appLabel: string,
-  productAccountId: [string, number],
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${productAccountId[0]} / ${String(productAccountId[1])}`;
-    const message = data.tag === "Payload" ? data.value : toHex(data.value);
-
-    log.warn("[dot.li signing] signRaw request received:", {
-      appLabel,
-      productAccountId,
-      dataTag: data.tag,
-      message: message.slice(0, 80) + (message.length > 80 ? "..." : ""),
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Message", value: message, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Message",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled signRaw");
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      log.warn("[dot.li signing] dispatching signRaw to session");
-
-      const signRawRequest = { productAccountId, data };
-      void withTimeout(session.signRaw(signRawRequest), SIGN_TIMEOUT_MS).then(
-        (result) => {
-          result.match(
-            ({ signature, signedTransaction }) => {
-              log.warn("[dot.li signing] signRaw SUCCESS:", {
-                signature: toHex(signature).slice(0, 20) + "...",
-                hasSignedTx: !!signedTransaction,
-              });
-              removeModal(backdrop);
-              resolve({
-                signature: toHex(signature),
-                signedTransaction: signedTransaction
-                  ? typeof signedTransaction === "string"
-                    ? signedTransaction
-                    : toHex(signedTransaction)
-                  : undefined,
-              });
-            },
-            (e) => {
-              log.error("[dot.li signing] signRaw FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signRaw timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Create-transaction modal. host-api 0.7.9 delegates extrinsic construction
- * to the wallet via host_create_transaction. The host forwards the typed
- * payload (signer tuple, genesis hash, call data, extensions, txExtVersion)
- * and the wallet returns the signed extrinsic bytes. The legacy-account
- * variant routes through the same flow with a synthetic product-account
- * tuple, see handleCreateTransactionWithLegacyAccount in container.ts.
- */
-export function showCreateTransactionModal(
-  session: UserSession,
-  payload: ContainerCreateTransactionPayload,
-  appLabel: string,
-): Promise<Uint8Array> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = `${payload.signer[0]} / ${String(payload.signer[1])}`;
-    const genesisHashHex = toHex(payload.genesisHash);
-    const callDataHex = toHex(payload.callData);
-    const callDataPreview =
-      callDataHex.length > 80 ? `${callDataHex.slice(0, 80)}...` : callDataHex;
-
-    log.warn("[dot.li signing] createTransaction request received:", {
-      appLabel,
-      signer: payload.signer,
-      genesisHash: genesisHashHex,
-      callDataLen: payload.callData.length,
-      extensions: payload.extensions.map((e) => e.id),
-      txExtVersion: payload.txExtVersion,
-    });
-    log.warn("[dot.li signing] session info:", {
-      localAccountId: toHex(session.localAccount.accountId),
-      sessionRoot: toHex(session.remoteAccount.accountId),
-    });
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel },
-      { label: "Genesis Hash", value: genesisHashHex, mono: true },
-      { label: "Call Data", value: callDataPreview, mono: true },
-      { label: "Tx Ext Version", value: String(payload.txExtVersion) },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      log.warn("[dot.li signing] user cancelled createTransaction");
-      removeModal(backdrop);
-      reject(new CreateTransactionErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      log.warn("[dot.li signing] dispatching createTransaction to session");
-
-      void withTimeout(
-        session.createTransaction({
-          payload: enumValue("v1", payload),
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signedTransaction) => {
-              log.warn("[dot.li signing] createTransaction SUCCESS:", {
-                signedTxLen: signedTransaction.length,
-              });
-              removeModal(backdrop);
-              resolve(signedTransaction);
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] createTransaction FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new CreateTransactionErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] createTransaction timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new CreateTransactionErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Sign-raw modal for a true legacy (imported) account.
- *
- * Unlike `showSignRawModal`, the wallet is asked to sign with a concrete
- * account public key (`signRawLegacy`) rather than deriving a product key from
- * a `[dotNsIdentifier, index]` tuple. host-papp's `signRawLegacy` returns the
- * raw signature only (no signed transaction).
- */
-export function showSignRawLegacyModal(
-  session: UserSession,
-  data: ContainerSignRawRequest["payload"],
-  appLabel: string,
-  account: Uint8Array,
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(account);
-    const message = data.tag === "Payload" ? data.value : toHex(data.value);
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Message", value: message, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Message",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.signRawLegacy({ account, data }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signature) => {
-              removeModal(backdrop);
-              resolve({ signature: toHex(signature) });
-            },
-            (e) => {
-              log.error("[dot.li signing] signRawLegacy FAILED:", e.message, e);
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signRawLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Create-transaction modal for a true legacy (imported) account. Mirrors
- * `showCreateTransactionModal` but routes through host-papp's
- * `createTransactionLegacy`, which carries the signer as a raw public key.
- */
-export function showCreateTransactionLegacyModal(
-  session: UserSession,
-  payload: ContainerCreateTransactionLegacyPayload,
-  appLabel: string,
-): Promise<Uint8Array> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(payload.signer);
-    const genesisHashHex = toHex(payload.genesisHash);
-    const callDataHex = toHex(payload.callData);
-    const callDataPreview =
-      callDataHex.length > 80 ? `${callDataHex.slice(0, 80)}...` : callDataHex;
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Genesis Hash", value: genesisHashHex, mono: true },
-      { label: "Call Data", value: callDataPreview, mono: true },
-      { label: "Tx Ext Version", value: String(payload.txExtVersion) },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new CreateTransactionErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.createTransactionLegacy({
-          payload: enumValue("v1", payload),
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signedTransaction) => {
-              removeModal(backdrop);
-              resolve(signedTransaction);
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] createTransactionLegacy FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new CreateTransactionErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] createTransactionLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new CreateTransactionErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
-
-/**
- * Sign-payload modal for a true legacy (imported) account. host-papp has no
- * `signPayloadLegacy`, so the JSON-encoded payload is signed through
- * `signRawLegacy` (Payload variant), mirroring polkadot-desktop. Returns the
- * raw signature only (no signed transaction).
- */
-export function showSignPayloadLegacyModal(
-  session: UserSession,
-  payload: ContainerSignPayloadRequest["payload"],
-  appLabel: string,
-  account: Uint8Array,
-): Promise<SigningResult> {
-  return new Promise((resolve, reject) => {
-    const signerLabel = productPublicKeyToAddress(account);
-
-    const fields: { label: string; value: string; mono?: boolean }[] = [
-      { label: "App", value: appLabel },
-      { label: "Signer", value: signerLabel, mono: true },
-      { label: "Genesis Hash", value: payload.genesisHash, mono: true },
-      { label: "Call Data", value: payload.method, mono: true },
-    ];
-
-    const { backdrop, signBtn, cancelBtn } = createModalDOM(
-      "Sign Transaction",
-      fields,
-    );
-
-    cancelBtn.addEventListener("click", () => {
-      removeModal(backdrop);
-      reject(new SigningErr.Rejected());
-    });
-
-    signBtn.addEventListener("click", () => {
-      signBtn.disabled = true;
-      signBtn.textContent = "Signing...";
-
-      void withTimeout(
-        session.signRawLegacy({
-          account,
-          data: { tag: "Payload", value: JSON.stringify(payload) },
-        }),
-        SIGN_TIMEOUT_MS,
-      ).then(
-        (result) => {
-          result.match(
-            (signature) => {
-              removeModal(backdrop);
-              resolve({ signature: toHex(signature) });
-            },
-            (e) => {
-              log.error(
-                "[dot.li signing] signPayloadLegacy FAILED:",
-                e.message,
-                e,
-              );
-              removeModal(backdrop);
-              reject(new SigningErr.Unknown({ reason: e.message }));
-            },
-          );
-        },
-        (e: unknown) => {
-          log.error("[dot.li signing] signPayloadLegacy timed out:", e);
-          removeModal(backdrop);
-          const msg = e instanceof Error ? e.message : "Request timed out";
-          reject(new SigningErr.Unknown({ reason: msg }));
-        },
-      );
-    });
-  });
-}
diff --git a/packages/auth/tests/account.test.ts b/packages/auth/tests/account.test.ts
deleted file mode 100644
index f00ace59..00000000
--- a/packages/auth/tests/account.test.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { describe, it, expect } from "vitest";
-import {
-  deriveProductPublicKey,
-  productPublicKeyToAddress,
-} from "@dotli/auth/account";
-import { AccountId } from "polkadot-api";
-import { secretFromSeed, getPublicKey } from "@scure/sr25519";
-
-describe("deriveProductPublicKey", () => {
-  // Generate a valid SR25519 public key from a deterministic seed
-  const seed = new Uint8Array(32);
-  seed[0] = 0x01;
-  const secret = secretFromSeed(seed);
-  const rootPublicKey = getPublicKey(secret);
-
-  it("returns a 32-byte public key", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(derived).toBeInstanceOf(Uint8Array);
-    expect(derived.length).toBe(32);
-  });
-
-  it("produces different keys for different product IDs", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "app1.dot", 0);
-    const key2 = deriveProductPublicKey(rootPublicKey, "app2.dot", 0);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(false);
-  });
-
-  it("produces different keys for different derivation indices", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    const key2 = deriveProductPublicKey(rootPublicKey, "myapp.dot", 1);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(false);
-  });
-
-  it("is deterministic", () => {
-    const key1 = deriveProductPublicKey(rootPublicKey, "test.dot", 5);
-    const key2 = deriveProductPublicKey(rootPublicKey, "test.dot", 5);
-    expect(Buffer.from(key1).equals(Buffer.from(key2))).toBe(true);
-  });
-
-  it("supports long preview product IDs", () => {
-    const derived = deriveProductPublicKey(
-      rootPublicKey,
-      "w-credentialless-staticblitz-com.local-credentialless.webcontainer-api.io",
-      0,
-    );
-    expect(derived).toBeInstanceOf(Uint8Array);
-    expect(derived.length).toBe(32);
-  });
-
-  it("derives different key from root (soft derivation changes output)", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(Buffer.from(derived).equals(Buffer.from(rootPublicKey))).toBe(false);
-  });
-});
-
-describe("productPublicKeyToAddress", () => {
-  const seed = new Uint8Array(32);
-  seed[0] = 0x01;
-  const rootPublicKey = getPublicKey(secretFromSeed(seed));
-
-  it("round-trips with polkadot-api's AccountId() encoder", () => {
-    const address = productPublicKeyToAddress(rootPublicKey);
-    const reEncoded = AccountId().enc(address);
-    expect(Buffer.from(reEncoded).equals(Buffer.from(rootPublicKey))).toBe(
-      true,
-    );
-  });
-
-  it("uses the substrate-generic (42) ss58 prefix by default", () => {
-    // Prefix 42 always produces an SS58 string starting with '5' for 32-byte
-    // public keys (mathematical property of base58 encoding of the prefix).
-    const address = productPublicKeyToAddress(rootPublicKey);
-    expect(address.startsWith("5")).toBe(true);
-  });
-
-  it("is deterministic", () => {
-    const a = productPublicKeyToAddress(rootPublicKey);
-    const b = productPublicKeyToAddress(rootPublicKey);
-    expect(a).toBe(b);
-  });
-
-  it("produces distinct addresses for distinct keys", () => {
-    const derived = deriveProductPublicKey(rootPublicKey, "myapp.dot", 0);
-    expect(productPublicKeyToAddress(derived)).not.toBe(
-      productPublicKeyToAddress(rootPublicKey),
-    );
-  });
-});
diff --git a/packages/auth/tests/shared-storage.test.ts b/packages/auth/tests/shared-storage.test.ts
deleted file mode 100644
index 49581fa1..00000000
--- a/packages/auth/tests/shared-storage.test.ts
+++ /dev/null
@@ -1,163 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { createSharedAuthStorageAdapter } from "@dotli/auth/shared-storage";
-import {
-  clearSharedAuthStorage,
-  readSharedAuthStorage,
-  subscribeSharedAuthStorage,
-  writeSharedAuthStorage,
-  type SharedAuthStorageListener,
-} from "@dotli/protocol/client";
-
-vi.mock("@dotli/protocol/client", () => ({
-  readSharedAuthStorage: vi.fn(),
-  writeSharedAuthStorage: vi.fn(),
-  clearSharedAuthStorage: vi.fn(),
-  subscribeSharedAuthStorage: vi.fn(),
-}));
-
-describe("createSharedAuthStorageAdapter", () => {
-  beforeEach(() => {
-    vi.mocked(readSharedAuthStorage).mockReset();
-    vi.mocked(writeSharedAuthStorage).mockReset();
-    vi.mocked(clearSharedAuthStorage).mockReset();
-    vi.mocked(subscribeSharedAuthStorage).mockReset();
-    vi.mocked(subscribeSharedAuthStorage).mockReturnValue(() => {
-      /* noop unsubscribe */
-    });
-  });
-
-  it("reads from shared host storage for the requested site", async () => {
-    vi.mocked(readSharedAuthStorage).mockResolvedValue("stored-value");
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const result = await adapter.read("SsoSessions");
-
-    expect(readSharedAuthStorage).toHaveBeenCalledWith("dot.li", "SsoSessions");
-    expect(result.isOk()).toBe(true);
-    expect(result._unsafeUnwrap()).toBe("stored-value");
-  });
-
-  it("emits local subscribers after writes and clears", async () => {
-    vi.mocked(writeSharedAuthStorage).mockResolvedValue(undefined);
-    vi.mocked(clearSharedAuthStorage).mockResolvedValue(undefined);
-    // After write/clear, the adapter reads back through the iframe
-    // (the authoritative store) to reconcile same-tab listeners against
-    // the value that was actually persisted. Mock the read-back so the
-    // local subscriber sees the post-write value.
-    vi.mocked(readSharedAuthStorage)
-      .mockResolvedValueOnce("next-value")
-      .mockResolvedValueOnce(null)
-      .mockResolvedValue("ignored");
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    const unsubscribe = adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    await adapter.write("SsoSessions", "next-value");
-    // Wait for the detached read-back chain scheduled by `.map()` to land
-    // its result in the subscriber. Polling on observable state is
-    // deterministic across event-loop schedulers. A fixed setTimeout(0)
-    // race-loses on slower JS engines.
-    await vi.waitFor(() => expect(seen).toContain("next-value"));
-    await adapter.clear("SsoSessions");
-    await vi.waitFor(() => expect(seen).toContain(null));
-    unsubscribe();
-    await adapter.write("SsoSessions", "ignored");
-    await vi.waitFor(() =>
-      expect(writeSharedAuthStorage).toHaveBeenCalledTimes(2),
-    );
-
-    expect(writeSharedAuthStorage).toHaveBeenNthCalledWith(
-      1,
-      "dot.li",
-      "SsoSessions",
-      "next-value",
-    );
-    expect(clearSharedAuthStorage).toHaveBeenCalledWith(
-      "dot.li",
-      "SsoSessions",
-    );
-    expect(seen).toEqual(["next-value", null]);
-  });
-
-  it("subscribes to cross-tab changes via the protocol client", () => {
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-
-    // No protocol-level subscription should happen until the adapter's
-    // subscribe() is called. We don't want to warm up the host iframe for
-    // read-only callers.
-    expect(subscribeSharedAuthStorage).not.toHaveBeenCalled();
-
-    adapter.subscribe("SsoSessions", () => {
-      /* noop */
-    });
-    adapter.subscribe("Other", () => {
-      /* noop */
-    });
-
-    // The adapter should only subscribe to the protocol client once. It
-    // multiplexes the single cross-tab listener across all key subscribers.
-    expect(subscribeSharedAuthStorage).toHaveBeenCalledTimes(1);
-  });
-
-  it("dispatches cross-tab changes to matching in-process subscribers", () => {
-    let relay: SharedAuthStorageListener | null = null;
-    vi.mocked(subscribeSharedAuthStorage).mockImplementation((listener) => {
-      relay = listener;
-      return () => {
-        relay = null;
-      };
-    });
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    if (relay === null) {
-      throw new Error("relay not captured");
-    }
-    // Simulate a sibling tab writing the same key
-    (relay as SharedAuthStorageListener)({
-      siteId: "dot.li",
-      key: "SsoSessions",
-      value: "from-other-tab",
-    });
-
-    expect(seen).toEqual(["from-other-tab"]);
-  });
-
-  it("ignores cross-tab changes for other siteIds", () => {
-    let relay: SharedAuthStorageListener | null = null;
-    vi.mocked(subscribeSharedAuthStorage).mockImplementation((listener) => {
-      relay = listener;
-      return () => {
-        relay = null;
-      };
-    });
-
-    const adapter = createSharedAuthStorageAdapter("dot.li");
-    const seen: (string | null)[] = [];
-    adapter.subscribe("SsoSessions", (value) => {
-      seen.push(value);
-    });
-
-    if (relay === null) {
-      throw new Error("relay not captured");
-    }
-    // A broadcast scoped to a different root domain must not fire
-    (relay as SharedAuthStorageListener)({
-      siteId: "paseo.li",
-      key: "SsoSessions",
-      value: "leak",
-    });
-
-    expect(seen).toEqual([]);
-  });
-});
diff --git a/packages/auth/tsconfig.json b/packages/auth/tsconfig.json
deleted file mode 100644
index 0849d319..00000000
--- a/packages/auth/tsconfig.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "extends": [
-    "@dotli/typescript-config/base.json",
-    "@dotli/typescript-config/paths.json"
-  ],
-  "include": ["src"]
-}
diff --git a/packages/auth/vitest.config.ts b/packages/auth/vitest.config.ts
deleted file mode 100644
index e51b66d6..00000000
--- a/packages/auth/vitest.config.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { defineConfig } from "vitest/config";
-import { resolve } from "node:path";
-
-export default defineConfig({
-  resolve: {
-    alias: {
-      "@dotli/auth": resolve(import.meta.dirname, "src"),
-      "@dotli/config": resolve(import.meta.dirname, "../config/src"),
-      "@dotli/protocol": resolve(import.meta.dirname, "../protocol/src"),
-      "@dotli/shared": resolve(import.meta.dirname, "../shared/src"),
-    },
-  },
-  test: {
-    include: ["tests/**/*.test.ts"],
-    environment: "happy-dom",
-    globals: false,
-  },
-  define: {
-    "import.meta.env.DEV": "false",
-    "import.meta.env.VITE_APP_DEBUG": '"true"',
-    // getEnabledNetworks() requires VITE_NETWORKS (no default by design); the
-    // test build supplies it the same way a deployment does.
-    "import.meta.env.VITE_NETWORKS": '"paseo-next-v2,previewnet"',
-  },
-});
diff --git a/packages/config/src/config.ts b/packages/config/src/config.ts
index ced8ad37..8bd44c36 100644
--- a/packages/config/src/config.ts
+++ b/packages/config/src/config.ts
@@ -89,9 +89,6 @@ export const SW_ARCHIVE_CACHE_MAX = 8;
 /** Max chain connections per origin on the protocol host. */
 export const MAX_CONNECTIONS_PER_ORIGIN = 10;
 
-/** Max nested container bridges per host shell. */
-export const MAX_NESTED_BRIDGES = 5;
-
 /** Drop scheduled notifications older than this many ms past `scheduledAt`. */
 export const SCHEDULED_NOTIFICATIONS_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 
diff --git a/packages/config/src/network.ts b/packages/config/src/network.ts
index e56d8f6a..b601a3d1 100644
--- a/packages/config/src/network.ts
+++ b/packages/config/src/network.ts
@@ -270,21 +270,24 @@ export function getActiveSupportedGenesisHashes(): Set<string> {
 
 /**
  * Chains a sandboxed dApp can reach in **RPC-gateway** mode: the curated
- * system chains that have configured WSS RPC endpoints. The Bulletin chain is
- * intentionally excluded even when it has an RPC - its content is served
- * through IPFS gateways, not a chain RPC connection - so gateway mode never
- * advertises it as a connectable dApp chain.
- *
- * Single source of truth shared by the host's chain-support advertisement
- * (`isRemoteChainSupported`) and the gateway provider factory
- * (`createRpcChainProvider`).
+ * system chains that have configured WSS RPC endpoints.
  */
 export function getActiveGatewayChains(): ChainService[] {
   const cfg = getActiveServicesConfig();
-  return [cfg.relay, cfg.assethub, cfg.people].filter((c) => c.rpcs.length > 0);
+  return [cfg.relay, cfg.assethub, cfg.people].filter(
+    (chain) => chain.rpcs.length > 0,
+  );
 }
 
 /** Genesis hashes (lowercased) a dApp can reach in RPC-gateway mode. */
 export function getActiveGatewaySupportedGenesisHashes(): Set<string> {
   return new Set(getActiveGatewayChains().map((c) => c.genesis.toLowerCase()));
 }
+
+/** Gateway chains available to the host-owned Rust core. */
+export function getActiveCoreGatewayChains(): ChainService[] {
+  const cfg = getActiveServicesConfig();
+  return [...getActiveGatewayChains(), cfg.bulletin].filter(
+    (chain) => chain.rpcs.length > 0,
+  );
+}
diff --git a/packages/config/tests/gateway-chains.test.ts b/packages/config/tests/gateway-chains.test.ts
index bcbf449c..a6ce4d58 100644
--- a/packages/config/tests/gateway-chains.test.ts
+++ b/packages/config/tests/gateway-chains.test.ts
@@ -6,6 +6,7 @@ import {
   NETWORK_NAME_TO_SERVICES_CONFIG,
   NetworkName,
   getActiveSupportedGenesisHashes,
+  getActiveCoreGatewayChains,
   getActiveGatewayChains,
   getActiveGatewaySupportedGenesisHashes,
   setNetworkOverride,
@@ -29,11 +30,18 @@ describe("gateway-supported chains (rpc-gateway mode)", () => {
     expect(hashes.has(v2.people.genesis.toLowerCase())).toBe(true);
   });
 
-  it("excludes the Bulletin chain (content served via IPFS, not chain RPC)", () => {
+  it("does not advertise the Bulletin chain to sandboxed dApps", () => {
     const hashes = getActiveGatewaySupportedGenesisHashes();
     expect(hashes.has(v2.bulletin.genesis.toLowerCase())).toBe(false);
   });
 
+  it("includes Bulletin in the host-owned core gateway set", () => {
+    const hashes = new Set(
+      getActiveCoreGatewayChains().map((chain) => chain.genesis.toLowerCase()),
+    );
+    expect(hashes.has(v2.bulletin.genesis.toLowerCase())).toBe(true);
+  });
+
   it("never advertises a chain without a configured RPC endpoint", () => {
     for (const chain of getActiveGatewayChains()) {
       expect(chain.rpcs.length).toBeGreaterThan(0);
diff --git a/packages/protocol/src/auth-storage.ts b/packages/protocol/src/auth-storage.ts
index 7a16fb16..bb866a54 100644
--- a/packages/protocol/src/auth-storage.ts
+++ b/packages/protocol/src/auth-storage.ts
@@ -5,7 +5,6 @@ import { BASE_DOMAIN, SITE_ID, type SiteId } from "@dotli/config/config";
 import type { ProtocolRequestMethod } from "./messages";
 
 export type SharedAuthRequestMethod =
-  | "authHasSession"
   | "authStorageRead"
   | "authStorageWrite"
   | "authStorageClear";
@@ -15,13 +14,7 @@ export type SharedModeRequestMethod =
   | "modeStorageWrite"
   | "modeStorageClear";
 
-export const SHARED_AUTH_SESSION_KEY = "SsoSessionsV3";
-
-// SCALE-encoded empty `Vec<Session>` from `@novasamatech/host-papp`, a single
-// length byte of 0. If host-papp ever changes the session list encoding (e.g.
-// wraps it in an `Option<>`), this sentinel must be updated or the probe will
-// return true for empty payloads and trigger `ensureAuth()` on every load.
-const EMPTY_SHARED_AUTH_SESSION_LIST = "0x00";
+export const SHARED_CORE_SESSION_KEY = "session";
 
 // Both the shared-auth and shared-mode stores accept the same key shape, an
 // alphanumeric token with dots, underscores, colons and dashes. Keep the
@@ -29,7 +22,6 @@ const EMPTY_SHARED_AUTH_SESSION_LIST = "0x00";
 // needing a different shape should get its own constant.
 const SHARED_STORAGE_KEY_PATTERN = /^[A-Za-z0-9._:-]+$/;
 const SHARED_AUTH_METHODS = new Set<ProtocolRequestMethod>([
-  "authHasSession",
   "authStorageRead",
   "authStorageWrite",
   "authStorageClear",
@@ -79,7 +71,10 @@ export function isValidSharedAuthKey(key: string): boolean {
 }
 
 export function buildSharedAuthStorageKey(siteId: SiteId, key: string): string {
-  return `PAPP_${siteId}_${key}`;
+  if (key === SHARED_CORE_SESSION_KEY) {
+    return `TRUAPI_SESSION_${siteId}`;
+  }
+  return `TRUAPI_${siteId}_${key}`;
 }
 
 /**
@@ -99,12 +94,6 @@ export function isValidSharedModeKey(key: string): boolean {
   return SHARED_STORAGE_KEY_PATTERN.test(key);
 }
 
-export function hasStoredSharedAuthSession(value: string | null): boolean {
-  return (
-    value !== null && value !== "" && value !== EMPTY_SHARED_AUTH_SESSION_LIST
-  );
-}
-
 export function isSharedAuthOriginAllowed(origin: string): boolean {
   try {
     const url = new URL(origin);
diff --git a/packages/protocol/src/client.ts b/packages/protocol/src/client.ts
index f5eed51a..de3baa14 100644
--- a/packages/protocol/src/client.ts
+++ b/packages/protocol/src/client.ts
@@ -601,10 +601,6 @@ export async function resolveRootManifestRemote(
   })) as ManifestResult<RootManifest>;
 }
 
-export async function hasSharedAuthSession(siteId: SiteId): Promise<boolean> {
-  return (await postRequest("authHasSession", { siteId })) as boolean;
-}
-
 export async function readSharedAuthStorage(
   siteId: SiteId,
   key: string,
@@ -691,8 +687,7 @@ export function subscribeSharedAuthStorage(
 
 export function isRemoteChainSupported(genesisHash: string): boolean {
   // Advertise only what the *active* backend can actually serve. Gateway mode
-  // bridges a curated RPC subset (no Bulletin chain — its content goes via
-  // IPFS gateways), while smoldot can run any configured chain.
+  // bridges a curated RPC subset, while smoldot can run any configured chain.
   const supported =
     getBackend() === "rpc-gateway"
       ? getActiveGatewaySupportedGenesisHashes()
@@ -742,6 +737,14 @@ export function createRemoteChainProvider(
           void postRequest("chainSend", {
             connectionId,
             message: JSON.stringify(message),
+          }).catch((error: unknown) => {
+            const errResponse = buildJsonRpcError(
+              message,
+              serializeError(error),
+            );
+            if (errResponse !== null) {
+              onMessage(errResponse);
+            }
           });
         }
         remote.pendingMessages = [];
diff --git a/packages/protocol/src/messages.ts b/packages/protocol/src/messages.ts
index e18859fe..b693efdc 100644
--- a/packages/protocol/src/messages.ts
+++ b/packages/protocol/src/messages.ts
@@ -10,7 +10,6 @@ export interface ProtocolRequestMap {
     kind: "app" | "widget" | "worker";
   };
   resolveRootManifest: { label: string };
-  authHasSession: { siteId: string };
   authStorageRead: { siteId: string; key: string };
   authStorageWrite: { siteId: string; key: string; value: string };
   authStorageClear: { siteId: string; key: string };
diff --git a/packages/protocol/tests/auth-storage.test.ts b/packages/protocol/tests/auth-storage.test.ts
index ea1be5c8..dbd76687 100644
--- a/packages/protocol/tests/auth-storage.test.ts
+++ b/packages/protocol/tests/auth-storage.test.ts
@@ -5,11 +5,11 @@ import { describe, expect, it } from "vitest";
 import { SITE_ID } from "@dotli/config/config";
 import {
   buildSharedAuthStorageKey,
-  hasStoredSharedAuthSession,
   isSharedAuthOriginAllowed,
   isSharedAuthRequestMethod,
   isSharedAuthSiteId,
   isValidSharedAuthKey,
+  SHARED_CORE_SESSION_KEY,
 } from "@dotli/protocol/auth-storage";
 
 describe("shared auth storage helpers", () => {
@@ -68,21 +68,19 @@ describe("shared auth storage helpers", () => {
     expect(isValidSharedAuthKey("")).toBe(false);
   });
 
-  it("builds stable storage keys and detects empty session payloads", () => {
-    expect(buildSharedAuthStorageKey("dot.li", "SsoSessions")).toBe(
-      "PAPP_dot.li_SsoSessions",
+  it("builds stable storage keys", () => {
+    expect(buildSharedAuthStorageKey("dot.li", SHARED_CORE_SESSION_KEY)).toBe(
+      "TRUAPI_SESSION_dot.li",
     );
-    expect(buildSharedAuthStorageKey("paseoli.dev", "SsoSessions")).toBe(
-      "PAPP_paseoli.dev_SsoSessions",
+    expect(
+      buildSharedAuthStorageKey("paseoli.dev", SHARED_CORE_SESSION_KEY),
+    ).toBe("TRUAPI_SESSION_paseoli.dev");
+    expect(buildSharedAuthStorageKey("dot.li", "UserSecrets")).toBe(
+      "TRUAPI_dot.li_UserSecrets",
     );
-    expect(hasStoredSharedAuthSession(null)).toBe(false);
-    expect(hasStoredSharedAuthSession("")).toBe(false);
-    expect(hasStoredSharedAuthSession("0x00")).toBe(false);
-    expect(hasStoredSharedAuthSession("0x04010203")).toBe(true);
   });
 
   it("identifies shared-auth RPC methods", () => {
-    expect(isSharedAuthRequestMethod("authHasSession")).toBe(true);
     expect(isSharedAuthRequestMethod("authStorageRead")).toBe(true);
     expect(isSharedAuthRequestMethod("authStorageWrite")).toBe(true);
     expect(isSharedAuthRequestMethod("authStorageClear")).toBe(true);
diff --git a/packages/resolver/package.json b/packages/resolver/package.json
index 6b5e9c04..421b755a 100644
--- a/packages/resolver/package.json
+++ b/packages/resolver/package.json
@@ -31,12 +31,9 @@
     "@ensdomains/content-hash": "^3.0.0",
     "@polkadot-api/json-rpc-provider": "^0.2.0",
     "@polkadot-api/json-rpc-provider-proxy": "^0.4.0",
-    "@polkadot-api/signer": "^0.3.3",
     "@polkadot-api/substrate-bindings": "0.20.3",
     "@polkadot-api/substrate-client": "0.7.0",
     "@polkadot-api/utils": "0.4.0",
-    "@polkadot-labs/hdkd": "^0.0.28",
-    "@polkadot-labs/hdkd-helpers": "^0.0.30",
     "polkadot-api": "^2.1.6",
     "smoldot": "^3.1.4"
   }
diff --git a/packages/resolver/src/rpc-chain.ts b/packages/resolver/src/rpc-chain.ts
index 0125c03e..230438b1 100644
--- a/packages/resolver/src/rpc-chain.ts
+++ b/packages/resolver/src/rpc-chain.ts
@@ -13,15 +13,18 @@
  * smoldot is never imported here, so Vite tree-shakes the light client out of
  * any bundle that only pulls this module.
  *
- * Coverage is the active network's relay, Asset Hub, and People chains, each
- * dialled through its configured `rpcs`. Login and identity resolution live
+ * Coverage is the active network's relay, Asset Hub, People, and Bulletin
+ * chains when they have configured `rpcs`. Login and identity resolution live
  * on the People chain, so it must be reachable for auth to work in gateway
- * mode. Bulletin is deliberately absent. Its content (IPFS or bitswap) is
- * served through IPFS gateways, not a chain RPC connection.
+ * mode. Bulletin is reachable so in-core preimage submission can use its
+ * `TransactionStorage` runtime API over the same trusted RPC posture.
  */
 import { getWsProvider } from "polkadot-api/ws";
 import type { JsonRpcProvider } from "polkadot-api";
-import { getActiveGatewayChains } from "@dotli/config/network";
+import {
+  getActiveCoreGatewayChains,
+  getActiveGatewayChains,
+} from "@dotli/config/network";
 import type { ChainService } from "@dotli/config/network";
 
 /**
@@ -38,6 +41,15 @@ function gatewayChain(genesisHash: string): ChainService | null {
   );
 }
 
+function coreGatewayChain(genesisHash: string): ChainService | null {
+  const key = genesisHash.toLowerCase();
+  return (
+    getActiveCoreGatewayChains().find(
+      (chain) => chain.genesis.toLowerCase() === key,
+    ) ?? null
+  );
+}
+
 /** Whether gateway mode can serve chain calls for `genesisHash`. */
 export function isRpcChainSupported(genesisHash: string): boolean {
   return gatewayChain(genesisHash) !== null;
@@ -47,7 +59,24 @@ export function isRpcChainSupported(genesisHash: string): boolean {
 export function createRpcChainProvider(
   genesisHash: string,
 ): JsonRpcProvider | null {
-  const chain = gatewayChain(genesisHash);
+  return createGatewayProvider(gatewayChain(genesisHash));
+}
+
+/** Whether the host-owned Rust core can reach `genesisHash` in gateway mode. */
+export function isCoreRpcChainSupported(genesisHash: string): boolean {
+  return coreGatewayChain(genesisHash) !== null;
+}
+
+/** Gateway provider for host-owned Rust-core traffic, including Bulletin. */
+export function createCoreRpcChainProvider(
+  genesisHash: string,
+): JsonRpcProvider | null {
+  return createGatewayProvider(coreGatewayChain(genesisHash));
+}
+
+function createGatewayProvider(
+  chain: ChainService | null,
+): JsonRpcProvider | null {
   if (chain === null) {
     return null;
   }
diff --git a/packages/resolver/tests/chains.test.ts b/packages/resolver/tests/chains.test.ts
new file mode 100644
index 00000000..1355544c
--- /dev/null
+++ b/packages/resolver/tests/chains.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { getActiveSupportedGenesisHashes } from "@dotli/config/network";
+import { isChainSupported } from "@dotli/resolver/chains";
+
+describe("isChainSupported", () => {
+  it("accepts every chain the host runtime can expose", () => {
+    for (const genesisHash of getActiveSupportedGenesisHashes()) {
+      expect(isChainSupported(genesisHash)).toBe(true);
+    }
+  });
+
+  it("rejects unknown genesis hashes", () => {
+    expect(isChainSupported("0xdeadbeef")).toBe(false);
+  });
+});
diff --git a/packages/resolver/tests/rpc-chain.test.ts b/packages/resolver/tests/rpc-chain.test.ts
new file mode 100644
index 00000000..7b355848
--- /dev/null
+++ b/packages/resolver/tests/rpc-chain.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import {
+  createCoreRpcChainProvider,
+  createRpcChainProvider,
+  isCoreRpcChainSupported,
+  isRpcChainSupported,
+} from "@dotli/resolver/rpc-chain";
+
+const mocks = vi.hoisted(() => ({
+  getWsProvider: vi.fn(),
+}));
+
+vi.mock("polkadot-api/ws", () => ({
+  getWsProvider: mocks.getWsProvider,
+}));
+
+describe("rpc-chain", () => {
+  it("supports the active People chain when RPC endpoints are configured", () => {
+    const people = getActiveServicesConfig().people;
+
+    expect(isRpcChainSupported(people.genesis)).toBe(true);
+
+    const provider = {};
+    mocks.getWsProvider.mockReturnValueOnce(provider);
+
+    expect(createRpcChainProvider(people.genesis)).toBe(provider);
+    expect(mocks.getWsProvider).toHaveBeenCalledWith([...people.rpcs], {
+      heartbeatTimeout: 120_000,
+    });
+  });
+
+  it("rejects unknown genesis hashes", () => {
+    expect(isRpcChainSupported("0xdeadbeef")).toBe(false);
+    expect(createRpcChainProvider("0xdeadbeef")).toBeNull();
+  });
+
+  it("reserves Bulletin RPC access for the host-owned Rust core", () => {
+    const bulletin = getActiveServicesConfig().bulletin;
+    expect(isRpcChainSupported(bulletin.genesis)).toBe(false);
+    expect(createRpcChainProvider(bulletin.genesis)).toBeNull();
+
+    const provider = {};
+    mocks.getWsProvider.mockReturnValueOnce(provider);
+    expect(isCoreRpcChainSupported(bulletin.genesis)).toBe(true);
+    expect(createCoreRpcChainProvider(bulletin.genesis)).toBe(provider);
+  });
+});
diff --git a/packages/storage/src/scheduled-notifications.ts b/packages/storage/src/scheduled-notifications.ts
index 1d3fb11b..256bc0a5 100644
--- a/packages/storage/src/scheduled-notifications.ts
+++ b/packages/storage/src/scheduled-notifications.ts
@@ -12,7 +12,7 @@
  * `scheduled_notifications` store (keyPath hostId, autoIncrement) holds
  * the records. The `notification_counters` store (keyPath productId)
  * holds the monotonic per-product `next` value, so each schedule returns
- * a stable, unique `perProductId` (the host-api NotificationId).
+ * a stable, unique `perProductId` for TrUAPI notification callbacks.
  */
 
 import { getDb } from "./db";
diff --git a/packages/truapi-debug/DEBUG_PANEL.md b/packages/truapi-debug/DEBUG_PANEL.md
index bbc4ede4..22a72b66 100644
--- a/packages/truapi-debug/DEBUG_PANEL.md
+++ b/packages/truapi-debug/DEBUG_PANEL.md
@@ -91,42 +91,29 @@ To turn it off:
 - Close the tab — the choice is sessionStorage-scoped, so a fresh
   tab starts clean regardless.
 
-## The three event sources
+## The two event sources
 
-Every event observed by the panel comes from one of three buses. Each
+Every event observed by the panel comes from one of two buses. Each
 bus is independent; the panel merges their streams into one time-
 aligned store.
 
 ### 1. TrUAPI — host ↔ product messages
 
 The postMessage protocol between the dotli host and product iframes,
-captured by `onHostApiDebugMessage` from `@novasamatech/host-container`.
-Every message is already decoded (no SCALE bytes). Categories:
+captured from the Rust-backed TrUAPI bridge. The producer currently decodes
+the transport envelope only: each event includes direction, request id, wire
+id, method tag, and raw SCALE payload bytes (`payload.value.bytes`). Method
+payload decoding is intentionally not duplicated in this package yet.
+Categories:
 
 - `host_*` — accounts, signing, scoped storage, chain connections,
   statement-store proxying, preimage submission, permissions prompts,
   push notifications.
 - `remote_chain_*` — chainHead, chainSpec, and transaction methods
   (one-to-one wrap of the new Substrate JSON-RPC spec).
-- Many more — anything in the `HostApiProtocol` enum.
+- Many more — anything in the generated TrUAPI wire table.
 
-### 2. host-papp — SSO / attestation / session
-
-Semantic protocol flows that sit above the statement-store transport,
-captured by `onHostPappDebugMessage` from `@novasamatech/host-papp/debug`.
-
-- `sso:*` — QR-code pairing flow (`pairing_started`,
-  `deeplink_generated`, `awaiting_response`, `response_received`,
-  `session_established`, `pairing_failed`).
-- `attestation:*` — on-chain guest identity registration
-  (`started`, `username_claimed`, `allowance_granted`,
-  `vrf_proof_generated`, `person_registered`, `completed`, `failed`).
-- `session:*` — post-pairing wallet ↔ host messages in both
-  directions (`peer_action_received/processed/failed`,
-  `host_action_sent/response_received/failed`, plus `opened` and
-  `terminated`).
-
-### 3. dotli — boot / resolve / render / bridge / failover
+### 2. dotli — boot / resolve / render / bridge / failover
 
 Dotli-internal host-side orchestration, captured by
 `onDotliDebugEvent` from `@dotli/truapi-debug/dotli-debug-bus`.
@@ -137,7 +124,8 @@ Dotli-internal host-side orchestration, captured by
 - `resolve:*` — `started`, `phase`, `storage_read`, `completed`,
   `failed`.
 - `render:*` — `iframe_begin`, `iframe_ready`.
-- `bridge:*` — `setup_begin`, `setup_ready`, `nested_detected`.
+- `bridge:*` — `setup_begin`, `setup_ready`,
+  `iframe_load`, `first_inbound`, `first_outbound`.
 - `failover:*` — `chain_backend` (user-triggered backend switch).
 
 ## Views
@@ -152,7 +140,7 @@ A chronological row per event. Each row shows:
 
 - Wall-clock timestamp (HH:MM:SS.mmm).
 - Direction arrow (▶ outgoing, ◀ incoming) for TrUAPI; a layer badge
-  (`boot`, `resolve`, `sso`, …) for system events.
+  (`boot`, `resolve`, `bridge`, …) for system events.
 - Product id (for TrUAPI) or a flow-id badge (for system) — both
   tinted by a stable hash of the id, so rows belonging to the same
   request / flow share a colour.
@@ -220,8 +208,7 @@ Click any row, box, or pill to pin it. The detail pane shows:
 
 ### For system events
 
-- **Core metadata**: time, source (`host-papp` or `dotli`), layer,
-  event, flowId.
+- **Core metadata**: time, source, layer, event, flowId.
 - **Summary** — the short sentence from `system-summary.ts`.
 - **"What is this?"** — a collapsible `<details>` block with a
   long-form paragraph explaining what the subsystem is doing at
@@ -235,7 +222,7 @@ Click any row, box, or pill to pin it. The detail pane shows:
 When a box is clicked in Timeline view, the detail pane stacks every
 member of the box's group chronologically. Each member has its own
 Summary, "What is this?", and payload JSON. This is useful for long
-flows (an SSO pairing, a chainHead.body that streamed N result
+flows (for example, a chainHead.body that streamed N result
 events through its follow subscription): you see the whole sequence
 in one glance.
 
@@ -263,11 +250,9 @@ In the Timeline:
 - A **box** represents a flow that has (or will have) a clear
   beginning and end. Examples: a TrUAPI request → response pair, a
   chainHead.body operation from request → terminal event on its
-  follow subscription, a whole SSO pairing flow, an attestation
-  sequence.
+  follow subscription.
 - A **pill** represents a point-in-time event with no natural end —
-  `failover:chain_backend`, `bridge:nested_detected`, and single-
-  event system flows.
+  `failover:chain_backend` and single-event system flows.
 - **Pending boxes** have a dashed bottom edge. They grow downward
   as time advances; once the terminal event lands, the box snaps to
   its final height.
@@ -286,8 +271,8 @@ their own left-edge column — not boxes.
   (otherwise it'd clutter the view with one-off queries). The
   header shows the chain's friendly name when known (Paseo, Paseo
   Asset Hub, Paseo Bulletin) or a short hex hash otherwise.
-- **System swimlane** — everything from the `host-papp` and `dotli`
-  buses. Always present if any system event is visible.
+- **System swimlane** — everything from the system event buses. Always
+  present if any system event is visible.
 - **Other swimlane** — TrUAPI traffic that isn't chain-related
   (host API calls for signing, storage, accounts, statement store,
   etc.).
@@ -313,10 +298,8 @@ subsequent no-listener emits go back to being silent no-ops.
 This makes the captured boot sequence consistent regardless of
 browser cache warmth.
 
-The TrUAPI hook and the host-papp hook don't need the same
-mechanism in practice: TrUAPI traffic can't start before a product
-iframe is rendered (long after the panel is up), and SSO flows only
-begin on user interaction.
+The TrUAPI hook does not need the same mechanism in practice: traffic cannot
+start before a product iframe is rendered, long after the panel is up.
 
 ### Keyed reconciliation
 
@@ -348,18 +331,16 @@ layer already being observed.
   calls into JSON-RPC over WebSocket. The TrUAPI hook already shows
   the semantic shape; the JSON-RPC layer is just the wire format.
 - **statement-store transport** (encrypt/decrypt, RPC adapter,
-  subscription multiplexer). Pure transport for SSO / session
-  messages; the SSO / session hooks capture the semantic protocol
-  on top.
+  subscription multiplexer). This remains opaque chain traffic at the host
+  boundary.
 - **smoldot internals** (raw log callback stream). Dependency
   chatter, not host logic. The resolver's decision outcomes are
   captured instead.
-- **host-container raw iframe postMessage**. Encoded form of TrUAPI
-  messages already observed in decoded form.
+- **Raw iframe postMessage**. The TrUAPI hook already captures the
+  transport envelope and payload bytes at the bridge boundary. Add
+  method-payload decoding there if the raw bytes become insufficient.
 - **handoff-service file chunking**. Transfer transport, not
   semantic protocol.
-- **Bulletin preimage submission**. Direct forward of the TrUAPI
-  `remote_preimage_submit` request.
 
 If any of these become useful to observe in practice, they can be
 added without restructuring anything: each hook is an independent
@@ -367,22 +348,21 @@ bus and the panel subscribes to all of them.
 
 ## Adding a new hook
 
-1. **Pick the right bus.** If the event originates in the SDK
-   (host-api / host-container / host-papp / statement-store), it
-   belongs in the SDK's bus (and needs an upstream release in
-   `@novasamatech/*`). If it originates in dotli, use the dotli bus.
-2. **Add an event type.** Extend the relevant discriminated union
-   (`DotliDebugEvent`, `HostPappDebugEvent`) with a new variant
-   carrying `layer`, `event`, `flowId`, `timestamp`, and a typed
-   `payload`.
+1. **Pick the right bus.** If the event originates in dotli host
+   orchestration, use the dotli bus. If it originates in TrUAPI traffic
+   use the dotli bus; TrUAPI wire traffic uses the TrUAPI event shape.
+2. **Add an event type.** Extend the relevant discriminated union with
+   a new variant carrying `layer`, `event`, `flowId`, `timestamp`, and a
+   typed `payload`.
 3. **Add a summary.** Extend `system-summary.ts` (one-liner) and
    `system-explanations.ts` (long-form "What is this?").
 4. **Add a flow terminator if needed.** If the new event closes a
-   multi-step flow, add its suffix to `SYSTEM_TERMINATOR_SUFFIXES`
-   in `timeline-layout.ts` so pending-vs-complete is computed right.
-5. **Emit.** Call `emitDotliDebugEvent(...)` or
-   `emitHostPappDebugMessage(...)` at the decision point. Check
-   `hasDotliDebugListeners()` first if payload construction is
+   multi-step flow, add an exact `layer:event` entry to
+   `SYSTEM_TERMINATOR_EVENTS` or, for a true event family, a suffix to
+   `SYSTEM_TERMINATOR_SUFFIXES` in `timeline-layout.ts` so
+   pending-vs-complete is computed right.
+5. **Emit.** Call the matching debug-bus emitter at the decision point.
+   Check `hasDotliDebugListeners()` first if payload construction is
    expensive.
 
 No UI changes required — the filters, swimlanes, and detail pane
diff --git a/packages/truapi-debug/package.json b/packages/truapi-debug/package.json
index 111c2724..5b623416 100644
--- a/packages/truapi-debug/package.json
+++ b/packages/truapi-debug/package.json
@@ -19,10 +19,8 @@
     "vite": "^8.0.16"
   },
   "dependencies": {
+    "@dotli/config": "workspace:*",
     "@dotli/shared": "workspace:*",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-container": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
     "nanoevents": "^9.1.0"
   }
 }
diff --git a/packages/truapi-debug/src/chain-decode.ts b/packages/truapi-debug/src/chain-decode.ts
index 6663f288..413125f2 100644
--- a/packages/truapi-debug/src/chain-decode.ts
+++ b/packages/truapi-debug/src/chain-decode.ts
@@ -4,19 +4,17 @@
 // TrUAPI chain message decoder
 //
 // Pure function that takes a TrUAPI payload tag (e.g.
-// `remote_chain_head_body_request`) plus its already-decoded value and
-// returns the JSON-RPC-level correlation keys the event carries:
-// `genesisHash`, `followSubscriptionId`, `operationId`, `blockHash`,
-// and (for follow receive events) the ChainHeadEvent variant tag.
+// `remote_chain_head_body_request`) plus an already-decoded value and returns
+// the JSON-RPC-level correlation keys the event carries: `genesisHash`,
+// `followSubscriptionId`, `operationId`, `blockHash`, and (for follow receive
+// events) the ChainHeadEvent variant tag.
 //
-// The hook in @novasamatech/host-container delivers payloads in
-// already-decoded form (scale-ts conventions: Hex becomes a hex string,
-// Option becomes T|undefined, Nullable becomes T|null, Enum becomes
-// {tag, value}, Result becomes {success, value}), so this module is a
-// shape-matching walk, not a SCALE decode.
+// Current dotli producers emit wire metadata plus raw SCALE bytes:
+// `{ wireId, bytes }`. Those raw payloads intentionally return null here.
+// The shape-matching decoder below is retained for any producer that opts into
+// method-payload decoding before insertion.
 //
-// Shapes mirror packages/host-api/src/protocol/v1/chainInteraction.ts
-// in the triangle-js-sdks repo.
+// Shapes mirror the TrUAPI chain callback payloads.
 
 /** High-level categorisation of a chain message. Direction (request vs
  *  response vs subscription start/receive) is already known from the
@@ -105,6 +103,9 @@ export function decodeChainAnnotations(
   tag: string,
   rawPayload: unknown,
 ): ChainAnnotations | null {
+  if (isRawWirePayload(rawPayload)) {
+    return null;
+  }
   const payload = peelVersion(rawPayload);
   switch (tag) {
     // chainHead.follow subscription
@@ -253,6 +254,18 @@ export function decodeChainAnnotations(
   }
 }
 
+function isRawWirePayload(payload: unknown): boolean {
+  const obj = asObj(payload);
+  return (
+    typeof obj?.wireId === "number" &&
+    (obj.bytes instanceof Uint8Array ||
+      (typeof obj.bytes === "object" &&
+        obj.bytes !== null &&
+        (obj.bytes as { constructor?: { name?: string } }).constructor?.name ===
+          "Uint8Array"))
+  );
+}
+
 /**
  * Human-readable label for a row, derived from the annotations. The
  * original TrUAPI method tag stays available on the event, so this label
@@ -408,12 +421,10 @@ function extractErrorReason(v: unknown): string | undefined {
   if (o === undefined) {
     return undefined;
   }
-  // `Err()` from @novasamatech/scale wraps struct data in an Error
-  // instance whose payload holds the struct, so `.payload.reason` is the
-  // canonical location. Top-level `.reason` is kept as a fallback in
-  // case a future error shape skips the Error wrapper, and the Error's
-  // `.message` is the last resort so we never render "err: ?" when
-  // there's a usable string somewhere on the value.
+  // Error-shaped decoded values can carry structured details in
+  // `.payload.reason`. Top-level `.reason` is kept as a fallback, and the
+  // Error's `.message` is the last resort so we never render "err: ?"
+  // when there's a usable string somewhere on the value.
   const payload = asObj(o.payload);
   const reason = asString(payload?.reason) ?? asString(o.reason);
   if (reason !== undefined) {
diff --git a/packages/truapi-debug/src/chain-summary.ts b/packages/truapi-debug/src/chain-summary.ts
index 2ffc3d93..ffe86c03 100644
--- a/packages/truapi-debug/src/chain-summary.ts
+++ b/packages/truapi-debug/src/chain-summary.ts
@@ -3,10 +3,10 @@
 
 // Human-readable summary of a chain-protocol message
 //
-// Translates the decoded payload of a `remote_chain_*` TrUAPI message
-// into a single-sentence description. Used in the detail pane so a
-// reader doesn't have to parse the JSON to understand what a message
-// is doing.
+// Translates an already-decoded `remote_chain_*` TrUAPI payload into a
+// single-sentence description. Current dotli wire-frame events carry raw SCALE
+// bytes, so this helper is only used by producers that decode method payloads
+// before inserting debug events.
 //
 // Returns `null` for non-chain messages or unknown shapes. The caller
 // omits the summary section when null.
diff --git a/packages/truapi-debug/src/dotli-debug-bus.ts b/packages/truapi-debug/src/dotli-debug-bus.ts
index b31b5e59..4ef7178f 100644
--- a/packages/truapi-debug/src/dotli-debug-bus.ts
+++ b/packages/truapi-debug/src/dotli-debug-bus.ts
@@ -4,11 +4,9 @@
 // dotli-internal debug event bus
 //
 // Module-global pub/sub for boot / resolve / render / bridge / failover
-// events. Mirrors the lazy-subscription pattern used by
-// `onHostApiDebugMessage` and `onHostPappDebugMessage` so emit cost
-// stays near zero when no listener is attached (the primary code path
-// checks `hasDotliDebugListeners()` before constructing expensive
-// payloads).
+// events. The emit path stays near zero-cost when no listener is attached
+// because the primary code path checks `hasDotliDebugListeners()` before
+// constructing expensive payloads.
 //
 // Runtime gate: the bus stays `null` until `enableDotliDebugBuffering()`
 // flips it on. That call is made by `resolveTruapiDebugMode()` in
@@ -24,9 +22,12 @@
 import { createNanoEvents } from "nanoevents";
 
 import type { DotliDebugEvent } from "./dotli-debug-types.ts";
+import type { TruapiDebugMessageEvent } from "./event-store.ts";
+
+export type DotliDebugBusEvent = DotliDebugEvent | TruapiDebugMessageEvent;
 
 let bus: ReturnType<
-  typeof createNanoEvents<{ event: (e: DotliDebugEvent) => void }>
+  typeof createNanoEvents<{ event: (e: DotliDebugBusEvent) => void }>
 > | null = null;
 let listenerCount = 0;
 
@@ -46,7 +47,7 @@ let listenerCount = 0;
  */
 const BUFFER_MAX = 512;
 let bufferingEnabled = false;
-let bufferedEvents: DotliDebugEvent[] = [];
+let bufferedEvents: DotliDebugBusEvent[] = [];
 
 function noopUnsubscribe(): void {
   /* prod stub returned from `onDotliDebugEvent` when the bus is disabled */
@@ -58,13 +59,13 @@ function noopUnsubscribe(): void {
  * decision to enable the debug panel, before any emit site runs.
  */
 export function enableDotliDebugBuffering(): void {
-  bus ??= createNanoEvents<{ event: (e: DotliDebugEvent) => void }>();
+  bus ??= createNanoEvents<{ event: (e: DotliDebugBusEvent) => void }>();
   bufferingEnabled = true;
 }
 
 /** Emit a debug event. Silent no-op when no listener is attached
  *  AND buffering is off. */
-export function emitDotliDebugEvent(event: DotliDebugEvent): void {
+export function emitDotliDebugEvent(event: DotliDebugBusEvent): void {
   if (bus === null) {
     return;
   }
@@ -95,7 +96,7 @@ export function hasDotliDebugListeners(): boolean {
  * is a catch-up mechanism, not a persistent replay log).
  */
 export function onDotliDebugEvent(
-  callback: (event: DotliDebugEvent) => void,
+  callback: (event: DotliDebugBusEvent) => void,
 ): () => void {
   if (bus === null) {
     return noopUnsubscribe;
diff --git a/packages/truapi-debug/src/dotli-debug-types.ts b/packages/truapi-debug/src/dotli-debug-types.ts
index 8ccfb86b..f7a37531 100644
--- a/packages/truapi-debug/src/dotli-debug-types.ts
+++ b/packages/truapi-debug/src/dotli-debug-types.ts
@@ -6,9 +6,7 @@
 // Events emitted by dotli host-side logic that is independent of the
 // TrUAPI transport: boot orchestration, resolver phases, render +
 // bridge-setup lifecycles, and backend failover decisions. These
-// complement the host-papp SSO/session events (which come from the
-// SDK) and the TrUAPI host-to-product message events (from
-// `@novasamatech/host-container`).
+// complement the TrUAPI host-to-product message events.
 //
 // Events are point-in-time OR paired start/end. The consumer decides
 // rendering: multi-event flows (same `flowId`) become boxes, single-
@@ -417,17 +415,6 @@ export type BridgeEvent =
         label: string;
         productId: string;
       };
-    }
-  | {
-      layer: "bridge";
-      event: "nested_detected";
-      flowId: string;
-      timestamp: number;
-      payload: {
-        label: string;
-        productId: string;
-        nestedIndex: number;
-      };
     };
 
 /** Backend failover decisions (chain backend switch on resolution error). */
diff --git a/packages/truapi-debug/src/event-store.ts b/packages/truapi-debug/src/event-store.ts
index d50be4d3..88e592b5 100644
--- a/packages/truapi-debug/src/event-store.ts
+++ b/packages/truapi-debug/src/event-store.ts
@@ -3,24 +3,21 @@
 
 // TrUAPI debug event store
 //
-// Ring buffer of debug events from three sources:
-//   - TrUAPI host-to-product messages (from @novasamatech/host-container).
-//   - Host-papp SSO/attestation/session events (from @novasamatech/host-papp).
-//   - dotli-internal boot/resolve/render/bridge/failover events (from
-//     @dotli/truapi-debug/dotli-debug-bus).
-//
-// All three sources store through the same ring and correlation index so
-// the panel treats them uniformly. A discriminated `kind` field keeps
-// the shape legible. `truapi` events carry a `requestId`, `system`
-// events (SDK plus dotli) carry a `flowId`. Both serve as the
-// correlation key used by `firstInGroup` and `eventsInGroup`.
+// Ring buffer of debug events from TrUAPI wire frames and dotli-internal
+// boot/resolve/render/bridge/failover sources.
 //
 // Events are never mutated after insertion.
 
-import type { HostApiDebugMessageEvent } from "@novasamatech/host-container";
-import type { HostPappDebugEvent } from "@novasamatech/host-papp/debug";
 import type { DotliDebugEvent } from "./dotli-debug-types.ts";
 
+export interface TruapiDebugMessageEvent {
+  kind: "truapi";
+  direction: "incoming" | "outgoing";
+  productId?: string;
+  requestId: string;
+  payload: { tag: string; value: unknown };
+}
+
 /** Monotonic sequence number assigned at insertion time. Stable, unique, and sortable. */
 export type EventSeq = number;
 
@@ -28,7 +25,7 @@ export interface StoredTruapiEvent {
   kind: "truapi";
   seq: EventSeq;
   receivedAt: number;
-  direction: HostApiDebugMessageEvent["direction"];
+  direction: TruapiDebugMessageEvent["direction"];
   productId: string | undefined;
   /** Correlation key for TrUAPI groups (request/response, subscription). */
   requestId: string;
@@ -40,8 +37,7 @@ export interface StoredSystemEvent {
   kind: "system";
   seq: EventSeq;
   receivedAt: number;
-  /** Which bus produced the event. `host-papp` for SDK-originated ones. */
-  source: "host-papp" | "dotli";
+  source: "dotli";
   layer: string;
   event: string;
   /** Correlation key for multi-event system flows (one flow = one box). */
@@ -102,11 +98,10 @@ export class EventStore {
   }
 
   /** Insert a TrUAPI host-to-product event. */
-  insertTruapi(ev: HostApiDebugMessageEvent): void {
+  insertTruapi(ev: TruapiDebugMessageEvent): void {
     if (this.paused) {
       return;
     }
-    const payload = ev.payload as { tag: string; value: unknown };
     const stored: StoredTruapiEvent = {
       kind: "truapi",
       seq: this.nextSeq++,
@@ -114,26 +109,8 @@ export class EventStore {
       direction: ev.direction,
       productId: ev.productId,
       requestId: ev.requestId,
-      tag: payload.tag,
-      payload: payload.value,
-    };
-    this.pushAndEvict(stored);
-  }
-
-  /** Insert a host-papp SDK-originated system event (SSO/session/attestation). */
-  insertHostPapp(ev: HostPappDebugEvent): void {
-    if (this.paused) {
-      return;
-    }
-    const stored: StoredSystemEvent = {
-      kind: "system",
-      seq: this.nextSeq++,
-      receivedAt: ev.timestamp,
-      source: "host-papp",
-      layer: ev.layer,
-      event: ev.event,
-      flowId: ev.flowId,
-      payload: ev.payload,
+      tag: ev.payload.tag,
+      payload: ev.payload.value,
     };
     this.pushAndEvict(stored);
   }
diff --git a/packages/truapi-debug/src/index.ts b/packages/truapi-debug/src/index.ts
index e8e3d574..f61a6364 100644
--- a/packages/truapi-debug/src/index.ts
+++ b/packages/truapi-debug/src/index.ts
@@ -3,8 +3,7 @@
 
 // TrUAPI debug package public API.
 //
-// Host-side debug panel that listens to the experimental
-// `onHostApiDebugMessage` hook from `@novasamatech/host-container` and
-// renders every host <-> product message in a docked, filterable panel.
+// Host-side debug panel that renders dotli-internal events in a docked,
+// filterable panel.
 
 export { setupTruapiDebugPanel, type SetupOptions } from "./panel.ts";
diff --git a/packages/truapi-debug/src/panel.ts b/packages/truapi-debug/src/panel.ts
index 30e3e7d8..687ab4d6 100644
--- a/packages/truapi-debug/src/panel.ts
+++ b/packages/truapi-debug/src/panel.ts
@@ -3,18 +3,14 @@
 
 // TrUAPI debug panel DOM and interaction.
 //
-// A docked, resizable panel that lists every host <-> product message
-// observed via the experimental `onHostApiDebugMessage` hook from
-// `@novasamatech/host-container`. Intended for host-side debugging only;
-// gated behind a feature flag in `apps/host`.
+// A docked, resizable panel that lists dotli-internal debug events. Intended
+// for host-side debugging only; gated behind a feature flag in `apps/host`.
 //
 // All DOM is created lazily on `setupTruapiDebugPanel()` and torn down
 // by the returned dispose function. Stylesheet is injected once per
 // document, keyed by id.
 
 import { escapeHtml } from "@dotli/shared/html";
-import { onHostApiDebugMessage } from "@novasamatech/host-container";
-import { onHostPappDebugMessage } from "@novasamatech/host-papp/debug";
 import {
   decodeChainAnnotations,
   formatChainLabel,
@@ -32,6 +28,7 @@ import {
   type StoredTruapiEvent,
 } from "./event-store.ts";
 import { EventStore } from "./event-store.ts";
+import type { DotliDebugBusEvent } from "./dotli-debug-bus.ts";
 import {
   initialFilterState,
   matches,
@@ -54,6 +51,12 @@ const DEBUG_SESSION_KEY = "dotli:truapi-debug";
 
 type DockPosition = "bottom" | "right";
 
+function isTruapiDebugEvent(
+  ev: DotliDebugBusEvent,
+): ev is Extract<DotliDebugBusEvent, { kind: "truapi" }> {
+  return "kind" in ev;
+}
+
 function readStoredDock(): DockPosition {
   try {
     const raw = localStorage.getItem(DOCK_STORAGE_KEY);
@@ -92,8 +95,8 @@ export interface SetupOptions {
  * Install the TrUAPI debug panel into the current document.
  *
  * Creates a single panel bound to the current page, subscribes once to
- * the global host-container debug bus, and returns a dispose function
- * that tears everything down (DOM + subscription).
+ * the dotli debug bus, and returns a dispose function that tears everything
+ * down (DOM + subscription).
  *
  * The panel mounts visible whenever debug mode is on. The header's `×`
  * button exits debug mode entirely (clears the session flag and
@@ -163,14 +166,12 @@ export function setupTruapiDebugPanel(options: SetupOptions = {}): () => void {
   };
 
   const unsubscribeStore = store.subscribe(scheduleRender);
-  const unsubscribeTruapi = onHostApiDebugMessage((ev) => {
-    store.insertTruapi(ev);
-  });
-  const unsubscribeHostPapp = onHostPappDebugMessage((ev) => {
-    store.insertHostPapp(ev);
-  });
   const unsubscribeDotli = onDotliDebugEvent((ev) => {
-    store.insertDotli(ev);
+    if (isTruapiDebugEvent(ev)) {
+      store.insertTruapi(ev);
+    } else {
+      store.insertDotli(ev);
+    }
   });
 
   // Initial render + iframe adjustment.
@@ -178,8 +179,6 @@ export function setupTruapiDebugPanel(options: SetupOptions = {}): () => void {
   adjustIframeForPanel(ui.panel, state);
 
   return () => {
-    unsubscribeTruapi();
-    unsubscribeHostPapp();
     unsubscribeDotli();
     unsubscribeStore();
     window.removeEventListener("dotli:product-loaded", onProductLoaded);
@@ -195,7 +194,7 @@ function adjustIframeForPanel(panel: HTMLElement, state: PanelState): void {
     return;
   }
   const hasTopbar = document.getElementById("topbar") !== null;
-  const topOffset = hasTopbar ? 40 : 0;
+  const topOffset = hasTopbar ? 56 : 0;
   if (state.dock === "right") {
     iframe.style.height = `calc(100vh - ${String(topOffset)}px)`;
     // When collapsed, the 32px header bar overlays the top-right corner
diff --git a/packages/truapi-debug/src/system-explanations.ts b/packages/truapi-debug/src/system-explanations.ts
index d78df618..3deeba90 100644
--- a/packages/truapi-debug/src/system-explanations.ts
+++ b/packages/truapi-debug/src/system-explanations.ts
@@ -143,16 +143,14 @@ The iframe's \`sandbox\` and \`allow\` attributes are configured here based on t
 
   "render:iframe_ready": {
     title: "Product iframe ready",
-    body: `The iframe element is in the DOM and has started navigating to its URL. The product itself has not executed yet — that happens asynchronously as the browser loads the iframe content. Next up is the container bridge setup, which runs in parallel.`,
+    body: `The iframe element is in the DOM and has started navigating to its URL. The product itself has not executed yet — that happens asynchronously as the browser loads the iframe content. Next up is the TrUAPI bridge setup, which runs in parallel.`,
   },
 
   // bridge
 
   "bridge:setup_begin": {
     title: "TrUAPI bridge wiring",
-    body: `Starting to wire the host-container postMessage bridge between the host and the product iframe. This bridge carries **all** TrUAPI traffic: account derivation, transaction signing, chain connections, scoped localStorage, statement-store subscriptions, preimage submission, permissions prompts, push notifications.
-
-A nested-bridge detector is also installed here — it watches for \`postMessage\` from windows other than the primary iframe and dynamically creates additional bridges for dApp-in-dApp compositions.`,
+    body: `Starting to wire the Rust-backed TrUAPI bridge between the host and the product iframe. This bridge carries **all** TrUAPI traffic: account derivation, transaction signing, chain connections, scoped localStorage, statement-store subscriptions, preimage submission, permissions prompts, push notifications.`,
   },
 
   "bridge:setup_ready": {
@@ -185,15 +183,6 @@ Gaps between \`setup_ready\` and \`first_inbound\` mean the product iframe wasn'
 Gaps between \`first_inbound\` and \`first_outbound\` imply a host-side problem (the handler wasn't registered, or the main thread was blocked). Under normal conditions these two events land in the same millisecond.`,
   },
 
-  "bridge:nested_detected": {
-    title: "Nested dApp detected",
-    body: `A product running inside the main iframe is itself embedding another product via a nested iframe. Because \`postMessage\` to \`window.top\` lets any descendant iframe reach the host, the host runs a nested-bridge detector that recognises these new sources and spins up a dedicated TrUAPI container for each.
-
-The inner product gets its own \`productId\` (\`parent:nested-N\`) and its own scoped storage prefix. Its traffic appears on the TrUAPI swimlane tagged with that productId.
-
-There's a cap (\`MAX_NESTED_BRIDGES\` in config) to prevent runaway iframe trees from exhausting resources.`,
-  },
-
   // failover
 
   "failover:chain_backend": {
@@ -309,175 +298,6 @@ This **must** complete before \`document.write\` for multi-file archives — oth
     title: "Sandbox boot failed",
     body: `Something in the fetch / decrypt / store pipeline threw. The sandbox has captured the exception to Sentry with the relevant \`dependency\` tag (\`ipfs-gateway\` / \`helia-bulletin\` / \`unknown\`) and rendered its error UI with a retry button. \`reason\` is the error message from whichever stage threw.`,
   },
-
-  // SSO (host-papp)
-
-  "sso:pairing_started": {
-    title: "Wallet pairing started",
-    body: `\`createPappAdapter().sso.authenticate()\` was called, usually because the user clicked the sign-in button. A fresh sr25519 session account is being derived from a generated mnemonic (it exists only for this session — the real wallet stays on the mobile device).
-
-\`metadata\` is the product-identity string the host passed when instantiating the PappAdapter; the mobile wallet will show this to the user as part of the consent screen.`,
-  },
-
-  "sso:deeplink_generated": {
-    title: "QR code ready",
-    body: `The host has built the handshake payload (session's sr25519 public key + encrypt public key + product metadata + host metadata) and base64-encoded it into a \`polkadotapp://pair?handshake=<hex>\` URL. This URL is rendered as a QR code in the browser.
-
-The \`handshakeTopic\` is a derived statement-store topic. When the wallet scans the QR, decrypts the payload, and responds, it will post its response statement on this specific topic. The host has already subscribed to it by the time this event fires.`,
-  },
-
-  "sso:awaiting_response": {
-    title: "Waiting for wallet scan",
-    body: `The host is now blocked on the statement-store subscription, waiting for a matching response statement to land on the \`handshakeTopic\`. There's no timeout at this layer — the user might scan the QR in 5 seconds or walk away for 20 minutes.
-
-If the user cancels the pairing dialog, an \`AbortError\` propagates and ends the flow with \`sso:pairing_failed\`.`,
-  },
-
-  "sso:response_received": {
-    title: "Wallet response received",
-    body: `The wallet posted its response statement on the handshake topic. The host has decrypted the response sensitive data (using the ECDH-derived shared secret), extracted the wallet's encrypt public key and account id, and instantiated a \`StoredUserSession\` bound to both parties.
-
-The session isn't saved yet — that happens after attestation completes, so a failed attestation doesn't leave an orphaned session.`,
-  },
-
-  "sso:session_established": {
-    title: "Session established",
-    body: `The session has been persisted: session secrets in the \`UserSecretRepository\`, the session itself in the \`UserSessionRepository\`. The session manager's subscriber will pick up the new entry and emit \`session:opened\`.
-
-After this event, the product can obtain signed payloads, request ring-VRF aliases, and receive disconnect signals via the session.`,
-  },
-
-  "sso:pairing_failed": {
-    title: "Wallet pairing failed",
-    body: `The pairing flow terminated without a session. Possible causes:
-
-• User cancelled (AbortError): explicit cancel button on the QR modal.
-• Subscription failure: statement-store could not deliver the response.
-• Decrypt failure: response payload did not decrypt with the expected key — indicates a mismatched protocol version or a malicious response.
-• Attestation parallel failure: the concurrent attestation flow failed, which also aborts pairing.
-
-The UI shows the error message and resets so the user can try again.`,
-  },
-
-  // attestation (host-papp)
-
-  "attestation:started": {
-    title: "Guest identity attestation started",
-    body: `Attestation runs in parallel with SSO pairing. Its job is to register the session's candidate account as a *lite person* on People chain, so the session has a verified guest identity rather than being fully anonymous.
-
-The candidate is a session-scoped sr25519 account — different from the wallet's own identity. The verifier is the Sudo Alice key (in the current testnet setup; production will use a proper registrar).`,
-  },
-
-  "attestation:username_claimed": {
-    title: "Username generated",
-    body: `A random guest username of the form \`guest<4 letters>.<4-digit suffix>\` has been generated client-side. It's not yet on-chain — registration happens at \`person_registered\`. The prefix is what the session presents publicly; the numeric suffix is a disambiguator.`,
-  },
-
-  "attestation:allowance_granted": {
-    title: "Verifier allowance granted",
-    body: `A Sudo-wrapped \`PeopleLite.increase_attestation_allowance\` extrinsic has been submitted and reached best-block confirmation. This gives the verifier credits to vouch for up to N new guest identities (current setting: 10).
-
-This step is idempotent — if the verifier already has sufficient allowance, the call is skipped and this event still fires.`,
-  },
-
-  "attestation:vrf_proof_generated": {
-    title: "VRF ring-proof generated",
-    body: `A ring-VRF proof of membership has been computed via \`verifiablejs\` for the candidate's entropy. This is the cryptographic evidence that the candidate is a legitimate member of the guest ring.
-
-Ring-VRF is zero-knowledge: the proof does not reveal which ring member the candidate corresponds to — only that they are one of them.`,
-  },
-
-  "attestation:person_registered": {
-    title: "Person registered on-chain",
-    body: `The \`PeopleLite.attest\` extrinsic has been submitted (signed by the verifier) and landed at best-block or finalization. The candidate's identity is now live on People chain.
-
-The call bundles the candidate signature, the ring-VRF key + proof, and a \`consumer_registration\` struct that records the username and identifier key. Any future interaction using this session's identity keys will be recognised on-chain.`,
-  },
-
-  "attestation:completed": {
-    title: "Attestation complete",
-    body: `All three on-chain steps (allowance grant, VRF proof, person register) succeeded. The guest identity is live. The parallel SSO pairing flow can now finalise into a saved session.`,
-  },
-
-  "attestation:failed": {
-    title: "Attestation failed",
-    body: `One of the attestation sub-steps threw. Most common causes:
-
-• Allowance extrinsic reverted — verifier out of allowance and sudo-increase failed.
-• VRF proof generation exception — verifiablejs WASM init failed or the entropy was malformed.
-• \`PeopleLite.attest\` rejected — dispatch-error (e.g. duplicate username, invalid signature).
-
-The parallel pairing flow is torn down too. No session is stored.`,
-  },
-
-  // session (host-papp)
-
-  "session:opened": {
-    title: "Session opened",
-    body: `A \`UserSession\` object has been instantiated for a stored session (either a freshly paired one or one restored from storage at host boot). The session is now subscribed to its statement-store channel for peer-originated actions (signing requests, alias responses, disconnect signals).
-
-The session persists across page reloads until explicitly terminated. Multiple sessions can be active simultaneously — each gets its own \`session:opened\` event with a unique \`sessionId\`.`,
-  },
-
-  "session:peer_action_received": {
-    title: "Wallet-originated action arrived",
-    body: `The wallet posted an action on the session's statement-store channel. \`actionKind\` identifies it: \`SignResponse\` (response to a signing request the host initiated), \`RingVrfAliasResponse\`, \`Disconnected\` (user chose to disconnect in the wallet UI), etc.
-
-The host hasn't processed the action yet — the handler will run and emit either \`peer_action_processed\` or \`peer_action_failed\`. Already-processed messages are deduplicated by \`messageId\`.`,
-  },
-
-  "session:peer_action_processed": {
-    title: "Peer action handled",
-    body: `The session's action handler completed.
-
-• \`processed=true\` — the handler recognised the action and acted on it (e.g. a \`Disconnected\` peer-action triggered session removal).
-• \`processed=false\` — the handler didn't match or chose to ignore; the action was accepted but had no effect.`,
-  },
-
-  "session:peer_action_failed": {
-    title: "Peer action handling failed",
-    body: `The action handler threw. Common causes: decrypt failure on the statement data, response came in for a messageId the host doesn't remember, malformed payload. The error is logged; the session continues.`,
-  },
-
-  "session:host_action_sent": {
-    title: "Host-originated action sent",
-    body: `The host is initiating an action to the wallet. Kinds:
-
-• \`SignPayload\` — the wallet needs to sign an extrinsic SignedPayload (a transaction the product wants to submit).
-• \`SignRaw\` — the wallet needs to sign arbitrary bytes (common for off-chain auth, not transactions).
-• \`RingVrfAliasRequest\` — the wallet should derive a product-scoped alias via ring-VRF.
-• \`Disconnect\` — the host is tearing down the session and informing the wallet.
-
-The action is encrypted and posted on the session's channel. The host is now waiting for a matching response statement.`,
-  },
-
-  "session:host_action_response_received": {
-    title: "Wallet responded to host action",
-    body: `The wallet posted its response on the session's channel and the host decrypted it.
-
-• \`success=true\` — the wallet approved; the response carries the signature or alias (payload-dependent).
-• \`success=false\` — the wallet declined or errored; the response carries a failure reason. The caller (product) will see an error.
-
-Distinct from \`host_action_failed\`, which is a transport-level failure (no response at all).`,
-  },
-
-  "session:host_action_failed": {
-    title: "Host action transport failure",
-    body: `The statement-store request/await machinery errored before a response could arrive. Possible causes: the peer took too long and the host gave up, the session's channel was torn down mid-request, or the response decrypt failed (wrong key or corrupted payload).
-
-Different from \`host_action_response_received\` with \`success=false\`, which is a business-level decline by the wallet.`,
-  },
-
-  "session:terminated": {
-    title: "Session terminated",
-    body: `A session has been removed from the repository. This happens on:
-
-• Explicit host disconnect — \`sessionManager.disconnect(session)\`, typically from a log-out click.
-• Explicit peer disconnect — the wallet posted a \`Disconnected\` peer-action (user logged out on their phone).
-• Global clear — all sessions wiped (e.g. on a "full reset" flow).
-
-After this event, no further peer-actions or host-actions are delivered on this \`sessionId\`.`,
-  },
 };
 
 /**
diff --git a/packages/truapi-debug/src/system-summary.ts b/packages/truapi-debug/src/system-summary.ts
index 414240c8..9b911edb 100644
--- a/packages/truapi-debug/src/system-summary.ts
+++ b/packages/truapi-debug/src/system-summary.ts
@@ -73,8 +73,6 @@ export function summariseSystemEvent(ev: StoredSystemEvent): string {
       return `First message from product received (productId=${str(p.productId)}).`;
     case "bridge:first_outbound":
       return `First message sent to product — bridge traffic established (productId=${str(p.productId)}).`;
-    case "bridge:nested_detected":
-      return `Nested dApp #${str(p.nestedIndex)} detected (productId=${str(p.productId)}).`;
 
     // failover
     case "failover:chain_backend":
@@ -119,54 +117,6 @@ export function summariseSystemEvent(ev: StoredSystemEvent): string {
     case "sandbox:failed":
       return `Sandbox failed: ${str(p.reason)}.`;
 
-    // SSO (host-papp)
-    case "sso:pairing_started":
-      return `Wallet pairing started (product metadata=${str(p.metadata)}).`;
-    case "sso:deeplink_generated":
-      return `Pairing deeplink generated. QR ready for scan.`;
-    case "sso:awaiting_response":
-      return "Waiting for wallet response on handshake topic.";
-    case "sso:response_received":
-      return `Wallet response received (identity account).`;
-    case "sso:session_established":
-      return `Session ${str(p.sessionId)} established.`;
-    case "sso:pairing_failed":
-      return `Wallet pairing failed: ${str(p.reason)}.`;
-
-    // attestation (host-papp)
-    case "attestation:started":
-      return `Starting guest identity attestation for candidate ${str(p.candidateAccountId)}.`;
-    case "attestation:username_claimed":
-      return `Username claimed: ${str(p.username)}.`;
-    case "attestation:allowance_granted":
-      return `Verifier allowance granted (${str(p.verifierAccountId)}).`;
-    case "attestation:vrf_proof_generated":
-      return "VRF ring-proof generated for candidate.";
-    case "attestation:person_registered":
-      return `Registered ${str(p.username)} on People chain.`;
-    case "attestation:completed":
-      return `Attestation complete for ${str(p.username)}.`;
-    case "attestation:failed":
-      return `Attestation failed: ${str(p.reason)}.`;
-
-    // session (host-papp)
-    case "session:opened":
-      return `Session ${str(p.sessionId)} opened.`;
-    case "session:peer_action_received":
-      return `Peer action received: ${str(p.actionKind)} (msg=${str(p.messageId)}).`;
-    case "session:peer_action_processed":
-      return `Peer action processed (msg=${str(p.messageId)}).`;
-    case "session:peer_action_failed":
-      return `Peer action failed (msg=${str(p.messageId)}): ${str(p.reason)}.`;
-    case "session:host_action_sent":
-      return `Host sent ${str(p.actionKind)} to wallet (msg=${str(p.messageId)}).`;
-    case "session:host_action_response_received":
-      return `Wallet responded to ${str(p.messageId)} (success=${String(p.success)}).`;
-    case "session:host_action_failed":
-      return `Host action failed (msg=${str(p.messageId)}): ${str(p.reason)}.`;
-    case "session:terminated":
-      return `Session ${str(p.sessionId)} terminated.`;
-
     default:
       return `${ev.layer}:${ev.event}`;
   }
diff --git a/packages/truapi-debug/src/timeline-layout.ts b/packages/truapi-debug/src/timeline-layout.ts
index 82385351..f3533a1e 100644
--- a/packages/truapi-debug/src/timeline-layout.ts
+++ b/packages/truapi-debug/src/timeline-layout.ts
@@ -652,7 +652,7 @@ function segmentForGroup(
  * point-in-time system events (boot phases, failover decisions, etc.)
  * still occupy a lane position at the right Y. `pending` is true for
  * flows whose first event is a "start" kind without a matching end
- * event in the buffer. See SYSTEM_TERMINATOR_SUFFIXES.
+ * event in the buffer. See `isSystemFlowTerminator`.
  */
 function systemSegmentForGroup(
   group: StoredSystemEvent[],
@@ -688,24 +688,21 @@ function systemSegmentDetail(
   return `${first.layer}·${String(all.length)} step${all.length === 1 ? "" : "s"}`;
 }
 
-/** Events that close a multi-step system flow. Mirrors the pairs we
- *  document in the detail pane so visual pending state matches intent. */
+/** Exact layer:event names that close a multi-step system flow. */
+const SYSTEM_TERMINATOR_EVENTS: ReadonlySet<string> = new Set([
+  "boot:ready",
+  "boot:landing_page_shown",
+  "bridge:first_outbound",
+  "render:iframe_ready",
+  "sandbox:document_written",
+  "main:monitor_stopped",
+]);
+
+/** Suffixes that close error/completion families without listing every event. */
 const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
-  "ready",
   "failed",
-  "landing_page_shown",
   "completed",
-  "session_established",
-  "pairing_failed",
   "terminated",
-  "iframe_ready",
-  // `setup_ready` does not close the bridge flow. It only means the
-  // host is listening, and the product can stay silent for many seconds
-  // after that (iframe still loading, sandbox relay not ready). The
-  // bridge flow stays open until bidirectional traffic is observed via
-  // `first_outbound`.
-  "first_outbound",
-  "document_written",
   "peer_action_processed",
   "peer_action_failed",
   "host_action_response_received",
@@ -714,10 +711,13 @@ const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
   "resolve_failed",
 ];
 
-function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
+export function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
   const event = ev.event;
+  if (SYSTEM_TERMINATOR_EVENTS.has(`${ev.layer}:${event}`)) {
+    return true;
+  }
   return SYSTEM_TERMINATOR_SUFFIXES.some(
-    (suf) => event === suf || event.endsWith(`_${suf}`) || event === suf,
+    (suf) => event === suf || event.endsWith(`_${suf}`),
   );
 }
 
diff --git a/packages/typescript-config/paths.json b/packages/typescript-config/paths.json
index 177ce792..5fea6f40 100644
--- a/packages/typescript-config/paths.json
+++ b/packages/typescript-config/paths.json
@@ -2,7 +2,6 @@
   "$schema": "https://json.schemastore.org/tsconfig",
   "compilerOptions": {
     "paths": {
-      "@dotli/auth/*": ["../auth/src/*"],
       "@dotli/config/*": ["../config/src/*"],
       "@dotli/content/*": ["../content/src/*"],
       "@dotli/metrics/*": ["../metrics/src/*"],
diff --git a/packages/ui/package.json b/packages/ui/package.json
index dba89f26..712b6db5 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -31,25 +31,20 @@
     "@dotli/shared": "workspace:*",
     "@dotli/storage": "workspace:*",
     "@dotli/truapi-debug": "workspace:*",
+    "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "@novasamatech/host-api": "0.8.9",
-    "@novasamatech/host-container": "0.8.9",
-    "@novasamatech/host-papp": "0.8.9",
-    "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/statement-store": "0.8.9",
+    "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
+    "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
     "@polkadot-api/json-rpc-provider": "^0.2.0",
+    "@scure/base": "^2.2.0",
     "neverthrow": "^8.2.0",
     "polkadot-api": "^2.1.6",
     "qrcode": "^1.5.4"
   },
   "peerDependencies": {
-    "@dotli/auth": "workspace:*",
     "@dotli/resolver": "workspace:*"
   },
   "peerDependenciesMeta": {
-    "@dotli/auth": {
-      "optional": true
-    },
     "@dotli/resolver": {
       "optional": true
     }
diff --git a/packages/ui/src/allocation-modal.ts b/packages/ui/src/allocation-modal.ts
deleted file mode 100644
index 09afa998..00000000
--- a/packages/ui/src/allocation-modal.ts
+++ /dev/null
@@ -1,341 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Allowance request modal.
- *
- * Lists the resources a product wants pre-allocated and runs the wallet
- * round-trip on Allow. On error the modal stays open so the user can retry.
- */
-
-import type {
-  AllocatableResource,
-  AllocationOutcome,
-  CodecType,
-} from "@novasamatech/host-api";
-
-export type AllocatableResourceValue = CodecType<typeof AllocatableResource>;
-export type AllocationOutcomeValue = CodecType<typeof AllocationOutcome>;
-
-/** Optional dependencies for {@link showAllocationRequestModal}. */
-export interface AllocationModalOptions {
-  /**
-   * Resolve the SS58 address of the app account that auto-signs for a
-   * `SmartContractAllowance` at the given derivation index. When provided, the
-   * smart-contract line gets an info tooltip naming that account; when omitted
-   * (e.g. in unit tests) the tooltip is simply not rendered.
-   */
-  resolveContractAccount?: (index: number) => string;
-}
-
-// Feather-style glyphs, inlined to match the rest of the UI (see topbar.ts).
-const INFO_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg>';
-const COPY_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="9" y="9" width="13" height="13" rx="2" ry="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg>';
-const CHECK_ICON_SVG =
-  '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
-const CHEVRON_ICON_SVG =
-  '<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>';
-
-let tooltipSeq = 0;
-
-/**
- * A `setTimeout` wrapper whose `schedule()` (re)starts the timer, replacing any
- * pending run, and `cancel()` clears it — keeps the clear-then-set bookkeeping
- * in one place.
- */
-function resettableTimeout(
-  action: () => void,
-  delayMs: number,
-): { schedule: () => void; cancel: () => void } {
-  let id: ReturnType<typeof setTimeout> | undefined;
-  const cancel = (): void => {
-    if (id !== undefined) {
-      clearTimeout(id);
-      id = undefined;
-    }
-  };
-  return {
-    cancel,
-    schedule: () => {
-      cancel();
-      id = setTimeout(action, delayMs);
-    },
-  };
-}
-
-/**
- * Build the info icon + hover/focus tooltip naming the app account that will
- * auto-sign smart-contract calls. The tooltip is `position: fixed` (placed via
- * JS on reveal) so it escapes the `.signing-fields` overflow clip.
- */
-function buildContractAccountInfo(index: number, address: string): HTMLElement {
-  const wrap = document.createElement("span");
-  wrap.className = "allocation-info-wrap";
-
-  const tooltipId = `allocation-account-tip-${String(++tooltipSeq)}`;
-
-  const icon = document.createElement("span");
-  icon.className = "allocation-info-icon";
-  icon.tabIndex = 0;
-  icon.setAttribute("role", "button");
-  icon.setAttribute("aria-label", "Show signing account");
-  icon.setAttribute("aria-describedby", tooltipId);
-  icon.innerHTML = INFO_ICON_SVG;
-  wrap.appendChild(icon);
-
-  const tooltip = document.createElement("span");
-  tooltip.className = "allocation-tooltip";
-  tooltip.id = tooltipId;
-  tooltip.setAttribute("role", "tooltip");
-
-  const title = document.createElement("span");
-  title.className = "allocation-tooltip-title";
-  title.textContent =
-    "Following accounts will sign contract calls automatically:";
-  tooltip.appendChild(title);
-
-  // Keep the SS58 address tucked behind a native disclosure so the tooltip
-  // stays compact; the summary names the account, expanding reveals the
-  // address + copy button.
-  const details = document.createElement("details");
-  details.className = "allocation-account";
-
-  const summary = document.createElement("summary");
-  summary.className = "allocation-account-summary";
-
-  const accountLabel = document.createElement("span");
-  accountLabel.className = "allocation-account-label";
-  accountLabel.textContent = `App account with index ${String(index)}`;
-  summary.appendChild(accountLabel);
-
-  const chevron = document.createElement("span");
-  chevron.className = "allocation-account-chevron";
-  chevron.innerHTML = CHEVRON_ICON_SVG;
-  summary.appendChild(chevron);
-
-  details.appendChild(summary);
-
-  const body = document.createElement("div");
-  body.className = "allocation-account-body";
-
-  const addr = document.createElement("span");
-  addr.className = "allocation-account-address";
-  addr.textContent = address;
-  body.appendChild(addr);
-
-  const copyBtn = document.createElement("button");
-  copyBtn.type = "button";
-  copyBtn.className = "allocation-account-copy";
-  copyBtn.title = "Copy address";
-  copyBtn.setAttribute("aria-label", "Copy address");
-  copyBtn.innerHTML = COPY_ICON_SVG;
-  const resetCopied = resettableTimeout(() => {
-    copyBtn.classList.remove("copied");
-    copyBtn.innerHTML = COPY_ICON_SVG;
-  }, 1000);
-  copyBtn.addEventListener("click", (e) => {
-    // Don't let the click bubble to the backdrop (which dismisses the modal).
-    e.stopPropagation();
-    void navigator.clipboard.writeText(address).then(() => {
-      copyBtn.classList.add("copied");
-      copyBtn.innerHTML = CHECK_ICON_SVG;
-      resetCopied.schedule();
-    });
-  });
-  body.appendChild(copyBtn);
-
-  details.appendChild(body);
-  tooltip.appendChild(details);
-
-  wrap.appendChild(tooltip);
-
-  // Place the fixed tooltip just under the icon, flipping above / clamping to
-  // the viewport when it would overflow. Runs in the reveal handler (before
-  // paint) so there's no flash at the origin.
-  const place = (): void => {
-    const iconRect = icon.getBoundingClientRect();
-    const tipRect = tooltip.getBoundingClientRect();
-    const gap = 8;
-    let top = iconRect.bottom + gap;
-    if (top + tipRect.height > window.innerHeight - gap) {
-      top = Math.max(gap, iconRect.top - gap - tipRect.height);
-    }
-    let left = iconRect.left;
-    if (left + tipRect.width > window.innerWidth - gap) {
-      left = window.innerWidth - gap - tipRect.width;
-    }
-    tooltip.style.top = `${String(Math.round(top))}px`;
-    tooltip.style.left = `${String(Math.round(Math.max(gap, left)))}px`;
-  };
-  // Drive visibility from JS (via the `is-open` class) rather than pure CSS
-  // `:hover`, so we can keep the tooltip open for a beat after the pointer
-  // leaves. Otherwise crossing the gap between the icon and the fixed tooltip
-  // drops `:hover` and hides it before the user can reach it to expand.
-  const CLOSE_DELAY_MS = 300;
-  const closeTooltip = resettableTimeout(() => {
-    wrap.classList.remove("is-open");
-  }, CLOSE_DELAY_MS);
-  const open = (): void => {
-    closeTooltip.cancel();
-    wrap.classList.add("is-open");
-    place();
-  };
-  wrap.addEventListener("mouseenter", open);
-  wrap.addEventListener("mouseleave", closeTooltip.schedule);
-  wrap.addEventListener("focusin", open);
-  wrap.addEventListener("focusout", closeTooltip.schedule);
-  // Expanding/collapsing changes the tooltip height — re-anchor so it doesn't
-  // spill off-screen.
-  details.addEventListener("toggle", place);
-
-  return wrap;
-}
-
-function describeResource(resource: AllocatableResourceValue): string {
-  switch (resource.tag) {
-    case "StatementStoreAllowance":
-      return "Post statements on your behalf";
-    case "BulletinAllowance":
-      return "Publish bulletin posts on your behalf";
-    case "SmartContractAllowance":
-      return "Sign smart-contract calls automatically";
-    case "AutoSigning":
-      return "Sign transactions automatically";
-    default: {
-      const exhaustive: never = resource;
-      return exhaustive;
-    }
-  }
-}
-
-/** Show an allowance request modal and run `performAllocation` on confirm. */
-export function showAllocationRequestModal(
-  productLabel: string,
-  resources: AllocatableResourceValue[],
-  performAllocation: () => Promise<AllocationOutcomeValue[]>,
-  options: AllocationModalOptions = {},
-): Promise<AllocationOutcomeValue[]> {
-  return new Promise((resolve, reject) => {
-    const backdrop = document.createElement("div");
-    backdrop.className = "signing-modal-backdrop";
-
-    const modal = document.createElement("div");
-    modal.className = "signing-modal";
-
-    const heading = document.createElement("h2");
-    heading.textContent = "Allowance request";
-    modal.appendChild(heading);
-
-    const description = document.createElement("div");
-    description.className = "signing-fields";
-
-    const productField = document.createElement("div");
-    productField.className = "signing-field";
-
-    const productFieldLabel = document.createElement("div");
-    productFieldLabel.className = "signing-field-label";
-    productFieldLabel.textContent = "Application";
-    productField.appendChild(productFieldLabel);
-
-    const productFieldValue = document.createElement("div");
-    productFieldValue.className = "signing-field-value";
-    productFieldValue.textContent = productLabel;
-    productField.appendChild(productFieldValue);
-
-    description.appendChild(productField);
-
-    const resourcesField = document.createElement("div");
-    resourcesField.className = "signing-field";
-
-    const resourcesLabel = document.createElement("div");
-    resourcesLabel.className = "signing-field-label";
-    resourcesLabel.textContent = "Requested allowances";
-    resourcesField.appendChild(resourcesLabel);
-
-    const list = document.createElement("ul");
-    list.className = "allocation-modal-list";
-    for (const resource of resources) {
-      const item = document.createElement("li");
-      item.textContent = describeResource(resource);
-      if (
-        resource.tag === "SmartContractAllowance" &&
-        options.resolveContractAccount
-      ) {
-        const address = options.resolveContractAccount(resource.value);
-        item.appendChild(buildContractAccountInfo(resource.value, address));
-      }
-      list.appendChild(item);
-    }
-    resourcesField.appendChild(list);
-
-    description.appendChild(resourcesField);
-
-    const errorBox = document.createElement("div");
-    errorBox.className = "allocation-modal-error";
-    errorBox.style.display = "none";
-    description.appendChild(errorBox);
-
-    modal.appendChild(description);
-
-    const footer = document.createElement("div");
-    footer.className = "signing-modal-footer";
-
-    const cancelBtn = document.createElement("button");
-    cancelBtn.className = "signing-btn-cancel";
-    cancelBtn.textContent = "Cancel";
-    footer.appendChild(cancelBtn);
-
-    const allowBtn = document.createElement("button");
-    allowBtn.className = "signing-btn-sign";
-    allowBtn.textContent = "Allow";
-    footer.appendChild(allowBtn);
-
-    modal.appendChild(footer);
-    backdrop.appendChild(modal);
-    document.body.appendChild(backdrop);
-
-    function cleanup(): void {
-      backdrop.remove();
-    }
-
-    function setPending(pending: boolean): void {
-      cancelBtn.disabled = pending;
-      allowBtn.disabled = pending;
-      allowBtn.textContent = pending ? "Allocating..." : "Allow";
-    }
-
-    function showError(message: string): void {
-      errorBox.textContent = message;
-      errorBox.style.display = "";
-    }
-
-    cancelBtn.addEventListener("click", () => {
-      cleanup();
-      reject(new Error("User cancelled allowance request"));
-    });
-
-    allowBtn.addEventListener("click", () => {
-      errorBox.style.display = "none";
-      setPending(true);
-      performAllocation().then(
-        (outcomes) => {
-          cleanup();
-          resolve(outcomes);
-        },
-        (error: unknown) => {
-          setPending(false);
-          showError(error instanceof Error ? error.message : String(error));
-        },
-      );
-    });
-
-    backdrop.addEventListener("click", (e) => {
-      if (e.target === backdrop && !allowBtn.disabled) {
-        cleanup();
-        reject(new Error("User dismissed allowance request"));
-      }
-    });
-  });
-}
diff --git a/packages/ui/src/bridge.ts b/packages/ui/src/bridge.ts
index 8dc420ee..b139adef 100644
--- a/packages/ui/src/bridge.ts
+++ b/packages/ui/src/bridge.ts
@@ -1,13 +1,26 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// dot.li Host-container bridge
+// dot.li — TrUAPI host bridge
+//
+// Boots a WASM TrUAPI core instance and connects it to a sandboxed
+// product iframe via `@parity/truapi-host`. Each render swaps the running
+// runtime, so disposing the last host tears down both the iframe and
+// the core.
 //
-// Connects embedded dApps to host services (accounts, signing, chain
-// connections, scoped storage) via postMessage protocol.
-// Only imported by the host build, keeps smoldot and auth out of the
-// sandbox bundle.
+// Nested dApp-in-dApp composition is not modeled as separate Rust runtimes,
+// sessions, product identities, or storage namespaces. Any future nested
+// traffic must share the top-level core/provider context.
 
+import {
+  decodeWireMessage,
+  encodeWireMessage,
+  HostRequestLoginResponse,
+  scale,
+  VersionedHostRequestLoginError,
+  VersionedHostRequestLoginRequest,
+  type HostRequestLoginResponse as LoginResponse,
+  type WireProvider as Provider,
+  createMessagePortProvider,
+} from "@parity/truapi";
+import { ACCOUNT_REQUEST_LOGIN } from "@parity/truapi/wire-table";
 import { BASE_DOMAIN } from "@dotli/config/config";
 import {
   SANDBOX_CONTRACT_PARAMS,
@@ -17,53 +30,217 @@ import { getBackend, getCacheSettings } from "@dotli/config/mode";
 import { getNetwork } from "@dotli/config/network";
 import { m } from "@dotli/metrics/metrics";
 import * as S from "@dotli/metrics/spans";
-import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
-import { buildAllowAttribute } from "./permissions";
+import { log } from "@dotli/shared/log";
+import {
+  emitDotliDebugEvent,
+  hasDotliDebugListeners,
+} from "@dotli/truapi-debug/dotli-debug-bus";
+import type { TrUApiProductProvider } from "@parity/truapi-host";
+import type { PairingHostAdmin } from "@parity/truapi-host";
+import {
+  buildAllowAttribute,
+  registerPermissionAuthorizationProvider,
+} from "./permissions";
+import { createHostCallbacks } from "./host-callbacks/handlers";
+import { dispatchAuthState } from "./host-callbacks/AuthState";
+import { onStoredSessionChanged } from "./host-callbacks/SessionStore";
+import { LoginRequestError } from "./login-request-error";
+import { createTruapiRuntimeConfig } from "./runtime-config";
+import { createWindowMessageProvider } from "./legacy-host-bridge";
 
-function newFlowId(prefix: string): string {
-  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
-    return crypto.randomUUID();
-  }
-  return `${prefix}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`;
-}
+// DEPRECATED: enables the legacy Nova host-api transport shim for products that
+// have not yet migrated to `@parity/truapi`. Remove once they have.
+const noop = (): void => undefined;
 
-// Eagerly load the container bridge chunk. Starts downloading when
-// this module is imported, so it's ready by the time we need it.
+// Eagerly load the iframe host chunk + worker constructor so they're ready
+// by the time we need them. The wasm core lives inside the worker; the host
+// shell only owns the postMessage bridge, keeping smoldot's CPU off the
+// main thread (no more `[Violation] 'message' handler took 150ms+`).
 const chunkLoadStart = performance.now();
-const containerChunkPromise = import("./container").then((mod) => {
+const runtimeChunkPromise = Promise.all([
+  import("@parity/truapi-host/web"),
+  import("@parity/truapi-host/worker-runtime?worker"),
+]).then(([web, workerMod]) => {
   m.measure(S.BRIDGE_CHUNK_LOAD, performance.now() - chunkLoadStart);
-  return mod;
+  return {
+    createWebWorkerPairingHostRuntime: web.createWebWorkerPairingHostRuntime,
+    createIframeHost: web.createIframeHost,
+    HostWorker: workerMod.default,
+  };
 });
-void containerChunkPromise.catch(() => {
+void runtimeChunkPromise.catch(() => {
   /* fire-and-forget */
 });
 
 const app = document.getElementById("app") ?? document.body;
 
-let currentDispose: (() => void) | null = null;
+interface ActiveHost {
+  iframe: HTMLIFrameElement;
+  requestLogin: (reason?: string) => Promise<LoginResponse>;
+  disconnect: () => Promise<void>;
+  dispose: () => void;
+}
+
+interface CoreHost {
+  requestLogin: (reason?: string) => Promise<LoginResponse>;
+  cancelLogin: () => void;
+  disconnect: () => Promise<void>;
+  dispose: () => void;
+}
+
+type CoreProviderBase = Provider &
+  Pick<
+    TrUApiProductProvider,
+    | "disconnectSession"
+    | "getPermissionAuthorizationStatus"
+    | "getPermissionAuthorizationStatuses"
+    | "setPermissionAuthorizationStatus"
+  >;
+type CoreProvider = CoreProviderBase & PairingHostAdmin;
+type PairingRuntimeControls = PairingHostAdmin & {
+  dispose(): void;
+};
+type CurrentProduct =
+  | {
+      mode: "iframe";
+      label: string;
+      url: string;
+      productId?: string;
+    }
+  | {
+      mode: "subdomain";
+      label: string;
+      cid: string;
+    };
+
+const LANDING_AUTH_LABEL = "dotli";
+const LANDING_AUTH_DISPLAY_LABEL = "Polkadot Web";
+
+let currentHost: ActiveHost | null = null;
+let landingAuthHostPromise: Promise<CoreHost> | null = null;
+let landingAuthGeneration = 0;
 let currentPanelDispose: (() => void) | null = null;
+let currentProduct: CurrentProduct | null = null;
+let renderGeneration = 0;
+const liveCoreProviders = new Set<CoreProvider>();
+let unsubscribeSessionStoreChanges: (() => void) | null = null;
 
-// Track current product state for permission-grant reloads
-let currentRenderMode: "iframe" | "subdomain" | null = null;
-let currentLabel: string | null = null;
-let currentUrl: string | null = null;
-let currentCid: string | null = null;
+function ensureStoredSessionForwarder(): void {
+  if (unsubscribeSessionStoreChanges !== null) {
+    return;
+  }
+  unsubscribeSessionStoreChanges = onStoredSessionChanged(() => {
+    notifyLiveCoreProvidersSessionStoreChanged();
+  });
+}
 
-// Listen for device permission grants and reload the iframe so the
+function trackCoreProvider(
+  provider: CoreProviderBase,
+  pairing: PairingRuntimeControls,
+): CoreProvider {
+  const tracked: CoreProvider = {
+    postMessage(message: Uint8Array): void {
+      provider.postMessage(message);
+    },
+    subscribe(callback) {
+      return provider.subscribe(callback);
+    },
+    subscribeClose(callback) {
+      return provider.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await provider.disconnectSession();
+    },
+    cancelPairing() {
+      pairing.cancelPairing();
+    },
+    notifySessionStoreChanged() {
+      pairing.notifySessionStoreChanged();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return provider.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return provider.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return provider.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      provider.dispose();
+      pairing.dispose();
+    },
+  };
+  liveCoreProviders.add(tracked);
+  ensureStoredSessionForwarder();
+  let disposed = false;
+  queueMicrotask(() => {
+    if (!disposed) {
+      tracked.notifySessionStoreChanged();
+    }
+  });
+  return {
+    postMessage(message: Uint8Array): void {
+      tracked.postMessage(message);
+    },
+    subscribe(callback) {
+      return tracked.subscribe(callback);
+    },
+    subscribeClose(callback) {
+      return tracked.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await tracked.disconnectSession();
+    },
+    cancelPairing() {
+      tracked.cancelPairing();
+    },
+    notifySessionStoreChanged() {
+      tracked.notifySessionStoreChanged();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return tracked.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return tracked.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return tracked.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      if (disposed) {
+        return;
+      }
+      disposed = true;
+      liveCoreProviders.delete(tracked);
+      if (
+        liveCoreProviders.size === 0 &&
+        unsubscribeSessionStoreChanges !== null
+      ) {
+        unsubscribeSessionStoreChanges();
+        unsubscribeSessionStoreChanges = null;
+      }
+      tracked.dispose();
+    },
+  };
+}
+
+function notifyLiveCoreProvidersSessionStoreChanged(): void {
+  for (const provider of [...liveCoreProviders]) {
+    provider.notifySessionStoreChanged();
+  }
+}
+
+// Listen for device permission grants — reload the iframe so the
 // updated `allow` attribute takes effect.
 window.addEventListener("dotli:device-permission-changed", () => {
-  if (
-    currentRenderMode === "iframe" &&
-    currentUrl !== null &&
-    currentLabel !== null
-  ) {
-    void renderIframe(currentUrl, currentLabel);
-  } else if (
-    currentRenderMode === "subdomain" &&
-    currentCid !== null &&
-    currentLabel !== null
-  ) {
-    void renderAppSubdomain(currentCid, currentLabel);
+  const product = currentProduct;
+  if (product?.mode === "iframe") {
+    void renderIframe(product.url, product.label, {
+      productId: product.productId,
+    });
+  } else if (product?.mode === "subdomain") {
+    void renderAppSubdomain(product.cid, product.label);
   }
 });
 
@@ -87,11 +264,10 @@ window.addEventListener("message", (event: MessageEvent) => {
   ) {
     return;
   }
+  const product = currentProduct;
   if (
-    currentRenderMode !== "subdomain" ||
-    currentCid === null ||
-    currentLabel === null ||
-    event.origin !== getAppOrigin(currentLabel)
+    product?.mode !== "subdomain" ||
+    event.origin !== getAppOrigin(product.label)
   ) {
     return;
   }
@@ -100,38 +276,544 @@ window.addEventListener("message", (event: MessageEvent) => {
     return;
   }
   lastRecoverAt = now;
-  void renderAppSubdomain(currentCid, currentLabel);
+  void renderAppSubdomain(product.cid, product.label);
 });
 
+let bridgeEventListenersInitialized = false;
+
+export function initBridgeEventListeners(): void {
+  if (bridgeEventListenersInitialized) {
+    return;
+  }
+  bridgeEventListenersInitialized = true;
+  (
+    window as typeof window & { __dotliTruapiBridgeReady?: boolean }
+  ).__dotliTruapiBridgeReady = true;
+  window.addEventListener("dotli:truapi-disconnect-request", () => {
+    void disconnectTruapiHosts();
+  });
+
+  // User closed the pairing modal: cancel the in-flight login on the auth
+  // host. Only an already-booted host can have a login in flight.
+  window.addEventListener("dotli:truapi-cancel-login", () => {
+    void landingAuthHostPromise?.then(
+      (host) => {
+        host.cancelLogin();
+      },
+      () => {
+        /* a failed pending host has no login to cancel */
+      },
+    );
+  });
+
+  window.addEventListener("dotli:truapi-login-request", (event: Event) => {
+    const detail = (event as CustomEvent<{ reason?: string }>).detail;
+    void (async () => {
+      const host = await getLandingAuthHost();
+      const result = await host.requestLogin(detail.reason);
+      if (result === "Success" || result === "AlreadyConnected") {
+        notifyLiveCoreProvidersSessionStoreChanged();
+      }
+    })().catch((error: unknown) => {
+      const message = error instanceof Error ? error.message : String(error);
+      // A `LoginRequestError` came back over the wire, so the core already
+      // rendered its own `LoginFailed` (or deliberately stayed silent, e.g.
+      // a second login while one is pairing). Synthesize a state only for
+      // failures the core never saw: host boot, encode, transport errors.
+      if (!(error instanceof LoginRequestError)) {
+        dispatchAuthState({ tag: "LoginFailed", reason: message });
+      }
+    });
+  });
+}
+
+initBridgeEventListeners();
+
+async function disconnectTruapiHosts(): Promise<void> {
+  const hosts = new Set<CoreHost | ActiveHost>();
+  if (currentHost !== null) {
+    hosts.add(currentHost);
+  }
+  if (landingAuthHostPromise !== null) {
+    try {
+      hosts.add(await landingAuthHostPromise);
+    } catch (err) {
+      log.warn("[dot.li] pending login host cleanup failed:", err);
+    }
+  }
+
+  if (hosts.size === 0) {
+    try {
+      hosts.add(await getLandingAuthHost());
+    } catch {
+      // If the auth runtime cannot boot, keep the UI responsive even though
+      // persisted core session state could not be cleared.
+      dispatchAuthState({ tag: "Disconnected" });
+      return;
+    }
+  }
+  await Promise.allSettled([...hosts].map((host) => host.disconnect()));
+}
+
 /**
  * Capture deep link path (pathname + search + hash) to forward into the iframe.
  */
 function getDeepPath(): string {
   const { pathname, search, hash } = window.location;
-  // Strip the deploy base path (e.g. a subpath deploy at /dotli/) so only the
-  // in-app route is forwarded to the iframe.
   let p = pathname;
   const base = import.meta.env.BASE_URL;
   if (base !== "/" && p.startsWith(base)) {
     p = "/" + p.slice(base.length);
   }
-  const isRoot = p === "" || p === "/";
+  const stripped = p.replace(/^\/[^/]+\.dot/, "");
+  const isRoot = stripped === "" || stripped === "/";
   if (isRoot) {
     return search || hash ? search + hash : "";
   }
-  return p + search + hash;
+  return stripped + search + hash;
+}
+
+function applyIframeStyling(
+  iframe: HTMLIFrameElement,
+  opts: { topbarOffset: boolean },
+): void {
+  iframe.style.cssText = opts.topbarOffset
+    ? "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;"
+    : "position:fixed;top:0;left:0;width:100%;height:100vh;border:none;margin:0;padding:0;";
+  document.body.style.margin = "0";
+  document.body.style.overflow = "hidden";
+}
+
+function pipeProviders(
+  product: Provider,
+  core: Provider,
+  args: { flowId: string; label: string; productId: string },
+): () => void {
+  let sawInbound = false;
+  let sawOutbound = false;
+  const unsubs = [
+    product.subscribe((message) => {
+      if (!sawInbound) {
+        sawInbound = true;
+        emitDotliDebugEvent({
+          layer: "bridge",
+          event: "first_inbound",
+          flowId: args.flowId,
+          timestamp: Date.now(),
+          payload: { label: args.label, productId: args.productId },
+        });
+      }
+      core.postMessage(message);
+    }),
+    core.subscribe((message) => {
+      if (!sawOutbound) {
+        sawOutbound = true;
+        emitDotliDebugEvent({
+          layer: "bridge",
+          event: "first_outbound",
+          flowId: args.flowId,
+          timestamp: Date.now(),
+          payload: { label: args.label, productId: args.productId },
+        });
+        window.dispatchEvent(new Event("dotli:debug:bridge-ready"));
+      }
+      product.postMessage(message);
+    }),
+    product.subscribeClose?.(() => {
+      core.dispose();
+    }),
+    core.subscribeClose?.(() => {
+      product.dispose();
+    }),
+  ].filter((fn): fn is () => void => typeof fn === "function");
+
+  return () => {
+    for (const unsub of unsubs) {
+      try {
+        unsub();
+        // eslint-disable-next-line no-restricted-syntax -- provider teardown is best-effort; stale MessagePorts can already be closed while the next cleanup still must run.
+      } catch {
+        /* ignore teardown races */
+      }
+    }
+  };
+}
+
+function emitWireFrameDebug(
+  direction: "incoming" | "outgoing",
+  productId: string,
+  message: Uint8Array,
+): void {
+  if (!hasDotliDebugListeners()) {
+    return;
+  }
+  const decoded = decodeWireMessage(message);
+  if (decoded.isErr()) {
+    return;
+  }
+  const wireId = decoded.value.payload.id;
+  emitDotliDebugEvent({
+    kind: "truapi",
+    direction,
+    productId,
+    requestId: decoded.value.requestId,
+    payload: {
+      tag: `wire_${String(wireId)}`,
+      value: {
+        wireId,
+        bytes: decoded.value.payload.value,
+      },
+    },
+  });
+}
+
+function wrapCoreProviderForDebug(
+  provider: CoreProviderBase,
+  productId: string,
+): CoreProviderBase {
+  const listeners = new Set<(message: Uint8Array) => void>();
+  let disposed = false;
+  const unsubscribeCore = provider.subscribe((message) => {
+    if (disposed) {
+      return;
+    }
+    emitWireFrameDebug("outgoing", productId, message);
+    for (const listener of [...listeners]) {
+      listener(message);
+    }
+  });
+
+  return {
+    postMessage(message: Uint8Array): void {
+      if (disposed) {
+        return;
+      }
+      emitWireFrameDebug("incoming", productId, message);
+      provider.postMessage(message);
+    },
+    subscribe(callback) {
+      listeners.add(callback);
+      return () => {
+        listeners.delete(callback);
+      };
+    },
+    subscribeClose(callback) {
+      return provider.subscribeClose?.(callback) ?? noop;
+    },
+    async disconnectSession() {
+      await provider.disconnectSession();
+    },
+    getPermissionAuthorizationStatus(request) {
+      return provider.getPermissionAuthorizationStatus(request);
+    },
+    getPermissionAuthorizationStatuses(requests) {
+      return provider.getPermissionAuthorizationStatuses(requests);
+    },
+    setPermissionAuthorizationStatus(request, status) {
+      return provider.setPermissionAuthorizationStatus(request, status);
+    },
+    dispose() {
+      if (disposed) {
+        return;
+      }
+      disposed = true;
+      unsubscribeCore();
+      listeners.clear();
+      provider.dispose();
+    },
+  };
+}
+
+let topbarLoginRequestSeq = 0;
+
+export function requestCoreLogin(
+  core: Provider,
+  reason?: string,
+): Promise<LoginResponse> {
+  const requestId = `dotli:topbar-login:${String(++topbarLoginRequestSeq)}`;
+  const responseCodec = scale.indexedTaggedUnion({
+    V1: [
+      0,
+      scale.Result(
+        HostRequestLoginResponse,
+        scale.CallError(VersionedHostRequestLoginError),
+      ),
+    ],
+  });
+  const frame = encodeWireMessage({
+    requestId,
+    payload: {
+      id: ACCOUNT_REQUEST_LOGIN.request,
+      value: VersionedHostRequestLoginRequest.enc({
+        tag: "V1",
+        value: { reason },
+      }),
+    },
+  });
+  if (frame.isErr()) {
+    return Promise.reject(frame.error);
+  }
+
+  return new Promise<LoginResponse>((resolve, reject) => {
+    const unsubscribe = core.subscribe((message) => {
+      const decoded = decodeWireMessage(message);
+      if (decoded.isErr()) {
+        cleanup();
+        reject(decoded.error);
+        return;
+      }
+      if (
+        decoded.value.requestId !== requestId ||
+        decoded.value.payload.id !== ACCOUNT_REQUEST_LOGIN.response
+      ) {
+        return;
+      }
+      cleanup();
+      try {
+        const envelope = responseCodec.dec(decoded.value.payload.value);
+        const result = envelope.value;
+        if (result.success) {
+          resolve(result.value);
+        } else {
+          const error = new LoginRequestError(result.value);
+          reject(error);
+        }
+      } catch (error) {
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    const cleanup = (): void => {
+      unsubscribe();
+    };
+
+    try {
+      core.postMessage(frame.value);
+    } catch (error) {
+      cleanup();
+      reject(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+}
+
+async function createHost(args: {
+  iframeUrl: string;
+  allowedOrigin: string;
+  sandbox: string;
+  label: string;
+  productId?: string;
+  container: HTMLElement;
+  debugFlowId: string;
+}): Promise<ActiveHost> {
+  const coreProvider = await createCoreProvider(args.label, {
+    productId: args.productId,
+  });
+  const unregisterPermissions = registerPermissionAuthorizationProvider(
+    args.label,
+    coreProvider,
+  );
+  const { createIframeHost } = await runtimeChunkPromise;
+  let productProvider: Provider | null = null;
+  let disposePipe: (() => void) | null = null;
+  let legacyProbeCleanup: (() => void) | null = null;
+  const pipeArgs = {
+    flowId: args.debugFlowId,
+    label: args.label,
+    productId: args.productId ?? args.label,
+  };
+  const cleanupProductSide = (): void => {
+    disposePipe?.();
+    productProvider?.dispose();
+    disposePipe = null;
+    productProvider = null;
+  };
+  try {
+    const allow = `${await buildAllowAttribute(args.label)}; cross-origin-isolated`;
+    const host = createIframeHost({
+      iframeUrl: args.iframeUrl,
+      allowedOrigin: args.allowedOrigin,
+      allow,
+      sandbox: args.sandbox,
+      container: args.container,
+      onPort: (port) => {
+        productProvider = createMessagePortProvider(port);
+        disposePipe = pipeProviders(productProvider, coreProvider, pipeArgs);
+      },
+    });
+
+    // DEPRECATED legacy host-API support. Modern products announce themselves
+    // with `{type:"truapi-ready"}` and use the MessagePort wired above. Products
+    // still on the Nova host-api SDK instead post raw SCALE frames (Uint8Array)
+    // to `window.parent`. Detect that first frame and re-pipe the core over a
+    // window-postMessage provider. Remove once products migrate.
+    let probeMode: "pending" | "modern" | "legacy" = "pending";
+    const onProbe = (event: MessageEvent): void => {
+      if (probeMode !== "pending") {
+        return;
+      }
+      const targetWindow = host.iframe.contentWindow;
+      if (!targetWindow || event.source !== targetWindow) {
+        return;
+      }
+      if (event.data instanceof Uint8Array) {
+        probeMode = "legacy";
+        legacyProbeCleanup?.();
+        // Drop the unused modern MessagePort pipe before rewiring.
+        cleanupProductSide();
+        const legacyProvider = createWindowMessageProvider(targetWindow);
+        productProvider = legacyProvider;
+        disposePipe = pipeProviders(legacyProvider, coreProvider, pipeArgs);
+        // Replay the handshake frame the probe just consumed.
+        legacyProvider.injectInbound(event.data);
+      } else if (
+        (event.data as { type?: unknown } | null)?.type === "truapi-ready"
+      ) {
+        probeMode = "modern";
+        legacyProbeCleanup?.();
+      }
+    };
+    window.addEventListener("message", onProbe);
+    legacyProbeCleanup = () => {
+      window.removeEventListener("message", onProbe);
+      legacyProbeCleanup = null;
+    };
+
+    return {
+      iframe: host.iframe,
+      requestLogin(reason) {
+        return requestCoreLogin(coreProvider, reason);
+      },
+      disconnect() {
+        return coreProvider.disconnectSession();
+      },
+      dispose() {
+        unregisterPermissions();
+        legacyProbeCleanup?.();
+        cleanupProductSide();
+        coreProvider.dispose();
+        host.dispose();
+      },
+    };
+  } catch (error) {
+    unregisterPermissions();
+    legacyProbeCleanup?.();
+    cleanupProductSide();
+    coreProvider.dispose();
+    throw error;
+  }
+}
+
+async function createCoreProvider(
+  label: string,
+  options: {
+    pairingLabel?: string;
+    pairingDotSuffix?: boolean;
+    pairingHostGlobal?: boolean;
+    productId?: string;
+  } = {},
+): Promise<CoreProvider> {
+  const { createWebWorkerPairingHostRuntime, HostWorker } =
+    await runtimeChunkPromise;
+  const runtimeConfig = createTruapiRuntimeConfig(
+    label,
+    window.location,
+    options.productId,
+  );
+  const { productId, ...hostConfig } = runtimeConfig;
+  const runtime = await createWebWorkerPairingHostRuntime(
+    new HostWorker(),
+    createHostCallbacks({
+      label,
+      pairingLabel: options.pairingLabel,
+      pairingDotSuffix: options.pairingDotSuffix,
+      pairingHostGlobal: options.pairingHostGlobal,
+    }),
+    {
+      hostConfig,
+    },
+  );
+  const provider = await runtime.createProvider({ productId });
+  return trackCoreProvider(
+    wrapCoreProviderForDebug(provider, options.productId ?? label),
+    runtime,
+  );
+}
+
+async function getLandingAuthHost(): Promise<CoreHost> {
+  if (landingAuthHostPromise !== null) {
+    return landingAuthHostPromise;
+  }
+  const generation = landingAuthGeneration;
+  const promise = createLandingAuthHost()
+    .then((host) => {
+      if (
+        generation !== landingAuthGeneration ||
+        landingAuthHostPromise !== promise
+      ) {
+        host.dispose();
+        throw new Error(
+          "Landing auth host was disposed before it became ready",
+        );
+      }
+      return host;
+    })
+    .catch((error: unknown) => {
+      if (landingAuthHostPromise === promise) {
+        landingAuthHostPromise = null;
+      }
+      throw error;
+    });
+  landingAuthHostPromise = promise;
+  return promise;
+}
+
+async function createLandingAuthHost(): Promise<CoreHost> {
+  const coreProvider = await createCoreProvider(LANDING_AUTH_LABEL, {
+    pairingLabel: LANDING_AUTH_DISPLAY_LABEL,
+    pairingDotSuffix: false,
+    pairingHostGlobal: true,
+  });
+  return {
+    requestLogin(reason) {
+      return requestCoreLogin(coreProvider, reason);
+    },
+    cancelLogin() {
+      coreProvider.cancelPairing();
+    },
+    disconnect() {
+      return coreProvider.disconnectSession();
+    },
+    dispose() {
+      coreProvider.dispose();
+    },
+  };
+}
+
+function disposeLandingAuthHost(): void {
+  landingAuthGeneration++;
+  const pending = landingAuthHostPromise;
+  landingAuthHostPromise = null;
+  void pending?.then(
+    (host) => {
+      host.dispose();
+    },
+    () => {
+      /* failed pending host has nothing to dispose */
+    },
+  );
 }
 
 /**
- * Render an iframe with the host-container bridge.
- *
- * Unlike the base renderIframe, this sets up the postMessage bridge
- * between the host and the embedded dApp, enabling accounts, signing,
- * chain connections, and scoped storage.
+ * Render a dApp iframe backed by the TrUAPI host bridge.
  */
-export async function renderIframe(url: string, label: string): Promise<void> {
+export async function renderIframe(
+  url: string,
+  label: string,
+  options: { productId?: string } = {},
+): Promise<void> {
+  const myRenderGeneration = ++renderGeneration;
   const renderFlowId = newFlowId("render");
   const bridgeFlowId = newFlowId("bridge");
+  const productId = options.productId ?? label;
   emitDotliDebugEvent({
     layer: "render",
     event: "iframe_begin",
@@ -141,74 +823,74 @@ export async function renderIframe(url: string, label: string): Promise<void> {
   });
   const stopSetup = m.timer(S.BRIDGE_SETUP);
   cleanup();
+  disposeLandingAuthHost();
 
-  currentRenderMode = "iframe";
-  currentLabel = label;
-  currentUrl = url;
-  currentCid = null;
-
-  const hasTopbar = document.getElementById("topbar") !== null;
-  const iframeStyle = hasTopbar
-    ? "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;"
-    : "position:fixed;top:0;left:0;width:100%;height:100vh;border:none;margin:0;padding:0;";
+  currentProduct = {
+    mode: "iframe",
+    label,
+    url,
+    productId: options.productId,
+  };
 
   app.innerHTML = "";
-  const iframe = document.createElement("iframe");
-  // TODO: Review sandbox default permissions
-  iframe.sandbox.add(
-    "allow-scripts",
-    "allow-same-origin",
-    "allow-forms",
-    "allow-pointer-lock",
-  );
-  iframe.allow = `${buildAllowAttribute(label)}; cross-origin-isolated`;
-  iframe.style.cssText = iframeStyle;
-  document.body.style.margin = "0";
-  document.body.style.overflow = "hidden";
-  app.appendChild(iframe);
-  iframe.addEventListener(
-    "load",
-    () => {
-      emitDotliDebugEvent({
-        layer: "bridge",
-        event: "iframe_load",
-        flowId: bridgeFlowId,
-        timestamp: Date.now(),
-        payload: { label, productId: label, mode: "iframe" },
-      });
-    },
-    { once: true },
-  );
 
-  const { setupContainer, setupNestedBridgeDetector } =
-    await containerChunkPromise;
+  const hasTopbar = document.getElementById("topbar") !== null;
+  const iframeUrl = new URL(url, window.location.href);
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_begin",
     flowId: bridgeFlowId,
     timestamp: Date.now(),
-    payload: { label, productId: label },
+    payload: { label, productId },
   });
-  const disposePrimary = setupContainer(iframe, url, label, bridgeFlowId);
-  const disposeNested = setupNestedBridgeDetector(iframe, label);
-  currentDispose = () => {
-    disposePrimary();
-    disposeNested();
-  };
+  const host = await createHost({
+    iframeUrl: iframeUrl.href,
+    allowedOrigin: iframeUrl.origin,
+    // Keep parity with the current dotli product sandbox permissions.
+    sandbox: "allow-scripts allow-same-origin allow-forms allow-pointer-lock",
+    label,
+    productId: options.productId,
+    container: app,
+    debugFlowId: bridgeFlowId,
+  });
+  if (myRenderGeneration !== renderGeneration) {
+    host.dispose();
+    stopSetup();
+    return;
+  }
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_ready",
     flowId: bridgeFlowId,
     timestamp: Date.now(),
-    payload: { label, productId: label },
+    payload: { label, productId },
   });
+  applyIframeStyling(host.iframe, { topbarOffset: hasTopbar });
+  currentHost = host;
+  host.iframe.addEventListener(
+    "load",
+    () => {
+      emitDotliDebugEvent({
+        layer: "bridge",
+        event: "iframe_load",
+        flowId: bridgeFlowId,
+        timestamp: Date.now(),
+        payload: { label, productId, mode: "iframe" },
+      });
+    },
+    { once: true },
+  );
 
   if (
     (import.meta.env.VITE_SANDBOX_CHECKER as string | undefined) !== undefined
   ) {
     const { setupViolationPanel } =
       await import("@dotli/sandbox-checker/sandbox-checker-ui");
-    currentPanelDispose = setupViolationPanel(iframe);
+    if (myRenderGeneration !== renderGeneration) {
+      stopSetup();
+      return;
+    }
+    currentPanelDispose = setupViolationPanel(host.iframe);
   }
 
   stopSetup();
@@ -227,43 +909,33 @@ export async function renderIframe(url: string, label: string): Promise<void> {
 }
 
 /**
- * Render content in a cross-origin app subdomain iframe at
- * `<label>.app.dot.li`.
- *
- * The host build delegates content fetching and rendering to the app
- * context. The origin is the human dotns label. The host owns dotns
- * resolution and threads the resolved CID through the URL contract
- * (`?cid=`), since it is no longer in the origin. The sandbox does
- * not re-resolve.
+ * Render content in a cross-origin app subdomain iframe (cid.app.dot.li).
+ * Used by the host build to delegate content fetching+rendering to the app context.
  *
- * Sets up the container bridge targeting the app iframe. The app context
- * acts as a transparent postMessage relay between the host and the dApp
- * iframe.
+ * The app context acts as a transparent relay between the host and the dApp
+ * iframe. Only the app subdomain itself participates in the TrUAPI
+ * MessageChannel; any nested dApp iframe it loads is opaque to the host.
  */
 export async function renderAppSubdomain(
   cid: string,
   label: string,
 ): Promise<void> {
+  const myRenderGeneration = ++renderGeneration;
   const renderFlowId = newFlowId("render");
   const bridgeFlowId = newFlowId("bridge");
   const stopSetup = m.timer(S.BRIDGE_SETUP);
   cleanup();
+  disposeLandingAuthHost();
 
-  currentRenderMode = "subdomain";
-  currentLabel = label;
-  currentCid = cid;
-  currentUrl = null;
-
-  // Propagate the two independent backend axes. The legacy `?mode=`
-  // preset param is no longer sent. Host and sandbox deploy together,
-  // there are no old sandbox builds in the wild, and the sandbox
-  // validator rejects unknown params so keeping it would guarantee a
-  // boot failure on the next deploy.
-  //
-  // The sandbox reads its own curated endpoint defaults from
-  // `@dotli/config/network` (same package, built into its bundle), so
-  // the host no longer threads RPC/gateway URLs across the origin.
-  // There are no user-overridable endpoints to preserve.
+  currentProduct = {
+    mode: "subdomain",
+    label,
+    cid,
+  };
+
+  // Propagate the current sandbox contract. The `?mode=` preset param is no
+  // longer sent. Host and sandbox deploy together, and the sandbox validator
+  // rejects unknown params.
   const chainBackend = getBackend();
   const network = getNetwork();
   const cache = getCacheSettings();
@@ -281,13 +953,11 @@ export async function renderAppSubdomain(
     }
     // eslint-disable-next-line no-restricted-syntax -- sessionStorage may be unavailable (Safari private mode); reset flag defaults to false which is the safe state.
   } catch {
-    /* sessionStorage unavailable: skip pending reset */
+    /* sessionStorage unavailable — skip pending reset */
   }
   let url = deepPath ? `${appOrigin}${deepPath}` : appOrigin;
   try {
     const parsed = new URL(url);
-    // CID is no longer in the origin, so the host hands the resolved CID to
-    // the sandbox here. `v` lets a stale sandbox reject a mismatched build.
     parsed.searchParams.set(SANDBOX_CONTRACT_PARAMS.cid, cid);
     parsed.searchParams.set(
       SANDBOX_CONTRACT_PARAMS.v,
@@ -313,43 +983,23 @@ export async function renderAppSubdomain(
     }
   }
 
-  const iframe = document.createElement("iframe");
-  iframe.sandbox.add(
-    "allow-scripts",
-    "allow-same-origin",
-    "allow-forms",
-    "allow-pointer-lock",
-    "allow-popups",
-  );
-  iframe.allow = buildAllowAttribute(label);
-  iframe.style.cssText =
-    "position:fixed;top:56px;left:0;width:100%;height:calc(100vh - 56px);border:none;margin:0;padding:0;";
-  document.body.style.margin = "0";
-  document.body.style.overflow = "hidden";
-
-  // Keep the loading overlay visible. The sandbox will post status
+  // Keep the loading overlay visible — the sandbox will post status
   // messages via dotli:loading-status and a final done=true to dismiss it.
-  // Only remove non-loading children from #app before appending the iframe.
+  // Only remove non-loading children from #app before handing it off.
   const loading = app.querySelector(".loading");
   app.innerHTML = "";
   if (loading) {
     app.appendChild(loading);
   }
-  app.appendChild(iframe);
-  iframe.addEventListener(
-    "load",
-    () => {
-      emitDotliDebugEvent({
-        layer: "bridge",
-        event: "iframe_load",
-        flowId: bridgeFlowId,
-        timestamp: Date.now(),
-        payload: { label, productId: label, mode: "subdomain" },
-      });
-    },
-    { once: true },
-  );
 
+  const iframeUrl = new URL(url);
+  emitDotliDebugEvent({
+    layer: "bridge",
+    event: "setup_begin",
+    flowId: bridgeFlowId,
+    timestamp: Date.now(),
+    payload: { label, productId: label },
+  });
   emitDotliDebugEvent({
     layer: "render",
     event: "iframe_begin",
@@ -357,22 +1007,20 @@ export async function renderAppSubdomain(
     timestamp: Date.now(),
     payload: { label, url, mode: "subdomain" },
   });
-
-  const { setupContainer, setupNestedBridgeDetector } =
-    await containerChunkPromise;
-  emitDotliDebugEvent({
-    layer: "bridge",
-    event: "setup_begin",
-    flowId: bridgeFlowId,
-    timestamp: Date.now(),
-    payload: { label, productId: label },
+  const host = await createHost({
+    iframeUrl: url,
+    allowedOrigin: iframeUrl.origin,
+    sandbox:
+      "allow-scripts allow-same-origin allow-forms allow-pointer-lock allow-popups",
+    label,
+    container: app,
+    debugFlowId: bridgeFlowId,
   });
-  const disposePrimary = setupContainer(iframe, url, label, bridgeFlowId);
-  const disposeNested = setupNestedBridgeDetector(iframe, label);
-  currentDispose = () => {
-    disposePrimary();
-    disposeNested();
-  };
+  if (myRenderGeneration !== renderGeneration) {
+    host.dispose();
+    stopSetup();
+    return;
+  }
   emitDotliDebugEvent({
     layer: "bridge",
     event: "setup_ready",
@@ -380,13 +1028,32 @@ export async function renderAppSubdomain(
     timestamp: Date.now(),
     payload: { label, productId: label },
   });
+  applyIframeStyling(host.iframe, { topbarOffset: true });
+  currentHost = host;
+  host.iframe.addEventListener(
+    "load",
+    () => {
+      emitDotliDebugEvent({
+        layer: "bridge",
+        event: "iframe_load",
+        flowId: bridgeFlowId,
+        timestamp: Date.now(),
+        payload: { label, productId: label, mode: "subdomain" },
+      });
+    },
+    { once: true },
+  );
 
   if (
     (import.meta.env.VITE_SANDBOX_CHECKER as string | undefined) !== undefined
   ) {
     const { setupViolationPanel } =
       await import("@dotli/sandbox-checker/sandbox-checker-ui");
-    currentPanelDispose = setupViolationPanel(iframe);
+    if (myRenderGeneration !== renderGeneration) {
+      stopSetup();
+      return;
+    }
+    currentPanelDispose = setupViolationPanel(host.iframe);
   }
 
   stopSetup();
@@ -404,8 +1071,6 @@ export async function renderAppSubdomain(
   });
 }
 
-// Origin is the human dotns label (`<label>.app.<root>`), not the CID. Storage
-// and permissions stay stable across content (CID) updates of the same name.
 function getAppOrigin(label: string): string {
   const hostname = window.location.hostname;
   if (hostname.endsWith(".localhost") || hostname === "localhost") {
@@ -420,8 +1085,15 @@ function cleanup(): void {
     currentPanelDispose();
     currentPanelDispose = null;
   }
-  if (currentDispose) {
-    currentDispose();
-    currentDispose = null;
+  if (currentHost) {
+    currentHost.dispose();
+    currentHost = null;
   }
 }
+
+function newFlowId(prefix: string): string {
+  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+    return crypto.randomUUID();
+  }
+  return `${prefix}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`;
+}
diff --git a/packages/ui/src/container.ts b/packages/ui/src/container.ts
deleted file mode 100644
index 4dc13233..00000000
--- a/packages/ui/src/container.ts
+++ /dev/null
@@ -1,1584 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// dot.li Host container bridge
-//
-// Bridges the host (dot.li) and the SPA loaded in the iframe using
-// @novasamatech/host-container's postMessage-based protocol.
-//
-// Supports nested dApps: when a dApp embeds another dApp via iframe,
-// the nested bridge detector dynamically creates additional bridges
-// for each descendant dApp that sends protocol messages to window.top.
-
-import {
-  createDefaultLogger,
-  CreateTransactionErr,
-  DeriveEntropyErr,
-  GenericError,
-  GetUserIdErr,
-  LoginErr,
-  PaymentBalanceErr,
-  PaymentRequestErr,
-  PaymentStatusErr,
-  PaymentTopUpErr,
-  PreimageSubmitErr,
-  PushNotificationError,
-  RequestCredentialsErr,
-  ResourceAllocationErr,
-  SigningErr,
-  StatementProofErr,
-  StorageErr,
-  toHex,
-} from "@novasamatech/host-api";
-import type { Provider } from "@novasamatech/host-api";
-import {
-  createContainer,
-  createIframeProvider,
-  createRateLimiter,
-  deriveProductEntropyFromSource,
-} from "@novasamatech/host-container";
-import type { Container, RateLimiter } from "@novasamatech/host-container";
-import type { SignedStatement } from "@novasamatech/sdk-statement";
-import {
-  createSr25519Prover,
-  type StatementStoreAdapter,
-} from "@novasamatech/statement-store";
-import { errAsync, fromPromise, okAsync, type ResultAsync } from "neverthrow";
-import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
-import { isLocalhost, BASE_DOMAIN } from "@dotli/config/config";
-import {
-  getPermissionStatus,
-  isEnforceableDevicePermission,
-  setPermissionStatus,
-  type PermissionName,
-} from "./permissions";
-import { showPermissionRequestModal } from "./permission-modal";
-import { showAllocationRequestModal } from "./allocation-modal";
-import { queueWalletFlow } from "./wallet-queue";
-
-import type { UserSession } from "@novasamatech/host-papp";
-import {
-  getAllowanceService,
-  getAuthState,
-  getStatementStore,
-  onAuthStateChange,
-  onStatementStoreReady,
-  readSessionSecret,
-  requestLogin,
-  type AuthState,
-} from "@dotli/auth/auth";
-import {
-  showCreateTransactionLegacyModal,
-  showCreateTransactionModal,
-  showSignPayloadLegacyModal,
-  showSignPayloadModal,
-  showSignRawLegacyModal,
-  showSignRawModal,
-  type ContainerCreateTransactionLegacyPayload,
-} from "@dotli/auth/signing";
-import {
-  deriveProductPublicKey,
-  normalizeProductAccountId,
-  productAddressToPublicKey,
-  productPublicKeyToAddress,
-} from "@dotli/auth/account";
-import {
-  createRemoteChainProvider,
-  isRemoteChainSupported,
-} from "@dotli/protocol/client";
-import { MAX_NESTED_BRIDGES } from "@dotli/config/config";
-import { dotNsUrl } from "@dotli/shared/dotns-url";
-import { log } from "@dotli/shared/log";
-import { getBackend } from "@dotli/config/mode";
-import { computePreimageKey, hashToCid } from "@dotli/content/preimage";
-import { fetchFromIpfs } from "@dotli/content/ipfs";
-import { submitPreimageAsUser } from "./preimage-submit";
-import { showNotification } from "./notification";
-import {
-  cancelNotification,
-  scheduleNotification,
-} from "./scheduled-notifications";
-import { showAliasPermissionModal } from "./alias-permission-modal";
-import { showPreimageSubmitModal } from "./preimage-modal";
-import {
-  mapFromHostSignedStatement,
-  mapFromHostStatement,
-  mapSdkProof,
-  mapSdkSignedStatement,
-} from "./statement-store-mapping";
-
-function getSession(): UserSession | null {
-  const state = getAuthState();
-  return state.status === "authenticated" ? state.session : null;
-}
-
-function subscribeSession(
-  callback: (session: ReturnType<typeof getSession>) => void,
-): () => void {
-  callback(getSession());
-  return onAuthStateChange((state: AuthState) => {
-    callback(state.status === "authenticated" ? state.session : null);
-  });
-}
-
-// localhost proxy and webcontainer previews are developer affordances for
-// running a `.dot` app before it's deployed.
-function isDevPreviewLabel(label: string): boolean {
-  return (
-    label.startsWith("localhost:") || dotNsUrl.isWebcontainerPreviewHost(label)
-  );
-}
-
-/**
- * Derive the product-id from an iframe label.
- *
- * Dev previews (localhost proxy, webcontainer) keep the bare host label. dotNs
- * products get the `.dot` suffix appended. Same rule encoded in
- * `isProductAccountValid`.
- */
-function labelToProductIdentifier(label: string): string {
-  return isDevPreviewLabel(label) ? label : `${label}.dot`;
-}
-
-function labelAcceptsIdentifier(label: string, id: string): boolean {
-  return (
-    dotNsUrl.isProductIdentifier(id) || id === labelToProductIdentifier(label)
-  );
-}
-
-// Dev previews are permissive. A deployed `.dot` must sign as its own identifier.
-function isProductAccountValid(label: string, accountId: string): boolean {
-  if (isDevPreviewLabel(label)) {
-    return labelAcceptsIdentifier(label, accountId);
-  }
-  return accountId === labelToProductIdentifier(label);
-}
-
-/**
- * Resolve the product-account tuple a product is allowed to act as.
- */
-function resolveProductAccountId(
-  label: string,
-  reported: Parameters<typeof normalizeProductAccountId>[0],
-): ReturnType<typeof normalizeProductAccountId> {
-  const normalized = normalizeProductAccountId(reported);
-  return isDevPreviewLabel(label)
-    ? normalized
-    : [labelToProductIdentifier(label), normalized[1]];
-}
-
-function wireContainerHandlers(
-  container: Container,
-  label: string,
-  storagePrefix: string,
-): () => void {
-  // One queue-strategy limiter per call-site domain. Browser parity
-  // (browser/src/shared/rateLimiter/index.ts): 20 req/s, 100 queued.
-  // Each limiter owns a refill timer that must be released on teardown.
-
-  function makeLimiter(onDrop: () => unknown): RateLimiter {
-    return createRateLimiter({
-      strategy: "queue",
-      maxRequestsPerInterval: 20,
-      intervalMs: 1000,
-      maxQueuedRequests: 100,
-      onDrop,
-    });
-  }
-
-  const aliasLimiter = makeLimiter(
-    () => new RequestCredentialsErr.Unknown({ reason: "Rate limited" }),
-  );
-  const permissionLimiter = makeLimiter(
-    () => new GenericError({ reason: "Rate limited" }),
-  );
-  const submitLimiter = makeLimiter(
-    () => new GenericError({ reason: "Rate limited" }),
-  );
-  const preimageLimiter = makeLimiter(
-    () => new PreimageSubmitErr.Unknown({ reason: "Rate limited" }),
-  );
-
-  let chainConnectionWarned = false;
-
-  function warnOnRawChainConnection(genesisHash: string): void {
-    if (chainConnectionWarned) {
-      return;
-    }
-    chainConnectionWarned = true;
-
-    log.warn(
-      `[${label}] Raw chain connection requested (genesis=${genesisHash.slice(0, 10)}…, storage=${storagePrefix})`,
-    );
-
-    showNotification({
-      label: "Direct Chain Access",
-      text: "This app uses a direct chain connection instead of the recommended host API.",
-      dismissMs: 8000,
-      browserNotification: false,
-    });
-  }
-
-  container.handleFeatureSupported((params, { ok }) => {
-    switch (params.tag as string) {
-      case "Chain":
-        return ok(isRemoteChainSupported(params.value));
-      default:
-        return ok(false);
-    }
-  });
-
-  container.handleChainConnection((genesisHash) => {
-    warnOnRawChainConnection(genesisHash);
-    return createRemoteChainProvider(genesisHash);
-  });
-
-  container.handleAccountGet((rawProductAccountId, { ok, err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new RequestCredentialsErr.NotConnected(undefined));
-    }
-
-    const [dotNsIdentifier, derivationIndex] = resolveProductAccountId(
-      label,
-      rawProductAccountId,
-    );
-
-    if (!labelAcceptsIdentifier(label, dotNsIdentifier)) {
-      return err(new RequestCredentialsErr.DomainNotValid(undefined));
-    }
-
-    const publicKey = deriveProductPublicKey(
-      session.rootAccountId,
-      dotNsIdentifier,
-      derivationIndex,
-    );
-
-    return ok({ publicKey });
-  });
-
-  // The web host has no user-imported accounts,
-  // only HDKD-derived product accounts.
-  container.handleGetLegacyAccounts((_, { ok }) => ok([]));
-
-  // Return the user's DotNS username. Disclosing it requires consent, gated by
-  // the per-product `GetUserId` permission. Returns `NotConnected` if no
-  // account is signed in, and `PermissionDenied` if the permission has not been
-  // granted explicitly.
-  container.handleGetUserId((_, { ok, err }) => {
-    const state = getAuthState();
-    if (state.status !== "authenticated") {
-      return errAsync(new GetUserIdErr.NotConnected(undefined));
-    }
-    const primaryUsername =
-      state.identity?.fullUsername ?? state.identity?.liteUsername;
-    if (primaryUsername === undefined || primaryUsername === "") {
-      return errAsync(
-        new GetUserIdErr.Unknown({
-          reason: "No primary username for this session",
-        }),
-      );
-    }
-    return promptCachedSubmitPermission(label, "GetUserId").andThen(
-      (granted) =>
-        granted
-          ? ok({ primaryUsername })
-          : err(new GetUserIdErr.PermissionDenied(undefined)),
-    );
-  });
-
-  // Products can trigger the host login flow. `requestLogin` dispatches a DOM
-  // event that the topbar listens for (it owns the QR modal), and resolves once
-  // the auth state settles.
-  container.handleRequestLogin((reason, { ok }) => {
-    return fromPromise(
-      requestLogin(reason, label),
-      (e) =>
-        new LoginErr.Unknown({
-          reason: e instanceof Error ? e.message : "Login flow failed",
-        }),
-    ).andThen((result) => ok(result));
-  });
-
-  container.handleAccountConnectionStatusSubscribe((_, send) => {
-    return subscribeSession((session) => {
-      send(session ? "connected" : "disconnected");
-    });
-  });
-
-  container.handleAccountGetAlias((rawProductAccountId, { err }) =>
-    aliasLimiter.schedule(() => {
-      const session = getSession();
-      if (!session) {
-        return err(new RequestCredentialsErr.NotConnected(undefined));
-      }
-
-      // Derive the alias off the bare base name.
-      const productAccountId = normalizeProductAccountId(rawProductAccountId);
-
-      if (!labelAcceptsIdentifier(label, productAccountId[0])) {
-        return err(new RequestCredentialsErr.DomainNotValid(undefined));
-      }
-
-      const identifier = labelToProductIdentifier(label);
-      const isOwnDomain = identifier === productAccountId[0];
-
-      if (isOwnDomain) {
-        return session
-          .getRingVrfAlias(productAccountId, identifier)
-          .mapErr(
-            (error) =>
-              new RequestCredentialsErr.Unknown({ reason: error.message }),
-          );
-      }
-
-      return fromPromise(
-        showAliasPermissionModal(identifier, productAccountId[0]),
-        () => new RequestCredentialsErr.Rejected(undefined),
-      ).andThen(() =>
-        session
-          .getRingVrfAlias(productAccountId, identifier)
-          .mapErr(
-            (error) =>
-              new RequestCredentialsErr.Unknown({ reason: error.message }),
-          ),
-      );
-    }),
-  );
-
-  container.handleSignPayload((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id so the wallet signs with the same
-      // account handleAccountGet returns, never the sandbox-reported one.
-      const account = resolveProductAccountId(label, payload.account);
-      log.warn(`[${label}] handleSignPayload invoked:`, {
-        account,
-        genesisHash: payload.payload.genesisHash,
-        method: payload.payload.method.slice(0, 40) + "...",
-      });
-
-      if (!isProductAccountValid(label, account[0])) {
-        log.warn(
-          `[${label}] handleSignPayload — invalid account[0]=${account[0]}`,
-        );
-        return errAsync(new SigningErr.PermissionDenied(undefined));
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(`[${label}] handleSignPayload — ChainSubmit not granted`);
-            return err(new SigningErr.PermissionDenied(undefined));
-          }
-          const session = getSession();
-          if (!session) {
-            log.error(`[${label}] handleSignPayload — no session, rejecting`);
-            return err(new SigningErr.Rejected(undefined));
-          }
-
-          return fromPromise(
-            showSignPayloadModal(session, payload.payload, label, account),
-            (e) => e as never,
-          )
-            .andThen((result) => {
-              log.warn(`[${label}] handleSignPayload — resolved OK`);
-              return ok({
-                signature: result.signature,
-                signedTransaction: result.signedTransaction,
-              });
-            })
-            .orElse((e) => {
-              log.warn(`[${label}] handleSignPayload — rejected:`, e);
-              return err(e);
-            });
-        },
-      );
-    }),
-  );
-
-  container.handleSignRaw((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id (see handleAccountGet).
-      const account = resolveProductAccountId(label, payload.account);
-      log.warn(`[${label}] handleSignRaw invoked:`, {
-        account,
-        dataTag: payload.payload.tag,
-      });
-
-      if (!isProductAccountValid(label, account[0])) {
-        log.warn(`[${label}] handleSignRaw — invalid account[0]=${account[0]}`);
-        return errAsync(new SigningErr.PermissionDenied(undefined));
-      }
-
-      const session = getSession();
-      if (!session) {
-        log.error(`[${label}] handleSignRaw — no session, rejecting`);
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      return fromPromise(
-        showSignRawModal(session, payload.payload, label, account),
-        (e) => e as never,
-      )
-        .andThen((result) => {
-          log.warn(`[${label}] handleSignRaw — resolved OK`);
-          return ok({
-            signature: result.signature,
-            signedTransaction: result.signedTransaction,
-          });
-        })
-        .orElse((e) => {
-          log.warn(`[${label}] handleSignRaw — rejected:`, e);
-          return err(e);
-        });
-    }),
-  );
-
-  // host-api 0.7.9 delegates extrinsic construction to the wallet via
-  // host_create_transaction. We forward the typed payload to the paired
-  // mobile app and return the signed extrinsic bytes the wallet builds.
-  container.handleCreateTransaction((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      // Resolve to the host's own product id (see handleAccountGet).
-      const signer = resolveProductAccountId(label, payload.signer);
-      const normalizedPayload = { ...payload, signer };
-      log.warn(`[${label}] handleCreateTransaction invoked:`, {
-        signer,
-        genesisHash: toHex(payload.genesisHash),
-        callDataLen: payload.callData.length,
-        extensions: payload.extensions.map((e) => e.id),
-        txExtVersion: payload.txExtVersion,
-      });
-
-      if (!isProductAccountValid(label, signer[0])) {
-        log.warn(
-          `[${label}] handleCreateTransaction — invalid signer[0]=${signer[0]}`,
-        );
-        return errAsync(new CreateTransactionErr.PermissionDenied());
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleCreateTransaction — ChainSubmit not granted`,
-            );
-            return err(new CreateTransactionErr.PermissionDenied());
-          }
-          const session = getSession();
-          if (!session) {
-            log.error(
-              `[${label}] handleCreateTransaction — no session, rejecting`,
-            );
-            return err(new CreateTransactionErr.Rejected());
-          }
-
-          return fromPromise(
-            showCreateTransactionModal(session, normalizedPayload, label),
-            (e) => e as never,
-          )
-            .andThen((signedTx) => {
-              log.warn(`[${label}] handleCreateTransaction — resolved OK`);
-              return ok(signedTx);
-            })
-            .orElse((e) => {
-              log.warn(`[${label}] handleCreateTransaction — rejected:`, e);
-              return err(e);
-            });
-        },
-      );
-    }),
-  );
-
-  // Legacy-account signing wires. A `*WithLegacyAccount` request always targets
-  // a genuine imported account, so decode the supplied signer to its raw
-  // AccountId and relay to the wallet via host-papp's legacy SDK calls. The
-  // non-legacy handlers above own the product-account (derived) path. Mirrors
-  // polkadot-desktop#632.
-  //
-  // host-papp has no `signPayloadLegacy`, so signPayload is signed through
-  // `signRawLegacy` (Payload variant) — see `showSignPayloadLegacyModal`.
-  container.handleSignPayloadWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleSignPayloadWithLegacyAccount invoked:`, {
-        signer: payload.signer,
-        genesisHash: payload.payload.genesisHash,
-        method: payload.payload.method.slice(0, 40) + "...",
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleSignPayloadWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      let account: Uint8Array;
-      try {
-        account = productAddressToPublicKey(payload.signer);
-      } catch {
-        return errAsync(
-          new SigningErr.Unknown({ reason: "Invalid legacy signer address" }),
-        );
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleSignPayloadWithLegacyAccount — ChainSubmit not granted`,
-            );
-            return err(new SigningErr.PermissionDenied(undefined));
-          }
-          return fromPromise(
-            showSignPayloadLegacyModal(
-              session,
-              payload.payload,
-              label,
-              account,
-            ),
-            (e) => e as never,
-          )
-            .andThen((result) =>
-              ok({
-                signature: result.signature,
-                signedTransaction: result.signedTransaction,
-              }),
-            )
-            .orElse((e) => err(e));
-        },
-      );
-    }),
-  );
-
-  container.handleSignRawWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleSignRawWithLegacyAccount invoked:`, {
-        signer: payload.signer,
-        dataTag: payload.payload.tag,
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleSignRawWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new SigningErr.Rejected(undefined));
-      }
-
-      let account: Uint8Array;
-      try {
-        account = productAddressToPublicKey(payload.signer);
-      } catch {
-        return errAsync(
-          new SigningErr.Unknown({ reason: "Invalid legacy signer address" }),
-        );
-      }
-
-      return fromPromise(
-        showSignRawLegacyModal(session, payload.payload, label, account),
-        (e) => e as never,
-      )
-        .andThen((result) =>
-          ok({
-            signature: result.signature,
-            signedTransaction: result.signedTransaction,
-          }),
-        )
-        .orElse((e) => err(e));
-    }),
-  );
-
-  // Legacy-account create-transaction: relay the raw 32-byte signer
-  // (`AccountId = Bytes(32)`) to the wallet via createTransactionLegacy.
-  container.handleCreateTransactionWithLegacyAccount((payload, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleCreateTransactionWithLegacyAccount invoked:`, {
-        signerHex: toHex(payload.signer),
-        genesisHash: toHex(payload.genesisHash),
-        callDataLen: payload.callData.length,
-        extensions: payload.extensions.map((e) => e.id),
-        txExtVersion: payload.txExtVersion,
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleCreateTransactionWithLegacyAccount — no session, rejecting`,
-        );
-        return errAsync(new CreateTransactionErr.Rejected());
-      }
-
-      return promptCachedSubmitPermission(label, "ChainSubmit").andThen(
-        (granted) => {
-          if (!granted) {
-            log.warn(
-              `[${label}] handleCreateTransactionWithLegacyAccount — ChainSubmit not granted`,
-            );
-            return err(new CreateTransactionErr.PermissionDenied());
-          }
-          const legacyPayload: ContainerCreateTransactionLegacyPayload = {
-            signer: payload.signer,
-            genesisHash: payload.genesisHash,
-            callData: payload.callData,
-            extensions: payload.extensions,
-            txExtVersion: payload.txExtVersion,
-          };
-          return fromPromise(
-            showCreateTransactionLegacyModal(session, legacyPayload, label),
-            (e) => e as never,
-          )
-            .andThen((signedTx) => ok(signedTx))
-            .orElse((e) => err(e));
-        },
-      );
-    }),
-  );
-
-  container.handleRequestResourceAllocation((resources, { ok, err }) =>
-    queueWalletFlow(() => {
-      log.warn(`[${label}] handleRequestResourceAllocation invoked:`, {
-        resources: resources.map((r) => r.tag),
-      });
-
-      const session = getSession();
-      if (!session) {
-        log.error(
-          `[${label}] handleRequestResourceAllocation — no session, rejecting`,
-        );
-        return errAsync(
-          new ResourceAllocationErr.Unknown({ reason: "No active session" }),
-        );
-      }
-
-      return fromPromise(
-        showAllocationRequestModal(
-          label,
-          resources,
-          async () => {
-            const outcomes = await session
-              .requestResourceAllocation({
-                callingProductId: labelToProductIdentifier(label),
-                // The product-facing host-api protocol spells this variant
-                // `BulletinAllowance`, but papp's host-to-mobile resource
-                // allocation codec still uses the legacy `BulletInAllowance`.
-                // Translate on the way in so the scale codec finds the variant.
-                resources: resources.map((r) =>
-                  r.tag === "BulletinAllowance"
-                    ? { tag: "BulletInAllowance" as const, value: undefined }
-                    : r,
-                ),
-                onExisting: "Increase",
-              })
-              .match(
-                (o) => o,
-                (e) => {
-                  throw e;
-                },
-              );
-            // Strip secret payload from Allocated outcomes before returning to product.
-            return outcomes.map((o) =>
-              o.tag === "Allocated"
-                ? ({ tag: "Allocated", value: undefined } as const)
-                : o,
-            );
-          },
-          {
-            // `SmartContractAllowance.value` is the app account's derivation
-            // index; derive its SS58 address for the tooltip, mirroring the
-            // legacy-signing handlers above.
-            resolveContractAccount: (index) =>
-              productPublicKeyToAddress(
-                deriveProductPublicKey(
-                  session.rootAccountId,
-                  labelToProductIdentifier(label),
-                  index,
-                ),
-              ),
-          },
-        ),
-        (e) =>
-          new ResourceAllocationErr.Unknown({
-            reason: e instanceof Error ? e.message : String(e),
-          }),
-      )
-        .andThen((outcomes) => {
-          log.warn(`[${label}] handleRequestResourceAllocation — resolved OK`);
-          return ok(outcomes);
-        })
-        .orElse((e) => {
-          log.warn(`[${label}] handleRequestResourceAllocation — rejected:`, e);
-          return err(e);
-        });
-    }),
-  );
-
-  container.handleLocalStorageRead((key, { ok, err }) => {
-    try {
-      const raw = localStorage.getItem(storagePrefix + key);
-      if (raw === null) {
-        return ok(undefined);
-      }
-      const bytes = Uint8Array.from(atob(raw), (c) => c.charCodeAt(0));
-      return ok(bytes);
-    } catch {
-      return err(
-        new StorageErr.Unknown({ reason: "Failed to read from storage" }),
-      );
-    }
-  });
-
-  container.handleLocalStorageWrite(([key, value], { ok, err }) => {
-    try {
-      const b64 = btoa(String.fromCharCode(...value));
-      localStorage.setItem(storagePrefix + key, b64);
-      return ok(undefined);
-    } catch {
-      return err(
-        new StorageErr.Unknown({ reason: "Failed to write to storage" }),
-      );
-    }
-  });
-
-  container.handleLocalStorageClear((key, { ok, err }) => {
-    try {
-      localStorage.removeItem(storagePrefix + key);
-      return ok(undefined);
-    } catch {
-      return err(new StorageErr.Unknown({ reason: "Failed to clear storage" }));
-    }
-  });
-
-  // Deterministic 32-byte entropy scoped to the calling product and a
-  // caller-chosen key. Uses the wallet-provided `rootEntropySource` so the
-  // output stays stable across re-pairings instead of churning with each
-  // session's statement-account secret.
-  container.handleDeriveEntropy((key, { ok, err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new DeriveEntropyErr.Unknown({ reason: "Not connected" }));
-    }
-    try {
-      const entropy = deriveProductEntropyFromSource(
-        session.rootEntropySource,
-        `${label}.dot`,
-        key,
-      );
-      return ok(entropy);
-    } catch (e) {
-      return err(
-        new DeriveEntropyErr.Unknown({
-          reason: e instanceof Error ? e.message : String(e),
-        }),
-      );
-    }
-  });
-
-  container.handleNavigateTo((url, { ok }) => {
-    const dotUrl = dotNsUrl.parseDotNsDomain(url);
-
-    if (dotUrl && dotNsUrl.isDotDomain(dotUrl.identifier)) {
-      // .dot domain (including polkadot:// scheme)
-      window.open(
-        buildDotTargetUrl(
-          identifierToLabel(dotUrl.identifier),
-          dotUrl.pathname,
-        ),
-        "_blank",
-      );
-    } else {
-      const localhostUrl = dotNsUrl.parseLocalhostUrl(url);
-      if (localhostUrl) {
-        // localhost product: wrap in host URL
-        const suffix = localhostUrl.pathname ? "/" + localhostUrl.pathname : "";
-        window.open(
-          `${getHostOrigin()}/${localhostUrl.host}${suffix}`,
-          "_blank",
-        );
-      } else {
-        window.open(dotNsUrl.normalizeUrl(url), "_blank");
-      }
-    }
-
-    return ok(undefined);
-  });
-
-  container.handleDevicePermission((permission, { ok }) =>
-    permissionLimiter.schedule(() => {
-      // Notifications: tri-state, no iframe reload, silent on denied.
-      // (No Permissions Policy directive maps to Notifications, so granting
-      // it doesn't change the iframe `allow` attribute. And a denied user
-      // explicitly chose silence. Surfacing a "your notifications are
-      // blocked" toast would defeat the point.)
-      if (permission === "Notifications") {
-        const status = getPermissionStatus(label, "Notifications");
-        if (status === "granted") {
-          return ok(true);
-        }
-        if (status === "denied") {
-          return ok(false);
-        }
-
-        return fromPromise(
-          showPermissionRequestModal(label, "Notifications").then(() => {
-            setPermissionStatus(label, "Notifications", "granted");
-          }),
-          () => "denied" as const,
-        )
-          .map(() => true)
-          .orElse(() => {
-            setPermissionStatus(label, "Notifications", "denied");
-            return ok(false);
-          });
-      }
-
-      // OpenUrl has no host-level enforcement point on the web (cross-origin
-      // navigation happens via anchor or window.open). Auto-grant rather than
-      // show a modal whose "Deny" button can't be honoured.
-      if (!isEnforceableDevicePermission(permission)) {
-        return ok(true);
-      }
-
-      const status = getPermissionStatus(label, permission);
-
-      if (status === "granted") {
-        return ok(true);
-      }
-
-      if (status === "denied") {
-        showNotification({
-          label: `${label}.dot`,
-          text: `${permission} access is blocked. Use the permissions menu in the top bar to change this.`,
-          dismissMs: 6000,
-          browserNotification: false,
-        });
-        return ok(false);
-      }
-
-      // status === 'ask': show consent modal
-      return fromPromise(
-        showPermissionRequestModal(label, permission).then(() => {
-          setPermissionStatus(label, permission, "granted");
-          // Defer the reload to the next event loop tick so the
-          // container can finish sending the response before being
-          // disposed. Without this, cleanup() runs synchronously
-          // inside the dispatch, disposing the transport mid-response.
-          setTimeout(() => {
-            window.dispatchEvent(
-              new CustomEvent("dotli:device-permission-changed", {
-                detail: { label, permission },
-              }),
-            );
-          }, 0);
-        }),
-        () => "denied" as const,
-      )
-        .map(() => {
-          // User allowed, but the iframe reloads, so return false for now
-          return false;
-        })
-        .orElse(() => {
-          // User denied (rejected promise) or dialog dismissed
-          setPermissionStatus(label, permission, "denied");
-          return ok(false);
-        });
-    }),
-  );
-
-  container.handlePermission((request, { ok }) =>
-    permissionLimiter.schedule(() => {
-      log.warn(
-        `[${label}] remote_permission incoming: tag=${request.tag}, value=${JSON.stringify(request.value)}`,
-      );
-
-      if (request.tag in CACHED_SUBMIT_PERMISSIONS) {
-        return promptCachedSubmitPermission(
-          label,
-          request.tag as keyof typeof CACHED_SUBMIT_PERMISSIONS,
-        );
-      }
-
-      // Remote (HTTP/WS) and WebRTC are auto-granted: the browser can't
-      // reliably intercept fetch/XHR/WebSocket from inside an iframe, and
-      // WebRTC is already gated by the iframe `allow` attribute. Any
-      // future unknown wire tag lands here too and auto-grants.
-      log.warn(`[${label}] remote_permission ${request.tag} auto-granted`);
-      return ok(true);
-    }),
-  );
-
-  container.handlePushNotification(
-    ({ text, deeplink, scheduledAt }, { ok }) => {
-      log.warn(`[${label}] Push notification:`, {
-        text,
-        deeplink,
-        scheduledAt,
-      });
-      const scheduledAtMs =
-        scheduledAt === undefined ? null : Number(scheduledAt);
-      return fromPromise(
-        scheduleNotification({
-          productId: label,
-          title: label,
-          text,
-          deeplink: deeplink ?? null,
-          scheduledAt: scheduledAtMs,
-        }),
-        (e) =>
-          new PushNotificationError.Unknown({
-            reason: e instanceof Error ? e.message : String(e),
-          }),
-      ).andThen((result) => {
-        if (!result.ok) {
-          // The only failure the scheduler reports is the per-product cap.
-          return errAsync(new PushNotificationError.ScheduleLimitReached());
-        }
-        if (result.immediate) {
-          showNotification({
-            text,
-            deeplink: deeplink ?? undefined,
-            label,
-          });
-        }
-        return ok(result.id);
-      });
-    },
-  );
-
-  container.handlePushNotificationCancel((id, { ok }) =>
-    fromPromise(
-      cancelNotification(label, id),
-      (e) =>
-        new GenericError({
-          reason: e instanceof Error ? e.message : String(e),
-        }),
-    ).andThen(() => ok(undefined)),
-  );
-
-  //
-  // Handlers resolve getStatementStore() lazily (at call time, not setup time)
-  // because initAuth() is lazy-loaded and may not have run yet.
-
-  container.handleStatementStoreSubscribe((topicFilter, send) => {
-    let innerUnsub: (() => void) | null = null;
-    let cancelled = false;
-
-    function startSubscription(store: StatementStoreAdapter): void {
-      if (cancelled) {
-        return;
-      }
-      // Bridge the wire-side tagged union to the adapter's discriminator-free
-      // `{ matchAll }`/`{ matchAny }` shape.
-      const topics = topicFilter.value;
-      const filter =
-        topicFilter.tag === "MatchAny"
-          ? { matchAny: topics }
-          : { matchAll: topics };
-      log.warn(`[${label}] Statement store subscribe, topics:`, topics.length);
-      innerUnsub = store.subscribeStatements(filter, (page) => {
-        log.warn(
-          `[${label}] Statement store received ${String(page.statements.length)} statements (isComplete=${String(page.isComplete)})`,
-        );
-        const signed = page.statements.filter(
-          (s): s is SignedStatement => s.proof !== undefined,
-        );
-        if (signed.length > 0) {
-          send({
-            statements: signed.map(mapSdkSignedStatement),
-            isComplete: page.isComplete,
-          });
-        }
-      });
-    }
-
-    const store = getStatementStore();
-    if (store) {
-      startSubscription(store);
-    } else {
-      log.warn(
-        `[${label}] Statement store subscribe — store not ready, waiting…`,
-      );
-      void onStatementStoreReady().then(startSubscription);
-    }
-
-    return () => {
-      cancelled = true;
-      innerUnsub?.();
-    };
-  });
-
-  container.handleStatementStoreSubmit((statement) =>
-    submitLimiter.schedule(() => {
-      const store = getStatementStore();
-      if (!store) {
-        return errAsync(
-          new GenericError({ reason: "Statement store not initialized" }),
-        );
-      }
-      return store
-        .submitStatement(mapFromHostSignedStatement(statement))
-        .map(() => undefined)
-        .mapErr((e: Error) => new GenericError({ reason: e.message }));
-    }),
-  );
-
-  // ProductAccountId ([dotNsIdentifier, derivationIndex]) is intentionally
-  // unused. The proof is always signed with the root session key because only
-  // the session account has a network allowance (quota) on People Chain.
-  // Derived product accounts are not registered and cannot submit statements.
-  container.handleStatementStoreCreateProof(([, statement], { err }) => {
-    const session = getSession();
-    if (!session) {
-      return err(new StatementProofErr.UnableToSign());
-    }
-
-    return fromPromise(readSessionSecret(session.id), (e) =>
-      e instanceof Error ? e : new Error(String(e)),
-    )
-      .mapErr((e) => new StatementProofErr.Unknown({ reason: e.message }))
-      .andThen((secret) =>
-        secret
-          ? fromPromise(
-              Promise.resolve(createSr25519Prover(secret)),
-              () => new StatementProofErr.UnableToSign(),
-            )
-          : err(new StatementProofErr.UnableToSign()),
-      )
-      .andThen((prover) =>
-        prover
-          .generateMessageProof(mapFromHostStatement(statement))
-          .mapErr((e) => new StatementProofErr.Unknown({ reason: e.message })),
-      )
-      .map((signed) => mapSdkProof(signed.proof));
-  });
-
-  // Submit stores data on Bulletin via TransactionStorage.store(), signed
-  // with the user's wallet-authorized allowance slot account, and returns
-  // the Blake2b-256 hash key.
-  // Lookup retrieves data by hash via Helia P2P (IPFS gateway fallback).
-
-  const preimageCache = new Map<string, Uint8Array>();
-
-  container.handlePreimageSubmit((value) =>
-    preimageLimiter.schedule(() => {
-      log.warn(
-        `[${label}] Preimage submit request, size: ${String(value.byteLength)}`,
-      );
-
-      return fromPromise(showPreimageSubmitModal(value.byteLength), (e) =>
-        e instanceof Error ? e.message : "User denied preimage submit",
-      )
-        .andThen(() => {
-          const session = getSession();
-          if (!session) {
-            return errAsync("No active session");
-          }
-          const allowance = getAllowanceService();
-          if (!allowance) {
-            return errAsync("Allowance service not initialized");
-          }
-          // Slot-account keys are cached per (session, product, resource) in
-          // host-papp's AllowanceRepository, so only the first submit
-          // round-trips to the wallet.
-          return allowance
-            .getBulletinSigner(session.id, labelToProductIdentifier(label))
-            .mapErr((e) => e.message);
-        })
-        .andThen((signer) => {
-          const key = computePreimageKey(value);
-          return fromPromise(submitPreimageAsUser(value, signer), (e) =>
-            e instanceof Error ? e.message : String(e),
-          ).map(() => {
-            preimageCache.set(key, value);
-            log.warn(`[${label}] Preimage stored, key: ${key}`);
-            return key;
-          });
-        })
-        .mapErr((reason) => {
-          // Surface the real failure reason on the host console. The
-          // product-side only receives the opaque `PreimageSubmitErr.Unknown`
-          // class, so without this log there is no way to diagnose why a
-          // submit got rejected.
-          log.error(`[${label}] Preimage submit failed: ${reason}`);
-          return new PreimageSubmitErr.Unknown({ reason });
-        });
-    }),
-  );
-
-  // Preimage lookup subscribe contract:
-  //   - Caller (sandboxed app) requests a preimage by key. The lookup runs
-  //     against the user's chosen content backend exclusively, no crossover.
-  //   - We poll at POLL_INTERVAL_MS until cached or the caller drops the
-  //     subscription.
-  //   - A miss ("not found yet") and a backend throw (Helia/gateway error)
-  //     are both logged and polling continues. The subscription never
-  //     self-interrupts: the propagation time for a valid preimage can be
-  //     arbitrary, and cutting the subscription on "a few misses" made slow
-  //     but healthy chains look like transport failure to the caller.
-  //   - This is not a silent retry across providers. The user-selected
-  //     backend is the only backend dialed. Failures stay attributable.
-  container.handlePreimageLookupSubscribe((key, send, _interrupt) => {
-    log.warn(`[${label}] Preimage lookup subscribe, key: ${key}`);
-
-    let stopped = false;
-
-    // Check local cache first
-    const cached = preimageCache.get(key);
-    if (cached) {
-      send(cached);
-    } else {
-      send(null);
-    }
-
-    // Poll: use whichever content backend the user selected.
-    const poll = async (): Promise<void> => {
-      if (stopped) {
-        return;
-      }
-
-      // Re-check cache (may have been populated by a submit)
-      const cachedValue = preimageCache.get(key);
-      if (cachedValue) {
-        send(cachedValue);
-        return;
-      }
-
-      const cid = hashToCid(key);
-      const cidString = cid.toString();
-
-      // Honor the user's backend choice. No silent smoldot-to-gateway
-      // crossover. A bitswap lookup failure is a bitswap failure. A
-      // gateway failure is a gateway failure. We log and keep polling.
-      // The caller unsubscribes when it's done waiting.
-      const backend = getBackend();
-      try {
-        if (backend === "rpc-gateway") {
-          const result = await fetchFromIpfs(cidString);
-          if (result.data.length > 0) {
-            preimageCache.set(key, result.data);
-            send(result.data);
-            return;
-          }
-        } else {
-          // smoldot-direct or smoldot-shared-worker: fetch via the protocol
-          // iframe's smoldot using `bitswap_v1_get`. The host helper sends
-          // it through the existing chainConnect/chainSend bridge and
-          // handles the -32811/-32812 retry envelope.
-          const { bitswapGet } = await import("./bulletin-bitswap");
-          const data = await bitswapGet(cidString);
-          if (data.length > 0) {
-            preimageCache.set(key, data);
-            send(data);
-            return;
-          }
-        }
-      } catch (err) {
-        log.warn(`[${label}] preimage lookup via ${backend} failed:`, err);
-      }
-    };
-
-    const POLL_INTERVAL_MS = 10_000;
-    const intervalId = setInterval(() => void poll(), POLL_INTERVAL_MS);
-    const initialTimeoutId = setTimeout(() => void poll(), 1000);
-
-    return () => {
-      stopped = true;
-      clearInterval(intervalId);
-      clearTimeout(initialTimeoutId);
-    };
-  });
-
-  container.handleThemeSubscribe((_params, send) => {
-    const readTheme = () =>
-      ({
-        name: { tag: "Default", value: undefined },
-        variant:
-          document.documentElement.getAttribute("data-theme") === "light"
-            ? "Light"
-            : "Dark",
-      }) as const;
-
-    send(readTheme());
-
-    const listener = (): void => {
-      send(readTheme());
-    };
-    window.addEventListener("dotli:theme-changed", listener);
-
-    return () => {
-      window.removeEventListener("dotli:theme-changed", listener);
-    };
-  });
-
-  // dot.li does not own a payment rail yet. Register explicit
-  // "not implemented" responses so products see a specific reason
-  // rather than a generic transport error, and subscription starts
-  // fail fast via `interrupt` with a typed error.
-  container.handlePaymentBalanceSubscribe((_, _send, interrupt) => {
-    interrupt(new PaymentBalanceErr.PermissionDenied());
-    return NOOP;
-  });
-
-  container.handlePaymentTopUp((_, { err }) => {
-    return err(
-      new PaymentTopUpErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-  });
-
-  container.handlePaymentRequest((_, { err }) => {
-    return err(
-      new PaymentRequestErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-  });
-
-  container.handlePaymentStatusSubscribe((_, _send, interrupt) => {
-    interrupt(
-      new PaymentStatusErr.Unknown({ reason: PAYMENTS_NOT_IMPLEMENTED }),
-    );
-    return NOOP;
-  });
-
-  return () => {
-    aliasLimiter.destroy();
-    permissionLimiter.destroy();
-    submitLimiter.destroy();
-    preimageLimiter.destroy();
-  };
-}
-
-const PAYMENTS_NOT_IMPLEMENTED = "Payments are not supported in dot.li";
-const NOOP: VoidFunction = () => undefined;
-
-// Each submit-style wire tag caches a per-product decision in
-// localStorage under the `storageKey` below, prompting once via
-// `showPermissionRequestModal` when the cache is empty. `Remote`
-// intentionally prompts every call (the domain-pattern list is
-// dynamic). `WebRTC` is auto-granted (browser gates it via the
-// iframe `allow` attribute).
-
-const CACHED_SUBMIT_PERMISSIONS = {
-  ChainSubmit: { storageKey: "ChainSubmit", label: "Transaction signing" },
-  PreimageSubmit: { storageKey: "PreimageSubmit", label: "Preimage submit" },
-  StatementSubmit: { storageKey: "StatementSubmit", label: "Statement submit" },
-  GetUserId: { storageKey: "GetUserId", label: "Reveal Username" },
-} satisfies Record<string, { storageKey: PermissionName; label: string }>;
-
-function promptCachedSubmitPermission(
-  productLabel: string,
-  tag: keyof typeof CACHED_SUBMIT_PERMISSIONS,
-): ResultAsync<boolean, never> {
-  const { storageKey, label: humanLabel } = CACHED_SUBMIT_PERMISSIONS[tag];
-  const status = getPermissionStatus(productLabel, storageKey);
-  log.warn(`[${productLabel}] remote_permission ${tag}, status=${status}`);
-
-  if (status === "granted") {
-    return okAsync(true);
-  }
-
-  if (status === "denied") {
-    log.warn(
-      `[${productLabel}] ${tag} cached as denied — toggle the permission in the top-bar menu to re-prompt`,
-    );
-    showNotification({
-      label: `${productLabel}.dot`,
-      text: `${humanLabel} is blocked. Use the permissions menu in the top bar to change this.`,
-      dismissMs: 6000,
-      browserNotification: false,
-    });
-    return okAsync(false);
-  }
-
-  return fromPromise(
-    showPermissionRequestModal(productLabel, storageKey).then(() => {
-      setPermissionStatus(productLabel, storageKey, "granted");
-      window.dispatchEvent(
-        new CustomEvent("dotli:permission-changed", {
-          detail: { label: productLabel },
-        }),
-      );
-    }),
-    () => "denied" as const,
-  )
-    .map(() => true)
-    .orElse(() => {
-      setPermissionStatus(productLabel, storageKey, "denied");
-      return okAsync(false);
-    });
-}
-
-/** Strip the `.dot` suffix to get the bare label (e.g. "mytestapp.dot" becomes "mytestapp"). */
-function identifierToLabel(identifier: string): string {
-  return identifier.slice(0, -".dot".length);
-}
-
-/** Build a full URL for a .dot product on the current environment. */
-function buildDotTargetUrl(label: string, pathname: string): string {
-  const suffix = pathname ? "/" + pathname : "";
-  if (isLocalhost) {
-    return `http://${label}.localhost:${window.location.port}${suffix}`;
-  }
-  return `${window.location.protocol}//${label}.${BASE_DOMAIN}${suffix}`;
-}
-
-/** Bare host origin without any product subdomain (e.g. `http://localhost:5173` or `https://dot.li`). */
-function getHostOrigin(): string {
-  if (isLocalhost) {
-    return `http://localhost:${window.location.port}`;
-  }
-  return `${window.location.protocol}//${BASE_DOMAIN}`;
-}
-
-/** Check if a value is a Uint8Array (or cross-realm equivalent). */
-function isUint8ArrayLike(data: unknown): data is Uint8Array {
-  if (data instanceof Uint8Array) {
-    return true;
-  }
-  if (typeof data !== "object" || data === null) {
-    return false;
-  }
-  return (
-    (data as { constructor: { name: string } }).constructor.name ===
-    "Uint8Array"
-  );
-}
-
-// Implements the same Provider interface as createIframeProvider
-// but targets a captured Window reference (from event.source)
-// instead of an HTMLIFrameElement.
-
-function createWindowProvider(sourceWindow: Window): Provider {
-  let disposed = false;
-  const subscribers = new Set<(message: Uint8Array) => void>();
-
-  const messageHandler = (event: MessageEvent): void => {
-    if (disposed) {
-      return;
-    }
-    if (event.source !== sourceWindow) {
-      return;
-    }
-    if (!isUint8ArrayLike(event.data)) {
-      return;
-    }
-
-    for (const subscriber of subscribers) {
-      subscriber(event.data);
-    }
-  };
-
-  window.addEventListener("message", messageHandler);
-
-  return {
-    logger: createDefaultLogger(),
-
-    isCorrectEnvironment() {
-      return true;
-    },
-    postMessage(message) {
-      if (disposed) {
-        return;
-      }
-      sourceWindow.postMessage(message, "*", [message.buffer]);
-    },
-    subscribe(callback) {
-      subscribers.add(callback);
-      return () => {
-        subscribers.delete(callback);
-      };
-    },
-    dispose() {
-      disposed = true;
-      subscribers.clear();
-      window.removeEventListener("message", messageHandler);
-    },
-  };
-}
-
-// Listens for Uint8Array postMessage events from windows other
-// than the primary iframe. When a new source is detected, creates
-// a full bridge (Provider + Container + handlers) for that window.
-//
-// This enables nested dApps (dApp-in-dApp) to communicate with
-// the HOST, since all dApps send to window.top regardless of depth.
-
-export function setupNestedBridgeDetector(
-  primaryIframe: HTMLIFrameElement,
-  label: string,
-): () => void {
-  const knownWindows = new Set<MessageEventSource>();
-  const disposers: (() => void)[] = [];
-
-  function messageHandler(event: MessageEvent): void {
-    // Only handle protocol messages (Uint8Array)
-    if (!isUint8ArrayLike(event.data)) {
-      return;
-    }
-    // Skip messages from the primary iframe (handled by its own bridge)
-    if (event.source === primaryIframe.contentWindow) {
-      return;
-    }
-    // Skip messages from ourselves
-    if (event.source === window) {
-      return;
-    }
-    // Must have a source
-    if (event.source === null) {
-      return;
-    }
-    // Skip already-known nested windows
-    if (knownWindows.has(event.source)) {
-      return;
-    }
-
-    // Validate origin: only allow *.dot.li and *.localhost origins
-    try {
-      const url = new URL(event.origin);
-      const h = url.hostname;
-      const allowed =
-        h.endsWith(`.${BASE_DOMAIN}`) ||
-        h === BASE_DOMAIN ||
-        h === "localhost" ||
-        h.endsWith(".localhost");
-      if (!allowed) {
-        log.warn(
-          `[dot.li] Rejected nested bridge from disallowed origin: ${event.origin}`,
-        );
-        return;
-      }
-    } catch {
-      return;
-    }
-
-    // Cap the number of nested bridges
-    if (knownWindows.size >= MAX_NESTED_BRIDGES) {
-      log.warn(
-        `[dot.li] Nested bridge limit reached (max ${String(MAX_NESTED_BRIDGES)}), ignoring`,
-      );
-      return;
-    }
-
-    // New nested dApp detected
-    knownWindows.add(event.source);
-    const nestedId = String(knownWindows.size);
-    log.warn(`[dot.li] Nested dApp #${nestedId} detected, creating bridge`);
-
-    const provider = createWindowProvider(event.source as Window);
-    const productId = `${label}:nested-${nestedId}`;
-    emitDotliDebugEvent({
-      layer: "bridge",
-      event: "nested_detected",
-      flowId:
-        typeof crypto !== "undefined" && "randomUUID" in crypto
-          ? crypto.randomUUID()
-          : `bridge-${String(Date.now())}-${nestedId}`,
-      timestamp: Date.now(),
-      payload: { label, productId, nestedIndex: knownWindows.size },
-    });
-    const container = createContainer(provider, { productId });
-    const nestedPrefix = `dotli:${label}:nested-${nestedId}:`;
-    const teardown = wireContainerHandlers(container, label, nestedPrefix);
-
-    disposers.push(() => {
-      teardown();
-      container.dispose();
-    });
-  }
-
-  window.addEventListener("message", messageHandler);
-
-  return () => {
-    window.removeEventListener("message", messageHandler);
-    for (const dispose of disposers) {
-      dispose();
-    }
-    knownWindows.clear();
-    disposers.length = 0;
-  };
-}
-
-/**
- * Set up the host container for an iframe displaying a .dot SPA.
- *
- * Creates a postMessage-based provider, wires up all handlers
- * (accounts, signing, localStorage, etc.) and loads the URL in the iframe.
- *
- * Returns a dispose function to tear down the container.
- */
-export function setupContainer(
-  iframe: HTMLIFrameElement,
-  blobUrl: string,
-  label: string,
-  bridgeFlowId?: string,
-): () => void {
-  const baseProvider = createIframeProvider({ iframe, url: blobUrl });
-  const provider =
-    bridgeFlowId !== undefined
-      ? instrumentProvider(baseProvider, label, bridgeFlowId)
-      : baseProvider;
-  const container = createContainer(provider, { productId: label });
-  const storagePrefix = `dotli:${label}:`;
-  const teardown = wireContainerHandlers(container, label, storagePrefix);
-
-  return () => {
-    teardown();
-    container.dispose();
-  };
-}
-
-/**
- * Wrap a bridge Provider so the first inbound and first outbound
- * messages emit debug events. These anchor the often-long window
- * between `bridge:setup_ready` (handler registered) and the moment
- * the product iframe actually starts exchanging messages with the
- * host, during which the TrUAPI swimlane typically shows dozens to
- * hundreds of `host_handshake_request` retries with no corresponding
- * system-layer activity.
- */
-function instrumentProvider(
-  base: Provider,
-  label: string,
-  bridgeFlowId: string,
-): Provider {
-  let inboundEmitted = false;
-  let outboundEmitted = false;
-  return {
-    ...base,
-    postMessage(message) {
-      if (!outboundEmitted) {
-        outboundEmitted = true;
-        emitDotliDebugEvent({
-          layer: "bridge",
-          event: "first_outbound",
-          flowId: bridgeFlowId,
-          timestamp: Date.now(),
-          payload: { label, productId: label },
-        });
-        // Signal the main-thread monitor that it can stop. The
-        // bridge is fully established.
-        try {
-          window.dispatchEvent(new CustomEvent("dotli:debug:bridge-ready"));
-          // eslint-disable-next-line no-restricted-syntax -- dispatchEvent may throw in exotic environments; the debug monitor is best-effort.
-        } catch {
-          /* ignore: monitor just falls back to its duration cap */
-        }
-      }
-      base.postMessage(message);
-    },
-    subscribe(callback) {
-      return base.subscribe((message) => {
-        if (!inboundEmitted) {
-          inboundEmitted = true;
-          emitDotliDebugEvent({
-            layer: "bridge",
-            event: "first_inbound",
-            flowId: bridgeFlowId,
-            timestamp: Date.now(),
-            payload: { label, productId: label },
-          });
-        }
-        callback(message);
-      });
-    },
-  };
-}
diff --git a/packages/ui/src/host-callbacks/AuthState.ts b/packages/ui/src/host-callbacks/AuthState.ts
new file mode 100644
index 00000000..98b49e67
--- /dev/null
+++ b/packages/ui/src/host-callbacks/AuthState.ts
@@ -0,0 +1,72 @@
+import type { AuthPresenter, AuthState } from "@parity/truapi-host";
+import {
+  toSessionUiState,
+  writeUiStateCache,
+  type TruapiSessionUiState,
+} from "./SessionStore";
+
+/**
+ * UI-level auth state dispatched on `dotli:truapi-auth-state`. Mirrors the
+ * core's `AuthState` with byte fields already converted for rendering, plus
+ * the pairing presentation context the topbar modal needs.
+ */
+export type DotliAuthState =
+  | { tag: "Disconnected" }
+  | {
+      tag: "Pairing";
+      deeplink: string;
+      label: string;
+      dotSuffix?: boolean;
+      hostGlobal?: boolean;
+    }
+  | { tag: "Connected"; session: TruapiSessionUiState }
+  | { tag: "LoginFailed"; reason: string };
+
+/** Dispatch a `dotli:truapi-auth-state` event for the topbar to render. */
+export function dispatchAuthState(state: DotliAuthState): void {
+  window.dispatchEvent(
+    new CustomEvent<DotliAuthState>("dotli:truapi-auth-state", {
+      detail: state,
+    }),
+  );
+}
+
+/**
+ * Build the `authStateChanged` host callback: converts the core's ordered
+ * auth states into `dotli:truapi-auth-state` events and maintains the
+ * boot-rehydration UI-state cache on connect/disconnect transitions.
+ */
+export function createAuthStateChanged(
+  label: string,
+  options: { dotSuffix?: boolean; hostGlobal?: boolean } = {},
+): Required<AuthPresenter>["authStateChanged"] {
+  return (state: AuthState) => {
+    switch (state.tag) {
+      case "Pairing": {
+        dispatchAuthState({
+          tag: "Pairing",
+          deeplink: state.value.deeplink,
+          label,
+          dotSuffix: options.dotSuffix,
+          hostGlobal: options.hostGlobal,
+        });
+        break;
+      }
+      case "Connected": {
+        const session = toSessionUiState(state.value);
+        void writeUiStateCache(session);
+        dispatchAuthState({ tag: "Connected", session });
+        break;
+      }
+      case "Disconnected": {
+        void writeUiStateCache({ connected: false });
+        dispatchAuthState({ tag: "Disconnected" });
+        break;
+      }
+      case "LoginFailed": {
+        dispatchAuthState({ tag: "LoginFailed", reason: state.value.reason });
+        break;
+      }
+    }
+  };
+}
diff --git a/packages/ui/src/host-callbacks/Chain.ts b/packages/ui/src/host-callbacks/Chain.ts
new file mode 100644
index 00000000..979aac4e
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Chain.ts
@@ -0,0 +1,130 @@
+// dot.li — TrUAPI chain callback
+//
+// Routes product chain RPC traffic through whichever backend the user
+// has selected in the host shell ("Light Client" via smoldot, or
+// "RPC Node" via curated WSS endpoints).
+//
+// Without this callback, truapi-server would fall back to its own
+// bundled smoldot — which would ignore the toggle, double the
+// light-client footprint, and rebuild a fresh chain alongside the one
+// dotli's resolver already maintains. Routing through dotli's existing
+// providers reuses already-synced chains and respects the toggle.
+
+import { bytesToHex } from "@parity/truapi/scale";
+import type {
+  JsonRpcRequest,
+  JsonRpcProvider,
+} from "@polkadot-api/json-rpc-provider";
+import type { ChainProvider } from "@parity/truapi-host";
+import type { PlatformJsonRpcConnection } from "@parity/truapi-host";
+import { getBackend } from "@dotli/config/mode";
+import {
+  createChainProvider as createSmoldotChainProvider,
+  isChainSupported as isSmoldotChainSupported,
+} from "@dotli/resolver/chains";
+import {
+  createCoreRpcChainProvider,
+  isCoreRpcChainSupported,
+} from "@dotli/resolver/rpc-chain";
+import { log } from "@dotli/shared/log";
+
+function isJsonRpcRequest(value: unknown): value is JsonRpcRequest<unknown> {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value as Record<string, unknown>;
+  const id = record.id;
+  return (
+    record.jsonrpc === "2.0" &&
+    typeof record.method === "string" &&
+    (id === undefined ||
+      id === null ||
+      typeof id === "string" ||
+      typeof id === "number")
+  );
+}
+
+function toConnection(
+  provider: JsonRpcProvider<unknown> | null,
+): PlatformJsonRpcConnection {
+  if (!provider) {
+    throw new Error("Chain provider unavailable");
+  }
+  const queue: string[] = [];
+  let wake: (() => void) | null = null;
+  let stopped = false;
+  let closed = false;
+  const conn = provider((message: unknown) => {
+    if (closed) {
+      return;
+    }
+    queue.push(JSON.stringify(message));
+    wake?.();
+    wake = null;
+  });
+  const close = (): void => {
+    if (closed) {
+      return;
+    }
+    stopped = true;
+    closed = true;
+    conn.disconnect();
+    wake?.();
+    wake = null;
+  };
+
+  return {
+    send(request: string): void {
+      const parsed: unknown = JSON.parse(request);
+      if (!isJsonRpcRequest(parsed)) {
+        throw new Error("Invalid JSON-RPC request");
+      }
+      conn.send(parsed);
+    },
+    async *responses(): AsyncIterable<string> {
+      try {
+        while (!stopped) {
+          while (queue.length > 0) {
+            const response = queue.shift();
+            if (response !== undefined) {
+              yield response;
+            }
+          }
+          await new Promise<void>((resolve) => {
+            wake = resolve;
+          });
+        }
+      } finally {
+        close();
+      }
+    },
+    close,
+  };
+}
+
+export function createChainConnect(): ChainProvider["connect"] {
+  return (genesisHashBytes) => {
+    const genesisHash = bytesToHex(genesisHashBytes);
+    const backend = getBackend();
+    if (backend === "rpc-gateway") {
+      if (!isCoreRpcChainSupported(genesisHash)) {
+        log.warn(
+          `[dot.li truapi-chain] RPC backend doesn't support ${genesisHash}; product call will fail`,
+        );
+        throw new Error(`Unsupported RPC chain: ${genesisHash}`);
+      }
+      const connection = toConnection(createCoreRpcChainProvider(genesisHash));
+      return Promise.resolve(connection);
+    }
+
+    if (!isSmoldotChainSupported(genesisHash)) {
+      log.warn(
+        `[dot.li truapi-chain] smoldot backend doesn't support ${genesisHash}; product call will fail`,
+      );
+      throw new Error(`Unsupported smoldot chain: ${genesisHash}`);
+    }
+    return Promise.resolve(
+      toConnection(createSmoldotChainProvider(genesisHash)),
+    );
+  };
+}
diff --git a/packages/ui/src/host-callbacks/FeatureSupported.ts b/packages/ui/src/host-callbacks/FeatureSupported.ts
new file mode 100644
index 00000000..aebc7ef1
--- /dev/null
+++ b/packages/ui/src/host-callbacks/FeatureSupported.ts
@@ -0,0 +1,14 @@
+import type { Features } from "@parity/truapi-host";
+import { getBackend } from "@dotli/config/mode";
+import { isChainSupported as isSmoldotChainSupported } from "@dotli/resolver/chains";
+import { isRpcChainSupported } from "@dotli/resolver/rpc-chain";
+
+export function createFeatureSupported(): Features["featureSupported"] {
+  return (request) => {
+    const supported =
+      getBackend() === "rpc-gateway"
+        ? isRpcChainSupported(request.value.genesisHash)
+        : isSmoldotChainSupported(request.value.genesisHash);
+    return Promise.resolve({ supported });
+  };
+}
diff --git a/packages/ui/src/host-callbacks/LocalStorage.ts b/packages/ui/src/host-callbacks/LocalStorage.ts
new file mode 100644
index 00000000..7fd734ef
--- /dev/null
+++ b/packages/ui/src/host-callbacks/LocalStorage.ts
@@ -0,0 +1,59 @@
+import type { ProductStorage } from "@parity/truapi-host";
+import { base64 } from "@scure/base";
+
+const SSO_DEVICE_IDENTITY_KEY = "truapi:sso-device-identity:v1";
+
+export function createLocalStorageRead(): ProductStorage["read"] {
+  return (key) => {
+    try {
+      const raw = localStorage.getItem(storageKey(key));
+      if (raw === null) {
+        return Promise.resolve(undefined);
+      }
+      return Promise.resolve(base64.decode(raw));
+    } catch (cause) {
+      return Promise.reject(
+        new Error("Failed to read from storage", { cause }),
+      );
+    }
+  };
+}
+
+export function createLocalStorageWrite(): ProductStorage["write"] {
+  return (key, value) => {
+    try {
+      localStorage.setItem(storageKey(key), base64.encode(value));
+      return Promise.resolve();
+    } catch (cause) {
+      return Promise.reject(new Error("Failed to write to storage", { cause }));
+    }
+  };
+}
+
+export function createLocalStorageClear(): ProductStorage["clear"] {
+  return (key) => {
+    try {
+      if (key === SSO_DEVICE_IDENTITY_KEY) {
+        clearSsoDeviceIdentities();
+      }
+      localStorage.removeItem(storageKey(key));
+      return Promise.resolve();
+    } catch (cause) {
+      return Promise.reject(new Error("Failed to clear storage", { cause }));
+    }
+  };
+}
+
+function storageKey(key: string): string {
+  return `dotli:${key}`;
+}
+
+function clearSsoDeviceIdentities(): void {
+  const suffix = `:${SSO_DEVICE_IDENTITY_KEY}`;
+  for (let index = localStorage.length - 1; index >= 0; index -= 1) {
+    const itemKey = localStorage.key(index);
+    if (itemKey?.startsWith("dotli:") === true && itemKey.endsWith(suffix)) {
+      localStorage.removeItem(itemKey);
+    }
+  }
+}
diff --git a/packages/ui/src/host-callbacks/OpenUrl.ts b/packages/ui/src/host-callbacks/OpenUrl.ts
new file mode 100644
index 00000000..9be6293f
--- /dev/null
+++ b/packages/ui/src/host-callbacks/OpenUrl.ts
@@ -0,0 +1,53 @@
+// Navigation callback. The Rust core pre-normalizes URLs, but dotli still
+// needs to classify the result so `.dot` domains land on the right host
+// subdomain and localhost products wrap into the configured host origin.
+
+import type { Navigation } from "@parity/truapi-host";
+import { isLocalhost, BASE_DOMAIN } from "@dotli/config/config";
+import { dotNsUrl } from "@dotli/shared/dotns-url";
+
+function identifierToLabel(identifier: string): string {
+  return identifier.slice(0, -".dot".length);
+}
+
+function buildDotTargetUrl(label: string, pathname: string): string {
+  const suffix = pathname ? "/" + pathname : "";
+  if (isLocalhost) {
+    return `http://${label}.localhost:${window.location.port}${suffix}`;
+  }
+  return `${window.location.protocol}//${label}.${BASE_DOMAIN}${suffix}`;
+}
+
+function getHostOrigin(): string {
+  if (isLocalhost) {
+    return `http://localhost:${window.location.port}`;
+  }
+  return `${window.location.protocol}//${BASE_DOMAIN}`;
+}
+
+export function createNavigateTo(): Navigation["navigateTo"] {
+  return (url) => {
+    const dotUrl = dotNsUrl.parseDotNsDomain(url);
+
+    if (dotUrl && dotNsUrl.isDotDomain(dotUrl.identifier)) {
+      window.open(
+        buildDotTargetUrl(
+          identifierToLabel(dotUrl.identifier),
+          dotUrl.pathname,
+        ),
+        "_blank",
+      );
+      return Promise.resolve(undefined);
+    }
+
+    const localhostUrl = dotNsUrl.parseLocalhostUrl(url);
+    if (localhostUrl) {
+      const suffix = localhostUrl.pathname ? "/" + localhostUrl.pathname : "";
+      window.open(`${getHostOrigin()}/${localhostUrl.host}${suffix}`, "_blank");
+      return Promise.resolve(undefined);
+    }
+
+    window.open(url, "_blank");
+    return Promise.resolve(undefined);
+  };
+}
diff --git a/packages/ui/src/host-callbacks/Preimage.ts b/packages/ui/src/host-callbacks/Preimage.ts
new file mode 100644
index 00000000..c2ff22ac
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Preimage.ts
@@ -0,0 +1,107 @@
+// Preimage lookup adapter — polls the user-selected content backend
+// (Helia P2P or IPFS gateway) until the preimage is found or the
+// subscription is dropped.
+
+import type { PreimageHost } from "@parity/truapi-host";
+import { hashToCid } from "@dotli/content/preimage";
+import { fetchFromIpfs } from "@dotli/content/ipfs";
+import { getBackend } from "@dotli/config/mode";
+import { serializeError } from "@dotli/shared/errors";
+import { log } from "@dotli/shared/log";
+import { bitswapGet } from "../bulletin-bitswap";
+import { toHex } from "@dotli/shared/hex";
+import { createResultStream } from "./result-stream";
+
+const POLL_INTERVAL_MS = 10_000;
+const INITIAL_POLL_DELAY_MS = 1000;
+const preimageCache = new Map<string, Uint8Array>();
+
+function noop(): void {
+  return;
+}
+
+function createPreimageLookupSubscribe(
+  label: string,
+): Required<PreimageHost>["lookupPreimage"] {
+  return (request) => {
+    const key = toHex(request);
+    log.warn(`[${label}] Preimage lookup subscribe, key: ${key}`);
+
+    const cached = preimageCache.get(key);
+    if (cached) {
+      return createResultStream<Uint8Array | undefined>([cached], () => noop);
+    }
+
+    let stopped = false;
+    return createResultStream<Uint8Array | undefined>(
+      [undefined],
+      (push, pushError) => {
+        let intervalId: ReturnType<typeof setInterval> | null = null;
+        let initialTimeoutId: ReturnType<typeof setTimeout> | null = null;
+        const stopPolling = (): void => {
+          stopped = true;
+          if (intervalId !== null) {
+            clearInterval(intervalId);
+            intervalId = null;
+          }
+          if (initialTimeoutId !== null) {
+            clearTimeout(initialTimeoutId);
+            initialTimeoutId = null;
+          }
+        };
+        const poll = async (): Promise<void> => {
+          if (stopped) {
+            return;
+          }
+
+          const cached = preimageCache.get(key);
+          if (cached) {
+            push(cached);
+            return;
+          }
+
+          const cid = hashToCid(key);
+          const cidString = cid.toString();
+          const backend = getBackend();
+          try {
+            if (backend !== "rpc-gateway") {
+              const data = await bitswapGet(cidString);
+              if (data.length > 0) {
+                preimageCache.set(key, data);
+                push(data);
+                stopPolling();
+                return;
+              }
+            } else {
+              const result = await fetchFromIpfs(cidString);
+              if (result.data.length > 0) {
+                preimageCache.set(key, result.data);
+                push(result.data);
+                stopPolling();
+                return;
+              }
+            }
+          } catch (err) {
+            log.warn(`[${label}] preimage lookup via ${backend} failed:`, err);
+            pushError({
+              reason: `preimage lookup via ${backend} failed: ${serializeError(err)}`,
+            });
+          }
+        };
+
+        intervalId = setInterval(() => void poll(), POLL_INTERVAL_MS);
+        initialTimeoutId = setTimeout(() => void poll(), INITIAL_POLL_DELAY_MS);
+
+        return () => {
+          stopPolling();
+        };
+      },
+    );
+  };
+}
+
+export function createPreimageAdapters(label: string): Required<PreimageHost> {
+  return {
+    lookupPreimage: createPreimageLookupSubscribe(label),
+  };
+}
diff --git a/packages/ui/src/host-callbacks/PromptPermission.ts b/packages/ui/src/host-callbacks/PromptPermission.ts
new file mode 100644
index 00000000..801f4a86
--- /dev/null
+++ b/packages/ui/src/host-callbacks/PromptPermission.ts
@@ -0,0 +1,127 @@
+// Permission prompt. The Rust core awaits the typed response before encoding
+// the product reply, so a slow modal blocks the product just as long as the
+// user takes to dismiss it. Device grants also schedule an iframe reload so
+// the browser sees the refreshed Permissions Policy `allow` attribute.
+
+import type { Permissions } from "@parity/truapi-host";
+import type { RemotePermission } from "@parity/truapi";
+import {
+  getPermissionStatus,
+  isEnforceableDevicePermission,
+  setPermissionStatus,
+  type EnforceablePermissionName,
+} from "../permissions";
+import { showPermissionRequestModal } from "../permission-modal";
+import { showNotification } from "../notification";
+import { createSubmitRateLimiter } from "./rate-limit";
+
+// Remote tags that don't reach a host enforcement point: WebRtc is gated
+// by the iframe `allow` attribute, and `Remote` (HTTP/WS) can't be
+// reliably intercepted from inside the sandbox. Auto-grant either.
+function gatedRemotePermissionName(
+  tag: RemotePermission["tag"],
+): EnforceablePermissionName | null {
+  switch (tag) {
+    case "ChainSubmit":
+    case "PreimageSubmit":
+    case "StatementSubmit":
+      return tag;
+    case "Remote":
+    case "WebRtc":
+      return null;
+  }
+}
+
+export function createPromptPermission(label: string): Permissions {
+  const limiter = createSubmitRateLimiter();
+  const devicePermission: Permissions["devicePermission"] = async (tag) => {
+    // OpenUrl has no host-side enforcement point; auto-grant rather than show
+    // a modal whose deny button cannot block the underlying browser API.
+    if (!isEnforceableDevicePermission(tag)) {
+      return { granted: true };
+    }
+    return {
+      granted: await decidePromptPermission(label, tag, {
+        kind: "Device",
+        limiter,
+        reloadOnGrant: true,
+      }),
+    };
+  };
+
+  const remotePermission: Permissions["remotePermission"] = async (request) => {
+    const name = gatedRemotePermissionName(request.permission.tag);
+    if (name === null) {
+      return { granted: true };
+    }
+    return {
+      granted: await decidePromptPermission(label, name, {
+        kind: "Remote",
+        limiter,
+      }),
+    };
+  };
+
+  return { devicePermission, remotePermission };
+}
+
+export async function decidePromptPermission(
+  label: string,
+  name: EnforceablePermissionName,
+  options: {
+    kind: "Device" | "Remote";
+    limiter: { allow: () => boolean };
+    reloadOnGrant?: boolean;
+  },
+): Promise<boolean> {
+  const { kind, limiter, reloadOnGrant = false } = options;
+  const status = await getPermissionStatus(label, name);
+  if (status === "granted") {
+    return true;
+  }
+  if (status === "denied") {
+    showNotification({
+      label: `${label}.dot`,
+      text:
+        kind === "Device"
+          ? `${name} access is blocked. Use the permissions menu in the top bar to change this.`
+          : "Transaction signing is blocked. Use the permissions menu in the top bar to change this.",
+      dismissMs: 6000,
+      browserNotification: false,
+    });
+    return false;
+  }
+  // status === "ask": show the modal and wait for the user.
+  if (!limiter.allow()) {
+    throw new Error("Permission prompt rate limited");
+  }
+  const decision = await showPermissionRequestModal(label, name);
+  if (decision === "dismissed") {
+    throw new Error("User dismissed permission dialog");
+  }
+  if (decision === "denied") {
+    await setPermissionStatus(label, name, "denied");
+    return false;
+  }
+  await setPermissionStatus(label, name, "granted");
+  if (kind === "Device" && reloadOnGrant) {
+    // Device permissions are also gated by the iframe `allow` attribute,
+    // which is fixed at iframe load time. Reload so the next attempt sees
+    // the updated attribute. Defer to the next tick so the prompt response
+    // can flush before the iframe is disposed.
+    setTimeout(() => {
+      window.dispatchEvent(
+        new CustomEvent("dotli:device-permission-changed", {
+          detail: { label, permission: name },
+        }),
+      );
+    }, 0);
+    return true;
+  }
+  // Remote permissions have no browser-level gate, so we can return the
+  // actual grant. The event keeps the topbar in sync.
+  window.dispatchEvent(
+    new CustomEvent("dotli:permission-changed", { detail: { label } }),
+  );
+  return true;
+}
diff --git a/packages/ui/src/host-callbacks/PushNotification.ts b/packages/ui/src/host-callbacks/PushNotification.ts
new file mode 100644
index 00000000..8735e397
--- /dev/null
+++ b/packages/ui/src/host-callbacks/PushNotification.ts
@@ -0,0 +1,60 @@
+// Push-notification callback. The Rust core passes the typed request, and
+// this adapter returns a stable host-side id for cancel support.
+
+import type { Notifications } from "@parity/truapi-host";
+import { log } from "@dotli/shared/log";
+import {
+  cancelNotification,
+  scheduleNotification,
+} from "../scheduled-notifications";
+import { showNotification } from "../notification";
+import { decidePromptPermission } from "./PromptPermission";
+import { createSubmitRateLimiter } from "./rate-limit";
+
+export function createNotificationAdapters(
+  label: string,
+): Required<Notifications> {
+  const limiter = createSubmitRateLimiter();
+  const pushNotification: Required<Notifications>["pushNotification"] = async ({
+    text,
+    deeplink,
+    scheduledAt,
+  }) => {
+    log.warn(`[${label}] Push notification:`, {
+      text,
+      deeplink,
+      scheduledAt,
+    });
+
+    const granted = await decidePromptPermission(label, "Notifications", {
+      kind: "Device",
+      limiter,
+    });
+    if (!granted) {
+      throw new Error("Notifications permission denied");
+    }
+
+    const result = await scheduleNotification({
+      productId: label,
+      title: label,
+      text,
+      deeplink: deeplink ?? null,
+      scheduledAt: scheduledAt === undefined ? null : Number(scheduledAt),
+    });
+    if (!result.ok) {
+      throw new Error("ScheduleLimitReached");
+    }
+
+    if (result.immediate) {
+      showNotification({ text, deeplink, label });
+    }
+    return { id: result.id };
+  };
+
+  const cancelPushNotification: Required<Notifications>["cancelNotification"] =
+    async (id) => {
+      await cancelNotification(label, id);
+    };
+
+  return { pushNotification, cancelNotification: cancelPushNotification };
+}
diff --git a/packages/ui/src/host-callbacks/SessionStore.ts b/packages/ui/src/host-callbacks/SessionStore.ts
new file mode 100644
index 00000000..a6e0dfa7
--- /dev/null
+++ b/packages/ui/src/host-callbacks/SessionStore.ts
@@ -0,0 +1,251 @@
+import { SITE_ID } from "@dotli/config/config";
+import { gcm } from "@noble/ciphers/aes.js";
+import { blake2b } from "@noble/hashes/blake2.js";
+import { bytesToHex, hexToBytes } from "@parity/truapi/scale";
+import { encodeCoreStorageKey } from "@parity/truapi-host";
+import type {
+  CoreStorage,
+  CoreStorageKey,
+  SessionUiInfo,
+} from "@parity/truapi-host";
+import { SHARED_CORE_SESSION_KEY } from "@dotli/protocol/auth-storage";
+import {
+  clearSharedAuthStorage,
+  readSharedAuthStorage,
+  subscribeSharedAuthStorage,
+  writeSharedAuthStorage,
+} from "@dotli/protocol/client";
+import { log } from "@dotli/shared/log";
+import { dispatchAuthState } from "./AuthState";
+
+const LOCAL_CHANGE_EVENT = "dotli:truapi-session-store-changed";
+const CORE_LOCAL_STORAGE_PREFIX = "dotli:core:";
+const textEncoder = new TextEncoder();
+
+// JSON cache of the last connected UI state the core reported via
+// `authStateChanged`. Lives in shared auth storage next to the opaque
+// root-domain session blob so boot-time rehydration never has to decode the
+// blob itself.
+const UI_STATE_CACHE_KEY = `${SHARED_CORE_SESSION_KEY}:ui-state`;
+
+function emitLocalChange(): void {
+  window.dispatchEvent(new Event(LOCAL_CHANGE_EVENT));
+}
+
+export interface TruapiSessionUiState {
+  connected: boolean;
+  publicKey?: string;
+  identityAccountId?: string;
+  liteUsername?: string;
+  fullUsername?: string;
+  primaryUsername?: string;
+}
+
+/** Convert the core's decoded session fields into the rendering-friendly
+ * shape (hex-encoded keys) the topbar and UI-state cache use. */
+export function toSessionUiState(info: SessionUiInfo): TruapiSessionUiState {
+  const primaryUsername = info.fullUsername ?? info.liteUsername;
+  return {
+    connected: true,
+    publicKey: bytesToHex(info.publicKey),
+    ...(info.identityAccountId !== undefined
+      ? { identityAccountId: bytesToHex(info.identityAccountId) }
+      : {}),
+    ...(info.liteUsername !== undefined
+      ? { liteUsername: info.liteUsername }
+      : {}),
+    ...(info.fullUsername !== undefined
+      ? { fullUsername: info.fullUsername }
+      : {}),
+    ...(primaryUsername !== undefined ? { primaryUsername } : {}),
+  };
+}
+
+/** Persist (or clear, when disconnected) the boot-rehydration UI-state
+ * cache next to the opaque session blob. Best-effort. */
+export async function writeUiStateCache(
+  detail: TruapiSessionUiState,
+): Promise<void> {
+  try {
+    if (detail.connected) {
+      await writeSharedAuthStorage(
+        SITE_ID,
+        UI_STATE_CACHE_KEY,
+        JSON.stringify(detail),
+      );
+    } else {
+      await clearSharedAuthStorage(SITE_ID, UI_STATE_CACHE_KEY);
+    }
+  } catch (err) {
+    log.warn("[dot.li] session UI cache write failed:", err);
+  }
+}
+
+async function readUiStateCache(): Promise<TruapiSessionUiState | null> {
+  try {
+    const raw = await readSharedAuthStorage(SITE_ID, UI_STATE_CACHE_KEY);
+    if (raw === null) {
+      return null;
+    }
+    const parsed: unknown = JSON.parse(raw);
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      (parsed as TruapiSessionUiState).connected
+    ) {
+      return parsed as TruapiSessionUiState;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Re-emit the cached UI state for the persisted same-origin session, if any.
+ * Used at boot so a reload shows the logged-in badge before any core
+ * instance runs. Only emits when a persisted session blob actually exists;
+ * without a cached state it degrades to a bare `connected: true`.
+ */
+export function emitPersistedSessionUiState(): void {
+  void (async () => {
+    let raw: string | null;
+    try {
+      raw = await readSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    } catch {
+      return;
+    }
+    if (raw === null || raw === "") {
+      return;
+    }
+    dispatchAuthState({
+      tag: "Connected",
+      session: (await readUiStateCache()) ?? { connected: true },
+    });
+  })();
+}
+
+export function createSessionStoreAdapters(): CoreStorage {
+  return {
+    async readCoreStorage(key) {
+      return readCoreStorageValue(key);
+    },
+    async writeCoreStorage(key, value) {
+      await writeCoreStorageValue(key, value);
+    },
+    async clearCoreStorage(key) {
+      await clearCoreStorageValue(key);
+    },
+  };
+}
+
+async function readCoreStorageValue(
+  key: CoreStorageKey,
+): Promise<Uint8Array | undefined> {
+  if (key.tag === "AuthSession") {
+    let raw: string | null;
+    try {
+      raw = await readSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    } catch (err) {
+      log.warn("[dot.li] shared auth session read failed:", err);
+      return undefined;
+    }
+    if (raw === null || raw === "") {
+      return undefined;
+    }
+    return hexToBytes(raw);
+  }
+  const raw = localStorage.getItem(coreLocalStorageKey(key));
+  return raw === null ? undefined : decodeCoreStorageValue(key, raw);
+}
+
+async function writeCoreStorageValue(
+  key: CoreStorageKey,
+  value: Uint8Array,
+): Promise<void> {
+  if (key.tag === "AuthSession") {
+    await writeSharedAuthStorage(
+      SITE_ID,
+      SHARED_CORE_SESSION_KEY,
+      bytesToHex(value),
+    );
+    emitLocalChange();
+    return;
+  }
+  localStorage.setItem(
+    coreLocalStorageKey(key),
+    encodeCoreStorageValue(key, value),
+  );
+}
+
+async function clearCoreStorageValue(key: CoreStorageKey): Promise<void> {
+  if (key.tag === "AuthSession") {
+    await clearSharedAuthStorage(SITE_ID, SHARED_CORE_SESSION_KEY);
+    await writeUiStateCache({ connected: false });
+    emitLocalChange();
+    return;
+  }
+  localStorage.removeItem(coreLocalStorageKey(key));
+}
+
+function coreLocalStorageKey(key: CoreStorageKey): string {
+  switch (key.tag) {
+    case "PairingDeviceIdentity":
+      return `${CORE_LOCAL_STORAGE_PREFIX}pairing-device-identity`;
+    case "PermissionAuthorization":
+      return `${CORE_LOCAL_STORAGE_PREFIX}permission:${hexNoPrefix(
+        encodeCoreStorageKey(key),
+      )}`;
+    case "AllowanceKeys":
+      return `${CORE_LOCAL_STORAGE_PREFIX}allowance-keys:${key.value.sessionId}`;
+    case "LastProcessedPairingStatement":
+      return `${CORE_LOCAL_STORAGE_PREFIX}last-processed-pairing-statement`;
+    case "AuthSession":
+      return `${CORE_LOCAL_STORAGE_PREFIX}auth-session`;
+  }
+}
+
+function encodeCoreStorageValue(
+  key: CoreStorageKey,
+  value: Uint8Array,
+): string {
+  if (key.tag === "AllowanceKeys") {
+    return bytesToHex(allowanceStorageCipher().encrypt(value));
+  }
+  return bytesToHex(value);
+}
+
+function decodeCoreStorageValue(key: CoreStorageKey, raw: string): Uint8Array {
+  const bytes = hexToBytes(raw);
+  if (key.tag === "AllowanceKeys") {
+    return allowanceStorageCipher().decrypt(bytes);
+  }
+  return bytes;
+}
+
+function allowanceStorageCipher(): ReturnType<typeof gcm> {
+  return gcm(
+    blake2b(textEncoder.encode(SITE_ID), { dkLen: 16 }),
+    blake2b(textEncoder.encode("nonce"), { dkLen: 32 }),
+  );
+}
+
+function hexNoPrefix(bytes: Uint8Array): string {
+  return bytesToHex(bytes).slice(2);
+}
+
+export function onStoredSessionChanged(listener: () => void): () => void {
+  const onLocalChange = (): void => {
+    listener();
+  };
+  window.addEventListener(LOCAL_CHANGE_EVENT, onLocalChange);
+  const unsubscribeShared = subscribeSharedAuthStorage((change) => {
+    if (change.siteId === SITE_ID && change.key === SHARED_CORE_SESSION_KEY) {
+      listener();
+    }
+  });
+  return () => {
+    window.removeEventListener(LOCAL_CHANGE_EVENT, onLocalChange);
+    unsubscribeShared();
+  };
+}
diff --git a/packages/ui/src/host-callbacks/Theme.ts b/packages/ui/src/host-callbacks/Theme.ts
new file mode 100644
index 00000000..c7cb74db
--- /dev/null
+++ b/packages/ui/src/host-callbacks/Theme.ts
@@ -0,0 +1,22 @@
+import type { ThemeHost } from "@parity/truapi-host";
+import type { ThemeVariant } from "@parity/truapi";
+import { createResultStream } from "./result-stream";
+
+function currentTheme(): ThemeVariant {
+  return document.documentElement.getAttribute("data-theme") === "light"
+    ? "Light"
+    : "Dark";
+}
+
+export function createThemeSubscribe(): Required<ThemeHost>["subscribeTheme"] {
+  return () =>
+    createResultStream<ThemeVariant>([currentTheme()], (push) => {
+      const onThemeChanged = (): void => {
+        push(currentTheme());
+      };
+      window.addEventListener("dotli:theme-changed", onThemeChanged);
+      return () => {
+        window.removeEventListener("dotli:theme-changed", onThemeChanged);
+      };
+    });
+}
diff --git a/packages/ui/src/host-callbacks/UserConfirmation.ts b/packages/ui/src/host-callbacks/UserConfirmation.ts
new file mode 100644
index 00000000..72e951b2
--- /dev/null
+++ b/packages/ui/src/host-callbacks/UserConfirmation.ts
@@ -0,0 +1,394 @@
+import type { UserConfirmation as UserConfirmationHost } from "@parity/truapi-host";
+import { showPreimageSubmitModal } from "../preimage-modal";
+
+interface ConfirmationCopy {
+  title: string;
+  action: string;
+  cancelAction?: string;
+}
+
+interface ConfirmationField {
+  label: string;
+  value: string;
+  mono?: boolean;
+}
+
+type UserConfirmationReview = Parameters<
+  Required<UserConfirmationHost>["confirmUserAction"]
+>[0];
+
+type ConfirmationDecision = "accepted" | "rejected" | "dismissed";
+
+function showConfirmationModal(
+  label: string,
+  copy: ConfirmationCopy,
+  review: UserConfirmationReview,
+): Promise<ConfirmationDecision> {
+  return new Promise((resolve) => {
+    const display = confirmationDisplay(label, review);
+    const backdrop = document.createElement("div");
+    backdrop.className = "signing-modal-backdrop";
+
+    const modal = document.createElement("div");
+    modal.className = "signing-modal";
+
+    const heading = document.createElement("h2");
+    heading.textContent = copy.title;
+    modal.appendChild(heading);
+
+    const fields = document.createElement("div");
+    fields.className = "signing-fields";
+
+    for (const field of display.fields) {
+      fields.appendChild(createField(field));
+    }
+
+    modal.appendChild(fields);
+
+    const footer = document.createElement("div");
+    footer.className = "signing-modal-footer";
+
+    const cancelBtn = document.createElement("button");
+    cancelBtn.className = "signing-btn-cancel";
+    cancelBtn.textContent = copy.cancelAction ?? "Cancel";
+    footer.appendChild(cancelBtn);
+
+    const allowBtn = document.createElement("button");
+    allowBtn.className = "signing-btn-sign";
+    allowBtn.textContent = copy.action;
+    footer.appendChild(allowBtn);
+
+    modal.appendChild(footer);
+    backdrop.appendChild(modal);
+    document.body.appendChild(backdrop);
+
+    const cleanup = (): void => {
+      backdrop.remove();
+    };
+    const finish = (decision: ConfirmationDecision): void => {
+      cleanup();
+      resolve(decision);
+    };
+
+    cancelBtn.addEventListener("click", () => {
+      finish("rejected");
+    });
+    allowBtn.addEventListener("click", () => {
+      finish("accepted");
+    });
+    backdrop.addEventListener("click", (e) => {
+      if (e.target === backdrop) {
+        finish("dismissed");
+      }
+    });
+  });
+}
+
+function createField(field: ConfirmationField): HTMLDivElement {
+  const group = document.createElement("div");
+  group.className = "signing-field";
+
+  const label = document.createElement("div");
+  label.className = "signing-field-label";
+  label.textContent = field.label;
+  group.appendChild(label);
+
+  const value = document.createElement("div");
+  value.className = "signing-field-value";
+  if (field.mono === true) {
+    value.classList.add("mono");
+  }
+  value.textContent = field.value;
+  group.appendChild(value);
+
+  return group;
+}
+
+function formatReview(review: unknown): string {
+  return JSON.stringify(
+    review,
+    (_key: string, value: unknown): unknown => {
+      if (typeof value === "bigint") {
+        return value.toString();
+      }
+      if (value instanceof Uint8Array) {
+        return `0x${Array.from(value, (byte) =>
+          byte.toString(16).padStart(2, "0"),
+        ).join("")}`;
+      }
+      return value;
+    },
+    2,
+  );
+}
+
+function confirmationDisplay(
+  label: string,
+  review: UserConfirmationReview,
+): { fields: ConfirmationField[] } {
+  if (review.tag === "SignPayload") {
+    return { fields: createSignPayloadFields(label, review.value) };
+  }
+  if (review.tag === "SignRaw") {
+    return { fields: createSignRawFields(label, review.value) };
+  }
+  if (review.tag === "CreateTransaction") {
+    return { fields: createTransactionFields(label, review.value) };
+  }
+  if (review.tag === "AccountAlias") {
+    return { fields: createAccountAliasFields(review.value) };
+  }
+  if (review.tag === "AccountAccess") {
+    return { fields: createAccountAccessFields(review.value) };
+  }
+  if (review.tag === "IdentityDisclosure") {
+    return { fields: createIdentityDisclosureFields(review.value) };
+  }
+  if (review.tag === "ResourceAllocation") {
+    return { fields: createResourceAllocationFields(review.value) };
+  }
+
+  const text = formatReview(review);
+  return {
+    fields: [
+      {
+        label: "Application",
+        value: label.startsWith("localhost:") ? label : `${label}.dot`,
+      },
+      {
+        label: "Request",
+        value: text.length > 180 ? `${text.slice(0, 180)}...` : text,
+      },
+    ],
+  };
+}
+
+function truncateHex(value: string): string {
+  return value.length > 80 ? `${value.slice(0, 80)}...` : value;
+}
+
+type SignRawPayload = Extract<
+  UserConfirmationReview,
+  { tag: "SignRaw" }
+>["value"]["value"]["payload"];
+
+function formatRawPayload(payload: SignRawPayload): string {
+  return truncateHex(
+    payload.tag === "Bytes" ? payload.value.bytes : payload.value.payload,
+  );
+}
+
+function formatProductAccount(account: {
+  dotNsIdentifier: string;
+  derivationIndex: number;
+}): string {
+  return `${account.dotNsIdentifier} / ${String(account.derivationIndex)}`;
+}
+
+type SignPayloadData = Extract<
+  UserConfirmationReview,
+  { tag: "SignPayload" }
+>["value"]["value"]["payload"];
+
+function createPayloadFields(
+  app: string,
+  signer: string,
+  payload: SignPayloadData,
+): ConfirmationField[] {
+  return [
+    { label: "App", value: app },
+    { label: "Signer", value: signer },
+    { label: "Genesis Hash", value: payload.genesisHash, mono: true },
+    { label: "Call Data", value: truncateHex(payload.method), mono: true },
+    { label: "Version", value: String(payload.version) },
+  ];
+}
+
+function createSignPayloadFields(
+  label: string,
+  review: Extract<UserConfirmationReview, { tag: "SignPayload" }>["value"],
+): ConfirmationField[] {
+  if (review.tag === "Product") {
+    return createPayloadFields(
+      label,
+      formatProductAccount(review.value.account),
+      review.value.payload,
+    );
+  }
+
+  return createPayloadFields(label, review.value.signer, review.value.payload);
+}
+
+function createSignRawFields(
+  label: string,
+  review: Extract<UserConfirmationReview, { tag: "SignRaw" }>["value"],
+): ConfirmationField[] {
+  if (review.tag === "Product") {
+    return [
+      { label: "App", value: label },
+      { label: "Signer", value: formatProductAccount(review.value.account) },
+      {
+        label: "Message",
+        value: formatRawPayload(review.value.payload),
+        mono: true,
+      },
+    ];
+  }
+
+  return [
+    { label: "App", value: label },
+    { label: "Signer", value: review.value.signer },
+    {
+      label: "Message",
+      value: formatRawPayload(review.value.payload),
+      mono: true,
+    },
+  ];
+}
+
+function createTransactionFields(
+  label: string,
+  review: Extract<
+    UserConfirmationReview,
+    { tag: "CreateTransaction" }
+  >["value"],
+): ConfirmationField[] {
+  const payload = review.value;
+  const signer =
+    review.tag === "Product"
+      ? formatProductAccount(review.value.signer)
+      : review.value.signer;
+
+  return [
+    { label: "App", value: label },
+    { label: "Signer", value: signer },
+    { label: "Genesis Hash", value: payload.genesisHash, mono: true },
+    { label: "Call Data", value: truncateHex(payload.callData), mono: true },
+    { label: "Tx Ext Version", value: String(payload.txExtVersion) },
+  ];
+}
+
+function createAccountAliasFields(
+  review: Extract<UserConfirmationReview, { tag: "AccountAlias" }>["value"],
+): ConfirmationField[] {
+  return [
+    { label: "Requesting product", value: review.requestingProductId },
+    { label: "Requested context", value: review.targetProductId },
+  ];
+}
+
+function createAccountAccessFields(
+  review: Extract<UserConfirmationReview, { tag: "AccountAccess" }>["value"],
+): ConfirmationField[] {
+  return [
+    { label: "Requesting product", value: review.requestingProductId },
+    { label: "Requested account", value: review.targetProductId },
+  ];
+}
+
+function createIdentityDisclosureFields(
+  review: Extract<
+    UserConfirmationReview,
+    { tag: "IdentityDisclosure" }
+  >["value"],
+): ConfirmationField[] {
+  return [{ label: "Requesting product", value: review.productId }];
+}
+
+function formatResource(
+  resource: Extract<
+    UserConfirmationReview,
+    { tag: "ResourceAllocation" }
+  >["value"]["resources"][number],
+): string {
+  return resource.tag === "SmartContractAllowance"
+    ? `SmartContractAllowance / ${String(resource.value)}`
+    : resource.tag;
+}
+
+function createResourceAllocationFields(
+  review: Extract<
+    UserConfirmationReview,
+    { tag: "ResourceAllocation" }
+  >["value"],
+): ConfirmationField[] {
+  return [
+    {
+      label: "Resources",
+      value: review.resources.map(formatResource).join(", "),
+    },
+  ];
+}
+
+function confirmationCopy(review: UserConfirmationReview): ConfirmationCopy {
+  switch (review.tag) {
+    case "SignPayload":
+      return { title: "Sign Transaction", action: "Sign" };
+    case "SignRaw":
+      return { title: "Sign Message", action: "Sign" };
+    case "CreateTransaction":
+      return { title: "Sign Transaction", action: "Sign" };
+    case "AccountAlias":
+      return {
+        title: "Alias Permission",
+        action: "Allow",
+        cancelAction: "Deny",
+      };
+    case "AccountAccess":
+      return {
+        title: "Account Access",
+        action: "Allow",
+        cancelAction: "Deny",
+      };
+    case "IdentityDisclosure":
+      return {
+        title: "Identity Disclosure",
+        action: "Allow",
+        cancelAction: "Deny",
+      };
+    case "ResourceAllocation":
+      return { title: "Resource Allocation", action: "Allow" };
+    case "PreimageSubmit":
+      return { title: "Submit Preimage", action: "Allow" };
+  }
+}
+
+async function handlePreimageSubmitReview(
+  review: Extract<UserConfirmationReview, { tag: "PreimageSubmit" }>,
+): Promise<boolean> {
+  try {
+    await showPreimageSubmitModal(Number(review.value.size));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function handleConfirmationReview(
+  label: string,
+  review: UserConfirmationReview,
+): Promise<boolean> {
+  const decision = await showConfirmationModal(
+    label,
+    confirmationCopy(review),
+    review,
+  );
+  if (decision === "accepted") {
+    return true;
+  }
+  if (decision === "dismissed" && review.tag === "IdentityDisclosure") {
+    throw new Error("User dismissed identity disclosure dialog");
+  }
+  return false;
+}
+
+export function createUserConfirmationAdapters(
+  label: string,
+): Required<UserConfirmationHost> {
+  return {
+    confirmUserAction: (review) =>
+      review.tag === "PreimageSubmit"
+        ? handlePreimageSubmitReview(review)
+        : handleConfirmationReview(label, review),
+  };
+}
diff --git a/packages/ui/src/host-callbacks/handlers.ts b/packages/ui/src/host-callbacks/handlers.ts
new file mode 100644
index 00000000..5640b228
--- /dev/null
+++ b/packages/ui/src/host-callbacks/handlers.ts
@@ -0,0 +1,60 @@
+// Composes the typed host callback surface consumed by
+// `createWasmRawCallbacks`. Each callback lives in its own file so the
+// dotli-specific UI and storage behavior stays outside the Rust core.
+//
+// Scoping:
+// - `label` identifies the dApp, used in topbar notifications, permission
+//   storage keys, and sign modal titles.
+// - product storage keys are opaque; Rust core owns product namespacing.
+//
+import type { RequiredHostCallbacks } from "@parity/truapi-host";
+import { createNavigateTo } from "./OpenUrl";
+import { createNotificationAdapters } from "./PushNotification";
+import { createPromptPermission } from "./PromptPermission";
+import {
+  createLocalStorageRead,
+  createLocalStorageWrite,
+  createLocalStorageClear,
+} from "./LocalStorage";
+import { createPreimageAdapters } from "./Preimage";
+import { createChainConnect } from "./Chain";
+import { createFeatureSupported } from "./FeatureSupported";
+import { createThemeSubscribe } from "./Theme";
+import { createAuthStateChanged } from "./AuthState";
+import { createSessionStoreAdapters } from "./SessionStore";
+import { createUserConfirmationAdapters } from "./UserConfirmation";
+
+export interface CreateHostCallbacksOptions {
+  label: string;
+  pairingLabel?: string;
+  pairingDotSuffix?: boolean;
+  pairingHostGlobal?: boolean;
+}
+
+export function createHostCallbacks(
+  options: CreateHostCallbacksOptions,
+): RequiredHostCallbacks {
+  const { label, pairingLabel, pairingDotSuffix, pairingHostGlobal } = options;
+  return {
+    navigation: { navigateTo: createNavigateTo() },
+    notifications: createNotificationAdapters(label),
+    permissions: createPromptPermission(label),
+    features: { featureSupported: createFeatureSupported() },
+    productStorage: {
+      read: createLocalStorageRead(),
+      write: createLocalStorageWrite(),
+      clear: createLocalStorageClear(),
+    },
+    coreStorage: createSessionStoreAdapters(),
+    auth: {
+      authStateChanged: createAuthStateChanged(pairingLabel ?? label, {
+        dotSuffix: pairingDotSuffix,
+        hostGlobal: pairingHostGlobal,
+      }),
+    },
+    userConfirmation: createUserConfirmationAdapters(label),
+    theme: { subscribeTheme: createThemeSubscribe() },
+    preimage: createPreimageAdapters(label),
+    chain: { connect: createChainConnect() },
+  };
+}
diff --git a/packages/ui/src/host-callbacks/rate-limit.ts b/packages/ui/src/host-callbacks/rate-limit.ts
new file mode 100644
index 00000000..249daaf4
--- /dev/null
+++ b/packages/ui/src/host-callbacks/rate-limit.ts
@@ -0,0 +1,21 @@
+// Sliding-window rate limiter shared across host callbacks.
+
+const SUBMIT_WINDOW_MS = 10_000;
+const SUBMIT_MAX_PER_WINDOW = 20;
+
+export function createSubmitRateLimiter(): { allow: () => boolean } {
+  const timestamps: number[] = [];
+  return {
+    allow() {
+      const now = Date.now();
+      while (timestamps.length > 0 && timestamps[0] <= now - SUBMIT_WINDOW_MS) {
+        timestamps.shift();
+      }
+      if (timestamps.length >= SUBMIT_MAX_PER_WINDOW) {
+        return false;
+      }
+      timestamps.push(now);
+      return true;
+    },
+  };
+}
diff --git a/packages/ui/src/host-callbacks/result-stream.ts b/packages/ui/src/host-callbacks/result-stream.ts
new file mode 100644
index 00000000..0b3138fd
--- /dev/null
+++ b/packages/ui/src/host-callbacks/result-stream.ts
@@ -0,0 +1,92 @@
+import type { GenericError, Result } from "@parity/truapi";
+import { err, ok } from "neverthrow";
+
+export function createResultStream<T>(
+  initial: T[],
+  start: (
+    push: (value: T) => void,
+    pushError: (error: GenericError) => void,
+  ) => () => void,
+): AsyncIterable<Result<T, GenericError>> {
+  return {
+    [Symbol.asyncIterator](): AsyncIterator<Result<T, GenericError>> {
+      const queue: Result<T, GenericError>[] = initial.map((value) =>
+        ok(value),
+      );
+      const state = { stopped: false };
+      let cleanup: (() => void) | null = null;
+      let cleanedUp = false;
+      let resolve:
+        | ((result: IteratorResult<Result<T, GenericError>>) => void)
+        | null = null;
+
+      const complete = (): IteratorResult<Result<T, GenericError>> => ({
+        done: true,
+        value: undefined as never,
+      });
+      const runCleanup = (): void => {
+        if (cleanedUp || cleanup === null) {
+          return;
+        }
+        cleanedUp = true;
+        cleanup();
+      };
+      const push = (value: T): void => {
+        if (state.stopped) {
+          return;
+        }
+        if (resolve) {
+          const send = resolve;
+          resolve = null;
+          send({ done: false, value: ok(value) });
+          return;
+        }
+        queue.push(ok(value));
+      };
+      const pushError = (error: GenericError): void => {
+        if (state.stopped) {
+          return;
+        }
+        state.stopped = true;
+        runCleanup();
+        const result = err<T, GenericError>(error);
+        if (resolve) {
+          const send = resolve;
+          resolve = null;
+          send({ done: false, value: result });
+          return;
+        }
+        queue.push(result);
+      };
+      cleanup = start(push, pushError);
+      if (state.stopped) {
+        runCleanup();
+      }
+
+      return {
+        next(): Promise<IteratorResult<Result<T, GenericError>>> {
+          const item = queue.shift();
+          if (item) {
+            return Promise.resolve({ done: false, value: item });
+          }
+          if (state.stopped) {
+            return Promise.resolve(complete());
+          }
+          return new Promise((r) => {
+            resolve = r;
+          });
+        },
+        return(): Promise<IteratorResult<Result<T, GenericError>>> {
+          state.stopped = true;
+          runCleanup();
+          if (resolve) {
+            const send = resolve;
+            resolve = null;
+            send(complete());
+          }
+          return Promise.resolve(complete());
+        },
+      };
+    },
+  };
+}
diff --git a/packages/ui/src/legacy-host-bridge.ts b/packages/ui/src/legacy-host-bridge.ts
new file mode 100644
index 00000000..9d67628d
--- /dev/null
+++ b/packages/ui/src/legacy-host-bridge.ts
@@ -0,0 +1,67 @@
+// DEPRECATED — legacy host-API backward-compat transport shim.
+//
+// The TrUAPI host shuttles product frames over a transferred `MessagePort`.
+// Products built on the older Nova host-api stack (the `@novasamatech` packages;
+// e.g. apps still on `@parity/product-sdk`) instead shuttle the SAME wire bytes
+// the old way: raw `Uint8Array` frames to/from `window.parent`. Only the
+// transport differs, so this is a pure byte bridge — no per-method translation,
+// no `@novasamatech/*` dependency.
+//
+// Remove this file (and the probe in `bridge.ts`) once products migrate to
+// `@parity/truapi`.
+
+import type { WireProvider } from "@parity/truapi";
+
+/**
+ * A {@link WireProvider} over `window.postMessage`, matching the legacy Nova
+ * host-api iframe transport. Pipe it into the core with `pipeProviders` exactly
+ * like the MessagePort path.
+ */
+export interface WindowMessageProvider extends WireProvider {
+  /** Replay a frame already read off the `window` (the probe's detection frame). */
+  injectInbound(message: Uint8Array): void;
+}
+
+let warned = false;
+
+export function createWindowMessageProvider(
+  targetWindow: Window,
+): WindowMessageProvider {
+  if (!warned) {
+    warned = true;
+    console.warn(
+      "[dotli] legacy host-API transport bridge active — migrate this product to @parity/truapi.",
+    );
+  }
+
+  const subscribers = new Set<(message: Uint8Array) => void>();
+  const deliver = (message: Uint8Array): void => {
+    for (const callback of subscribers) {
+      callback(message);
+    }
+  };
+  const onMessage = (event: MessageEvent): void => {
+    if (event.source === targetWindow && event.data instanceof Uint8Array) {
+      deliver(event.data);
+    }
+  };
+  window.addEventListener("message", onMessage);
+
+  return {
+    // "*" matches the credentialless product iframe (its origin reports "null").
+    postMessage(message) {
+      targetWindow.postMessage(message, "*");
+    },
+    subscribe(callback) {
+      subscribers.add(callback);
+      return () => {
+        subscribers.delete(callback);
+      };
+    },
+    injectInbound: deliver,
+    dispose() {
+      window.removeEventListener("message", onMessage);
+      subscribers.clear();
+    },
+  };
+}
diff --git a/packages/ui/src/login-request-error.ts b/packages/ui/src/login-request-error.ts
new file mode 100644
index 00000000..7f2c6a8a
--- /dev/null
+++ b/packages/ui/src/login-request-error.ts
@@ -0,0 +1,35 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { VersionedHostRequestLoginError } from "@parity/truapi";
+import type { CallErrorValue } from "@parity/truapi/scale";
+
+type LoginRequestFailure = CallErrorValue<VersionedHostRequestLoginError>;
+
+export class LoginRequestError extends Error {
+  readonly error: LoginRequestFailure;
+
+  constructor(error: LoginRequestFailure) {
+    super(formatLoginRequestError(error));
+    this.name = "LoginRequestError";
+    this.error = error;
+  }
+}
+
+export function formatLoginRequestError(error: LoginRequestFailure): string {
+  switch (error.tag) {
+    case "Domain":
+      return formatDomainLoginError(error.value);
+    case "Denied":
+      return "Login request denied";
+    case "Unsupported":
+      return "Login is not supported by this host";
+    case "MalformedFrame":
+    case "HostFailure":
+      return error.value.reason;
+  }
+}
+
+function formatDomainLoginError(error: VersionedHostRequestLoginError): string {
+  return error.value.value.reason;
+}
diff --git a/packages/ui/src/permission-modal.ts b/packages/ui/src/permission-modal.ts
index d99f53fc..c2de6870 100644
--- a/packages/ui/src/permission-modal.ts
+++ b/packages/ui/src/permission-modal.ts
@@ -11,10 +11,11 @@ import {
 // Shows a confirmation dialog when a product requests a permission the
 // host can actually gate: the Permissions-Policy-backed device
 // variants (Camera, Microphone, Location, Bluetooth, NFC, Clipboard,
-// Biometrics, Notifications) and the internal submitted gates (ChainSubmit,
-// PreimageSubmit, StatementSubmit). `OpenUrl` is auto-granted at the
-// container level and never reaches this modal.
-// Returns a Promise that resolves on "Allow" and rejects on "Deny".
+// Biometrics, Notifications), identity disclosure, and the internal submitted
+// gates (ChainSubmit, PreimageSubmit, StatementSubmit). `OpenUrl` is
+// auto-granted at the container level and never reaches this modal.
+// Returns an explicit decision so callers can distinguish "Deny" from
+// dismissing the dialog without storing a denial.
 //
 // DOM structure follows the signing modal pattern (signing.css).
 
@@ -30,10 +31,10 @@ export const PERMISSION_DESCRIPTIONS: Record<
   NFC: "Read and write nearby NFC tags",
   Clipboard: "Read text and data from your clipboard",
   Biometrics: "Authenticate with a platform passkey or biometric prompt",
+  IdentityDisclosure: "Share your primary DotNS identity with this app",
   ChainSubmit: "Sign and submit on-chain transactions on your behalf",
   PreimageSubmit: "Store preimage data on-chain via the Bulletin network",
   StatementSubmit: "Submit signed statements to the statement store",
-  GetUserId: "Reveal your dotNS username to this app",
 };
 
 const PERMISSION_ICONS: Record<EnforceablePermissionName, string> = {
@@ -72,6 +73,11 @@ const PERMISSION_ICONS: Record<EnforceablePermissionName, string> = {
     '<path d="M12 11a4 4 0 0 0-4 4v2a4 4 0 0 0 8 0v-2a4 4 0 0 0-4-4z"/>' +
     '<path d="M6 11a6 6 0 0 1 12 0"/>' +
     '<path d="M4 11a8 8 0 0 1 16 0"/></svg>',
+  IdentityDisclosure:
+    '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
+    '<circle cx="12" cy="8" r="4"/>' +
+    '<path d="M4 21a8 8 0 0 1 16 0"/>' +
+    '<path d="M19 3v4h4"/></svg>',
   ChainSubmit:
     '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
     '<polyline points="17 1 21 5 17 9"/><path d="M3 11V9a4 4 0 0 1 4-4h14"/>' +
@@ -87,21 +93,18 @@ const PERMISSION_ICONS: Record<EnforceablePermissionName, string> = {
     '<polyline points="14 2 14 8 20 8"/>' +
     '<line x1="8" y1="13" x2="16" y2="13"/>' +
     '<line x1="8" y1="17" x2="14" y2="17"/></svg>',
-  GetUserId:
-    '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
-    '<path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/>' +
-    '<circle cx="12" cy="7" r="4"/></svg>',
 };
 
+export type PermissionPromptDecision = "granted" | "denied" | "dismissed";
+
 /**
- * Show a permission request modal. Resolves when the user clicks "Allow",
- * rejects when the user clicks "Deny".
+ * Show a permission request modal.
  */
 export function showPermissionRequestModal(
   label: string,
   permission: EnforceablePermissionName,
-): Promise<void> {
-  return new Promise((resolve, reject) => {
+): Promise<PermissionPromptDecision> {
+  return new Promise((resolve) => {
     const backdrop = document.createElement("div");
     backdrop.className = "signing-modal-backdrop";
 
@@ -187,19 +190,19 @@ export function showPermissionRequestModal(
 
     denyBtn.addEventListener("click", () => {
       cleanup();
-      reject(new Error("User denied permission"));
+      resolve("denied");
     });
 
     allowBtn.addEventListener("click", () => {
       cleanup();
-      resolve();
+      resolve("granted");
     });
 
     // Close on backdrop click (outside modal)
     backdrop.addEventListener("click", (e) => {
       if (e.target === backdrop) {
         cleanup();
-        reject(new Error("User dismissed permission dialog"));
+        resolve("dismissed");
       }
     });
   });
diff --git a/packages/ui/src/permissions.ts b/packages/ui/src/permissions.ts
index 5dff44a5..f2bba1fa 100644
--- a/packages/ui/src/permissions.ts
+++ b/packages/ui/src/permissions.ts
@@ -1,26 +1,32 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-// dot.li Permission storage
+// dot.li Permission authorization
 //
-// Persists host-level permission decisions per product in localStorage.
+// Permission authorization is owned by the Rust core and persisted through
+// CoreStorage. Web dotli only maps authorized device permissions to browser
+// iframe policy directives.
 // Device permissions that map to a Permissions Policy directive also
 // gate the iframe `allow` attribute (granting or revoking reloads the
 // iframe). Variants without a directive are policy-only.
 //
 // Permission status: 'ask' (default), 'granted', or 'denied'.
 
-import type { CodecType } from "@novasamatech/host-api";
-import type { DevicePermission as DevicePermissionCodec } from "@novasamatech/host-api";
+import type { HostDevicePermissionRequest } from "@parity/truapi";
+import type {
+  PermissionAuthorizationRequest,
+  PermissionAuthorizationStatus,
+  TrUApiProductProvider,
+} from "@parity/truapi-host";
 
-export type DevicePermissionName = CodecType<typeof DevicePermissionCodec>;
+export type DevicePermissionName = HostDevicePermissionRequest;
 
 export type PermissionName =
   | DevicePermissionName
   | "ChainSubmit"
+  | "IdentityDisclosure"
   | "PreimageSubmit"
-  | "StatementSubmit"
-  | "GetUserId";
+  | "StatementSubmit";
 
 /** Device permissions the host can't actually gate (see AUTO_GRANT_DEVICE_PERMISSIONS). */
 export type AutoGrantDevicePermission = "OpenUrl";
@@ -42,9 +48,9 @@ export type PermissionStatus = "ask" | "granted" | "denied";
 /**
  * Map from Host API device permission names to Permissions Policy directives.
  *
- * Only variants with a browser-level enforcement point are listed. Granting
- * a variant absent from this map is still recorded in localStorage but
- * does not alter the iframe `allow` attribute.
+ * Only variants with a browser-level enforcement point are listed. Authorizing
+ * a variant absent from this map is still persisted by the core but does not
+ * alter the iframe `allow` attribute.
  */
 export const DEVICE_PERMISSION_POLICY: Partial<
   Record<DevicePermissionName, string>
@@ -97,10 +103,10 @@ export const ALL_PERMISSIONS: readonly {
   { name: "NFC", label: "NFC" },
   { name: "Clipboard", label: "Clipboard" },
   { name: "Biometrics", label: "Biometrics" },
+  { name: "IdentityDisclosure", label: "Identity Disclosure" },
   { name: "ChainSubmit", label: "Sign Transactions" },
   { name: "PreimageSubmit", label: "Submit Preimages" },
   { name: "StatementSubmit", label: "Submit Statements" },
-  { name: "GetUserId", label: "Reveal Username" },
 ];
 
 /** Returns true if the permission name maps to an iframe `allow` directive. */
@@ -108,72 +114,140 @@ export function isDevicePermission(name: string): boolean {
   return name in DEVICE_PERMISSION_POLICY;
 }
 
-const STORAGE_PREFIX = "dotli:permissions:";
+type PermissionAuthorizationProvider = Pick<
+  TrUApiProductProvider,
+  "getPermissionAuthorizationStatuses" | "setPermissionAuthorizationStatus"
+>;
+
+const permissionProviders = new Map<string, PermissionAuthorizationProvider>();
 
-type StoredPermissions = Record<string, PermissionStatus>;
+export function registerPermissionAuthorizationProvider(
+  label: string,
+  provider: PermissionAuthorizationProvider,
+): () => void {
+  permissionProviders.set(label, provider);
+  return () => {
+    if (permissionProviders.get(label) === provider) {
+      permissionProviders.delete(label);
+    }
+  };
+}
 
-function storageKey(label: string): string {
-  return STORAGE_PREFIX + label;
+function providerFor(label: string): PermissionAuthorizationProvider | null {
+  return permissionProviders.get(label) ?? null;
 }
 
-function readStored(label: string): StoredPermissions {
-  try {
-    const raw = localStorage.getItem(storageKey(label));
-    if (raw === null) {
-      return {};
-    }
-    return JSON.parse(raw) as StoredPermissions;
-  } catch {
-    return {};
+function authorizationRequest(
+  permission: PermissionName,
+): PermissionAuthorizationRequest {
+  if (
+    permission === "ChainSubmit" ||
+    permission === "PreimageSubmit" ||
+    permission === "StatementSubmit"
+  ) {
+    return {
+      tag: "Remote",
+      value: { permission: { tag: permission } },
+    };
+  }
+  if (permission === "IdentityDisclosure") {
+    return { tag: "IdentityDisclosure" };
+  }
+  return { tag: "Device", value: permission };
+}
+
+function fromAuthorizationStatus(
+  status: PermissionAuthorizationStatus,
+): PermissionStatus {
+  switch (status) {
+    case "Authorized":
+      return "granted";
+    case "Denied":
+      return "denied";
+    case "NotDetermined":
+      return "ask";
   }
 }
 
-function writeStored(label: string, data: StoredPermissions): void {
-  localStorage.setItem(storageKey(label), JSON.stringify(data));
+function toAuthorizationStatus(
+  status: PermissionStatus,
+): PermissionAuthorizationStatus {
+  switch (status) {
+    case "granted":
+      return "Authorized";
+    case "denied":
+      return "Denied";
+    case "ask":
+      return "NotDetermined";
+  }
 }
 
-export function getPermissionStatus(
+export async function getPermissionStatus(
   label: string,
   permission: PermissionName,
-): PermissionStatus {
-  return readStored(label)[permission] ?? "ask";
+): Promise<PermissionStatus> {
+  const [status] = await getPermissionStatuses(label, [permission]);
+  return status;
 }
 
-export function setPermissionStatus(
+export async function getPermissionStatuses(
+  label: string,
+  permissions: readonly PermissionName[],
+): Promise<PermissionStatus[]> {
+  const provider = providerFor(label);
+  if (provider === null) {
+    return permissions.map(() => "ask");
+  }
+  const statuses = await provider.getPermissionAuthorizationStatuses(
+    permissions.map(authorizationRequest),
+  );
+  return statuses.map(fromAuthorizationStatus);
+}
+
+export async function setPermissionStatus(
   label: string,
   permission: PermissionName,
   status: PermissionStatus,
-): void {
-  const data = readStored(label);
-  data[permission] = status;
-  writeStored(label, data);
+): Promise<void> {
+  const provider = providerFor(label);
+  if (provider === null) {
+    return;
+  }
+  await provider.setPermissionAuthorizationStatus(
+    authorizationRequest(permission),
+    toAuthorizationStatus(status),
+  );
 }
 
-export function resetPermission(
+export async function resetPermission(
   label: string,
   permission: PermissionName,
-): void {
-  const data = readStored(label);
-  const { [permission]: _, ...rest } = data;
-  writeStored(label, rest);
+): Promise<void> {
+  await setPermissionStatus(label, permission, "ask");
 }
 
 /** Returns the list of device permission names that have been granted. */
-export function getGrantedDevicePermissions(
+export async function getGrantedDevicePermissions(
   label: string,
-): DevicePermissionName[] {
-  const data = readStored(label);
-  return Object.entries(data)
-    .filter(
-      ([name, status]) => status === "granted" && isDevicePermission(name),
-    )
-    .map(([name]) => name as DevicePermissionName);
+): Promise<DevicePermissionName[]> {
+  const granted: DevicePermissionName[] = [];
+  const names = Object.keys(DEVICE_PERMISSION_POLICY) as DevicePermissionName[];
+  const statuses = await getPermissionStatuses(label, names);
+  for (const [index, name] of names.entries()) {
+    if (statuses[index] === "granted") {
+      granted.push(name);
+    }
+  }
+  return granted;
 }
 
 /** Returns true if any permission (device or remote) is granted. */
-export function hasAnyGrant(label: string): boolean {
-  const data = readStored(label);
-  return Object.values(data).some((status) => status === "granted");
+export async function hasAnyGrant(label: string): Promise<boolean> {
+  const statuses = await getPermissionStatuses(
+    label,
+    ALL_PERMISSIONS.map(({ name }) => name),
+  );
+  return statuses.some((status) => status === "granted");
 }
 
 /**
@@ -181,9 +255,9 @@ export function hasAnyGrant(label: string): boolean {
  * Always includes `clipboard-write`; adds Permissions Policy directives
  * for each granted device permission.
  */
-export function buildAllowAttribute(label: string): string {
+export async function buildAllowAttribute(label: string): Promise<string> {
   const policies = ["clipboard-write"];
-  for (const name of getGrantedDevicePermissions(label)) {
+  for (const name of await getGrantedDevicePermissions(label)) {
     const directive = DEVICE_PERMISSION_POLICY[name];
     if (directive !== undefined) {
       policies.push(directive);
diff --git a/packages/ui/src/preimage-submit.ts b/packages/ui/src/preimage-submit.ts
deleted file mode 100644
index 7736f4fe..00000000
--- a/packages/ui/src/preimage-submit.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Host-side Bulletin preimage submission, signed by the user's allowance
- * slot account.
- *
- * Provider selection mirrors initAuth's People chain wiring in @dotli/auth.
- * Smoldot backends bridge to the protocol iframe / shared worker's
- * ChainBroker by genesis hash, while `rpc-gateway` dials the configured WS
- * endpoints directly.
- */
-
-import {
-  createClient,
-  type PolkadotClient,
-  type PolkadotSigner,
-} from "polkadot-api";
-import { getWsProvider } from "polkadot-api/ws";
-import { createRemoteChainProvider } from "@dotli/protocol/client";
-import { getActiveServicesConfig } from "@dotli/config/network";
-import { getBackend } from "@dotli/config/mode";
-import { log } from "@dotli/shared/log";
-
-let bulletinClient: PolkadotClient | null = null;
-
-function ensureBulletinClient(): PolkadotClient {
-  if (bulletinClient) {
-    return bulletinClient;
-  }
-  const bulletin = getActiveServicesConfig().bulletin;
-  let provider;
-  if (getBackend() !== "rpc-gateway") {
-    const remote = createRemoteChainProvider(bulletin.genesis);
-    if (remote === null) {
-      throw new Error(
-        "[dot.li bulletin] Protocol bridge does not support the Bulletin chain",
-      );
-    }
-    provider = remote;
-  } else {
-    if (bulletin.rpcs.length === 0) {
-      throw new Error(
-        "[dot.li bulletin] Active network has no public Bulletin RPC endpoint",
-      );
-    }
-    provider = getWsProvider([...bulletin.rpcs], {
-      heartbeatTimeout: 120_000, // the default 40s is too aggressive through tunnels
-    });
-  }
-  bulletinClient = createClient(provider);
-  return bulletinClient;
-}
-
-const TX_TIMEOUT_MS = 120_000;
-
-export async function submitPreimageAsUser(
-  data: Uint8Array,
-  signer: PolkadotSigner,
-): Promise<void> {
-  const client = ensureBulletinClient();
-  const api = client.getUnsafeApi();
-  const tx = api.tx.TransactionStorage.store({ data });
-
-  await new Promise<void>((resolve, reject) => {
-    let resolved = false;
-
-    const subscription = tx.signSubmitAndWatch(signer).subscribe({
-      next: (ev: {
-        type: string;
-        found?: boolean;
-        ok?: boolean;
-        dispatchError?: { type: string; value: unknown };
-        isValid?: boolean;
-      }) => {
-        log.debug(`[dot.li bulletin] tx event`, { type: ev.type });
-        if (resolved || ev.type !== "txBestBlocksState" || ev.found !== true) {
-          return;
-        }
-        resolved = true;
-        clearTimeout(timeoutId);
-        subscription.unsubscribe();
-        // When `found: true`, `ok` tells us whether the extrinsic dispatch
-        // succeeded. `ok: false` means the tx landed but the pallet
-        // rejected it (e.g. unauthorized signer, insufficient funds).
-        if (ev.ok === false) {
-          reject(
-            new Error(
-              `TransactionStorage.store dispatch failed: ${ev.dispatchError?.type ?? "Unknown"}`,
-              { cause: ev.dispatchError },
-            ),
-          );
-          return;
-        }
-        resolve();
-      },
-      error: (e: unknown) => {
-        if (resolved) {
-          return;
-        }
-        resolved = true;
-        clearTimeout(timeoutId);
-        subscription.unsubscribe();
-        reject(new Error("Bulletin tx failed", { cause: e }));
-      },
-    });
-
-    const timeoutId = setTimeout(() => {
-      if (!resolved) {
-        resolved = true;
-        subscription.unsubscribe();
-        reject(new Error("Transaction timed out"));
-      }
-    }, TX_TIMEOUT_MS);
-  });
-}
diff --git a/packages/ui/src/runtime-config.ts b/packages/ui/src/runtime-config.ts
new file mode 100644
index 00000000..822e3768
--- /dev/null
+++ b/packages/ui/src/runtime-config.ts
@@ -0,0 +1,53 @@
+import { getActiveServicesConfig } from "@dotli/config/network";
+import type { ProductRuntimeConfig } from "@parity/truapi-host";
+
+type RuntimeLocation = Pick<Location, "origin">;
+
+declare const __DOTLI_VERSION__: string | undefined;
+
+export function labelToProductId(label: string): string {
+  return label.startsWith("localhost:") ? label : `${label}.dot`;
+}
+
+function getPlatformType(userAgent: string = navigator.userAgent): string {
+  if (userAgent.includes("Win")) {
+    return "Windows";
+  }
+  if (userAgent.includes("Mac")) {
+    return "macOS";
+  }
+  if (userAgent.includes("Linux")) {
+    return "Linux";
+  }
+  return "Unknown";
+}
+
+export function createTruapiRuntimeConfig(
+  label: string,
+  location: RuntimeLocation = window.location,
+  productId: string = labelToProductId(label),
+): ProductRuntimeConfig {
+  void location;
+  return {
+    productId,
+    host: {
+      name: "Polkadot Web",
+      icon: undefined,
+      version:
+        typeof __DOTLI_VERSION__ === "string" ? __DOTLI_VERSION__ : undefined,
+    },
+    platform: {
+      type: getPlatformType(),
+      version: undefined,
+    },
+    people: {
+      genesisHash: getActiveServicesConfig().people.genesis,
+    },
+    bulletin: {
+      genesisHash: getActiveServicesConfig().bulletin.genesis,
+    },
+    pairing: {
+      deeplinkScheme: "polkadotapp",
+    },
+  };
+}
diff --git a/packages/ui/src/scheduled-notifications.ts b/packages/ui/src/scheduled-notifications.ts
index dd3ad931..cca11ab4 100644
--- a/packages/ui/src/scheduled-notifications.ts
+++ b/packages/ui/src/scheduled-notifications.ts
@@ -7,7 +7,7 @@
  * @dotli/storage/scheduled-notifications.
  *
  * Runs in the product origin's top frame (for example acme.dot.li).
- * A guest dapp schedules via host-api 0.7, the record lands in IDB, and
+ * A guest dapp schedules via TrUAPI, the record lands in IDB, and
  * any tab on this origin fires it once it is past due.
  *
  * Two mechanisms keep sibling same-origin tabs from firing the same
@@ -108,8 +108,7 @@ export function initScheduledNotifications(opts: InitOpts): void {
 }
 
 /**
- * Schedule a notification, called by the host-api `handlePushNotification`
- * handler.
+ * Schedule a notification, called by the push-notification handler.
  *
  * An immediate fire (null or past `scheduledAt`) only bumps the counter to
  * allocate an id. Everything else is persisted to IDB.
@@ -149,8 +148,8 @@ export async function scheduleNotification(req: {
 }
 
 /**
- * Cancel a pending notification, called by the host-api
- * `handlePushNotificationCancel` handler.
+ * Cancel a pending notification, called by the push-notification cancel
+ * handler.
  *
  * Idempotent. Returns true if a pending record was removed, false if it
  * had already fired or never existed.
diff --git a/packages/ui/src/statement-store-mapping.ts b/packages/ui/src/statement-store-mapping.ts
deleted file mode 100644
index ecf77bc6..00000000
--- a/packages/ui/src/statement-store-mapping.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-// Statement store type mapping between Host API and SDK formats.
-//
-// Host API uses SCALE codec types (PascalCase tags, Uint8Array fields).
-// SDK uses substrate-bindings types (camelCase types, hex string fields).
-// Cherry-picked from browser/src/widgets/ProductContainerBinding/integrations/statementStore.ts
-
-import {
-  type CodecType,
-  type SignedStatement as HostSignedStatement,
-  type Statement as HostStatement,
-  fromHex,
-  toHex,
-} from "@novasamatech/host-api";
-import type {
-  Proof,
-  SignedStatement,
-  Statement,
-} from "@novasamatech/sdk-statement";
-
-export function mapHostProof(
-  proof: CodecType<typeof HostSignedStatement>["proof"],
-): Proof {
-  switch (proof.tag) {
-    case "Ecdsa":
-      return {
-        type: "ecdsa",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "Ed25519":
-      return {
-        type: "ed25519",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "Sr25519":
-      return {
-        type: "sr25519",
-        value: {
-          signature: toHex(proof.value.signature),
-          signer: toHex(proof.value.signer),
-        },
-      };
-    case "OnChain":
-      return {
-        type: "onChain",
-        value: {
-          who: toHex(proof.value.who),
-          blockHash: toHex(proof.value.blockHash),
-          event: proof.value.event,
-        },
-      };
-  }
-}
-
-export function mapFromHostSignedStatement(
-  statement: CodecType<typeof HostSignedStatement>,
-): SignedStatement {
-  const result: SignedStatement = {
-    proof: mapHostProof(statement.proof),
-    topics: statement.topics.map(toHex),
-  };
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = toHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = toHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result;
-}
-
-export function mapFromHostStatement(
-  statement: CodecType<typeof HostStatement>,
-): Statement {
-  // Only include fields that have values. The SDK's SCALE codec iterates
-  // object keys and crashes on `proof: undefined` (reads `proof.type`).
-  const result: Statement = {
-    topics: statement.topics.map(toHex),
-  };
-  if (statement.proof) {
-    result.proof = mapHostProof(statement.proof);
-  }
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = toHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = toHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result;
-}
-
-export function mapSdkSignedStatement(
-  statement: SignedStatement,
-): CodecType<typeof HostSignedStatement> {
-  const result: Record<string, unknown> = {
-    proof: mapSdkProof(statement.proof),
-    topics: (statement.topics ?? []).map((t) => fromHex(t)),
-  };
-  if (statement.expiry !== undefined) {
-    result.expiry = statement.expiry;
-  }
-  if (statement.channel) {
-    result.channel = fromHex(statement.channel);
-  }
-  if (statement.data) {
-    result.data = statement.data;
-  }
-  /* eslint-disable @typescript-eslint/no-deprecated */
-  if (statement.decryptionKey) {
-    result.decryptionKey = fromHex(statement.decryptionKey);
-  }
-  /* eslint-enable @typescript-eslint/no-deprecated */
-  return result as CodecType<typeof HostSignedStatement>;
-}
-
-export function mapSdkProof(
-  proof: Proof,
-): CodecType<typeof HostSignedStatement>["proof"] {
-  switch (proof.type) {
-    case "ecdsa":
-      return {
-        tag: "Ecdsa",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "ed25519":
-      return {
-        tag: "Ed25519",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "sr25519":
-      return {
-        tag: "Sr25519",
-        value: {
-          signature: fromHex(proof.value.signature),
-          signer: fromHex(proof.value.signer),
-        },
-      };
-    case "onChain":
-      return {
-        tag: "OnChain",
-        value: {
-          who: fromHex(proof.value.who),
-          blockHash: fromHex(proof.value.blockHash),
-          event: proof.value.event,
-        },
-      };
-  }
-}
diff --git a/packages/ui/src/styles/signing.css b/packages/ui/src/styles/signing.css
index 4d375af8..baaa3d36 100644
--- a/packages/ui/src/styles/signing.css
+++ b/packages/ui/src/styles/signing.css
@@ -59,138 +59,6 @@
   max-height: 120px;
   overflow-y: auto;
 }
-.allocation-modal-list {
-  font-size: 0.85rem;
-  color: #e0e0e0;
-  line-height: 1.5;
-  list-style: none;
-}
-/* Smart-contract allowance — info icon + signing-account tooltip */
-.allocation-info-wrap {
-  position: relative;
-  display: inline-flex;
-  vertical-align: middle;
-  margin-left: 6px;
-}
-.allocation-info-icon {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  color: #888;
-  cursor: help;
-  border-radius: 50%;
-}
-.allocation-info-icon:hover,
-.allocation-info-wrap:focus-within .allocation-info-icon {
-  color: #ccc;
-}
-.allocation-tooltip {
-  /* Positioned by JS (`place()`) on each reveal, so it can escape the
-     `.signing-fields` overflow clip — no static top/left needed. */
-  position: fixed;
-  width: 320px;
-  max-width: calc(100vw - 16px);
-  padding: 14px;
-  background: rgba(28, 28, 28, 0.98);
-  -webkit-backdrop-filter: blur(24px) saturate(180%);
-  backdrop-filter: blur(24px) saturate(180%);
-  border: 1px solid rgba(255, 255, 255, 0.1);
-  border-radius: 10px;
-  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.5);
-  text-align: left;
-  z-index: 3100;
-  opacity: 0;
-  pointer-events: none;
-  transform: translateY(4px);
-  transition:
-    opacity 0.15s ease,
-    transform 0.15s ease;
-}
-.allocation-info-wrap.is-open .allocation-tooltip {
-  opacity: 1;
-  transform: translateY(0);
-  pointer-events: auto;
-}
-.allocation-tooltip-title {
-  display: block;
-  font-size: 0.72rem;
-  font-weight: 600;
-  line-height: 1.4;
-  color: rgba(255, 255, 255, 0.6);
-  margin-bottom: 12px;
-}
-.allocation-account-summary {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 8px;
-  padding: 6px 8px;
-  margin: 0 -8px;
-  border-radius: 8px;
-  cursor: pointer;
-  list-style: none;
-  transition: background 0.15s ease;
-}
-.allocation-account-summary::-webkit-details-marker {
-  display: none;
-}
-.allocation-account-summary:hover {
-  background: rgba(255, 255, 255, 0.06);
-}
-.allocation-account-label {
-  font-size: 0.8rem;
-  color: rgba(255, 255, 255, 0.92);
-}
-.allocation-account-chevron {
-  display: inline-flex;
-  flex-shrink: 0;
-  color: rgba(255, 255, 255, 0.45);
-  transition: transform 0.15s ease;
-}
-.allocation-account[open] .allocation-account-chevron {
-  transform: rotate(180deg);
-}
-.allocation-account-body {
-  display: flex;
-  align-items: flex-start;
-  gap: 8px;
-  margin-top: 8px;
-}
-.allocation-account-copy {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  padding: 6px;
-  background: transparent;
-  border: none;
-  border-radius: 6px;
-  color: rgba(255, 255, 255, 0.55);
-  cursor: pointer;
-  flex-shrink: 0;
-  transition: background 0.15s ease;
-}
-.allocation-account-copy:hover {
-  background: rgba(255, 255, 255, 0.08);
-  color: rgba(255, 255, 255, 0.9);
-}
-.allocation-account-copy.copied {
-  color: #4ade80;
-}
-.allocation-account-address {
-  flex: 1;
-  min-width: 0;
-  font-family:
-    ui-monospace, "Cascadia Code", "Source Code Pro", Menlo, Consolas,
-    "DejaVu Sans Mono", monospace;
-  font-size: 0.72rem;
-  line-height: 1.4;
-  color: rgba(255, 255, 255, 0.75);
-  background: rgba(0, 0, 0, 0.35);
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  border-radius: 8px;
-  padding: 10px;
-  word-break: break-all;
-}
 .signing-modal-footer {
   display: flex;
   gap: 8px;
diff --git a/packages/ui/src/styles/themes.css b/packages/ui/src/styles/themes.css
index c6361b65..90ab62b1 100644
--- a/packages/ui/src/styles/themes.css
+++ b/packages/ui/src/styles/themes.css
@@ -256,48 +256,6 @@
 [data-theme="light"] .signing-field-value {
   color: #333;
 }
-[data-theme="light"] .allocation-modal-list {
-  color: #333;
-}
-[data-theme="light"] .allocation-info-icon {
-  color: #999;
-}
-[data-theme="light"] .allocation-info-icon:hover,
-[data-theme="light"] .allocation-info-wrap:focus-within .allocation-info-icon {
-  color: #555;
-}
-[data-theme="light"] .allocation-tooltip {
-  background: rgba(255, 255, 255, 0.98);
-  border-color: rgba(0, 0, 0, 0.1);
-  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.18);
-}
-[data-theme="light"] .allocation-tooltip-title {
-  color: #333;
-}
-[data-theme="light"] .allocation-account-summary:hover {
-  background: rgba(0, 0, 0, 0.05);
-}
-[data-theme="light"] .allocation-account-label {
-  color: #1a1a1a;
-}
-[data-theme="light"] .allocation-account-chevron {
-  color: rgba(0, 0, 0, 0.4);
-}
-[data-theme="light"] .allocation-account-copy {
-  color: #888;
-}
-[data-theme="light"] .allocation-account-copy:hover {
-  background: rgba(0, 0, 0, 0.06);
-  color: #333;
-}
-[data-theme="light"] .allocation-account-copy.copied {
-  color: #16a34a;
-}
-[data-theme="light"] .allocation-account-address {
-  color: #333;
-  background: #f5f5f5;
-  border-color: #e2e2e2;
-}
 [data-theme="light"] .signing-field-value.mono {
   background: #f5f5f5;
   border-color: #ddd;
diff --git a/packages/ui/src/topbar.ts b/packages/ui/src/topbar.ts
index 37a50e8c..09406cad 100644
--- a/packages/ui/src/topbar.ts
+++ b/packages/ui/src/topbar.ts
@@ -6,25 +6,16 @@
 // Manages the auth button, QR pairing modal, and user popover.
 // All plain DOM manipulation, no framework.
 //
-// Auth module is lazy-loaded. The heavy host-papp, statement-store, and
-// polkadot-api WS deps only load when a persisted session exists or the
-// user clicks the auth button.
-
-import type { AuthState } from "@dotli/auth/auth";
-import type { Identity } from "@novasamatech/host-papp";
 import { log } from "@dotli/shared/log";
 import { escapeHtml } from "@dotli/shared/html";
 import { isMobileDevice } from "@dotli/shared/device";
-import { toHex } from "@dotli/shared/hex";
 import {
   formatAppVersion,
   getActiveAppManifest,
   getActiveRootManifest,
 } from "@dotli/shared/active-manifest";
-import { SITE_ID } from "@dotli/config/config";
 import {
   createRemoteChainProvider,
-  hasSharedAuthSession,
   isRemoteChainSupported,
 } from "@dotli/protocol/client";
 import {
@@ -49,13 +40,18 @@ import { getActiveServicesConfig } from "@dotli/config/network";
 import { writeSettingsToSearch } from "@dotli/config/url-settings";
 import {
   ALL_PERMISSIONS,
-  getPermissionStatus,
+  getPermissionStatuses,
   hasAnyGrant,
   isDevicePermission,
   resetPermission,
   setPermissionStatus,
   type PermissionStatus,
 } from "./permissions";
+import type { DotliAuthState } from "./host-callbacks/AuthState";
+import {
+  emitPersistedSessionUiState,
+  type TruapiSessionUiState,
+} from "./host-callbacks/SessionStore";
 
 function getElement(id: string): HTMLElement {
   const el = document.getElementById(id);
@@ -99,33 +95,7 @@ const USER_SVG = `<svg width="12" height="12" viewBox="0 0 24 24" fill="none" st
 
 // Track the current QR payload to prevent stale canvas appends
 let currentQrPayload: string | null = null;
-
-interface AuthModule {
-  initAuth: () => Promise<void>;
-  getAuthState: () => AuthState;
-  onAuthStateChange: (fn: (state: AuthState) => void) => () => void;
-  startPairing: () => void;
-  abortPairing: () => void;
-  disconnect: () => Promise<void>;
-  shortenName: (identity: Identity) => string;
-}
-
-let authMod: AuthModule | null = null;
-
-/**
- * Lazy-load and initialize the auth module. Subsequent calls return
- * the cached module immediately (initAuth is idempotent).
- */
-async function ensureAuth(): Promise<AuthModule> {
-  if (authMod) {
-    return authMod;
-  }
-  authMod = await import("@dotli/auth/auth");
-  await authMod.initAuth();
-  authMod.onAuthStateChange(renderAuthState);
-  renderAuthState(authMod.getAuthState());
-  return authMod;
-}
+let truapiSessionConnected = false;
 
 function getStoredTheme(): "light" | "dark" {
   const stored = localStorage.getItem("dotli-theme");
@@ -140,7 +110,7 @@ function getStoredTheme(): "light" | "dark" {
 
 function applyTheme(theme: "light" | "dark"): void {
   document.documentElement.setAttribute("data-theme", theme);
-  // Notify the container bridge (container.ts) to forward the new theme to the
+  // Notify the Rust bridge to forward the new theme to the
   // embedded dApp.
   window.dispatchEvent(new Event("dotli:theme-changed"));
 }
@@ -176,7 +146,9 @@ export function initTopBar(): void {
   authButton.removeAttribute("disabled");
 
   // Modal close button
-  modalClose.addEventListener("click", closeModal);
+  modalClose.addEventListener("click", () => {
+    closeModal();
+  });
 
   // Clicking backdrop (outside modal) closes modal
   modalBackdrop.addEventListener("click", (e) => {
@@ -188,28 +160,20 @@ export function initTopBar(): void {
   // Disconnect button
   userPopoverDisconnect.addEventListener("click", handleDisconnect);
 
-  // Products can trigger the login flow via `handleRequestLogin`.
-  // `requestLogin()` in @dotli/auth dispatches this event after checking
-  // the already-connected fast path. The topbar owns the QR modal so we
-  // open it here and kick off pairing.
   window.addEventListener("dotli:request-login", (e: Event) => {
     const detail = (e as CustomEvent<{ reason?: string; label?: string }>)
       .detail;
     openModal(detail.reason, detail.label);
-    void ensureAuth().then(() => {
-      // Skip if the flow advanced between dispatch and here.
-      const state = authMod?.getAuthState();
-      if (
-        state &&
-        state.status !== "authenticated" &&
-        state.status !== "pairing" &&
-        state.status !== "attesting"
-      ) {
-        authMod?.startPairing();
-      }
-    });
+    requestTruapiLogin(detail.reason);
   });
 
+  // Single ordered auth-state stream owned by the Rust core (plus the boot
+  // rehydration and bridge transport-failure synthetics). The modal closes
+  // only on `Connected` or explicit user action; a `Disconnected` can never
+  // tear down an in-flight pairing presentation.
+  window.addEventListener("dotli:truapi-auth-state", (e: Event) => {
+    renderAuthState((e as CustomEvent<DotliAuthState>).detail);
+  });
   // Mobile-only "more" menu: collapses Permissions / Theme / Settings into a
   // single flyout. Each row delegates to .click() on the real button so the
   // existing handlers (and their viewport-anchored popovers) work unchanged.
@@ -302,40 +266,50 @@ export function initTopBar(): void {
   // Show default logged-out state
   renderLoggedOut();
 
-  // Probe the shared auth storage on host.dot.li. Sessions now live on the
-  // shared host origin so sibling host shells can rehydrate after a
-  // cross-subdomain navigation without eagerly loading the auth bundle for
-  // every visitor.
-  requestIdleCallback(() => {
-    void (async () => {
-      try {
-        if (await hasSharedAuthSession(SITE_ID)) {
-          await ensureAuth();
-        }
-      } catch (error) {
-        log.warn("[dot.li auth] Shared session probe failed:", error);
-      }
-    })();
+  // Rehydrate the persisted same-origin session on idle so a reload shows
+  // the logged-in badge before any core instance boots.
+  scheduleIdle(() => {
+    emitPersistedSessionUiState();
   });
 }
 
-function renderAuthState(state: AuthState): void {
-  switch (state.status) {
-    case "idle":
+function scheduleIdle(callback: () => void): void {
+  if (typeof requestIdleCallback === "function") {
+    requestIdleCallback(() => {
+      callback();
+    });
+  } else {
+    window.setTimeout(callback, 0);
+  }
+}
+
+/**
+ * Render one auth state. The modal lifecycle is state-driven: `Pairing`
+ * opens it with the QR, `Connected` closes it, `LoginFailed` shows a
+ * retryable error, and `Disconnected` only updates the badge so an
+ * unrelated disconnect signal can never close an active pairing modal.
+ */
+function renderAuthState(state: DotliAuthState): void {
+  truapiSessionConnected = state.tag === "Connected";
+  switch (state.tag) {
+    case "Disconnected":
       renderLoggedOut();
       break;
-    case "pairing":
-      renderPairing(state.payload);
+    case "Pairing":
+      openModal(
+        undefined,
+        state.hostGlobal === true ? undefined : state.label,
+        { dotSuffix: state.dotSuffix },
+      );
+      renderPairing(state.deeplink);
       break;
-    case "attesting":
-      renderAttesting();
+    case "Connected":
+      closeModal({ skipTruapiCancel: true });
+      renderTruapiLoggedIn(state.session);
       break;
-    case "authenticated":
-      renderLoggedIn(state);
-      closeModal();
-      break;
-    case "error":
-      renderError(state.message);
+    case "LoginFailed":
+      openModal();
+      renderError(state.reason);
       break;
   }
 }
@@ -346,28 +320,47 @@ function renderLoggedOut(): void {
   window.dispatchEvent(new Event("dotli:logged-out"));
 }
 
-function renderLoggedIn(state: AuthState & { status: "authenticated" }): void {
-  const initials =
-    state.identity && authMod ? authMod.shortenName(state.identity) : "??";
-  authButton.innerHTML = `<div class="user-badge">${escapeHtml(initials)}</div>`;
+function renderTruapiLoggedIn(state: TruapiSessionUiState): void {
+  authButton.innerHTML = `<div class="user-badge">${escapeHtml(
+    shortenTruapiSessionName(state),
+  )}</div>`;
   authButton.title = "Account";
+  userPopoverUsername.textContent =
+    state.primaryUsername ??
+    state.fullUsername ??
+    state.liteUsername ??
+    shortenAccount(state.identityAccountId ?? state.publicKey) ??
+    "Connected with Polkadot Mobile";
   window.dispatchEvent(new Event("dotli:authenticated"));
+}
 
-  // Update popover with identity name or truncated account address
-  let username: string;
-  const fullName = state.identity?.fullUsername;
-  const liteName = state.identity?.liteUsername;
-  if (
-    (fullName !== undefined && fullName !== "") ||
-    (liteName !== undefined && liteName !== "")
-  ) {
-    username = fullName ?? liteName ?? "";
-  } else {
-    // Fallback to truncated account address
-    const id = toHex(state.session.remoteAccount.accountId).slice(2);
-    username = `0x${id.slice(0, 6)}...${id.slice(-4)}`;
+function shortenTruapiSessionName(state: TruapiSessionUiState): string {
+  const fullName = state.fullUsername;
+  if (fullName !== undefined && fullName.length > 0) {
+    const parts = fullName.split(" ").filter((part) => part.length > 0);
+    if (parts.length === 1) {
+      return parts[0].slice(0, 2).toUpperCase();
+    }
+    if (parts.length > 1) {
+      return `${parts[0].charAt(0)}${parts[1].charAt(0)}`.toUpperCase();
+    }
+  }
+  const liteName = state.liteUsername;
+  if (liteName !== undefined && liteName.length > 0) {
+    return liteName.slice(0, 2).toUpperCase();
   }
-  userPopoverUsername.textContent = username;
+  const account = state.identityAccountId ?? state.publicKey;
+  if (account !== undefined && account.length >= 4) {
+    return account.slice(2, 4).toUpperCase();
+  }
+  return "??";
+}
+
+function shortenAccount(account: string | undefined): string | undefined {
+  if (account === undefined || account.length < 12) {
+    return undefined;
+  }
+  return `${account.slice(0, 8)}...${account.slice(-4)}`;
 }
 
 function renderPairing(payload: string): void {
@@ -438,26 +431,40 @@ function renderPairing(payload: string): void {
     });
 }
 
-function renderAttesting(): void {
-  modalQr.innerHTML = `
-    <div class="attesting">
-      <div class="spinner"></div>
-      <p>Logging in...</p>
-    </div>
-  `;
-}
-
 // Clock glyph for the "account still being set up" state.
 const PENDING_ICON_SVG =
   '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 2"/></svg>';
 
 // Recognize known wallet-side SSO failures and return friendly copy, or null to
-// fall back to the raw error. OriginPersonProviderError ("error 0" =
-// noPersonsExist) means the signer's personhood is not yet included in a VRF
-// ring, so the wallet cannot grant the host its statement-store allowance yet.
+// fall back to the raw error.
 function friendlyAuthError(
   message: string,
-): { title: string; subtitle: string } | null {
+): { title: string; subtitle: string; detail?: string } | null {
+  if (
+    message.includes("no free statement-store slot for device registration")
+  ) {
+    return {
+      title: "No Statement Store slots left",
+      subtitle: "Polkadot Mobile could not register this browser as a device.",
+      detail: "no free statement-store slot for device registration",
+    };
+  }
+  if (message.includes("Invalid Transaction")) {
+    return {
+      title: "Statement Store transaction rejected",
+      subtitle:
+        "Polkadot Mobile could not register this browser because the chain rejected the registration transaction.",
+      detail: message,
+    };
+  }
+  if (message.includes("SubstrateSdk.JSONRPCError error 1")) {
+    return {
+      title: "Statement Store registration failed",
+      subtitle:
+        "Polkadot Mobile reported a JSON-RPC failure while registering this browser as a device.",
+      detail: message,
+    };
+  }
   if (message.includes("OriginPersonProviderError")) {
     return {
       title: "Your account is still being set up",
@@ -487,6 +494,13 @@ function renderError(message: string): void {
     subtitle.className = "auth-modal-pending-subtitle";
     subtitle.textContent = friendly.subtitle;
     container.appendChild(subtitle);
+
+    if (friendly.detail !== undefined && friendly.detail.length > 0) {
+      const detail = document.createElement("p");
+      detail.className = "auth-modal-error";
+      detail.textContent = friendly.detail;
+      container.appendChild(detail);
+    }
   } else {
     const msg = document.createElement("p");
     msg.className = "auth-modal-error";
@@ -498,7 +512,8 @@ function renderError(message: string): void {
   retry.className = "auth-modal-retry";
   retry.textContent = "Retry";
   retry.addEventListener("click", () => {
-    authMod?.startPairing();
+    openModal();
+    requestTruapiLogin();
   });
   container.appendChild(retry);
 
@@ -507,34 +522,31 @@ function renderError(message: string): void {
 }
 
 function handleAuthButtonClick(): void {
-  if (authMod) {
-    const state = authMod.getAuthState();
-
-    if (state.status === "authenticated") {
-      // Toggle user popover
-      userPopover.classList.toggle("open");
-    } else if (state.status === "attesting") {
-      // Attestation still running in background, just reshow the modal
-      modalBackdrop.classList.add("open");
-    } else {
-      // Open modal and start pairing
-      openModal();
-      authMod.startPairing();
-    }
+  if (truapiSessionConnected) {
+    userPopover.classList.toggle("open");
   } else {
-    // Auth not loaded yet, load it and start pairing
     openModal();
-    void ensureAuth().then(() => {
-      authMod?.startPairing();
-    });
+    requestTruapiLogin();
   }
 }
 
 function handleDisconnect(): void {
   userPopover.classList.remove("open");
-  if (authMod) {
-    void authMod.disconnect();
-  }
+  requestTruapiDisconnect();
+}
+
+export function requestTruapiDisconnect(): void {
+  window.dispatchEvent(new Event("dotli:truapi-disconnect-request"));
+}
+
+function requestTruapiLogin(reason?: string): void {
+  window.dispatchEvent(
+    new CustomEvent("dotli:truapi-login-request", {
+      detail: {
+        reason,
+      },
+    }),
+  );
 }
 
 const PERM_ICONS: Record<string, string> = {
@@ -555,14 +567,14 @@ const PERM_ICONS: Record<string, string> = {
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg>',
   Biometrics:
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 11a4 4 0 0 0-4 4v2a4 4 0 0 0 8 0v-2a4 4 0 0 0-4-4z"/><path d="M6 11a6 6 0 0 1 12 0"/><path d="M4 11a8 8 0 0 1 16 0"/></svg>',
+  IdentityDisclosure:
+    '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/><path d="M19 3v4h4"/></svg>',
   ChainSubmit:
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="17 1 21 5 17 9"/><path d="M3 11V9a4 4 0 0 1 4-4h14"/><polyline points="7 23 3 19 7 15"/><path d="M21 13v2a4 4 0 0 1-4 4H3"/></svg>',
   PreimageSubmit:
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>',
   StatementSubmit:
     '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="8" y1="13" x2="16" y2="13"/><line x1="8" y1="17" x2="14" y2="17"/></svg>',
-  GetUserId:
-    '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>',
 };
 
 function initPermissions(): void {
@@ -626,14 +638,21 @@ function initPermissions(): void {
 
 /** Update the shield icon to reflect whether any permissions are active. */
 function updatePermissionsButtonState(): void {
-  if (currentProductLabel === null) {
+  const productLabel = currentProductLabel;
+  if (productLabel === null) {
     permissionsButton.classList.remove("has-grants");
     return;
   }
-  permissionsButton.classList.toggle(
-    "has-grants",
-    hasAnyGrant(currentProductLabel),
-  );
+  void (async () => {
+    const hasGrant = await hasAnyGrant(productLabel);
+    if (currentProductLabel === productLabel) {
+      permissionsButton.classList.toggle("has-grants", hasGrant);
+    }
+  })().catch(() => {
+    if (currentProductLabel === productLabel) {
+      permissionsButton.classList.remove("has-grants");
+    }
+  });
 }
 
 const STATUS_LABELS: Record<PermissionStatus, string> = {
@@ -645,6 +664,7 @@ const STATUS_LABELS: Record<PermissionStatus, string> = {
 const STATUS_ORDER: readonly PermissionStatus[] = ["ask", "granted", "denied"];
 
 let openDropdownCleanup: (() => void) | null = null;
+let permissionsRenderToken = 0;
 
 function closeOpenDropdown(): void {
   openDropdownCleanup?.();
@@ -652,10 +672,25 @@ function closeOpenDropdown(): void {
 }
 
 function renderPermissionsPopover(): void {
+  const token = ++permissionsRenderToken;
+  void renderPermissionsPopoverAsync(token).catch(() => {
+    if (token !== permissionsRenderToken) {
+      return;
+    }
+    permissionsPopoverList.innerHTML = "";
+    const hint = document.createElement("div");
+    hint.className = "permissions-popover-footer";
+    hint.textContent = "Permissions are unavailable for this app.";
+    permissionsPopoverList.appendChild(hint);
+  });
+}
+
+async function renderPermissionsPopoverAsync(token: number): Promise<void> {
   closeOpenDropdown();
   permissionsPopoverList.innerHTML = "";
 
-  if (currentProductLabel === null) {
+  const productLabel = currentProductLabel;
+  if (productLabel === null) {
     const hint = document.createElement("div");
     hint.className = "permissions-popover-footer";
     hint.textContent = productErrored
@@ -665,9 +700,19 @@ function renderPermissionsPopover(): void {
     return;
   }
 
-  for (const perm of ALL_PERMISSIONS) {
-    const productLabel = currentProductLabel;
-    const status = getPermissionStatus(productLabel, perm.name);
+  const statuses = await getPermissionStatuses(
+    productLabel,
+    ALL_PERMISSIONS.map(({ name }) => name),
+  );
+
+  for (const [index, perm] of ALL_PERMISSIONS.entries()) {
+    const status = statuses[index] ?? "ask";
+    if (
+      token !== permissionsRenderToken ||
+      currentProductLabel !== productLabel
+    ) {
+      return;
+    }
 
     const row = document.createElement("div");
     row.className = "permissions-popover-row";
@@ -684,22 +729,26 @@ function renderPermissionsPopover(): void {
 
     row.appendChild(
       createPermissionDropdown(status, (next) => {
-        if (next === "ask") {
-          resetPermission(productLabel, perm.name);
-        } else {
-          setPermissionStatus(productLabel, perm.name, next);
-        }
-        // Device permissions need iframe reload (allow attribute changes).
-        // Non-device permissions just update the UI.
-        const event = isDevicePermission(perm.name)
-          ? "dotli:device-permission-changed"
-          : "dotli:permission-changed";
-        window.dispatchEvent(
-          new CustomEvent(event, {
-            detail: { label: productLabel, permission: perm.name },
-          }),
-        );
-        renderPermissionsPopover();
+        void (async () => {
+          if (next === "ask") {
+            await resetPermission(productLabel, perm.name);
+          } else {
+            await setPermissionStatus(productLabel, perm.name, next);
+          }
+          // Device permissions need iframe reload (allow attribute changes).
+          // Non-device permissions just update the UI.
+          const event = isDevicePermission(perm.name)
+            ? "dotli:device-permission-changed"
+            : "dotli:permission-changed";
+          window.dispatchEvent(
+            new CustomEvent(event, {
+              detail: { label: productLabel, permission: perm.name },
+            }),
+          );
+          renderPermissionsPopover();
+        })().catch(() => {
+          renderPermissionsPopover();
+        });
       }),
     );
 
@@ -1319,7 +1368,7 @@ declare const __POLKADOT_API_VERSION__: string | undefined;
 declare const __POLKADOT_API_VERSIONS__:
   | { name: string; version: string }[]
   | undefined;
-declare const __NOVASAMATECH_VERSIONS__:
+declare const __PARITY_TRUAPI_VERSIONS__:
   | { name: string; version: string }[]
   | undefined;
 
@@ -1433,19 +1482,10 @@ function renderDiagnostics(parent: HTMLElement): void {
     polkadotApi.push(...__POLKADOT_API_VERSIONS__);
   }
 
-  // @novasamatech/* versions move in lockstep, so showing every single
-  // package is noise. Keep only the two that are independently meaningful:
-  // host-api (the host runtime) and sdk-statement (the statement store
-  // client). Everything else in the scope tracks host-api's version.
-  const NOVASAMATECH_ALLOWLIST = new Set([
-    "@novasamatech/host-api",
-    "@novasamatech/sdk-statement",
-  ]);
-  const novasamatech = (
-    typeof __NOVASAMATECH_VERSIONS__ === "undefined"
+  const parityTruapi =
+    typeof __PARITY_TRUAPI_VERSIONS__ === "undefined"
       ? []
-      : __NOVASAMATECH_VERSIONS__
-  ).filter((p) => NOVASAMATECH_ALLOWLIST.has(p.name));
+      : __PARITY_TRUAPI_VERSIONS__;
 
   if (polkadotApi.length > 0) {
     appendSectionHeader(parent, "@polkadot-api");
@@ -1453,9 +1493,9 @@ function renderDiagnostics(parent: HTMLElement): void {
       renderInfoRow(parent, pkg.name, pkg.version);
     }
   }
-  if (novasamatech.length > 0) {
-    appendSectionHeader(parent, "@triangle-sdk");
-    for (const pkg of novasamatech) {
+  if (parityTruapi.length > 0) {
+    appendSectionHeader(parent, "@parity/truapi");
+    for (const pkg of parityTruapi) {
       renderInfoRow(parent, pkg.name, pkg.version);
     }
   }
@@ -1470,24 +1510,26 @@ function renderDiagnostics(parent: HTMLElement): void {
   shareBtn.title =
     "Open a new issue on paritytech/dotli pre-filled with these diagnostics";
   shareBtn.addEventListener("click", () => {
-    const report = formatDiagnosticsReport(
-      base,
-      smoldotInfo,
-      polkadotApi,
-      novasamatech,
-    );
-    const body = [
-      "<!-- Describe the issue above this line; the diagnostics below are auto-filled. -->",
-      "",
-      "## Diagnostics",
-      "",
-      "```",
-      report,
-      "```",
-    ].join("\n");
-    const url = new URL("https://github.com/paritytech/dotli/issues/new");
-    url.searchParams.set("body", body);
-    window.open(url.toString(), "_blank", "noopener,noreferrer");
+    void (async () => {
+      const report = await formatDiagnosticsReport(
+        base,
+        smoldotInfo,
+        polkadotApi,
+        parityTruapi,
+      );
+      const body = [
+        "<!-- Describe the issue above this line; the diagnostics below are auto-filled. -->",
+        "",
+        "## Diagnostics",
+        "",
+        "```",
+        report,
+        "```",
+      ].join("\n");
+      const url = new URL("https://github.com/paritytech/dotli/issues/new");
+      url.searchParams.set("body", body);
+      window.open(url.toString(), "_blank", "noopener,noreferrer");
+    })();
   });
 
   const debugOn = isTruapiDebugEnabled();
@@ -1528,16 +1570,16 @@ function isTruapiDebugEnabled(): boolean {
  *              so the snapshot matches what's actually live right now.
  *    3. Permissions: per-product, omitted on landing where we don't have
  *                    a scoped label to query.
- *    4. Packages: flat list of smoldot, polkadot-api, and novasamatech. The
+ *    4. Packages: flat list of smoldot, polkadot-api, and @parity/truapi. The
  *                 live block heights from the @smoldot popover section
  *                 aren't included here because they're noise in a bug
  *                 report. The popover already shows them live. */
-function formatDiagnosticsReport(
+async function formatDiagnosticsReport(
   base: [label: string, value: string][],
   smoldot: SmoldotInfo,
   polkadotApi: { name: string; version: string }[],
-  novasamatech: { name: string; version: string }[],
-): string {
+  parityTruapi: { name: string; version: string }[],
+): Promise<string> {
   const lines: string[] = [];
   for (const [k, v] of base) {
     lines.push(`${k}: ${v}`);
@@ -1554,10 +1596,15 @@ function formatDiagnosticsReport(
   );
 
   // Permissions, only when we know which product label to scope against.
-  if (currentProductLabel !== null) {
+  const productLabel = currentProductLabel;
+  if (productLabel !== null) {
     lines.push("", "Permissions:");
-    for (const perm of ALL_PERMISSIONS) {
-      const status = getPermissionStatus(currentProductLabel, perm.name);
+    const statuses = await getPermissionStatuses(
+      productLabel,
+      ALL_PERMISSIONS.map(({ name }) => name),
+    );
+    for (const [index, perm] of ALL_PERMISSIONS.entries()) {
+      const status = statuses[index] ?? "ask";
       lines.push(`  ${perm.label}: ${status === "granted" ? "on" : "off"}`);
     }
   }
@@ -1568,7 +1615,7 @@ function formatDiagnosticsReport(
   for (const p of polkadotApi) {
     lines.push(`  ${p.name}: ${p.version}`);
   }
-  for (const p of novasamatech) {
+  for (const p of parityTruapi) {
     lines.push(`  ${p.name}: ${p.version}`);
   }
   return lines.join("\n");
@@ -1960,7 +2007,11 @@ function renderCacheToggle(
   parent.appendChild(row);
 }
 
-function openModal(reason?: string, label?: string): void {
+function openModal(
+  reason?: string,
+  label?: string,
+  options: { dotSuffix?: boolean } = {},
+): void {
   modalQr.innerHTML = `<div class="spinner"></div>`;
   // Mobile leads with the deeplink button. The QR toggle swaps this copy later.
   modalHint.textContent = isMobileDevice()
@@ -1973,7 +2024,10 @@ function openModal(reason?: string, label?: string): void {
   // label and get the ".dot" suffix.
   let productLabel = "";
   if (label !== undefined && label.length > 0) {
-    productLabel = label.startsWith("localhost:") ? label : `${label}.dot`;
+    productLabel =
+      label.startsWith("localhost:") || options.dotSuffix === false
+        ? label
+        : `${label}.dot`;
   }
   modalTitle.innerHTML =
     productLabel.length > 0
@@ -1989,14 +2043,14 @@ function openModal(reason?: string, label?: string): void {
   modalBackdrop.classList.add("open");
 }
 
-function closeModal(): void {
+function closeModal(opts: { skipTruapiCancel?: boolean } = {}): void {
   modalBackdrop.classList.remove("open");
+  currentQrPayload = null;
+  modalQr.innerHTML = "";
 
-  if (authMod) {
-    const state = authMod.getAuthState();
-    // Only abort during pairing or error. Let attestation continue in background
-    if (state.status === "pairing" || state.status === "error") {
-      authMod.abortPairing();
-    }
+  if (opts.skipTruapiCancel !== true) {
+    // User-initiated close: cancel any in-flight login in the core so the
+    // pairing flow stops polling and resolves as Rejected.
+    window.dispatchEvent(new Event("dotli:truapi-cancel-login"));
   }
 }
diff --git a/packages/ui/src/wallet-queue.ts b/packages/ui/src/wallet-queue.ts
deleted file mode 100644
index b065cc41..00000000
--- a/packages/ui/src/wallet-queue.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-/**
- * Single-slot FIFO queue serializing host-side wallet-flow modals.
- *
- * host-papp already serializes the SSO wire internally, but each call also
- * opens a host modal that must not stack with another wallet flow.
- */
-
-import { ResultAsync, type Result } from "neverthrow";
-
-export type WalletFlowQueue = <T, E>(
-  fn: () => ResultAsync<T, E>,
-) => ResultAsync<T, E>;
-
-export function createWalletFlowQueue(): WalletFlowQueue {
-  let chain: Promise<unknown> = Promise.resolve();
-
-  function enqueue<T, E>(fn: () => ResultAsync<T, E>): ResultAsync<T, E> {
-    // Both then branches run fn so a previous rejection cannot stall the queue.
-    const run = (): ResultAsync<T, E> => fn();
-    const next: Promise<Result<T, E>> = chain.then(run, run);
-    chain = next;
-    return ResultAsync.fromSafePromise(next).andThen((r) => r);
-  }
-
-  return enqueue;
-}
-
-export const queueWalletFlow: WalletFlowQueue = createWalletFlowQueue();
diff --git a/packages/ui/tests/allocation-modal.test.ts b/packages/ui/tests/allocation-modal.test.ts
deleted file mode 100644
index de861991..00000000
--- a/packages/ui/tests/allocation-modal.test.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { afterEach, describe, expect, it } from "vitest";
-import {
-  showAllocationRequestModal,
-  type AllocatableResourceValue,
-  type AllocationOutcomeValue,
-} from "@dotli/ui/allocation-modal";
-
-afterEach(() => {
-  document.body.innerHTML = "";
-});
-
-function findModal(): HTMLElement {
-  const modal = document.querySelector(".signing-modal");
-  if (!(modal instanceof HTMLElement)) {
-    throw new Error("modal not mounted");
-  }
-  return modal;
-}
-
-function clickButton(text: string): void {
-  const buttons = Array.from(document.querySelectorAll("button"));
-  const button = buttons.find((b) => b.textContent === text);
-  if (!button) throw new Error(`button "${text}" not found`);
-  button.click();
-}
-
-const flush = (): Promise<void> => new Promise((r) => setTimeout(r, 0));
-
-describe("showAllocationRequestModal", () => {
-  const allowed: AllocationOutcomeValue[] = [
-    { tag: "Allocated", value: undefined },
-  ];
-
-  it("renders one item per resource with the expected label", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-      { tag: "BulletinAllowance", value: undefined },
-      { tag: "SmartContractAllowance", value: 5 },
-      { tag: "AutoSigning", value: undefined },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed);
-
-    const items = Array.from(
-      findModal().querySelectorAll(".allocation-modal-list li"),
-    ).map((li) => li.textContent);
-
-    expect(items).toEqual([
-      "Post statements on your behalf",
-      "Publish bulletin posts on your behalf",
-      "Sign smart-contract calls automatically",
-      "Sign transactions automatically",
-    ]);
-  });
-
-  it("adds a signing-account tooltip for smart-contract allowances when a resolver is given", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "SmartContractAllowance", value: 0 },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed, {
-      resolveContractAccount: (index) => `5Addr${String(index)}`,
-    });
-
-    const modal = findModal();
-    expect(modal.querySelector(".allocation-tooltip-title")?.textContent).toBe(
-      "Following accounts will sign contract calls automatically:",
-    );
-
-    // The account label is the disclosure summary; the SS58 address is tucked
-    // inside the collapsible <details>.
-    const summary = modal.querySelector("summary.allocation-account-summary");
-    expect(
-      summary?.querySelector(".allocation-account-label")?.textContent,
-    ).toBe("App account with index 0");
-
-    const details = modal.querySelector("details.allocation-account");
-    expect(details).not.toBeNull();
-    expect(
-      details?.querySelector(".allocation-account-address")?.textContent,
-    ).toBe("5Addr0");
-  });
-
-  it("omits the tooltip when no resolver is provided", () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "SmartContractAllowance", value: 0 },
-    ];
-
-    void showAllocationRequestModal("myapp", resources, async () => allowed);
-
-    expect(findModal().querySelector(".allocation-tooltip")).toBeNull();
-  });
-
-  it("resolves with the wallet outcomes on Allow", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    clickButton("Allow");
-    await expect(promise).resolves.toEqual(allowed);
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("rejects on Cancel and removes the modal", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "BulletinAllowance", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    clickButton("Cancel");
-    await expect(promise).rejects.toThrow();
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("rejects on backdrop click while not pending", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "AutoSigning", value: undefined },
-    ];
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      async () => allowed,
-    );
-
-    const backdrop = document.querySelector(".signing-modal-backdrop");
-    if (!(backdrop instanceof HTMLElement)) {
-      throw new Error("backdrop not mounted");
-    }
-    backdrop.click();
-    await expect(promise).rejects.toThrow();
-    expect(document.querySelector(".signing-modal")).toBeNull();
-  });
-
-  it("keeps the modal open and shows the error when performAllocation rejects", async () => {
-    const resources: AllocatableResourceValue[] = [
-      { tag: "StatementStoreAllowance", value: undefined },
-    ];
-    let attempts = 0;
-    const performAllocation = async (): Promise<AllocationOutcomeValue[]> => {
-      attempts += 1;
-      if (attempts === 1) throw new Error("phone unreachable");
-      return allowed;
-    };
-
-    const promise = showAllocationRequestModal(
-      "myapp",
-      resources,
-      performAllocation,
-    );
-
-    clickButton("Allow");
-    await flush();
-    await flush();
-
-    const errorBox = document.querySelector(".allocation-modal-error");
-    expect(errorBox?.textContent).toBe("phone unreachable");
-    expect(document.querySelector(".signing-modal")).not.toBeNull();
-
-    const allow = Array.from(document.querySelectorAll("button")).find(
-      (b) => b.textContent === "Allow",
-    );
-    expect(allow?.disabled).toBe(false);
-
-    // Retry path settles the original promise.
-    clickButton("Allow");
-    await expect(promise).resolves.toEqual(allowed);
-    expect(attempts).toBe(2);
-  });
-});
diff --git a/packages/ui/tests/bridge.test.ts b/packages/ui/tests/bridge.test.ts
new file mode 100644
index 00000000..4b06f5e5
--- /dev/null
+++ b/packages/ui/tests/bridge.test.ts
@@ -0,0 +1,408 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  HostRequestLoginResponse,
+  VersionedHostRequestLoginError,
+  decodeWireMessage,
+  encodeWireMessage,
+  scale,
+} from "@parity/truapi";
+import { ACCOUNT_REQUEST_LOGIN } from "@parity/truapi/wire-table";
+
+type Deferred<T> = {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (error: unknown) => void;
+};
+
+type MockProvider = {
+  postMessage: ReturnType<typeof vi.fn>;
+  subscribe: ReturnType<typeof vi.fn>;
+  subscribeClose: ReturnType<typeof vi.fn>;
+  disconnectSession: ReturnType<typeof vi.fn>;
+  getPermissionAuthorizationStatus: ReturnType<typeof vi.fn>;
+  getPermissionAuthorizationStatuses: ReturnType<typeof vi.fn>;
+  setPermissionAuthorizationStatus: ReturnType<typeof vi.fn>;
+  disconnect: ReturnType<typeof vi.fn>;
+  dispose: ReturnType<typeof vi.fn>;
+};
+
+type MockRuntime = {
+  createProvider: ReturnType<typeof vi.fn>;
+  cancelPairing: ReturnType<typeof vi.fn>;
+  notifySessionStoreChanged: ReturnType<typeof vi.fn>;
+  dispose: ReturnType<typeof vi.fn>;
+};
+
+type ProviderListener = (message: Uint8Array) => void;
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  let reject!: (error: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+const mocks = vi.hoisted(() => ({
+  coreProviders: [] as MockProvider[],
+  coreProviderDefers: [] as Deferred<MockProvider>[],
+  coreRuntimes: [] as MockRuntime[],
+  iframeHosts: [] as {
+    iframeUrl: string;
+    iframe: HTMLIFrameElement;
+    dispose: ReturnType<typeof vi.fn>;
+  }[],
+  createWebWorkerPairingHostRuntime: vi.fn(),
+  createIframeHost: vi.fn(),
+  createWasmRawCallbacks: vi.fn((callbacks: unknown) => callbacks),
+  timerStop: vi.fn(),
+  HostWorker: vi.fn(),
+}));
+
+vi.mock("@parity/truapi-host", () => ({
+  createWasmRawCallbacks: mocks.createWasmRawCallbacks,
+}));
+
+vi.mock("@parity/truapi-host/web", () => ({
+  createWebWorkerPairingHostRuntime: mocks.createWebWorkerPairingHostRuntime,
+  createIframeHost: mocks.createIframeHost,
+}));
+
+vi.mock("@parity/truapi-host/worker-runtime?worker", () => ({
+  default: mocks.HostWorker,
+}));
+
+vi.mock("@dotli/metrics/metrics", () => ({
+  m: {
+    measure: vi.fn(),
+    timer: vi.fn(() => mocks.timerStop),
+  },
+}));
+
+function makeProvider(): MockProvider {
+  const provider = {
+    postMessage: vi.fn(),
+    subscribe: vi.fn(() => () => {}),
+    subscribeClose: vi.fn(() => () => {}),
+    disconnectSession: vi.fn(async () => {}),
+    getPermissionAuthorizationStatus: vi.fn(async () => "NotDetermined"),
+    getPermissionAuthorizationStatuses: vi.fn(async (requests: unknown[]) =>
+      requests.map(() => "NotDetermined"),
+    ),
+    setPermissionAuthorizationStatus: vi.fn(async () => {}),
+    disconnect: vi.fn(async () => {}),
+    dispose: vi.fn(),
+  };
+  mocks.coreProviders.push(provider);
+  return provider;
+}
+
+function makeLoginProvider(options: {
+  onPostMessage?: (message: Uint8Array) => void;
+}): MockProvider & { listener: ProviderListener | null } {
+  const provider = {
+    listener: null as ProviderListener | null,
+    postMessage: vi.fn((message: Uint8Array) => {
+      options.onPostMessage?.(message);
+    }),
+    subscribe: vi.fn((callback: ProviderListener) => {
+      provider.listener = callback;
+      return () => {
+        provider.listener = null;
+      };
+    }),
+    subscribeClose: vi.fn(() => () => {}),
+    disconnectSession: vi.fn(async () => {}),
+    getPermissionAuthorizationStatus: vi.fn(async () => "NotDetermined"),
+    getPermissionAuthorizationStatuses: vi.fn(async (requests: unknown[]) =>
+      requests.map(() => "NotDetermined"),
+    ),
+    setPermissionAuthorizationStatus: vi.fn(async () => {}),
+    disconnect: vi.fn(async () => {}),
+    dispose: vi.fn(),
+  };
+  return provider;
+}
+
+function makeRuntime(): MockRuntime {
+  const runtime = {
+    createProvider: vi.fn(() => {
+      const item = deferred<MockProvider>();
+      mocks.coreProviderDefers.push(item);
+      return item.promise;
+    }),
+    cancelPairing: vi.fn(),
+    notifySessionStoreChanged: vi.fn(),
+    dispose: vi.fn(),
+  };
+  mocks.coreRuntimes.push(runtime);
+  return runtime;
+}
+
+function loginResponseFrame(
+  requestId: string,
+  result:
+    | { success: true; value: "Success" | "AlreadyConnected" | "Rejected" }
+    | { success: false; reason: string }
+    | { success: false; hostFailure: string },
+): Uint8Array {
+  const responseCodec = scale.indexedTaggedUnion({
+    V1: [
+      0,
+      scale.Result(
+        HostRequestLoginResponse,
+        scale.CallError(VersionedHostRequestLoginError),
+      ),
+    ] as const,
+  });
+  const value = responseCodec.enc({
+    tag: "V1",
+    value: result.success
+      ? { success: true, value: result.value }
+      : "hostFailure" in result
+        ? {
+            success: false,
+            value: {
+              tag: "HostFailure",
+              value: { reason: result.hostFailure },
+            },
+          }
+        : {
+            success: false,
+            value: {
+              tag: "Domain",
+              value: {
+                tag: "V1",
+                value: {
+                  tag: "Unknown",
+                  value: { reason: result.reason },
+                },
+              },
+            },
+          },
+  });
+  const frame = encodeWireMessage({
+    requestId,
+    payload: {
+      id: ACCOUNT_REQUEST_LOGIN.response,
+      value,
+    },
+  });
+  if (frame.isErr()) {
+    throw frame.error;
+  }
+  return frame.value;
+}
+
+function requestIdFromFrame(message: Uint8Array): string {
+  const decoded = decodeWireMessage(message);
+  if (decoded.isErr()) {
+    throw decoded.error;
+  }
+  return decoded.value.requestId;
+}
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+async function waitForProviderRequests(count: number): Promise<void> {
+  for (let i = 0; i < 20; i += 1) {
+    if (mocks.coreProviderDefers.length >= count) {
+      return;
+    }
+    await flushMicrotasks();
+  }
+  throw new Error(`expected ${count} provider request(s)`);
+}
+
+async function waitForMockCalls(
+  mock: ReturnType<typeof vi.fn>,
+  count: number,
+): Promise<void> {
+  for (let i = 0; i < 20; i += 1) {
+    if (mock.mock.calls.length >= count) {
+      return;
+    }
+    await flushMicrotasks();
+  }
+  throw new Error(`expected ${count} mock call(s)`);
+}
+
+describe("bridge render lifecycle", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    mocks.coreProviders.length = 0;
+    mocks.coreProviderDefers.length = 0;
+    mocks.coreRuntimes.length = 0;
+    mocks.iframeHosts.length = 0;
+    document.body.innerHTML = `<div id="app"></div>`;
+    mocks.createWebWorkerPairingHostRuntime.mockImplementation(() =>
+      Promise.resolve(makeRuntime()),
+    );
+    mocks.createIframeHost.mockImplementation(
+      (args: { iframeUrl: string; container: HTMLElement }) => {
+        const iframe = document.createElement("iframe");
+        iframe.dataset.src = args.iframeUrl;
+        args.container.appendChild(iframe);
+        const dispose = vi.fn(() => {
+          iframe.remove();
+        });
+        const host = { iframeUrl: args.iframeUrl, iframe, dispose };
+        mocks.iframeHosts.push(host);
+        return { iframe, dispose };
+      },
+    );
+  });
+
+  it("disposes a host that resolves after a newer render has started", async () => {
+    const { renderIframe } = await import("@dotli/ui/bridge");
+
+    const first = renderIframe("https://first.example/app", "first");
+    await waitForProviderRequests(1);
+    const second = renderIframe("https://second.example/app", "second");
+    await waitForProviderRequests(2);
+
+    const secondProvider = makeProvider();
+    mocks.coreProviderDefers[1].resolve(secondProvider);
+    await second;
+    expect(document.querySelector("iframe")?.dataset.src).toBe(
+      "https://second.example/app",
+    );
+
+    const firstProvider = makeProvider();
+    mocks.coreProviderDefers[0].resolve(firstProvider);
+    await first;
+
+    expect(mocks.iframeHosts).toHaveLength(2);
+    const firstHost = mocks.iframeHosts.find(
+      (host) => host.iframeUrl === "https://first.example/app",
+    );
+    expect(firstHost?.dispose).toHaveBeenCalledTimes(1);
+    expect(firstProvider.dispose).toHaveBeenCalledTimes(1);
+    expect(secondProvider.dispose).not.toHaveBeenCalled();
+    expect(document.querySelector("iframe")?.dataset.src).toBe(
+      "https://second.example/app",
+    );
+  });
+
+  it("boots the landing auth core to disconnect a stored session without a product", async () => {
+    await import("@dotli/ui/bridge");
+
+    window.dispatchEvent(new Event("dotli:truapi-disconnect-request"));
+    await waitForProviderRequests(1);
+
+    const provider = makeProvider();
+    mocks.coreProviderDefers[0].resolve(provider);
+    await waitForMockCalls(provider.disconnectSession, 1);
+
+    expect(provider.disconnectSession).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("requestCoreLogin", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    document.body.innerHTML = `<div id="app"></div>`;
+  });
+
+  it("resolves successful login responses", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage(message) {
+        provider.listener?.(
+          loginResponseFrame(requestIdFromFrame(message), {
+            success: true,
+            value: "Success",
+          }),
+        );
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).resolves.toBe("Success");
+    expect(provider.subscribe).toHaveBeenCalledTimes(1);
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects typed login errors as LoginRequestError", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage(message) {
+        provider.listener?.(
+          loginResponseFrame(requestIdFromFrame(message), {
+            success: false,
+            reason: "Rejected",
+          }),
+        );
+      },
+    });
+
+    const promise = requestCoreLogin(provider);
+
+    await expect(promise).rejects.toThrow("Rejected");
+    await expect(promise).rejects.toMatchObject({
+      name: "LoginRequestError",
+      error: {
+        tag: "Domain",
+        value: {
+          tag: "V1",
+          value: { tag: "Unknown", value: { reason: "Rejected" } },
+        },
+      },
+    });
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects host failures with the reason as the error message", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const reason = "no free statement-store slot for device registration";
+    const provider = makeLoginProvider({
+      onPostMessage(message) {
+        provider.listener?.(
+          loginResponseFrame(requestIdFromFrame(message), {
+            success: false,
+            hostFailure: reason,
+          }),
+        );
+      },
+    });
+
+    const promise = requestCoreLogin(provider);
+
+    await expect(promise).rejects.toThrow(reason);
+    await expect(promise).rejects.toMatchObject({
+      name: "LoginRequestError",
+      error: { tag: "HostFailure", value: { reason } },
+    });
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects malformed response frames and unsubscribes", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage() {
+        provider.listener?.(new Uint8Array([0xff, 0x00]));
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).rejects.toThrow();
+    expect(provider.listener).toBeNull();
+  });
+
+  it("rejects send failures and unsubscribes", async () => {
+    const { requestCoreLogin } = await import("@dotli/ui/bridge");
+    const provider = makeLoginProvider({
+      onPostMessage() {
+        throw new Error("send failed");
+      },
+    });
+
+    await expect(requestCoreLogin(provider)).rejects.toThrow("send failed");
+    expect(provider.listener).toBeNull();
+  });
+});
diff --git a/packages/ui/tests/chain-callback.test.ts b/packages/ui/tests/chain-callback.test.ts
new file mode 100644
index 00000000..7bb02f97
--- /dev/null
+++ b/packages/ui/tests/chain-callback.test.ts
@@ -0,0 +1,139 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import { createChainConnect } from "@dotli/ui/host-callbacks/Chain";
+
+const mocks = vi.hoisted(() => ({
+  backend: "smoldot-shared-worker",
+  smoldotProvider: vi.fn(),
+  rpcProvider: vi.fn(),
+  createSmoldotChainProvider: vi.fn(),
+  createRpcChainProvider: vi.fn(),
+  isSmoldotChainSupported: vi.fn(),
+  isCoreRpcChainSupported: vi.fn(),
+}));
+
+vi.mock("@dotli/config/mode", () => ({
+  getBackend: () => mocks.backend,
+}));
+
+vi.mock("@dotli/resolver/chains", () => ({
+  createChainProvider: mocks.createSmoldotChainProvider,
+  isChainSupported: mocks.isSmoldotChainSupported,
+}));
+
+vi.mock("@dotli/resolver/rpc-chain", () => ({
+  createCoreRpcChainProvider: mocks.createRpcChainProvider,
+  isCoreRpcChainSupported: mocks.isCoreRpcChainSupported,
+}));
+
+function hexBytes(hex: string): Uint8Array {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+describe("createChainConnect", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.backend = "smoldot-shared-worker";
+    mocks.smoldotProvider.mockReturnValue({
+      send: vi.fn(),
+      disconnect: vi.fn(),
+    });
+    mocks.rpcProvider.mockReturnValue({
+      send: vi.fn(),
+      disconnect: vi.fn(),
+    });
+    mocks.createSmoldotChainProvider.mockReturnValue(mocks.smoldotProvider);
+    mocks.createRpcChainProvider.mockReturnValue(mocks.rpcProvider);
+    mocks.isSmoldotChainSupported.mockReturnValue(true);
+    mocks.isCoreRpcChainSupported.mockReturnValue(true);
+  });
+
+  it("routes People-chain connections through the selected smoldot backend", async () => {
+    const peopleGenesis = getActiveServicesConfig().people.genesis;
+
+    await createChainConnect()(hexBytes(peopleGenesis));
+
+    expect(mocks.createSmoldotChainProvider).toHaveBeenCalledWith(
+      peopleGenesis,
+    );
+    expect(mocks.createRpcChainProvider).not.toHaveBeenCalled();
+  });
+
+  it("keeps non-People chain connections on the selected smoldot backend", async () => {
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+
+    await createChainConnect()(hexBytes(assetHubGenesis));
+
+    expect(mocks.createSmoldotChainProvider).toHaveBeenCalledWith(
+      assetHubGenesis,
+    );
+    expect(mocks.createRpcChainProvider).not.toHaveBeenCalled();
+  });
+
+  it("passes statement-store traffic through untouched", async () => {
+    let onMessage: ((message: unknown) => void) | undefined;
+    const sent: unknown[] = [];
+    mocks.smoldotProvider.mockImplementation(
+      (handler: (message: unknown) => void) => {
+        onMessage = handler;
+        return {
+          send: (request: unknown) => {
+            sent.push(request);
+          },
+          disconnect: vi.fn(),
+        };
+      },
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+    const query = {
+      jsonrpc: "2.0",
+      id: "opaque-query-request",
+      method: "statement_subscribeStatement",
+      params: [{ matchAll: [] }],
+    };
+    connection.send(JSON.stringify(query));
+    expect(sent).toEqual([query]);
+
+    const ack = {
+      jsonrpc: "2.0",
+      id: "opaque-query-request",
+      result: "remote-sub",
+    };
+    onMessage?.(ack);
+    const responses = connection.responses()[Symbol.asyncIterator]();
+    expect(JSON.parse((await responses.next()).value)).toEqual(ack);
+    await responses.return?.();
+  });
+
+  it("does not rewrite core chain RPC requests", async () => {
+    const sent: unknown[] = [];
+    mocks.smoldotProvider.mockImplementation(
+      (_handler: (message: unknown) => void) => ({
+        send: (request: unknown) => {
+          sent.push(request);
+        },
+        disconnect: vi.fn(),
+      }),
+    );
+    const assetHubGenesis = getActiveServicesConfig().assethub.genesis;
+    const connection = await createChainConnect()(hexBytes(assetHubGenesis));
+    const unpin = {
+      jsonrpc: "2.0",
+      id: "core-unpin",
+      method: "chainHead_v1_unpin",
+      params: ["REMOTE-FOLLOW", "0xabc"],
+    };
+
+    connection.send(JSON.stringify(unpin));
+
+    expect(sent).toEqual([unpin]);
+    connection.close();
+  });
+});
diff --git a/packages/ui/tests/local-storage.test.ts b/packages/ui/tests/local-storage.test.ts
new file mode 100644
index 00000000..4fbd6875
--- /dev/null
+++ b/packages/ui/tests/local-storage.test.ts
@@ -0,0 +1,76 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  createLocalStorageClear,
+  createLocalStorageRead,
+  createLocalStorageWrite,
+} from "@dotli/ui/host-callbacks/LocalStorage";
+
+describe("local-storage host callbacks", () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it("round-trips product-scoped bytes", async () => {
+    const read = createLocalStorageRead();
+    const write = createLocalStorageWrite();
+    const clear = createLocalStorageClear();
+
+    await write(
+      "truapi:product-storage:v1:9:myapp.dot:key",
+      new Uint8Array([0, 1, 2, 253, 254, 255]),
+    );
+
+    expect(
+      localStorage.getItem("dotli:truapi:product-storage:v1:9:myapp.dot:key"),
+    ).toBe("AAEC/f7/");
+    expect(
+      Array.from(
+        (await read("truapi:product-storage:v1:9:myapp.dot:key")) ?? [],
+      ),
+    ).toEqual([0, 1, 2, 253, 254, 255]);
+
+    await clear("truapi:product-storage:v1:9:myapp.dot:key");
+    expect(
+      await read("truapi:product-storage:v1:9:myapp.dot:key"),
+    ).toBeUndefined();
+  });
+
+  it("rotates SSO device identity across host runtime prefixes", async () => {
+    const clear = createLocalStorageClear();
+    localStorage.setItem("dotli:dotli:truapi:sso-device-identity:v1", "old");
+    localStorage.setItem(
+      "dotli:localhost:3000:truapi:sso-device-identity:v1",
+      "old",
+    );
+    localStorage.setItem("dotli:myapp:other", "keep");
+
+    await clear("truapi:sso-device-identity:v1");
+
+    expect(
+      localStorage.getItem("dotli:dotli:truapi:sso-device-identity:v1"),
+    ).toBeNull();
+    expect(
+      localStorage.getItem(
+        "dotli:localhost:3000:truapi:sso-device-identity:v1",
+      ),
+    ).toBeNull();
+    expect(localStorage.getItem("dotli:myapp:other")).toBe("keep");
+  });
+
+  it("writes values larger than a single argument-spread chunk", async () => {
+    const read = createLocalStorageRead();
+    const write = createLocalStorageWrite();
+    const value = Uint8Array.from(
+      { length: 70_000 },
+      (_, index) => index % 256,
+    );
+
+    await write("truapi:product-storage:v1:9:myapp.dot:large", value);
+
+    expect(
+      Array.from(
+        (await read("truapi:product-storage:v1:9:myapp.dot:large")) ?? [],
+      ),
+    ).toEqual(Array.from(value));
+  });
+});
diff --git a/packages/ui/tests/notification.test.ts b/packages/ui/tests/notification.test.ts
new file mode 100644
index 00000000..2093fa3f
--- /dev/null
+++ b/packages/ui/tests/notification.test.ts
@@ -0,0 +1,169 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  scheduleNotification: vi.fn(),
+  cancelNotification: vi.fn(),
+  showPermissionRequestModal: vi.fn(),
+}));
+
+vi.mock("@dotli/ui/scheduled-notifications", () => ({
+  scheduleNotification: mocks.scheduleNotification,
+  cancelNotification: mocks.cancelNotification,
+}));
+
+vi.mock("@dotli/ui/permission-modal", () => ({
+  showPermissionRequestModal: mocks.showPermissionRequestModal,
+}));
+
+async function registerNotificationAuthorization(
+  initialStatus: "NotDetermined" | "Denied" | "Authorized" = "NotDetermined",
+): Promise<{ status: "NotDetermined" | "Denied" | "Authorized" }> {
+  const state = { status: initialStatus };
+  const { registerPermissionAuthorizationProvider } =
+    await import("@dotli/ui/permissions");
+  registerPermissionAuthorizationProvider("myapp", {
+    async getPermissionAuthorizationStatuses(requests) {
+      return requests.map((request) =>
+        request.tag === "Device" && request.value === "Notifications"
+          ? state.status
+          : "NotDetermined",
+      );
+    },
+    async setPermissionAuthorizationStatus(request, status) {
+      if (request.tag === "Device" && request.value === "Notifications") {
+        state.status = status;
+      }
+    },
+  });
+  return state;
+}
+
+describe("notification host callbacks", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    localStorage.clear();
+    document.body.innerHTML = "";
+    mocks.scheduleNotification.mockResolvedValue({
+      ok: true,
+      id: 7,
+      immediate: true,
+    });
+    mocks.cancelNotification.mockResolvedValue(true);
+    mocks.showPermissionRequestModal.mockResolvedValue("granted");
+  });
+
+  it("prompts for notification permission, schedules, fires immediate notifications, and returns ids", async () => {
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    const response = await pushNotification({
+      text: "hello",
+      deeplink: undefined,
+      scheduledAt: undefined,
+    });
+
+    expect(response).toEqual({ id: 7 });
+    expect(mocks.showPermissionRequestModal).toHaveBeenCalledWith(
+      "myapp",
+      "Notifications",
+    );
+    expect(mocks.scheduleNotification).toHaveBeenCalledWith({
+      productId: "myapp",
+      title: "myapp",
+      text: "hello",
+      deeplink: null,
+      scheduledAt: null,
+    });
+    expect(
+      [...document.querySelectorAll(".notif-body")].map((node) =>
+        node.textContent?.trim(),
+      ),
+    ).toEqual(["hello"]);
+  });
+
+  it("reuses granted permission and cancels through the shared scheduler", async () => {
+    await registerNotificationAuthorization("Authorized");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification, cancelNotification } =
+      createNotificationAdapters("myapp");
+
+    await pushNotification({
+      text: "later",
+      deeplink: "dot://open",
+      scheduledAt: 123n,
+    });
+    await cancelNotification(7);
+
+    expect(mocks.showPermissionRequestModal).not.toHaveBeenCalled();
+    expect(mocks.scheduleNotification).toHaveBeenCalledWith({
+      productId: "myapp",
+      title: "myapp",
+      text: "later",
+      deeplink: "dot://open",
+      scheduledAt: 123,
+    });
+    expect(mocks.cancelNotification).toHaveBeenCalledWith("myapp", 7);
+  });
+
+  it("rejects when notification permission is denied", async () => {
+    const authorization = await registerNotificationAuthorization();
+    mocks.showPermissionRequestModal.mockResolvedValue("denied");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    await expect(
+      pushNotification({
+        text: "hello",
+        deeplink: undefined,
+        scheduledAt: undefined,
+      }),
+    ).rejects.toThrow("Notifications permission denied");
+
+    expect(mocks.scheduleNotification).not.toHaveBeenCalled();
+    expect(authorization.status).toBe("Denied");
+  });
+
+  it("keeps notification permission ask when the prompt is dismissed", async () => {
+    const authorization = await registerNotificationAuthorization();
+    mocks.showPermissionRequestModal.mockResolvedValue("dismissed");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    await expect(
+      pushNotification({
+        text: "hello",
+        deeplink: undefined,
+        scheduledAt: undefined,
+      }),
+    ).rejects.toThrow("User dismissed permission dialog");
+
+    expect(mocks.scheduleNotification).not.toHaveBeenCalled();
+    expect(authorization.status).toBe("NotDetermined");
+  });
+
+  it("reuses the shared blocked-permission path for stored notification denials", async () => {
+    await registerNotificationAuthorization("Denied");
+    const { createNotificationAdapters } =
+      await import("@dotli/ui/host-callbacks/PushNotification");
+    const { pushNotification } = createNotificationAdapters("myapp");
+
+    await expect(
+      pushNotification({
+        text: "hello",
+        deeplink: undefined,
+        scheduledAt: undefined,
+      }),
+    ).rejects.toThrow("Notifications permission denied");
+
+    expect(mocks.showPermissionRequestModal).not.toHaveBeenCalled();
+    expect(mocks.scheduleNotification).not.toHaveBeenCalled();
+    expect(document.body.textContent).toContain(
+      "Notifications access is blocked. Use the permissions menu in the top bar to change this.",
+    );
+  });
+});
diff --git a/packages/ui/tests/nova-removal.test.ts b/packages/ui/tests/nova-removal.test.ts
new file mode 100644
index 00000000..9994dcbb
--- /dev/null
+++ b/packages/ui/tests/nova-removal.test.ts
@@ -0,0 +1,70 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = resolve(import.meta.dirname, "../../..");
+const forbiddenPackages = [
+  "@novasamatech/host-api",
+  "@novasamatech/host-container",
+  "@novasamatech/host-papp",
+  "@novasamatech/scale",
+  "@novasamatech/sdk-statement",
+  "@novasamatech/statement-store",
+  "@novasamatech/storage-adapter",
+  "@novasamatech/substrate-slot-sr25519-wasm",
+] as const;
+
+async function collectFiles(
+  root: string,
+  shouldInclude: (path: string) => boolean,
+): Promise<string[]> {
+  const entries = await readdir(root, { withFileTypes: true });
+  const files = await Promise.all(
+    entries.map(async (entry) => {
+      const path = join(root, entry.name);
+      if (entry.isDirectory()) {
+        if (
+          entry.name === "dist" ||
+          entry.name === "node_modules" ||
+          entry.name === ".turbo" ||
+          entry.name === ".git"
+        ) {
+          return [];
+        }
+        return collectFiles(path, shouldInclude);
+      }
+      return shouldInclude(path) ? [path] : [];
+    }),
+  );
+
+  return files.flat();
+}
+
+describe("Nova host dependency removal", () => {
+  it("keeps runtime manifests, lockfile, and source free of Nova packages", async () => {
+    const manifestFiles = await collectFiles(repoRoot, (path) =>
+      path.endsWith("package.json"),
+    );
+    const sourceFiles = await collectFiles(repoRoot, (path) =>
+      /\/(apps|packages)\/[^/]+\/src\/.*\.[cm]?tsx?$/.test(path),
+    );
+    const files = [
+      ...manifestFiles,
+      join(repoRoot, "bun.lock"),
+      join(repoRoot, "THIRD_PARTY_NOTICES.md"),
+      ...sourceFiles,
+    ];
+
+    const violations: string[] = [];
+    for (const file of files) {
+      const content = await readFile(file, "utf8");
+      for (const packageName of forbiddenPackages) {
+        if (content.includes(packageName)) {
+          violations.push(`${relative(repoRoot, file)} imports ${packageName}`);
+        }
+      }
+    }
+
+    expect(violations).toEqual([]);
+  });
+});
diff --git a/packages/ui/tests/permission-modal.test.ts b/packages/ui/tests/permission-modal.test.ts
new file mode 100644
index 00000000..bb3d657a
--- /dev/null
+++ b/packages/ui/tests/permission-modal.test.ts
@@ -0,0 +1,32 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { showPermissionRequestModal } from "@dotli/ui/permission-modal";
+
+afterEach(() => {
+  document.body.replaceChildren();
+});
+
+describe("permission request modal", () => {
+  it("resolves granted when the user allows", async () => {
+    const decision = showPermissionRequestModal("myapp", "Camera");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(decision).resolves.toBe("granted");
+  });
+
+  it("resolves denied when the user denies", async () => {
+    const decision = showPermissionRequestModal("myapp", "Camera");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-cancel")?.click();
+
+    await expect(decision).resolves.toBe("denied");
+  });
+
+  it("resolves dismissed when the backdrop is clicked", async () => {
+    const decision = showPermissionRequestModal("myapp", "Camera");
+
+    document.querySelector<HTMLDivElement>(".signing-modal-backdrop")?.click();
+
+    await expect(decision).resolves.toBe("dismissed");
+  });
+});
diff --git a/packages/ui/tests/permissions.test.ts b/packages/ui/tests/permissions.test.ts
index 5c454c06..78747209 100644
--- a/packages/ui/tests/permissions.test.ts
+++ b/packages/ui/tests/permissions.test.ts
@@ -1,106 +1,169 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   ALL_PERMISSIONS,
   AUTO_GRANT_DEVICE_PERMISSIONS,
   DEVICE_PERMISSION_POLICY,
   buildAllowAttribute,
   getGrantedDevicePermissions,
+  getPermissionStatuses,
   getPermissionStatus,
   hasAnyGrant,
   isDevicePermission,
   isEnforceableDevicePermission,
+  registerPermissionAuthorizationProvider,
   resetPermission,
   setPermissionStatus,
 } from "@dotli/ui/permissions";
+import type {
+  PermissionAuthorizationRequest,
+  PermissionAuthorizationStatus,
+} from "@parity/truapi-host";
+
+type Store = Map<string, PermissionAuthorizationStatus>;
+
+let unregisterMyapp: (() => void) | null = null;
+let myappStore: Store;
+let myappBatchReads = 0;
 
 beforeEach(() => {
-  localStorage.clear();
+  myappStore = new Map();
+  myappBatchReads = 0;
+  unregisterMyapp = registerTestProvider("myapp", myappStore);
 });
 
-describe("getPermissionStatus / setPermissionStatus", () => {
-  it("returns 'ask' by default", () => {
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("ask");
-  });
+afterEach(() => {
+  unregisterMyapp?.();
+  unregisterMyapp = null;
+});
 
-  it("round-trips a granted status", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("granted");
+function registerTestProvider(label: string, store: Store): () => void {
+  return registerPermissionAuthorizationProvider(label, {
+    async getPermissionAuthorizationStatuses(requests) {
+      if (label === "myapp") {
+        myappBatchReads += 1;
+      }
+      return requests.map(
+        (request) => store.get(requestKey(request)) ?? "NotDetermined",
+      );
+    },
+    async setPermissionAuthorizationStatus(request, status) {
+      const key = requestKey(request);
+      if (status === "NotDetermined") {
+        store.delete(key);
+      } else {
+        store.set(key, status);
+      }
+    },
   });
+}
+
+function requestKey(request: PermissionAuthorizationRequest): string {
+  switch (request.tag) {
+    case "Device":
+      return `Device:${request.value}`;
+    case "Remote":
+      return `Remote:${request.value.permission.tag}`;
+    case "IdentityDisclosure":
+      return "IdentityDisclosure";
+  }
+}
 
-  it("round-trips a denied status", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "denied");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("denied");
+describe("getPermissionStatus / setPermissionStatus", () => {
+  it("returns 'ask' by default", async () => {
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("ask");
+    expect(await getPermissionStatus("myapp", "IdentityDisclosure")).toBe(
+      "ask",
+    );
   });
 
-  it("persists across a reload (raw localStorage shape)", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    setPermissionStatus("myapp", "Camera", "denied");
+  it("round-trips a granted status", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("granted");
+  });
 
-    // What a reloaded tab would observe directly in localStorage.
-    const raw = localStorage.getItem("dotli:permissions:myapp");
-    expect(raw).not.toBeNull();
-    expect(JSON.parse(raw as string)).toEqual({
-      ChainSubmit: "granted",
-      Camera: "denied",
-    });
+  it("round-trips a denied status", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "denied");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("denied");
+  });
 
-    // And the public API surfaces those values without any priming.
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("denied");
+  it("uses the core-backed authorization store", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "Camera", "denied");
+    await setPermissionStatus("myapp", "IdentityDisclosure", "granted");
+
+    expect(myappStore).toEqual(
+      new Map([
+        ["Remote:ChainSubmit", "Authorized"],
+        ["Device:Camera", "Denied"],
+        ["IdentityDisclosure", "Authorized"],
+      ]),
+    );
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("denied");
+    expect(await getPermissionStatus("myapp", "IdentityDisclosure")).toBe(
+      "granted",
+    );
   });
 
-  it("isolates grants per product label", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(getPermissionStatus("otherapp", "Camera")).toBe("ask");
+  it("reads multiple statuses in one provider call", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "Camera", "denied");
+    const callsBeforeRead = myappBatchReads;
+
+    await expect(
+      getPermissionStatuses("myapp", ["ChainSubmit", "Camera", "Microphone"]),
+    ).resolves.toEqual(["granted", "denied", "ask"]);
+    expect(myappBatchReads - callsBeforeRead).toBe(1);
   });
 
-  it("falls back to 'ask' when localStorage holds malformed JSON", () => {
-    localStorage.setItem("dotli:permissions:myapp", "{ not json");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
+  it("isolates grants per product label", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    expect(await getPermissionStatus("otherapp", "Camera")).toBe("ask");
   });
 });
 
 describe("resetPermission", () => {
-  it("removes one entry without affecting others on the same label", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
+  it("removes one entry without affecting others on the same label", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
 
-    resetPermission("myapp", "Camera");
+    await resetPermission("myapp", "Camera");
 
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
-    expect(getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
+    expect(await getPermissionStatus("myapp", "ChainSubmit")).toBe("granted");
   });
 
-  it("is a no-op for unknown entries", () => {
-    resetPermission("myapp", "Camera");
-    expect(getPermissionStatus("myapp", "Camera")).toBe("ask");
+  it("is a no-op for unknown entries", async () => {
+    await resetPermission("myapp", "Camera");
+    expect(await getPermissionStatus("myapp", "Camera")).toBe("ask");
   });
 });
 
 describe("hasAnyGrant", () => {
-  it("returns false for a fresh label", () => {
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false for a fresh label", async () => {
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 
-  it("returns true after any grant", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    expect(hasAnyGrant("myapp")).toBe(true);
+  it("returns true after any grant", async () => {
+    await setPermissionStatus("myapp", "IdentityDisclosure", "granted");
+    expect(await hasAnyGrant("myapp")).toBe(true);
   });
 
-  it("returns false when only denials exist", () => {
-    setPermissionStatus("myapp", "Camera", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "denied");
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false when only denials exist", async () => {
+    await setPermissionStatus("myapp", "Camera", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "denied");
+    await setPermissionStatus("myapp", "IdentityDisclosure", "denied");
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 
-  it("returns false again after the only grant is reset", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    resetPermission("myapp", "Camera");
-    expect(hasAnyGrant("myapp")).toBe(false);
+  it("returns false again after the only grant is reset", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await resetPermission("myapp", "Camera");
+    expect(await hasAnyGrant("myapp")).toBe(false);
   });
 });
 
@@ -119,6 +182,7 @@ describe("isDevicePermission", () => {
     expect(isDevicePermission("ChainSubmit")).toBe(false);
     expect(isDevicePermission("PreimageSubmit")).toBe(false);
     expect(isDevicePermission("StatementSubmit")).toBe(false);
+    expect(isDevicePermission("IdentityDisclosure")).toBe(false);
   });
 
   it("rejects device permissions absent from the policy map", () => {
@@ -135,46 +199,47 @@ describe("isEnforceableDevicePermission", () => {
   });
 
   it("accepts gateable device permissions", () => {
+    expect(isEnforceableDevicePermission("Notifications")).toBe(true);
     expect(isEnforceableDevicePermission("Camera")).toBe(true);
     expect(isEnforceableDevicePermission("Microphone")).toBe(true);
-    expect(isEnforceableDevicePermission("Notifications")).toBe(true);
   });
 });
 
 describe("getGrantedDevicePermissions", () => {
-  it("returns only granted device permissions, ignoring submit-style grants", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "Microphone", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
+  it("returns only granted device permissions, ignoring core-only grants", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "Microphone", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "IdentityDisclosure", "granted");
 
-    expect(getGrantedDevicePermissions("myapp")).toEqual(["Camera"]);
+    expect(await getGrantedDevicePermissions("myapp")).toEqual(["Camera"]);
   });
 
-  it("returns an empty array when only submit-style grants exist", () => {
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    setPermissionStatus("myapp", "PreimageSubmit", "granted");
-    expect(getGrantedDevicePermissions("myapp")).toEqual([]);
+  it("returns an empty array when only submit-style grants exist", async () => {
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    await setPermissionStatus("myapp", "PreimageSubmit", "granted");
+    expect(await getGrantedDevicePermissions("myapp")).toEqual([]);
   });
 });
 
 describe("buildAllowAttribute", () => {
-  it("always includes clipboard-write", () => {
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
+  it("always includes clipboard-write", async () => {
+    expect(await buildAllowAttribute("myapp")).toBe("clipboard-write");
   });
 
-  it("appends Permissions Policy directives for granted device permissions", () => {
-    setPermissionStatus("myapp", "Camera", "granted");
-    setPermissionStatus("myapp", "Microphone", "granted");
+  it("appends Permissions Policy directives for granted device permissions", async () => {
+    await setPermissionStatus("myapp", "Camera", "granted");
+    await setPermissionStatus("myapp", "Microphone", "granted");
 
     // Order follows JSON insertion order, so assert on the directive set.
-    const directives = buildAllowAttribute("myapp").split("; ").sort();
+    const directives = (await buildAllowAttribute("myapp")).split("; ").sort();
     expect(directives).toEqual(["camera", "clipboard-write", "microphone"]);
   });
 
-  it("excludes denied device permissions and submit-style grants", () => {
-    setPermissionStatus("myapp", "Camera", "denied");
-    setPermissionStatus("myapp", "ChainSubmit", "granted");
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
+  it("excludes denied device permissions and submit-style grants", async () => {
+    await setPermissionStatus("myapp", "Camera", "denied");
+    await setPermissionStatus("myapp", "ChainSubmit", "granted");
+    expect(await buildAllowAttribute("myapp")).toBe("clipboard-write");
   });
 });
 
@@ -188,34 +253,12 @@ describe("ALL_PERMISSIONS (data invariants)", () => {
   it("uses the canonical v0.7 wire tags for submit gates", () => {
     const names = ALL_PERMISSIONS.map((p) => p.name);
     expect(names).toContain("ChainSubmit");
+    expect(names).toContain("IdentityDisclosure");
     expect(names).toContain("PreimageSubmit");
     expect(names).toContain("StatementSubmit");
+    expect(names).toContain("Notifications");
     expect(names).not.toContain("TransactionSubmit");
   });
-
-  it("exposes the GetUserId gate with its display label", () => {
-    expect(ALL_PERMISSIONS).toContainEqual({
-      name: "GetUserId",
-      label: "Reveal Username",
-    });
-  });
-});
-
-describe("GetUserId permission (RFC-0015 username disclosure gate)", () => {
-  it("defaults to 'ask' and round-trips granted/denied", () => {
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("ask");
-    setPermissionStatus("myapp", "GetUserId", "granted");
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("granted");
-    setPermissionStatus("myapp", "GetUserId", "denied");
-    expect(getPermissionStatus("myapp", "GetUserId")).toBe("denied");
-  });
-
-  it("is not a device permission and never alters the iframe allow attribute", () => {
-    expect(isDevicePermission("GetUserId")).toBe(false);
-    setPermissionStatus("myapp", "GetUserId", "granted");
-    expect(getGrantedDevicePermissions("myapp")).toEqual([]);
-    expect(buildAllowAttribute("myapp")).toBe("clipboard-write");
-  });
 });
 
 describe("DEVICE_PERMISSION_POLICY (sanity)", () => {
diff --git a/packages/ui/tests/preimage.test.ts b/packages/ui/tests/preimage.test.ts
new file mode 100644
index 00000000..73c04dcd
--- /dev/null
+++ b/packages/ui/tests/preimage.test.ts
@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createPreimageAdapters } from "@dotli/ui/host-callbacks/Preimage";
+
+const mocks = vi.hoisted(() => ({
+  fetchFromIpfs: vi.fn(async () => ({ data: new Uint8Array() })),
+  getBackend: vi.fn(() => "rpc-gateway"),
+}));
+
+vi.mock("@dotli/content/ipfs", () => ({
+  fetchFromIpfs: mocks.fetchFromIpfs,
+}));
+
+vi.mock("@dotli/config/mode", () => ({
+  getBackend: mocks.getBackend,
+}));
+
+describe("preimage host callbacks", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.fetchFromIpfs.mockResolvedValue({ data: new Uint8Array() });
+    mocks.getBackend.mockReturnValue("rpc-gateway");
+  });
+
+  it("emits a miss immediately for an uncached lookup", async () => {
+    const { lookupPreimage } = createPreimageAdapters("myapp");
+    const missingKey = new Uint8Array(32);
+
+    const iterator = lookupPreimage(missingKey)[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    await iterator.return?.();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBeUndefined();
+  });
+
+  it("only exposes the lookup callback (submission is core-owned)", () => {
+    const adapters = createPreimageAdapters("myapp");
+    expect(typeof adapters.lookupPreimage).toBe("function");
+    expect("submitPreimage" in adapters).toBe(false);
+  });
+
+  it("emits lookup backend failures as stream errors", async () => {
+    vi.useFakeTimers();
+    try {
+      const { lookupPreimage } = createPreimageAdapters("myapp");
+      const missingKey = new Uint8Array(32);
+      mocks.fetchFromIpfs.mockRejectedValueOnce(
+        new Error("gateway unavailable"),
+      );
+
+      const iterator = lookupPreimage(missingKey)[Symbol.asyncIterator]();
+      const first = await iterator.next();
+      const secondPromise = iterator.next();
+      await vi.advanceTimersByTimeAsync(1000);
+      const second = await secondPromise;
+      const done = await iterator.next();
+
+      expect(first.done).toBe(false);
+      expect(first.value.isOk()).toBe(true);
+      expect(first.value._unsafeUnwrap()).toBeUndefined();
+      expect(second.done).toBe(false);
+      expect(second.value.isErr()).toBe(true);
+      expect(second.value._unsafeUnwrapErr().reason).toContain(
+        "preimage lookup via rpc-gateway failed: gateway unavailable",
+      );
+      await vi.advanceTimersByTimeAsync(10_000);
+      expect(mocks.fetchFromIpfs).toHaveBeenCalledTimes(1);
+      expect(done.done).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
diff --git a/packages/ui/tests/runtime-config.test.ts b/packages/ui/tests/runtime-config.test.ts
new file mode 100644
index 00000000..80ecea1a
--- /dev/null
+++ b/packages/ui/tests/runtime-config.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { getActiveServicesConfig } from "@dotli/config/network";
+import {
+  createTruapiRuntimeConfig,
+  labelToProductId,
+} from "@dotli/ui/runtime-config";
+
+describe("labelToProductId", () => {
+  it("maps dotli labels to .dot product ids", () => {
+    expect(labelToProductId("acme")).toBe("acme.dot");
+  });
+
+  it("keeps localhost labels stable", () => {
+    expect(labelToProductId("localhost:5174")).toBe("localhost:5174");
+  });
+});
+
+describe("createTruapiRuntimeConfig", () => {
+  it("accepts an explicit product id for local previews", () => {
+    expect(
+      createTruapiRuntimeConfig(
+        "localhost:3000",
+        {
+          origin: "http://localhost:5173",
+        } as Location,
+        "truapi-playground.dot",
+      ).productId,
+    ).toBe("truapi-playground.dot");
+  });
+
+  it("passes the full host runtime contract to the WASM core", () => {
+    expect(
+      createTruapiRuntimeConfig("acme", {
+        hostname: "host.dot.li",
+        origin: "https://host.dot.li",
+      } as Location),
+    ).toEqual({
+      productId: "acme.dot",
+      host: {
+        name: "Polkadot Web",
+        icon: undefined,
+        version: undefined,
+      },
+      platform: {
+        type: expect.any(String),
+        version: undefined,
+      },
+      people: {
+        genesisHash: getActiveServicesConfig().people.genesis,
+      },
+      bulletin: {
+        genesisHash: getActiveServicesConfig().bulletin.genesis,
+      },
+      pairing: {
+        deeplinkScheme: "polkadotapp",
+      },
+    });
+  });
+});
diff --git a/packages/ui/tests/session-store.test.ts b/packages/ui/tests/session-store.test.ts
new file mode 100644
index 00000000..b14d97eb
--- /dev/null
+++ b/packages/ui/tests/session-store.test.ts
@@ -0,0 +1,314 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { SHARED_CORE_SESSION_KEY } from "@dotli/protocol/auth-storage";
+import { SITE_ID } from "@dotli/config/config";
+import {
+  createSessionStoreAdapters,
+  emitPersistedSessionUiState,
+  onStoredSessionChanged,
+} from "@dotli/ui/host-callbacks/SessionStore";
+import { createAuthStateChanged } from "@dotli/ui/host-callbacks/AuthState";
+import type { CoreStorageKey } from "@parity/truapi-host";
+
+const sharedAuth = vi.hoisted(() => ({
+  storage: new Map<string, string>(),
+  listeners: new Set<
+    (change: { siteId: string; key: string; value: string | null }) => void
+  >(),
+}));
+
+vi.mock("@dotli/protocol/client", () => ({
+  readSharedAuthStorage: async (siteId: string, key: string) => {
+    return sharedAuth.storage.get(`${siteId}:${key}`) ?? null;
+  },
+  writeSharedAuthStorage: async (
+    siteId: string,
+    key: string,
+    value: string,
+  ) => {
+    sharedAuth.storage.set(`${siteId}:${key}`, value);
+  },
+  clearSharedAuthStorage: async (siteId: string, key: string) => {
+    sharedAuth.storage.delete(`${siteId}:${key}`);
+  },
+  subscribeSharedAuthStorage: (
+    listener: (change: {
+      siteId: string;
+      key: string;
+      value: string | null;
+    }) => void,
+  ) => {
+    sharedAuth.listeners.add(listener);
+    return () => {
+      sharedAuth.listeners.delete(listener);
+    };
+  },
+}));
+
+const STORAGE_KEY = `${SITE_ID}:${SHARED_CORE_SESSION_KEY}`;
+const UI_STATE_CACHE_KEY = `${SITE_ID}:${SHARED_CORE_SESSION_KEY}:ui-state`;
+const AUTH_SESSION_KEY = { tag: "AuthSession" as const };
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function connectedSessionUiInfo() {
+  return {
+    publicKey: new Uint8Array(Array.from({ length: 32 }, (_, i) => i)),
+    identityAccountId: new Uint8Array(
+      Array.from({ length: 32 }, (_, i) => 0xa0 + i),
+    ),
+    liteUsername: "pgherveou.04",
+  };
+}
+
+const CONNECTED_DETAIL = {
+  connected: true,
+  publicKey:
+    "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+  identityAccountId:
+    "0xa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebf",
+  liteUsername: "pgherveou.04",
+  primaryUsername: "pgherveou.04",
+};
+
+describe("session-store host callbacks", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    sharedAuth.storage.clear();
+    sharedAuth.listeners.clear();
+    vi.restoreAllMocks();
+  });
+
+  it("round-trips the host core session blob", async () => {
+    const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
+      createSessionStoreAdapters();
+
+    expect(await readCoreStorage(AUTH_SESSION_KEY)).toBeUndefined();
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    expect(sharedAuth.storage.get(STORAGE_KEY)).toBe("0x010203");
+    expect(localStorage.length).toBe(0);
+    expect(Array.from((await readCoreStorage(AUTH_SESSION_KEY)) ?? [])).toEqual(
+      [1, 2, 3],
+    );
+
+    await clearCoreStorage(AUTH_SESSION_KEY);
+    expect(sharedAuth.storage.get(STORAGE_KEY)).toBeUndefined();
+    expect(await readCoreStorage(AUTH_SESSION_KEY)).toBeUndefined();
+  });
+
+  it("round-trips permission authorization slots from typed core keys", async () => {
+    const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
+      createSessionStoreAdapters();
+    const key = {
+      tag: "PermissionAuthorization",
+      value: {
+        productId: "My App",
+        request: { tag: "Device", value: "OpenUrl" },
+      },
+    } satisfies CoreStorageKey;
+
+    await writeCoreStorage(key, new Uint8Array([4]));
+
+    expect(localStorage.length).toBe(1);
+    const storageKey = localStorage.key(0);
+    expect(storageKey).toMatch(/^dotli:core:permission:[0-9a-f]+$/);
+    expect(storageKey).not.toContain("open-url");
+    expect(localStorage.getItem(storageKey ?? "")).toBe("0x04");
+    expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([4]);
+
+    await clearCoreStorage(key);
+    expect(await readCoreStorage(key)).toBeUndefined();
+  });
+
+  it("keeps remote permission authorization keys opaque", async () => {
+    const { readCoreStorage, writeCoreStorage } = createSessionStoreAdapters();
+    const key = {
+      tag: "PermissionAuthorization",
+      value: {
+        productId: "myapp",
+        request: {
+          tag: "Remote",
+          value: {
+            permission: {
+              tag: "Remote",
+              value: { domains: ["B.example", "a.example", "b.example"] },
+            },
+          },
+        },
+      },
+    } satisfies CoreStorageKey;
+
+    await writeCoreStorage(key, new Uint8Array([7]));
+
+    const storageKey = localStorage.key(0);
+    expect(storageKey).toMatch(/^dotli:core:permission:[0-9a-f]+$/);
+    expect(storageKey).not.toContain("example");
+    expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([7]);
+    expect(localStorage.length).toBe(1);
+  });
+
+  it("encrypts persisted allowance key slots", async () => {
+    const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
+      createSessionStoreAdapters();
+    const key = {
+      tag: "AllowanceKeys",
+      value: { sessionId: "session-1" },
+    } satisfies CoreStorageKey;
+
+    await writeCoreStorage(key, new Uint8Array([1, 2, 3, 4]));
+
+    const storageKey = "dotli:core:allowance-keys:session-1";
+    expect(localStorage.getItem(storageKey)).not.toBe("0x01020304");
+    expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([
+      1, 2, 3, 4,
+    ]);
+
+    await clearCoreStorage(key);
+    expect(await readCoreStorage(key)).toBeUndefined();
+  });
+
+  it("emits the typed session identity details from a connected auth state", () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+
+    expect(events).toEqual([{ tag: "Connected", session: CONNECTED_DETAIL }]);
+  });
+
+  it("dispatches the pairing presentation with its host context", () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web", {
+      dotSuffix: false,
+      hostGlobal: true,
+    });
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    authStateChanged?.({
+      tag: "Pairing",
+      value: { deeplink: "polkadotapp://pair?handshake=test" },
+    });
+
+    expect(events).toEqual([
+      {
+        tag: "Pairing",
+        deeplink: "polkadotapp://pair?handshake=test",
+        label: "Polkadot Web",
+        dotSuffix: false,
+        hostGlobal: true,
+      },
+    ]);
+  });
+
+  it("caches the connected UI state and clears it with the session", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const { clearCoreStorage } = createSessionStoreAdapters();
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    expect(
+      JSON.parse(sharedAuth.storage.get(UI_STATE_CACHE_KEY) ?? ""),
+    ).toEqual(CONNECTED_DETAIL);
+
+    await clearCoreStorage(AUTH_SESSION_KEY);
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeUndefined();
+  });
+
+  it("clears the cached UI state on a disconnected auth state", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeDefined();
+
+    authStateChanged?.({ tag: "Disconnected" });
+    await flushMicrotasks();
+    expect(sharedAuth.storage.get(UI_STATE_CACHE_KEY)).toBeUndefined();
+  });
+
+  it("rehydrates the cached session UI state", async () => {
+    const authStateChanged = createAuthStateChanged("Polkadot Web");
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    // Nothing persisted: nothing emitted, even with a stale cache entry.
+    sharedAuth.storage.set(
+      UI_STATE_CACHE_KEY,
+      JSON.stringify(CONNECTED_DETAIL),
+    );
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+    expect(events).toEqual([]);
+    sharedAuth.storage.delete(UI_STATE_CACHE_KEY);
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    authStateChanged?.({
+      tag: "Connected",
+      value: connectedSessionUiInfo(),
+    });
+    await flushMicrotasks();
+    events.length = 0;
+
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+    expect(events).toEqual([{ tag: "Connected", session: CONNECTED_DETAIL }]);
+  });
+
+  it("rehydrates a bare connected state when no cache exists", async () => {
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const events: unknown[] = [];
+    window.addEventListener("dotli:truapi-auth-state", (event) => {
+      events.push((event as CustomEvent).detail);
+    });
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([1, 2, 3]));
+    emitPersistedSessionUiState();
+    await flushMicrotasks();
+
+    expect(events).toEqual([
+      { tag: "Connected", session: { connected: true } },
+    ]);
+  });
+
+  it("notifies local and matching storage changes", async () => {
+    const { writeCoreStorage } = createSessionStoreAdapters();
+    const listener = vi.fn();
+    const unsubscribe = onStoredSessionChanged(listener);
+
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([9]));
+    expect(listener).toHaveBeenCalledTimes(1);
+
+    for (const sharedListener of sharedAuth.listeners) {
+      sharedListener({
+        siteId: SITE_ID,
+        key: SHARED_CORE_SESSION_KEY,
+        value: "0x09",
+      });
+    }
+    expect(listener).toHaveBeenCalledTimes(2);
+
+    unsubscribe();
+    await writeCoreStorage(AUTH_SESSION_KEY, new Uint8Array([8]));
+    expect(listener).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/packages/ui/tests/theme.test.ts b/packages/ui/tests/theme.test.ts
new file mode 100644
index 00000000..b3c99338
--- /dev/null
+++ b/packages/ui/tests/theme.test.ts
@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { createThemeSubscribe } from "@dotli/ui/host-callbacks/Theme";
+
+describe("theme host callbacks", () => {
+  beforeEach(() => {
+    document.documentElement.removeAttribute("data-theme");
+  });
+
+  it("emits the current theme immediately", async () => {
+    document.documentElement.setAttribute("data-theme", "light");
+    const subscribeTheme = createThemeSubscribe();
+
+    const iterator = subscribeTheme()[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    await iterator.return?.();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBe("Light");
+  });
+
+  it("emits theme changes until unsubscribed", async () => {
+    document.documentElement.setAttribute("data-theme", "dark");
+    const subscribeTheme = createThemeSubscribe();
+
+    const iterator = subscribeTheme()[Symbol.asyncIterator]();
+    const first = await iterator.next();
+    const next = iterator.next();
+
+    document.documentElement.setAttribute("data-theme", "light");
+    window.dispatchEvent(new Event("dotli:theme-changed"));
+    const changed = await next;
+
+    await iterator.return?.();
+    const afterReturn = await iterator.next();
+
+    expect(first.done).toBe(false);
+    expect(first.value.isOk()).toBe(true);
+    expect(first.value._unsafeUnwrap()).toBe("Dark");
+    expect(changed.done).toBe(false);
+    expect(changed.value.isOk()).toBe(true);
+    expect(changed.value._unsafeUnwrap()).toBe("Light");
+    expect(afterReturn.done).toBe(true);
+  });
+});
diff --git a/packages/ui/tests/topbar.test.ts b/packages/ui/tests/topbar.test.ts
new file mode 100644
index 00000000..56bf252f
--- /dev/null
+++ b/packages/ui/tests/topbar.test.ts
@@ -0,0 +1,439 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const sharedAuth = vi.hoisted(() => ({
+  storage: new Map<string, string>(),
+  listeners: new Set<
+    (change: { siteId: string; key: string; value: string | null }) => void
+  >(),
+}));
+
+vi.mock("@dotli/protocol/client", () => ({
+  readSharedAuthStorage: async (siteId: string, key: string) => {
+    return sharedAuth.storage.get(`${siteId}:${key}`) ?? null;
+  },
+  writeSharedAuthStorage: async (
+    siteId: string,
+    key: string,
+    value: string,
+  ) => {
+    sharedAuth.storage.set(`${siteId}:${key}`, value);
+  },
+  clearSharedAuthStorage: async (siteId: string, key: string) => {
+    sharedAuth.storage.delete(`${siteId}:${key}`);
+  },
+  subscribeSharedAuthStorage: (
+    listener: (change: {
+      siteId: string;
+      key: string;
+      value: string | null;
+    }) => void,
+  ) => {
+    sharedAuth.listeners.add(listener);
+    return () => {
+      sharedAuth.listeners.delete(listener);
+    };
+  },
+}));
+
+async function flushMicrotasks(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function installTopbarDom(): void {
+  document.body.innerHTML = `
+    <a id="topbar-home"></a>
+    <button id="auth-button" disabled></button>
+    <div id="auth-modal-backdrop">
+      <div id="auth-modal-title"></div>
+      <div id="auth-modal-qr"></div>
+      <div id="auth-modal-reason"></div>
+      <div id="auth-modal-hint"></div>
+      <button id="auth-modal-close"></button>
+    </div>
+    <div id="user-popover">
+      <span id="user-popover-username"></span>
+      <button id="user-popover-disconnect"></button>
+    </div>
+    <button id="theme-toggle"></button>
+    <span id="theme-icon-sun"></span>
+    <span id="theme-icon-moon"></span>
+    <button id="mode-button"></button>
+    <div id="mode-popover"><div id="mode-popover-content"></div></div>
+    <div id="mode-popover-backdrop"></div>
+    <button id="permissions-button"></button>
+    <div id="permissions-popover"><div id="permissions-popover-list"></div></div>
+    <div id="permissions-popover-backdrop"></div>
+  `;
+}
+
+beforeEach(() => {
+  vi.resetModules();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+  localStorage.clear();
+  sharedAuth.storage.clear();
+  sharedAuth.listeners.clear();
+  document.body.innerHTML = "";
+});
+
+describe("topbar disconnect", () => {
+  it("emits the Rust-core disconnect request", async () => {
+    const { requestTruapiDisconnect } = await import("@dotli/ui/topbar");
+    let requests = 0;
+    window.addEventListener(
+      "dotli:truapi-disconnect-request",
+      () => {
+        requests += 1;
+      },
+      { once: true },
+    );
+
+    requestTruapiDisconnect();
+
+    expect(requests).toBe(1);
+  });
+
+  it("routes the disconnect button through the Rust-core event path", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    let requests = 0;
+    window.addEventListener("dotli:truapi-disconnect-request", () => {
+      requests += 1;
+    });
+
+    initTopBar();
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "Connected", session: { connected: true } },
+      }),
+    );
+
+    document.getElementById("auth-button")?.click();
+    expect(
+      document.getElementById("user-popover")?.classList.contains("open"),
+    ).toBe(true);
+
+    document.getElementById("user-popover-disconnect")?.click();
+
+    expect(requests).toBe(1);
+    expect(
+      document.getElementById("user-popover")?.classList.contains("open"),
+    ).toBe(false);
+  });
+
+  it("renders the connected username from the Rust-core auth state", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Connected",
+          session: {
+            connected: true,
+            publicKey:
+              "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+            liteUsername: "pgherveou.04",
+            primaryUsername: "pgherveou.04",
+          },
+        },
+      }),
+    );
+
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+    expect(document.getElementById("user-popover-username")?.textContent).toBe(
+      "pgherveou.04",
+    );
+  });
+});
+
+describe("topbar login cancellation", () => {
+  it("opens host-global login from the topbar even when a product is loaded", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    const loginRequests: unknown[] = [];
+    window.addEventListener("dotli:truapi-login-request", (event) => {
+      loginRequests.push((event as CustomEvent).detail);
+    });
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:product-loaded", {
+        detail: { label: "localhost:3000" },
+      }),
+    );
+    document.getElementById("auth-button")?.click();
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+    expect(loginRequests).toEqual([{ reason: undefined }]);
+  });
+
+  it("emits a login request on the first auth button click", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    const loginRequests: unknown[] = [];
+    window.addEventListener("dotli:truapi-login-request", (event) => {
+      loginRequests.push((event as CustomEvent).detail);
+    });
+    initTopBar();
+
+    (
+      window as typeof window & { __dotliTruapiBridgeReady?: boolean }
+    ).__dotliTruapiBridgeReady = true;
+    expect(
+      document.getElementById("auth-button")?.hasAttribute("disabled"),
+    ).toBe(false);
+    document.getElementById("auth-button")?.click();
+
+    expect(loginRequests).toEqual([{ reason: undefined }]);
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+  });
+
+  it("keeps the pairing modal open through an unrelated disconnected state", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "Polkadot Web",
+          dotSuffix: false,
+          hostGlobal: true,
+        },
+      }),
+    );
+    // A bare disconnected state (e.g. a product core clearing its session)
+    // must only update the badge, never tear down the pairing modal.
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "Disconnected" },
+      }),
+    );
+
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+  });
+
+  it("keeps landing pairing presentation host-global", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "Polkadot Web",
+          dotSuffix: false,
+          hostGlobal: true,
+        },
+      }),
+    );
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+  });
+
+  it("cancels the in-flight login when the user closes the pairing modal", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    let cancels = 0;
+    window.addEventListener("dotli:truapi-cancel-login", () => {
+      cancels += 1;
+    });
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "localhost:3000",
+        },
+      }),
+    );
+    document.getElementById("auth-modal-close")?.click();
+
+    expect(cancels).toBe(1);
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(false);
+    expect(document.getElementById("auth-modal-qr")?.children).toHaveLength(0);
+  });
+
+  it("closes the pairing modal when the session connects", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    let cancels = 0;
+    window.addEventListener("dotli:truapi-cancel-login", () => {
+      cancels += 1;
+    });
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Pairing",
+          deeplink: "polkadotapp://pair?handshake=test",
+          label: "localhost:3000",
+        },
+      }),
+    );
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "Connected",
+          session: { connected: true, liteUsername: "pgherveou.04" },
+        },
+      }),
+    );
+
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(false);
+    expect(cancels).toBe(0);
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+  });
+
+  it("keeps the retry view for login failures", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:product-loaded", {
+        detail: { label: "localhost:3000" },
+      }),
+    );
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: { tag: "LoginFailed", reason: "Host failure" },
+      }),
+    );
+
+    expect(document.getElementById("auth-modal-title")?.textContent).toBe(
+      "Login with Polkadot Mobile",
+    );
+    expect(
+      document
+        .getElementById("auth-modal-backdrop")
+        ?.classList.contains("open"),
+    ).toBe(true);
+    expect(document.getElementById("auth-modal-qr")?.textContent).toContain(
+      "Retry",
+    );
+  });
+
+  it("explains statement-store slot exhaustion in the login failure view", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "LoginFailed",
+          reason: "no free statement-store slot for device registration",
+        },
+      }),
+    );
+
+    const modalText = document.getElementById("auth-modal-qr")?.textContent;
+    expect(modalText).toContain("No Statement Store slots left");
+    expect(modalText).toContain(
+      "no free statement-store slot for device registration",
+    );
+    expect(modalText).toContain("Retry");
+  });
+
+  it("explains rejected statement-store transactions from the raw reason", async () => {
+    installTopbarDom();
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    window.dispatchEvent(
+      new CustomEvent("dotli:truapi-auth-state", {
+        detail: {
+          tag: "LoginFailed",
+          reason: "submit RPC error: Invalid Transaction",
+        },
+      }),
+    );
+
+    const modalText = document.getElementById("auth-modal-qr")?.textContent;
+    expect(modalText).toContain("Statement Store transaction rejected");
+    expect(modalText).toContain("submit RPC error: Invalid Transaction");
+    expect(modalText).toContain("Retry");
+  });
+});
+
+describe("topbar boot rehydration", () => {
+  it("renders the persisted session badge on idle after init", async () => {
+    installTopbarDom();
+    vi.stubGlobal("requestIdleCallback", (callback: () => void): number => {
+      callback();
+      return 0;
+    });
+
+    const { SHARED_CORE_SESSION_KEY } =
+      await import("@dotli/protocol/auth-storage");
+    const { SITE_ID } = await import("@dotli/config/config");
+    // Opaque session blob plus the JSON UI-state cache the core-driven
+    // authStateChanged callback persists alongside it in shared auth storage.
+    sharedAuth.storage.set(`${SITE_ID}:${SHARED_CORE_SESSION_KEY}`, "0x0102");
+    sharedAuth.storage.set(
+      `${SITE_ID}:${SHARED_CORE_SESSION_KEY}:ui-state`,
+      JSON.stringify({
+        connected: true,
+        publicKey:
+          "0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+        liteUsername: "pgherveou.04",
+        primaryUsername: "pgherveou.04",
+      }),
+    );
+
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+    await flushMicrotasks();
+
+    expect(document.getElementById("auth-button")?.textContent).toBe("PG");
+    expect(document.getElementById("user-popover-username")?.textContent).toBe(
+      "pgherveou.04",
+    );
+  });
+
+  it("stays logged out when no session is persisted", async () => {
+    installTopbarDom();
+    vi.stubGlobal("requestIdleCallback", (callback: () => void): number => {
+      callback();
+      return 0;
+    });
+
+    const { initTopBar } = await import("@dotli/ui/topbar");
+    initTopBar();
+
+    expect(
+      document.getElementById("auth-button")?.querySelector(".user-badge"),
+    ).toBeNull();
+  });
+});
diff --git a/packages/ui/tests/user-confirmation.test.ts b/packages/ui/tests/user-confirmation.test.ts
new file mode 100644
index 00000000..bd9dc13d
--- /dev/null
+++ b/packages/ui/tests/user-confirmation.test.ts
@@ -0,0 +1,252 @@
+import type { UserConfirmation } from "@parity/truapi-host";
+import { afterEach, describe, expect, it } from "vitest";
+import { createUserConfirmationAdapters } from "@dotli/ui/host-callbacks/UserConfirmation";
+
+type UserConfirmationReview = Parameters<
+  Required<UserConfirmation>["confirmUserAction"]
+>[0];
+
+afterEach(() => {
+  document.body.replaceChildren();
+});
+
+function modalFields(): Record<string, string> {
+  return Object.fromEntries(
+    Array.from(document.querySelectorAll(".signing-field")).map((field) => {
+      const label = field.querySelector(".signing-field-label")?.textContent;
+      const value = field.querySelector(".signing-field-value")?.textContent;
+      return [label ?? "", value ?? ""];
+    }),
+  );
+}
+
+describe("user confirmation modal", () => {
+  it("renders legacy payload signing as structured transaction fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "SignPayload",
+      value: {
+        tag: "LegacyAccount",
+        value: {
+          signer:
+            "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+          payload: {
+            blockHash:
+              "0xd6eec26135305a8ad257a20d003357284c8aa03d0bdb2b357ab0a22371e11ef2",
+            blockNumber: "0x00000000",
+            era: "0x00",
+            genesisHash:
+              "0xbf0488dbe9daa1de1c08c5f743e26fdc2a4ecd74cf87dd1b4b1eeb99ae4ef19f",
+            method: "0x0000",
+            nonce: "0x00000000",
+            signedExtensions: [],
+            specVersion: "0x00000000",
+            tip: "0x00000000000000000000000000000000",
+            transactionVersion: "0x00000000",
+            version: 4,
+          },
+        },
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Sign Transaction",
+    );
+    expect(modalFields()).toEqual({
+      App: "localhost:3000",
+      Signer:
+        "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+      "Genesis Hash":
+        "0xbf0488dbe9daa1de1c08c5f743e26fdc2a4ecd74cf87dd1b4b1eeb99ae4ef19f",
+      "Call Data": "0x0000",
+      Version: "4",
+    });
+    expect(document.body.textContent).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders legacy raw signing as structured sign-message fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "SignRaw",
+      value: {
+        tag: "LegacyAccount",
+        value: {
+          signer:
+            "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+          payload: {
+            tag: "Bytes",
+            value: { bytes: "0x48656c6c6f2c20776f726c6421" },
+          },
+        },
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Sign Message",
+    );
+    expect(modalFields()).toEqual({
+      App: "localhost:3000",
+      Signer:
+        "0x2afb6161ad5d4132b6d2362330e1475be90b706b0e68ba344a80e7a1df071304",
+      Message: "0x48656c6c6f2c20776f726c6421",
+    });
+    expect(document.body.textContent).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders resource allocation as structured resource fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "ResourceAllocation",
+      value: {
+        resources: [{ tag: "StatementStoreAllowance" }, { tag: "AutoSigning" }],
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Resource Allocation",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      Resources: "StatementStoreAllowance, AutoSigning",
+    });
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders account alias permission as structured product fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "AccountAlias",
+      value: {
+        requestingProductId: "truapi-playground.dot",
+        targetProductId: "truapix-playground.dot",
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Alias Permission",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      "Requesting product": "truapi-playground.dot",
+      "Requested context": "truapix-playground.dot",
+    });
+    expect(
+      document.querySelector<HTMLButtonElement>(".signing-btn-cancel")
+        ?.textContent,
+    ).toBe("Deny");
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders account access permission as structured product fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "AccountAccess",
+      value: {
+        requestingProductId: "truapi-playground.dot",
+        targetProductId: "other-product.dot",
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Account Access",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      "Requesting product": "truapi-playground.dot",
+      "Requested account": "other-product.dot",
+    });
+    expect(
+      document.querySelector<HTMLButtonElement>(".signing-btn-cancel")
+        ?.textContent,
+    ).toBe("Deny");
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("renders identity disclosure as structured product fields", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "IdentityDisclosure",
+      value: {
+        productId: "truapi-playground.dot",
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    expect(document.querySelector(".signing-modal h2")?.textContent).toBe(
+      "Identity Disclosure",
+    );
+    const fields = modalFields();
+    expect(fields).toEqual({
+      "Requesting product": "truapi-playground.dot",
+    });
+    expect(
+      document.querySelector<HTMLButtonElement>(".signing-btn-cancel")
+        ?.textContent,
+    ).toBe("Deny");
+    expect(Object.keys(fields)).not.toContain("Application");
+    expect(Object.keys(fields)).not.toContain("Request");
+
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+
+    await expect(confirmation).resolves.toBe(true);
+  });
+
+  it("rejects identity disclosure when the dialog is dismissed", async () => {
+    const { confirmUserAction } =
+      createUserConfirmationAdapters("localhost:3000");
+    const review: UserConfirmationReview = {
+      tag: "IdentityDisclosure",
+      value: {
+        productId: "truapi-playground.dot",
+      },
+    };
+
+    const confirmation = confirmUserAction(review);
+
+    document.querySelector<HTMLDivElement>(".signing-modal-backdrop")?.click();
+
+    await expect(confirmation).rejects.toThrow(
+      "User dismissed identity disclosure dialog",
+    );
+  });
+});
diff --git a/packages/ui/tests/wallet-queue.test.ts b/packages/ui/tests/wallet-queue.test.ts
deleted file mode 100644
index f1069a6c..00000000
--- a/packages/ui/tests/wallet-queue.test.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-// Copyright 2026 Parity Technologies (UK) Ltd.
-// SPDX-License-Identifier: AGPL-3.0-only
-
-import { describe, expect, it } from "vitest";
-import { errAsync, okAsync } from "neverthrow";
-import { createWalletFlowQueue } from "@dotli/ui/wallet-queue";
-
-const wait = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-describe("createWalletFlowQueue", () => {
-  it("preserves call order even when later thunks resolve faster", async () => {
-    const queue = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const first = queue<string, never>(() =>
-      okAsync(undefined).map(async () => {
-        await wait(30);
-        order.push("first");
-        return "first";
-      }),
-    );
-    const second = queue<string, never>(() =>
-      okAsync(undefined).map(() => {
-        order.push("second");
-        return "second";
-      }),
-    );
-
-    const [r1, r2] = await Promise.all([first, second]);
-    expect(r1.isOk() && r1.value).toBe("first");
-    expect(r2.isOk() && r2.value).toBe("second");
-    expect(order).toEqual(["first", "second"]);
-  });
-
-  it("does not break the chain when a thunk returns errAsync", async () => {
-    const queue = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const failing = queue<string, string>(() => {
-      order.push("failing");
-      return errAsync("boom");
-    });
-    const followUp = queue<string, never>(() => {
-      order.push("followUp");
-      return okAsync("ok");
-    });
-
-    const r1 = await failing;
-    const r2 = await followUp;
-
-    expect(r1.isErr() && r1.error).toBe("boom");
-    expect(r2.isOk() && r2.value).toBe("ok");
-    expect(order).toEqual(["failing", "followUp"]);
-  });
-
-  it("surfaces the original error type to the caller", async () => {
-    const queue = createWalletFlowQueue();
-    type MyErr = { kind: "my-err"; reason: string };
-    const myErr: MyErr = { kind: "my-err", reason: "nope" };
-
-    const r = await queue<never, MyErr>(() => errAsync(myErr));
-    expect(r.isErr()).toBe(true);
-    if (r.isErr()) {
-      expect(r.error).toEqual(myErr);
-    }
-  });
-
-  it("serializes many concurrent calls in FIFO order", async () => {
-    const queue = createWalletFlowQueue();
-    const order: number[] = [];
-
-    const tasks = Array.from({ length: 5 }, (_, i) =>
-      queue<number, never>(() =>
-        okAsync(undefined).map(async () => {
-          // Earlier tasks wait longer so a non-serialized impl would reorder.
-          await wait(20 - i * 3);
-          order.push(i);
-          return i;
-        }),
-      ),
-    );
-
-    const results = await Promise.all(tasks);
-    expect(results.map((r) => r.isOk() && r.value)).toEqual([0, 1, 2, 3, 4]);
-    expect(order).toEqual([0, 1, 2, 3, 4]);
-  });
-
-  it("isolates state across queue instances", async () => {
-    const a = createWalletFlowQueue();
-    const b = createWalletFlowQueue();
-    const order: string[] = [];
-
-    const slowOnA = a<string, never>(() =>
-      okAsync(undefined).map(async () => {
-        await wait(20);
-        order.push("a");
-        return "a";
-      }),
-    );
-    const fastOnB = b<string, never>(() =>
-      okAsync(undefined).map(() => {
-        order.push("b");
-        return "b";
-      }),
-    );
-
-    await Promise.all([slowOnA, fastOnB]);
-    // Independent queues, so fast B finishes before slow A despite later call.
-    expect(order).toEqual(["b", "a"]);
-  });
-});

From 9b29b7bc40bf63fe870358e5a76e18a78151de1d Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 10:12:24 +0200
Subject: [PATCH 02/17] test(ui): wait for bridge lifecycle events

---
 packages/ui/tests/bridge.test.ts | 29 ++++++++---------------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/packages/ui/tests/bridge.test.ts b/packages/ui/tests/bridge.test.ts
index 4b06f5e5..5b0461f3 100644
--- a/packages/ui/tests/bridge.test.ts
+++ b/packages/ui/tests/bridge.test.ts
@@ -204,32 +204,19 @@ function requestIdFromFrame(message: Uint8Array): string {
   return decoded.value.requestId;
 }
 
-async function flushMicrotasks(): Promise<void> {
-  await Promise.resolve();
-  await Promise.resolve();
-}
-
 async function waitForProviderRequests(count: number): Promise<void> {
-  for (let i = 0; i < 20; i += 1) {
-    if (mocks.coreProviderDefers.length >= count) {
-      return;
-    }
-    await flushMicrotasks();
-  }
-  throw new Error(`expected ${count} provider request(s)`);
+  await vi.waitFor(() => {
+    expect(mocks.coreProviderDefers.length).toBeGreaterThanOrEqual(count);
+  });
 }
 
 async function waitForMockCalls(
   mock: ReturnType<typeof vi.fn>,
   count: number,
 ): Promise<void> {
-  for (let i = 0; i < 20; i += 1) {
-    if (mock.mock.calls.length >= count) {
-      return;
-    }
-    await flushMicrotasks();
-  }
-  throw new Error(`expected ${count} mock call(s)`);
+  await vi.waitFor(() => {
+    expect(mock).toHaveBeenCalledTimes(count);
+  });
 }
 
 describe("bridge render lifecycle", () => {
@@ -288,7 +275,7 @@ describe("bridge render lifecycle", () => {
     expect(document.querySelector("iframe")?.dataset.src).toBe(
       "https://second.example/app",
     );
-  });
+  }, 10_000);
 
   it("boots the landing auth core to disconnect a stored session without a product", async () => {
     await import("@dotli/ui/bridge");
@@ -301,7 +288,7 @@ describe("bridge render lifecycle", () => {
     await waitForMockCalls(provider.disconnectSession, 1);
 
     expect(provider.disconnectSession).toHaveBeenCalledTimes(1);
-  });
+  }, 10_000);
 });
 
 describe("requestCoreLogin", () => {

From 2864c016598cc60800e8cace67de673bf2e04485 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 10:17:15 +0200
Subject: [PATCH 03/17] test(ui): allow cold topbar import

---
 packages/ui/tests/topbar.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/ui/tests/topbar.test.ts b/packages/ui/tests/topbar.test.ts
index 56bf252f..ec0ae6cc 100644
--- a/packages/ui/tests/topbar.test.ts
+++ b/packages/ui/tests/topbar.test.ts
@@ -92,7 +92,7 @@ describe("topbar disconnect", () => {
     requestTruapiDisconnect();
 
     expect(requests).toBe(1);
-  });
+  }, 10_000);
 
   it("routes the disconnect button through the Rust-core event path", async () => {
     installTopbarDom();

From 95b810c04b41fa2bdd3f50ddabd3c38d40bb390f Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 10:43:56 +0200
Subject: [PATCH 04/17] fix(ui): preserve notification requests

Notification grants do not alter iframe Permissions Policy. Reloading disposed the in-flight Rust request before its response reached the product.
---
 apps/host/tests/e2e/fixtures/paired.ts        |  4 +-
 apps/host/tests/e2e/helpers/signing.ts        | 19 +++++-----
 apps/host/tests/e2e/truapi.spec.ts            | 37 +++++++++++--------
 .../ui/src/host-callbacks/PromptPermission.ts |  3 +-
 packages/ui/tests/permissions.test.ts         | 36 +++++++++++++++++-
 5 files changed, 70 insertions(+), 29 deletions(-)

diff --git a/apps/host/tests/e2e/fixtures/paired.ts b/apps/host/tests/e2e/fixtures/paired.ts
index 877a7871..fa5b188c 100644
--- a/apps/host/tests/e2e/fixtures/paired.ts
+++ b/apps/host/tests/e2e/fixtures/paired.ts
@@ -30,12 +30,12 @@ function startAutoAllow(page: Page): () => void {
       try {
         const allow = page.getByRole("button", { name: "Allow", exact: true });
         const visible = await allow
-          .last()
+          .first()
           .isVisible({ timeout: POLL_MS })
           .catch(() => false);
         if (visible) {
           await allow
-            .last()
+            .first()
             .click({ timeout: 2_000 })
             .catch(() => {});
         } else {
diff --git a/apps/host/tests/e2e/helpers/signing.ts b/apps/host/tests/e2e/helpers/signing.ts
index d10bab77..bc9a03f0 100644
--- a/apps/host/tests/e2e/helpers/signing.ts
+++ b/apps/host/tests/e2e/helpers/signing.ts
@@ -6,16 +6,15 @@ import { expect, type Page, type Frame, type Locator } from "@playwright/test";
 type PageLike = Page | Frame;
 
 /**
- * Click run-<testId>, handle non-permission host dialogs, and wait for the log
- * entry to resolve. The worker fixture owns every "Allow" click; keeping one
- * permission driver avoids concurrent clicks when host dialogs overlap. The
- * bot signs automatically once the SignRequest hits the Statement Store.
+ * Click run-<testId>, click through dot.li's host-side dialogs, and wait for
+ * the log entry to resolve. The bot signs automatically once the SignRequest
+ * hits the Statement Store.
  */
 export async function runWebSignedTest(
   hostPage: Page,
   productFrame: PageLike,
   testId: string,
-  manualDialogButtons: readonly string[],
+  dialogButtons: readonly string[],
   opts: { timeoutMs?: number; preClickDelayMs?: number } = {},
 ): Promise<"success" | "error"> {
   const timeoutMs = opts.timeoutMs ?? 90_000;
@@ -36,10 +35,10 @@ export async function runWebSignedTest(
 
   const dialogController = new AbortController();
   const dialogTask =
-    manualDialogButtons.length > 0
+    dialogButtons.length > 0
       ? clickHostDialogs(
           hostPage,
-          manualDialogButtons,
+          dialogButtons,
           60_000,
           preClickDelayMs,
           dialogController.signal,
@@ -74,8 +73,8 @@ export async function runWebSignedTest(
 }
 
 /**
- * Drive non-permission host dialogs through their lifecycle. Permission
- * "Allow" modals are handled exclusively by the worker fixture.
+ * Drive dot.li host-side dialogs through their lifecycle. Different operations
+ * may show permission ("Allow") and confirmation ("Sign") dialogs in sequence.
  *
  * Strategy: poll for any of `buttonNames` to be visible. When one is, click
  * it. Keep polling until either no expected button has appeared for
@@ -104,7 +103,7 @@ async function clickHostDialogs(
 
     let clickedThisPass = false;
     for (const name of buttonNames) {
-      const btn = page.getByRole("button", { name, exact: true }).last();
+      const btn = page.getByRole("button", { name, exact: true }).first();
       const visible = await btn.isVisible({ timeout: 250 }).catch(() => false);
       if (!visible) continue;
 
diff --git a/apps/host/tests/e2e/truapi.spec.ts b/apps/host/tests/e2e/truapi.spec.ts
index a922c7c0..a375340d 100644
--- a/apps/host/tests/e2e/truapi.spec.ts
+++ b/apps/host/tests/e2e/truapi.spec.ts
@@ -78,7 +78,7 @@ test.describe("dot.li > host-playground.dot", () => {
   });
 
   // Each allocation triggers an "Allow" modal on the host that the user
-  // approves. The bot is auto-paired and the worker fixture accepts the modal.
+  // approves. The bot is auto-paired so the test only drives the modal.
 
   test.describe("Allowances", () => {
     test("StatementStore Allowance", async ({ pairedPage, productFrame }) => {
@@ -90,7 +90,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "allowances-statement-store",
-        [],
+        ["Allow"],
         { timeoutMs: 90_000 },
       );
 
@@ -107,7 +107,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "allowances-bulletin",
-        [],
+        ["Allow"],
         { timeoutMs: 90_000 },
       );
 
@@ -124,7 +124,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "allowances-smart-contract",
-        [],
+        ["Allow"],
         { timeoutMs: 90_000 },
       );
 
@@ -141,7 +141,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "allowances-all",
-        [],
+        ["Allow"],
         { timeoutMs: 90_000 },
       );
 
@@ -189,7 +189,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-remote",
-        [],
+        ["Allow"],
         { timeoutMs: 30_000 },
       );
 
@@ -206,7 +206,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-webrtc",
-        [],
+        ["Allow"],
         { timeoutMs: 30_000 },
       );
 
@@ -223,7 +223,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-chain-submit",
-        [],
+        ["Allow"],
         { timeoutMs: 30_000 },
       );
 
@@ -240,7 +240,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-preimage-submit",
-        [],
+        ["Allow"],
         { timeoutMs: 30_000 },
       );
 
@@ -257,7 +257,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "remote-permission-statement-submit",
-        [],
+        ["Allow"],
         { timeoutMs: 30_000 },
       );
 
@@ -370,7 +370,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "preimage-factory",
-        [],
+        ["Allow"],
         { timeoutMs: 60_000 },
       );
 
@@ -387,7 +387,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "preimage-submit",
-        [],
+        ["Allow"],
         { timeoutMs: 60_000 },
       );
 
@@ -397,8 +397,15 @@ test.describe("dot.li > host-playground.dot", () => {
   });
 
   test.describe("Notifications", () => {
-    test("Push Notification", async ({ productFrame }) => {
-      await runTestExpectSuccess(productFrame, "push-notification");
+    test("Push Notification", async ({ pairedPage, productFrame }) => {
+      const status = await runWebSignedTest(
+        pairedPage,
+        productFrame,
+        "push-notification",
+        ["Allow"],
+        { timeoutMs: 20_000 },
+      );
+      expect(status).toBe("success");
     });
   });
 
@@ -415,7 +422,7 @@ test.describe("dot.li > host-playground.dot", () => {
         pairedPage,
         productFrame,
         "wallet-sign-message",
-        ["Sign"],
+        ["Allow", "Sign"],
         { timeoutMs: 120_000, preClickDelayMs: 1_000 },
       );
 
diff --git a/packages/ui/src/host-callbacks/PromptPermission.ts b/packages/ui/src/host-callbacks/PromptPermission.ts
index 801f4a86..3c25d0fd 100644
--- a/packages/ui/src/host-callbacks/PromptPermission.ts
+++ b/packages/ui/src/host-callbacks/PromptPermission.ts
@@ -7,6 +7,7 @@ import type { Permissions } from "@parity/truapi-host";
 import type { RemotePermission } from "@parity/truapi";
 import {
   getPermissionStatus,
+  isDevicePermission,
   isEnforceableDevicePermission,
   setPermissionStatus,
   type EnforceablePermissionName,
@@ -44,7 +45,7 @@ export function createPromptPermission(label: string): Permissions {
       granted: await decidePromptPermission(label, tag, {
         kind: "Device",
         limiter,
-        reloadOnGrant: true,
+        reloadOnGrant: isDevicePermission(tag),
       }),
     };
   };
diff --git a/packages/ui/tests/permissions.test.ts b/packages/ui/tests/permissions.test.ts
index 78747209..8d05daa5 100644
--- a/packages/ui/tests/permissions.test.ts
+++ b/packages/ui/tests/permissions.test.ts
@@ -1,7 +1,7 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
   ALL_PERMISSIONS,
   AUTO_GRANT_DEVICE_PERMISSIONS,
@@ -21,6 +21,7 @@ import type {
   PermissionAuthorizationRequest,
   PermissionAuthorizationStatus,
 } from "@parity/truapi-host";
+import { createPromptPermission } from "@dotli/ui/host-callbacks/PromptPermission";
 
 type Store = Map<string, PermissionAuthorizationStatus>;
 
@@ -205,6 +206,39 @@ describe("isEnforceableDevicePermission", () => {
   });
 });
 
+describe("device permission prompts", () => {
+  async function grantAndCountReloads(
+    permission: "Camera" | "Notifications",
+  ): Promise<number> {
+    let reloads = 0;
+    const onReload = (): void => {
+      reloads += 1;
+    };
+    window.addEventListener("dotli:device-permission-changed", onReload);
+
+    const response =
+      createPromptPermission("myapp").devicePermission(permission);
+    await vi.waitFor(() => {
+      expect(document.querySelector(".signing-btn-sign")).not.toBeNull();
+    });
+    document.querySelector<HTMLButtonElement>(".signing-btn-sign")?.click();
+    await expect(response).resolves.toEqual({ granted: true });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    window.removeEventListener("dotli:device-permission-changed", onReload);
+    document.body.replaceChildren();
+    return reloads;
+  }
+
+  it("keeps the iframe alive for notification grants", async () => {
+    expect(await grantAndCountReloads("Notifications")).toBe(0);
+  });
+
+  it("reloads for grants that alter the iframe allow attribute", async () => {
+    expect(await grantAndCountReloads("Camera")).toBe(1);
+  });
+});
+
 describe("getGrantedDevicePermissions", () => {
   it("returns only granted device permissions, ignoring core-only grants", async () => {
     await setPermissionStatus("myapp", "Camera", "granted");

From e8915f0ec9f3f40cb5c1bb4a441bba84076d53d3 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 11:26:25 +0200
Subject: [PATCH 05/17] docs(shared): remove stale auth reference

---
 packages/shared/src/executables.ts | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/packages/shared/src/executables.ts b/packages/shared/src/executables.ts
index 54a20938..85b2e1e6 100644
--- a/packages/shared/src/executables.ts
+++ b/packages/shared/src/executables.ts
@@ -2,10 +2,8 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 // Canonical executable-manifest kinds. A product publishes one manifest per
-// kind under an `<kind>.<base>.dot` subname, but all kinds share one derived
-// account (see `stripExecutableSubname` in @dotli/auth/account). Single source
-// of truth so the protocol bridge allowlist and the account derivation stay in
-// sync.
+// kind under an `<kind>.<base>.dot` subname. The host passes the base product
+// name to the Rust core, so every executable kind shares one derived account.
 
 export const EXECUTABLE_KINDS = ["app", "widget", "worker"] as const;
 

From 44b880c51796babebd7db42ec22643b2652280ba Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 12:53:26 +0200
Subject: [PATCH 06/17] refactor(protocol): unify auth storage keys

---
 packages/protocol/src/auth-storage.ts        | 3 ---
 packages/protocol/tests/auth-storage.test.ts | 4 ++--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/packages/protocol/src/auth-storage.ts b/packages/protocol/src/auth-storage.ts
index bb866a54..2abe0bf1 100644
--- a/packages/protocol/src/auth-storage.ts
+++ b/packages/protocol/src/auth-storage.ts
@@ -71,9 +71,6 @@ export function isValidSharedAuthKey(key: string): boolean {
 }
 
 export function buildSharedAuthStorageKey(siteId: SiteId, key: string): string {
-  if (key === SHARED_CORE_SESSION_KEY) {
-    return `TRUAPI_SESSION_${siteId}`;
-  }
   return `TRUAPI_${siteId}_${key}`;
 }
 
diff --git a/packages/protocol/tests/auth-storage.test.ts b/packages/protocol/tests/auth-storage.test.ts
index dbd76687..17e70710 100644
--- a/packages/protocol/tests/auth-storage.test.ts
+++ b/packages/protocol/tests/auth-storage.test.ts
@@ -70,11 +70,11 @@ describe("shared auth storage helpers", () => {
 
   it("builds stable storage keys", () => {
     expect(buildSharedAuthStorageKey("dot.li", SHARED_CORE_SESSION_KEY)).toBe(
-      "TRUAPI_SESSION_dot.li",
+      "TRUAPI_dot.li_session",
     );
     expect(
       buildSharedAuthStorageKey("paseoli.dev", SHARED_CORE_SESSION_KEY),
-    ).toBe("TRUAPI_SESSION_paseoli.dev");
+    ).toBe("TRUAPI_paseoli.dev_session");
     expect(buildSharedAuthStorageKey("dot.li", "UserSecrets")).toBe(
       "TRUAPI_dot.li_UserSecrets",
     );

From 6e8dc55f8eee43aa700ccd430547bb2ed91e0ad1 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 15:57:35 +0200
Subject: [PATCH 07/17] refactor(protocol): defer chainSend flush error
 responses to a follow-up

The pending-message flush drops send failures silently, matching the
pre-port behavior. Surfacing them as JSON-RPC errors moves to a
follow-up PR with test coverage.
---
 packages/protocol/src/client.ts | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/packages/protocol/src/client.ts b/packages/protocol/src/client.ts
index de3baa14..b6df73f8 100644
--- a/packages/protocol/src/client.ts
+++ b/packages/protocol/src/client.ts
@@ -737,14 +737,6 @@ export function createRemoteChainProvider(
           void postRequest("chainSend", {
             connectionId,
             message: JSON.stringify(message),
-          }).catch((error: unknown) => {
-            const errResponse = buildJsonRpcError(
-              message,
-              serializeError(error),
-            );
-            if (errResponse !== null) {
-              onMessage(errResponse);
-            }
           });
         }
         remote.pendingMessages = [];

From d2c57a1fa5cb285ded632be0a4456514e93efd5f Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 15:59:10 +0200
Subject: [PATCH 08/17] refactor(resolver): defer dependency pruning and
 coverage tests to a follow-up

Keep @polkadot-api/signer and @polkadot-labs/hdkd{,-helpers} declared
(unused since before the port) and limit rpc-chain tests to the new
core gateway provider surface. Removing the dead deps and adding
coverage for pre-existing chain checks moves to a follow-up PR.
---
 bun.lock                                  | 15 +++++++++++++++
 packages/resolver/package.json            |  3 +++
 packages/resolver/tests/chains.test.ts    | 15 ---------------
 packages/resolver/tests/rpc-chain.test.ts | 19 -------------------
 4 files changed, 18 insertions(+), 34 deletions(-)
 delete mode 100644 packages/resolver/tests/chains.test.ts

diff --git a/bun.lock b/bun.lock
index 97e510bc..86ef5d9b 100644
--- a/bun.lock
+++ b/bun.lock
@@ -196,9 +196,12 @@
         "@noble/hashes": "^2.2.0",
         "@polkadot-api/json-rpc-provider": "^0.2.0",
         "@polkadot-api/json-rpc-provider-proxy": "^0.4.0",
+        "@polkadot-api/signer": "^0.3.3",
         "@polkadot-api/substrate-bindings": "0.20.3",
         "@polkadot-api/substrate-client": "0.7.0",
         "@polkadot-api/utils": "0.4.0",
+        "@polkadot-labs/hdkd": "^0.0.28",
+        "@polkadot-labs/hdkd-helpers": "^0.0.30",
         "polkadot-api": "^2.1.6",
         "smoldot": "^3.1.4",
       },
@@ -653,6 +656,8 @@
 
     "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
 
+    "@noble/curves": ["@noble/curves@2.2.0", "", { "dependencies": { "@noble/hashes": "2.2.0" } }, "sha512-T/BoHgFXirb0ENSPBquzX0rcjXeM6Lo892a2jlYJkqk83LqZx0l1Of7DzlKJ6jkpvMrkHSnAcgb5JegL8SeIkQ=="],
+
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
     "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
@@ -711,6 +716,10 @@
 
     "@polkadot-api/ws-provider": ["@polkadot-api/ws-provider@0.9.0", "", { "dependencies": { "@polkadot-api/json-rpc-provider": "0.2.0", "@polkadot-api/json-rpc-provider-proxy": "0.4.0", "@polkadot-api/utils": "0.4.0" }, "peerDependencies": { "rxjs": ">=7.8.0" } }, "sha512-czTLgHEJPqx+6t5sb5OJpXDaSmbDTr8zYngBdUI47QYqcNB225zo/GdYakiNiGThtxVp1MLK7QsNXcT6XgqQNQ=="],
 
+    "@polkadot-labs/hdkd": ["@polkadot-labs/hdkd@0.0.28", "", { "dependencies": { "@polkadot-labs/hdkd-helpers": "~0.0.29" } }, "sha512-LpdqtQRpcgZQ5Mr8J0ddMA5ZufsbI4W3KuJkVdoYMnSmWs4179LigDb1rTYAOtyCg2jWUjf7rWP0mGxQQvNrHw=="],
+
+    "@polkadot-labs/hdkd-helpers": ["@polkadot-labs/hdkd-helpers@0.0.30", "", { "dependencies": { "@noble/curves": "^2.2.0", "@noble/hashes": "^2.2.0", "@scure/base": "^2.2.0", "@scure/sr25519": "^1.0.0", "scale-ts": "^1.6.1" } }, "sha512-qWmmD6ayj14RenDuDFfjF3sHS7ObqPzwIIMPcSVoDeKFSeQV7RY0HwyhC5CG4i6FoguMzak2dbtjYpNN5XQiwQ=="],
+
     "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.3", "", { "os": "android", "cpu": "arm64" }, "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw=="],
 
     "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA=="],
@@ -807,6 +816,8 @@
 
     "@scure/base": ["@scure/base@2.2.0", "", {}, "sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg=="],
 
+    "@scure/sr25519": ["@scure/sr25519@1.0.0", "", { "dependencies": { "@noble/curves": "~2.0.0", "@noble/hashes": "~2.0.0" } }, "sha512-b+uhK5akMINXZP95F3gJGcb5CMKYxf+q55fwMl0GoBwZDbWolmGNi1FrBSwuaZX5AhqS2byHiAueZgtDNpot2A=="],
+
     "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
 
     "@sentry-internal/browser-utils": ["@sentry-internal/browser-utils@10.57.0", "", { "dependencies": { "@sentry/core": "10.57.0" } }, "sha512-tXObp954rMTSYKlbftjVXHtNl4t/6ssks3jkqyzmKb+PDPWzabGQO7sWwqVuTjT8Kx/8A3FmriS1bGmqxiJy3A=="],
@@ -1741,6 +1752,10 @@
 
     "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
+    "@scure/sr25519/@noble/curves": ["@noble/curves@2.0.1", "", { "dependencies": { "@noble/hashes": "2.0.1" } }, "sha512-vs1Az2OOTBiP4q0pwjW5aF0xp9n4MxVrmkFBxc6EKZc6ddYx5gaZiAsZoq0uRRXWbi3AT/sBqn05eRPtn1JCPw=="],
+
+    "@scure/sr25519/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
+
     "@sentry/bundler-plugin-core/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "@sentry/bundler-plugin-core/glob": ["glob@13.0.6", "", { "dependencies": { "minimatch": "^10.2.2", "minipass": "^7.1.3", "path-scurry": "^2.0.2" } }, "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw=="],
diff --git a/packages/resolver/package.json b/packages/resolver/package.json
index 421b755a..6b5e9c04 100644
--- a/packages/resolver/package.json
+++ b/packages/resolver/package.json
@@ -31,9 +31,12 @@
     "@ensdomains/content-hash": "^3.0.0",
     "@polkadot-api/json-rpc-provider": "^0.2.0",
     "@polkadot-api/json-rpc-provider-proxy": "^0.4.0",
+    "@polkadot-api/signer": "^0.3.3",
     "@polkadot-api/substrate-bindings": "0.20.3",
     "@polkadot-api/substrate-client": "0.7.0",
     "@polkadot-api/utils": "0.4.0",
+    "@polkadot-labs/hdkd": "^0.0.28",
+    "@polkadot-labs/hdkd-helpers": "^0.0.30",
     "polkadot-api": "^2.1.6",
     "smoldot": "^3.1.4"
   }
diff --git a/packages/resolver/tests/chains.test.ts b/packages/resolver/tests/chains.test.ts
deleted file mode 100644
index 1355544c..00000000
--- a/packages/resolver/tests/chains.test.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { getActiveSupportedGenesisHashes } from "@dotli/config/network";
-import { isChainSupported } from "@dotli/resolver/chains";
-
-describe("isChainSupported", () => {
-  it("accepts every chain the host runtime can expose", () => {
-    for (const genesisHash of getActiveSupportedGenesisHashes()) {
-      expect(isChainSupported(genesisHash)).toBe(true);
-    }
-  });
-
-  it("rejects unknown genesis hashes", () => {
-    expect(isChainSupported("0xdeadbeef")).toBe(false);
-  });
-});
diff --git a/packages/resolver/tests/rpc-chain.test.ts b/packages/resolver/tests/rpc-chain.test.ts
index 7b355848..7ea4f172 100644
--- a/packages/resolver/tests/rpc-chain.test.ts
+++ b/packages/resolver/tests/rpc-chain.test.ts
@@ -16,25 +16,6 @@ vi.mock("polkadot-api/ws", () => ({
 }));
 
 describe("rpc-chain", () => {
-  it("supports the active People chain when RPC endpoints are configured", () => {
-    const people = getActiveServicesConfig().people;
-
-    expect(isRpcChainSupported(people.genesis)).toBe(true);
-
-    const provider = {};
-    mocks.getWsProvider.mockReturnValueOnce(provider);
-
-    expect(createRpcChainProvider(people.genesis)).toBe(provider);
-    expect(mocks.getWsProvider).toHaveBeenCalledWith([...people.rpcs], {
-      heartbeatTimeout: 120_000,
-    });
-  });
-
-  it("rejects unknown genesis hashes", () => {
-    expect(isRpcChainSupported("0xdeadbeef")).toBe(false);
-    expect(createRpcChainProvider("0xdeadbeef")).toBeNull();
-  });
-
   it("reserves Bulletin RPC access for the host-owned Rust core", () => {
     const bulletin = getActiveServicesConfig().bulletin;
     expect(isRpcChainSupported(bulletin.genesis)).toBe(false);

From 984f073d012d08ef7758a0a2bbcf08d7f2f298b3 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:00:31 +0200
Subject: [PATCH 09/17] refactor(debug): defer panel fixes unrelated to the
 port to a follow-up

Keep the base panel top offset and suffix-based terminator matching
(minus the removed host-papp events). The offset correction, the
exact-match terminator set, and the @dotli/config dependency
declaration move to a follow-up PR.
---
 bun.lock                                     |  1 -
 packages/truapi-debug/package.json           |  1 -
 packages/truapi-debug/src/panel.ts           |  2 +-
 packages/truapi-debug/src/timeline-layout.ts | 32 +++++++++-----------
 4 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/bun.lock b/bun.lock
index 86ef5d9b..b0d39c7d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -267,7 +267,6 @@
       "name": "@dotli/truapi-debug",
       "version": "0.6.0",
       "dependencies": {
-        "@dotli/config": "workspace:*",
         "@dotli/shared": "workspace:*",
         "nanoevents": "^9.1.0",
       },
diff --git a/packages/truapi-debug/package.json b/packages/truapi-debug/package.json
index 5b623416..be0b89c0 100644
--- a/packages/truapi-debug/package.json
+++ b/packages/truapi-debug/package.json
@@ -19,7 +19,6 @@
     "vite": "^8.0.16"
   },
   "dependencies": {
-    "@dotli/config": "workspace:*",
     "@dotli/shared": "workspace:*",
     "nanoevents": "^9.1.0"
   }
diff --git a/packages/truapi-debug/src/panel.ts b/packages/truapi-debug/src/panel.ts
index 687ab4d6..be304773 100644
--- a/packages/truapi-debug/src/panel.ts
+++ b/packages/truapi-debug/src/panel.ts
@@ -194,7 +194,7 @@ function adjustIframeForPanel(panel: HTMLElement, state: PanelState): void {
     return;
   }
   const hasTopbar = document.getElementById("topbar") !== null;
-  const topOffset = hasTopbar ? 56 : 0;
+  const topOffset = hasTopbar ? 40 : 0;
   if (state.dock === "right") {
     iframe.style.height = `calc(100vh - ${String(topOffset)}px)`;
     // When collapsed, the 32px header bar overlays the top-right corner
diff --git a/packages/truapi-debug/src/timeline-layout.ts b/packages/truapi-debug/src/timeline-layout.ts
index f3533a1e..5e9881be 100644
--- a/packages/truapi-debug/src/timeline-layout.ts
+++ b/packages/truapi-debug/src/timeline-layout.ts
@@ -652,7 +652,7 @@ function segmentForGroup(
  * point-in-time system events (boot phases, failover decisions, etc.)
  * still occupy a lane position at the right Y. `pending` is true for
  * flows whose first event is a "start" kind without a matching end
- * event in the buffer. See `isSystemFlowTerminator`.
+ * event in the buffer. See SYSTEM_TERMINATOR_SUFFIXES.
  */
 function systemSegmentForGroup(
   group: StoredSystemEvent[],
@@ -688,21 +688,22 @@ function systemSegmentDetail(
   return `${first.layer}·${String(all.length)} step${all.length === 1 ? "" : "s"}`;
 }
 
-/** Exact layer:event names that close a multi-step system flow. */
-const SYSTEM_TERMINATOR_EVENTS: ReadonlySet<string> = new Set([
-  "boot:ready",
-  "boot:landing_page_shown",
-  "bridge:first_outbound",
-  "render:iframe_ready",
-  "sandbox:document_written",
-  "main:monitor_stopped",
-]);
-
-/** Suffixes that close error/completion families without listing every event. */
+/** Events that close a multi-step system flow. Mirrors the pairs we
+ *  document in the detail pane so visual pending state matches intent. */
 const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
+  "ready",
   "failed",
+  "landing_page_shown",
   "completed",
   "terminated",
+  "iframe_ready",
+  // `setup_ready` does not close the bridge flow. It only means the
+  // host is listening, and the product can stay silent for many seconds
+  // after that (iframe still loading, sandbox relay not ready). The
+  // bridge flow stays open until bidirectional traffic is observed via
+  // `first_outbound`.
+  "first_outbound",
+  "document_written",
   "peer_action_processed",
   "peer_action_failed",
   "host_action_response_received",
@@ -711,13 +712,10 @@ const SYSTEM_TERMINATOR_SUFFIXES: readonly string[] = [
   "resolve_failed",
 ];
 
-export function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
+function isSystemFlowTerminator(ev: StoredSystemEvent): boolean {
   const event = ev.event;
-  if (SYSTEM_TERMINATOR_EVENTS.has(`${ev.layer}:${event}`)) {
-    return true;
-  }
   return SYSTEM_TERMINATOR_SUFFIXES.some(
-    (suf) => event === suf || event.endsWith(`_${suf}`),
+    (suf) => event === suf || event.endsWith(`_${suf}`) || event === suf,
   );
 }
 

From 98690c0f02a9d0ac99d6ff5fb6d688d94645db30 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:01:31 +0200
Subject: [PATCH 10/17] refactor(ui): defer permission-prompt rate limiting to
 a follow-up

Prompts always reach the modal, matching the pre-port behavior. The
sliding-window limiter returns in a follow-up PR together with the
denied-path semantics and a test that trips the window.
---
 .../ui/src/host-callbacks/PromptPermission.ts | 10 +--------
 .../ui/src/host-callbacks/PushNotification.ts |  3 ---
 packages/ui/src/host-callbacks/rate-limit.ts  | 21 -------------------
 3 files changed, 1 insertion(+), 33 deletions(-)
 delete mode 100644 packages/ui/src/host-callbacks/rate-limit.ts

diff --git a/packages/ui/src/host-callbacks/PromptPermission.ts b/packages/ui/src/host-callbacks/PromptPermission.ts
index 3c25d0fd..635971bc 100644
--- a/packages/ui/src/host-callbacks/PromptPermission.ts
+++ b/packages/ui/src/host-callbacks/PromptPermission.ts
@@ -14,7 +14,6 @@ import {
 } from "../permissions";
 import { showPermissionRequestModal } from "../permission-modal";
 import { showNotification } from "../notification";
-import { createSubmitRateLimiter } from "./rate-limit";
 
 // Remote tags that don't reach a host enforcement point: WebRtc is gated
 // by the iframe `allow` attribute, and `Remote` (HTTP/WS) can't be
@@ -34,7 +33,6 @@ function gatedRemotePermissionName(
 }
 
 export function createPromptPermission(label: string): Permissions {
-  const limiter = createSubmitRateLimiter();
   const devicePermission: Permissions["devicePermission"] = async (tag) => {
     // OpenUrl has no host-side enforcement point; auto-grant rather than show
     // a modal whose deny button cannot block the underlying browser API.
@@ -44,7 +42,6 @@ export function createPromptPermission(label: string): Permissions {
     return {
       granted: await decidePromptPermission(label, tag, {
         kind: "Device",
-        limiter,
         reloadOnGrant: isDevicePermission(tag),
       }),
     };
@@ -58,7 +55,6 @@ export function createPromptPermission(label: string): Permissions {
     return {
       granted: await decidePromptPermission(label, name, {
         kind: "Remote",
-        limiter,
       }),
     };
   };
@@ -71,11 +67,10 @@ export async function decidePromptPermission(
   name: EnforceablePermissionName,
   options: {
     kind: "Device" | "Remote";
-    limiter: { allow: () => boolean };
     reloadOnGrant?: boolean;
   },
 ): Promise<boolean> {
-  const { kind, limiter, reloadOnGrant = false } = options;
+  const { kind, reloadOnGrant = false } = options;
   const status = await getPermissionStatus(label, name);
   if (status === "granted") {
     return true;
@@ -93,9 +88,6 @@ export async function decidePromptPermission(
     return false;
   }
   // status === "ask": show the modal and wait for the user.
-  if (!limiter.allow()) {
-    throw new Error("Permission prompt rate limited");
-  }
   const decision = await showPermissionRequestModal(label, name);
   if (decision === "dismissed") {
     throw new Error("User dismissed permission dialog");
diff --git a/packages/ui/src/host-callbacks/PushNotification.ts b/packages/ui/src/host-callbacks/PushNotification.ts
index 8735e397..5b502f69 100644
--- a/packages/ui/src/host-callbacks/PushNotification.ts
+++ b/packages/ui/src/host-callbacks/PushNotification.ts
@@ -9,12 +9,10 @@ import {
 } from "../scheduled-notifications";
 import { showNotification } from "../notification";
 import { decidePromptPermission } from "./PromptPermission";
-import { createSubmitRateLimiter } from "./rate-limit";
 
 export function createNotificationAdapters(
   label: string,
 ): Required<Notifications> {
-  const limiter = createSubmitRateLimiter();
   const pushNotification: Required<Notifications>["pushNotification"] = async ({
     text,
     deeplink,
@@ -28,7 +26,6 @@ export function createNotificationAdapters(
 
     const granted = await decidePromptPermission(label, "Notifications", {
       kind: "Device",
-      limiter,
     });
     if (!granted) {
       throw new Error("Notifications permission denied");
diff --git a/packages/ui/src/host-callbacks/rate-limit.ts b/packages/ui/src/host-callbacks/rate-limit.ts
deleted file mode 100644
index 249daaf4..00000000
--- a/packages/ui/src/host-callbacks/rate-limit.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-// Sliding-window rate limiter shared across host callbacks.
-
-const SUBMIT_WINDOW_MS = 10_000;
-const SUBMIT_MAX_PER_WINDOW = 20;
-
-export function createSubmitRateLimiter(): { allow: () => boolean } {
-  const timestamps: number[] = [];
-  return {
-    allow() {
-      const now = Date.now();
-      while (timestamps.length > 0 && timestamps[0] <= now - SUBMIT_WINDOW_MS) {
-        timestamps.shift();
-      }
-      if (timestamps.length >= SUBMIT_MAX_PER_WINDOW) {
-        return false;
-      }
-      timestamps.push(now);
-      return true;
-    },
-  };
-}

From 6c0147364858a842dde0565b051e86a8156dbf96 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:03:29 +0200
Subject: [PATCH 11/17] refactor(ui): defer allowance-key at-rest encryption to
 a follow-up

AllowanceKeys persist as plain hex through the same path as every
other core storage key. The at-rest cipher moves to a follow-up PR
where the scheme (per-write nonce, plain-hex read fallback) can get a
focused security review.
---
 bun.lock                                      |  1 -
 packages/ui/package.json                      |  1 -
 .../ui/src/host-callbacks/SessionStore.ts     | 35 ++-----------------
 packages/ui/tests/session-store.test.ts       |  4 +--
 4 files changed, 4 insertions(+), 37 deletions(-)

diff --git a/bun.lock b/bun.lock
index b0d39c7d..819084aa 100644
--- a/bun.lock
+++ b/bun.lock
@@ -294,7 +294,6 @@
         "@dotli/shared": "workspace:*",
         "@dotli/storage": "workspace:*",
         "@dotli/truapi-debug": "workspace:*",
-        "@noble/ciphers": "^2.2.0",
         "@noble/hashes": "^2.2.0",
         "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
         "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 712b6db5..657268e1 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -31,7 +31,6 @@
     "@dotli/shared": "workspace:*",
     "@dotli/storage": "workspace:*",
     "@dotli/truapi-debug": "workspace:*",
-    "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
     "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
     "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
diff --git a/packages/ui/src/host-callbacks/SessionStore.ts b/packages/ui/src/host-callbacks/SessionStore.ts
index a6e0dfa7..3c36dc60 100644
--- a/packages/ui/src/host-callbacks/SessionStore.ts
+++ b/packages/ui/src/host-callbacks/SessionStore.ts
@@ -1,6 +1,4 @@
 import { SITE_ID } from "@dotli/config/config";
-import { gcm } from "@noble/ciphers/aes.js";
-import { blake2b } from "@noble/hashes/blake2.js";
 import { bytesToHex, hexToBytes } from "@parity/truapi/scale";
 import { encodeCoreStorageKey } from "@parity/truapi-host";
 import type {
@@ -20,7 +18,6 @@ import { dispatchAuthState } from "./AuthState";
 
 const LOCAL_CHANGE_EVENT = "dotli:truapi-session-store-changed";
 const CORE_LOCAL_STORAGE_PREFIX = "dotli:core:";
-const textEncoder = new TextEncoder();
 
 // JSON cache of the last connected UI state the core reported via
 // `authStateChanged`. Lives in shared auth storage next to the opaque
@@ -156,7 +153,7 @@ async function readCoreStorageValue(
     return hexToBytes(raw);
   }
   const raw = localStorage.getItem(coreLocalStorageKey(key));
-  return raw === null ? undefined : decodeCoreStorageValue(key, raw);
+  return raw === null ? undefined : hexToBytes(raw);
 }
 
 async function writeCoreStorageValue(
@@ -172,10 +169,7 @@ async function writeCoreStorageValue(
     emitLocalChange();
     return;
   }
-  localStorage.setItem(
-    coreLocalStorageKey(key),
-    encodeCoreStorageValue(key, value),
-  );
+  localStorage.setItem(coreLocalStorageKey(key), bytesToHex(value));
 }
 
 async function clearCoreStorageValue(key: CoreStorageKey): Promise<void> {
@@ -205,31 +199,6 @@ function coreLocalStorageKey(key: CoreStorageKey): string {
   }
 }
 
-function encodeCoreStorageValue(
-  key: CoreStorageKey,
-  value: Uint8Array,
-): string {
-  if (key.tag === "AllowanceKeys") {
-    return bytesToHex(allowanceStorageCipher().encrypt(value));
-  }
-  return bytesToHex(value);
-}
-
-function decodeCoreStorageValue(key: CoreStorageKey, raw: string): Uint8Array {
-  const bytes = hexToBytes(raw);
-  if (key.tag === "AllowanceKeys") {
-    return allowanceStorageCipher().decrypt(bytes);
-  }
-  return bytes;
-}
-
-function allowanceStorageCipher(): ReturnType<typeof gcm> {
-  return gcm(
-    blake2b(textEncoder.encode(SITE_ID), { dkLen: 16 }),
-    blake2b(textEncoder.encode("nonce"), { dkLen: 32 }),
-  );
-}
-
 function hexNoPrefix(bytes: Uint8Array): string {
   return bytesToHex(bytes).slice(2);
 }
diff --git a/packages/ui/tests/session-store.test.ts b/packages/ui/tests/session-store.test.ts
index b14d97eb..00140926 100644
--- a/packages/ui/tests/session-store.test.ts
+++ b/packages/ui/tests/session-store.test.ts
@@ -150,7 +150,7 @@ describe("session-store host callbacks", () => {
     expect(localStorage.length).toBe(1);
   });
 
-  it("encrypts persisted allowance key slots", async () => {
+  it("round-trips persisted allowance key slots", async () => {
     const { readCoreStorage, writeCoreStorage, clearCoreStorage } =
       createSessionStoreAdapters();
     const key = {
@@ -161,7 +161,7 @@ describe("session-store host callbacks", () => {
     await writeCoreStorage(key, new Uint8Array([1, 2, 3, 4]));
 
     const storageKey = "dotli:core:allowance-keys:session-1";
-    expect(localStorage.getItem(storageKey)).not.toBe("0x01020304");
+    expect(localStorage.getItem(storageKey)).toBe("0x01020304");
     expect(Array.from((await readCoreStorage(key)) ?? [])).toEqual([
       1, 2, 3, 4,
     ]);

From c6a1d9480694ff27a36723749b1486693c52827c Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:04:59 +0200
Subject: [PATCH 12/17] refactor(bridge): defer the per-frame wire debug tap to
 a follow-up

The bridge emits only the first_inbound/first_outbound lifecycle
events. The per-frame TrUAPI tap that feeds the debug panel timeline
returns in a follow-up PR; the panel's truapi event handling stays in
place and receives no events until then.
---
 packages/ui/src/bridge.ts | 95 +--------------------------------------
 1 file changed, 2 insertions(+), 93 deletions(-)

diff --git a/packages/ui/src/bridge.ts b/packages/ui/src/bridge.ts
index b139adef..3a4d838e 100644
--- a/packages/ui/src/bridge.ts
+++ b/packages/ui/src/bridge.ts
@@ -31,10 +31,7 @@ import { getNetwork } from "@dotli/config/network";
 import { m } from "@dotli/metrics/metrics";
 import * as S from "@dotli/metrics/spans";
 import { log } from "@dotli/shared/log";
-import {
-  emitDotliDebugEvent,
-  hasDotliDebugListeners,
-} from "@dotli/truapi-debug/dotli-debug-bus";
+import { emitDotliDebugEvent } from "@dotli/truapi-debug/dotli-debug-bus";
 import type { TrUApiProductProvider } from "@parity/truapi-host";
 import type { PairingHostAdmin } from "@parity/truapi-host";
 import {
@@ -439,91 +436,6 @@ function pipeProviders(
   };
 }
 
-function emitWireFrameDebug(
-  direction: "incoming" | "outgoing",
-  productId: string,
-  message: Uint8Array,
-): void {
-  if (!hasDotliDebugListeners()) {
-    return;
-  }
-  const decoded = decodeWireMessage(message);
-  if (decoded.isErr()) {
-    return;
-  }
-  const wireId = decoded.value.payload.id;
-  emitDotliDebugEvent({
-    kind: "truapi",
-    direction,
-    productId,
-    requestId: decoded.value.requestId,
-    payload: {
-      tag: `wire_${String(wireId)}`,
-      value: {
-        wireId,
-        bytes: decoded.value.payload.value,
-      },
-    },
-  });
-}
-
-function wrapCoreProviderForDebug(
-  provider: CoreProviderBase,
-  productId: string,
-): CoreProviderBase {
-  const listeners = new Set<(message: Uint8Array) => void>();
-  let disposed = false;
-  const unsubscribeCore = provider.subscribe((message) => {
-    if (disposed) {
-      return;
-    }
-    emitWireFrameDebug("outgoing", productId, message);
-    for (const listener of [...listeners]) {
-      listener(message);
-    }
-  });
-
-  return {
-    postMessage(message: Uint8Array): void {
-      if (disposed) {
-        return;
-      }
-      emitWireFrameDebug("incoming", productId, message);
-      provider.postMessage(message);
-    },
-    subscribe(callback) {
-      listeners.add(callback);
-      return () => {
-        listeners.delete(callback);
-      };
-    },
-    subscribeClose(callback) {
-      return provider.subscribeClose?.(callback) ?? noop;
-    },
-    async disconnectSession() {
-      await provider.disconnectSession();
-    },
-    getPermissionAuthorizationStatus(request) {
-      return provider.getPermissionAuthorizationStatus(request);
-    },
-    getPermissionAuthorizationStatuses(requests) {
-      return provider.getPermissionAuthorizationStatuses(requests);
-    },
-    setPermissionAuthorizationStatus(request, status) {
-      return provider.setPermissionAuthorizationStatus(request, status);
-    },
-    dispose() {
-      if (disposed) {
-        return;
-      }
-      disposed = true;
-      unsubscribeCore();
-      listeners.clear();
-      provider.dispose();
-    },
-  };
-}
-
 let topbarLoginRequestSeq = 0;
 
 export function requestCoreLogin(
@@ -732,10 +644,7 @@ async function createCoreProvider(
     },
   );
   const provider = await runtime.createProvider({ productId });
-  return trackCoreProvider(
-    wrapCoreProviderForDebug(provider, options.productId ?? label),
-    runtime,
-  );
+  return trackCoreProvider(provider, runtime);
 }
 
 async function getLandingAuthHost(): Promise<CoreHost> {

From cf9955105b741ccf4892d982239c6ffe599cab3a Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:08:06 +0200
Subject: [PATCH 13/17] refactor(topbar): defer login-failure copy and popover
 hardening to a follow-up

Login failures fall back to the raw reason except for the base
OriginPersonProviderError mapping, and the permissions popover renders
last-write-wins without a staleness guard or unavailable-state hint.
The failure-message pack and popover hardening move to a follow-up PR.
---
 packages/ui/src/topbar.ts        | 52 +++-----------------------------
 packages/ui/tests/topbar.test.ts | 42 --------------------------
 2 files changed, 4 insertions(+), 90 deletions(-)

diff --git a/packages/ui/src/topbar.ts b/packages/ui/src/topbar.ts
index 09406cad..73ed696e 100644
--- a/packages/ui/src/topbar.ts
+++ b/packages/ui/src/topbar.ts
@@ -439,32 +439,7 @@ const PENDING_ICON_SVG =
 // fall back to the raw error.
 function friendlyAuthError(
   message: string,
-): { title: string; subtitle: string; detail?: string } | null {
-  if (
-    message.includes("no free statement-store slot for device registration")
-  ) {
-    return {
-      title: "No Statement Store slots left",
-      subtitle: "Polkadot Mobile could not register this browser as a device.",
-      detail: "no free statement-store slot for device registration",
-    };
-  }
-  if (message.includes("Invalid Transaction")) {
-    return {
-      title: "Statement Store transaction rejected",
-      subtitle:
-        "Polkadot Mobile could not register this browser because the chain rejected the registration transaction.",
-      detail: message,
-    };
-  }
-  if (message.includes("SubstrateSdk.JSONRPCError error 1")) {
-    return {
-      title: "Statement Store registration failed",
-      subtitle:
-        "Polkadot Mobile reported a JSON-RPC failure while registering this browser as a device.",
-      detail: message,
-    };
-  }
+): { title: string; subtitle: string } | null {
   if (message.includes("OriginPersonProviderError")) {
     return {
       title: "Your account is still being set up",
@@ -494,13 +469,6 @@ function renderError(message: string): void {
     subtitle.className = "auth-modal-pending-subtitle";
     subtitle.textContent = friendly.subtitle;
     container.appendChild(subtitle);
-
-    if (friendly.detail !== undefined && friendly.detail.length > 0) {
-      const detail = document.createElement("p");
-      detail.className = "auth-modal-error";
-      detail.textContent = friendly.detail;
-      container.appendChild(detail);
-    }
   } else {
     const msg = document.createElement("p");
     msg.className = "auth-modal-error";
@@ -664,7 +632,6 @@ const STATUS_LABELS: Record<PermissionStatus, string> = {
 const STATUS_ORDER: readonly PermissionStatus[] = ["ask", "granted", "denied"];
 
 let openDropdownCleanup: (() => void) | null = null;
-let permissionsRenderToken = 0;
 
 function closeOpenDropdown(): void {
   openDropdownCleanup?.();
@@ -672,20 +639,12 @@ function closeOpenDropdown(): void {
 }
 
 function renderPermissionsPopover(): void {
-  const token = ++permissionsRenderToken;
-  void renderPermissionsPopoverAsync(token).catch(() => {
-    if (token !== permissionsRenderToken) {
-      return;
-    }
+  void renderPermissionsPopoverAsync().catch(() => {
     permissionsPopoverList.innerHTML = "";
-    const hint = document.createElement("div");
-    hint.className = "permissions-popover-footer";
-    hint.textContent = "Permissions are unavailable for this app.";
-    permissionsPopoverList.appendChild(hint);
   });
 }
 
-async function renderPermissionsPopoverAsync(token: number): Promise<void> {
+async function renderPermissionsPopoverAsync(): Promise<void> {
   closeOpenDropdown();
   permissionsPopoverList.innerHTML = "";
 
@@ -707,10 +666,7 @@ async function renderPermissionsPopoverAsync(token: number): Promise<void> {
 
   for (const [index, perm] of ALL_PERMISSIONS.entries()) {
     const status = statuses[index] ?? "ask";
-    if (
-      token !== permissionsRenderToken ||
-      currentProductLabel !== productLabel
-    ) {
+    if (currentProductLabel !== productLabel) {
       return;
     }
 
diff --git a/packages/ui/tests/topbar.test.ts b/packages/ui/tests/topbar.test.ts
index ec0ae6cc..eb489601 100644
--- a/packages/ui/tests/topbar.test.ts
+++ b/packages/ui/tests/topbar.test.ts
@@ -343,48 +343,6 @@ describe("topbar login cancellation", () => {
       "Retry",
     );
   });
-
-  it("explains statement-store slot exhaustion in the login failure view", async () => {
-    installTopbarDom();
-    const { initTopBar } = await import("@dotli/ui/topbar");
-    initTopBar();
-
-    window.dispatchEvent(
-      new CustomEvent("dotli:truapi-auth-state", {
-        detail: {
-          tag: "LoginFailed",
-          reason: "no free statement-store slot for device registration",
-        },
-      }),
-    );
-
-    const modalText = document.getElementById("auth-modal-qr")?.textContent;
-    expect(modalText).toContain("No Statement Store slots left");
-    expect(modalText).toContain(
-      "no free statement-store slot for device registration",
-    );
-    expect(modalText).toContain("Retry");
-  });
-
-  it("explains rejected statement-store transactions from the raw reason", async () => {
-    installTopbarDom();
-    const { initTopBar } = await import("@dotli/ui/topbar");
-    initTopBar();
-
-    window.dispatchEvent(
-      new CustomEvent("dotli:truapi-auth-state", {
-        detail: {
-          tag: "LoginFailed",
-          reason: "submit RPC error: Invalid Transaction",
-        },
-      }),
-    );
-
-    const modalText = document.getElementById("auth-modal-qr")?.textContent;
-    expect(modalText).toContain("Statement Store transaction rejected");
-    expect(modalText).toContain("submit RPC error: Invalid Transaction");
-    expect(modalText).toContain("Retry");
-  });
 });
 
 describe("topbar boot rehydration", () => {

From 963ac835fbd09c2329c16545d72dd2200ea95671 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:19:15 +0200
Subject: [PATCH 14/17] build(ui): depend on published @parity/truapi 0.4.0 and
 @parity/truapi-host 0.1.0

The published packages replace the temporary personal-scope npm
aliases used while the port was in review.
---
 MIGRATION.md             | 18 +++++++-----------
 bun.lock                 |  8 ++++----
 packages/ui/package.json |  4 ++--
 3 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/MIGRATION.md b/MIGRATION.md
index 5dec5443..6383a0a1 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -53,21 +53,17 @@ routing that belongs inside the Rust core.
 
 ## Dependencies
 
-`packages/ui/package.json` currently resolves the public TrUAPI package names
-through temporary npm aliases:
+`packages/ui/package.json` depends on the published TrUAPI packages:
 
 ```jsonc
-"@parity/truapi": "npm:@pgherveou2/truapi-dev@...",
-"@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@..."
+"@parity/truapi": "0.4.0",
+"@parity/truapi-host": "0.1.0"
 ```
 
-This keeps standalone dotli installs and CI reproducible while the Rust core
-port is in review. TrUAPI's development and E2E Make targets run
-`bun run link:truapi` after building the local packages, so parent-repo work
-always exercises the current checkout instead of the npm artifacts.
-
-> **TODO(packaging):** publish `@parity/truapi` and
-> `@parity/truapi-host`, then replace the temporary aliases before merge.
+Standalone dotli installs and CI exercise these npm artifacts. TrUAPI's
+development and E2E Make targets run `bun run link:truapi` after building the
+local packages, so parent-repo work always exercises the current checkout
+instead of the npm artifacts.
 
 The runtime manifests and source must not depend on or import the removed
 `@novasamatech/*` runtime packages.
diff --git a/bun.lock b/bun.lock
index 819084aa..84758ebd 100644
--- a/bun.lock
+++ b/bun.lock
@@ -295,8 +295,8 @@
         "@dotli/storage": "workspace:*",
         "@dotli/truapi-debug": "workspace:*",
         "@noble/hashes": "^2.2.0",
-        "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
-        "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
+        "@parity/truapi": "0.4.0",
+        "@parity/truapi-host": "0.1.0",
         "@polkadot-api/json-rpc-provider": "^0.2.0",
         "@scure/base": "^2.2.0",
         "neverthrow": "^8.2.0",
@@ -660,9 +660,9 @@
 
     "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="],
 
-    "@parity/truapi": ["@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f", "", { "dependencies": { "@noble/hashes": "^2.2.0", "neverthrow": "^8.2.0", "scale-ts": "^1.6.1" } }, "sha512-wjdhSmf2k84kNse9H6ewn/Nw025XnODMElDqkK9UTh8hrcCdA0w1fJGKez5PEH3ljQb8DT2Qo6U3VDEKO7QwpA=="],
+    "@parity/truapi": ["@parity/truapi@0.4.0", "", { "dependencies": { "@noble/hashes": "^2.2.0", "neverthrow": "^8.2.0", "scale-ts": "^1.6.1" } }, "sha512-niZvQ/l5Eh4slCj4FtpNzY+zuW8371BpyQn/pQMZsayrg7mT4gxZNK9MM1GzL2SF3gVIzc7wj3KR6NtPbT+ydw=="],
 
-    "@parity/truapi-host": ["@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f", "", { "dependencies": { "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f" } }, "sha512-veBQxEQ3Ecq1Jd6VHfF1eRIps/X051X2CNBml89eVCSjNDwGI7rD7cfj0UJRiYMoKC7PxmF5UxpHn9eULmtaKA=="],
+    "@parity/truapi-host": ["@parity/truapi-host@0.1.0", "", { "dependencies": { "@parity/truapi": "^0.4.0" } }, "sha512-DbV9V2juXmj6LT2qi6X4qi1x5+G2mY1Kudv61+tsk1eXLVJzncfcyr/W1WbIgdEVuD81ZSORFpLmGmZ2Mxmgww=="],
 
     "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
 
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 657268e1..9c26349b 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -32,8 +32,8 @@
     "@dotli/storage": "workspace:*",
     "@dotli/truapi-debug": "workspace:*",
     "@noble/hashes": "^2.2.0",
-    "@parity/truapi": "npm:@pgherveou2/truapi-dev@0.3.1-bulletin.t20260714183005.14a5711f",
-    "@parity/truapi-host": "npm:@pgherveou2/truapi-host-dev@0.1.0-bulletin.t20260714183005.14a5711f",
+    "@parity/truapi": "0.4.0",
+    "@parity/truapi-host": "0.1.0",
     "@polkadot-api/json-rpc-provider": "^0.2.0",
     "@scure/base": "^2.2.0",
     "neverthrow": "^8.2.0",

From 0bf87e5f67086a900cf656320a4ed279bbadecc0 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 09:46:57 +0200
Subject: [PATCH 15/17] build: link local TrUAPI packages

bun run link:truapi replaces the two installed TrUAPI npm packages with
symlinks to a sibling TrUAPI checkout, and bun run unlink:truapi runs a
forced frozen install to restore the declared packages. Package
resolution is validated after linking so local E2E cannot silently
exercise a stale npm build. The parent truapi repo's make e2e-dotli
target depends on this script via make dotli-link.
---
 Makefile                       | 17 ++++++++--
 README.md                      | 20 ++++++++++++
 package.json                   |  2 ++
 scripts/link-truapi-local.ts   | 60 ++++++++++++++++++++++++++++++++++
 scripts/unlink-truapi-local.ts | 25 ++++++++++++++
 5 files changed, 122 insertions(+), 2 deletions(-)
 create mode 100644 scripts/link-truapi-local.ts
 create mode 100644 scripts/unlink-truapi-local.ts

diff --git a/Makefile b/Makefile
index ff261541..c601a924 100644
--- a/Makefile
+++ b/Makefile
@@ -59,17 +59,30 @@ RATE_LIMITED_ENVS := paseo dev-test
 # Default env when none is passed on the command line.
 ENV ?= paseo
 
+# When this repo is checked out as truapi/hosts/dotli, local make builds should
+# consume the checked-out TrUAPI packages instead of the temporary npm aliases.
+TRUAPI_REPO ?= $(abspath ../..)
+TRUAPI_LOCAL_PACKAGE := $(TRUAPI_REPO)/js/packages/truapi/package.json
+TRUAPI_HOST_LOCAL_PACKAGE := $(TRUAPI_REPO)/js/packages/truapi-host/package.json
+
 # Packages required on a fresh Ubuntu 22.04+ box. The brotli module is split
 # across two packages on noble (filter + static) and both ship a drop-in in
 # /etc/nginx/modules-enabled/ so they auto-load. curl and ca-certificates
 # back certbot's API calls.
 APT_PACKAGES := nginx libnginx-mod-http-brotli-filter libnginx-mod-http-brotli-static certbot python3-certbot-dns-cloudflare rsync ufw curl ca-certificates
 
-.PHONY: build provision provision-prereqs provision-firewall provision-cloudflare-creds provision-cert provision-renewal deploy ci-deploy deploy-nginx render-nginx _require-env _require-env-name
+.PHONY: build link-truapi-local provision provision-prereqs provision-firewall provision-cloudflare-creds provision-cert provision-renewal deploy ci-deploy deploy-nginx render-nginx _require-env _require-env-name
 
-build:
+build: link-truapi-local
 	bun run build
 
+link-truapi-local:
+	@if [ -f "$(TRUAPI_LOCAL_PACKAGE)" ] && [ -f "$(TRUAPI_HOST_LOCAL_PACKAGE)" ]; then \
+		TRUAPI_REPO="$(TRUAPI_REPO)" bun run link:truapi; \
+	else \
+		echo "No local TrUAPI checkout found at $(TRUAPI_REPO); using package manager dependencies."; \
+	fi
+
 # ====================================================================
 # Fresh-server provisioning. Idempotent; safe to re-run.
 #
diff --git a/README.md b/README.md
index 2ee0da81..74f7d6f1 100644
--- a/README.md
+++ b/README.md
@@ -154,6 +154,26 @@ bun install
 bun run preview          # Build + serve both apps on localhost:5173
 ```
 
+The TrUAPI packages are installed from temporary npm aliases while the Rust core
+port is in review. To iterate against a local truapi checkout instead, run:
+
+```bash
+bun run link:truapi
+```
+
+When dotli is not checked out under `truapi/hosts/dotli`, point the script at
+the truapi repo:
+
+```bash
+TRUAPI_REPO=/path/to/truapi bun run link:truapi
+```
+
+Return to the package versions recorded in `bun.lock` with:
+
+```bash
+bun run unlink:truapi
+```
+
 Local development uses wildcard subdomains:
 
 - `host-playground.localhost:5173` — resolves `host-playground.dot` via the host
diff --git a/package.json b/package.json
index 89475065..3f36ad7c 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,8 @@
     "format:check": "prettier --check \"**/*.{ts,tsx,md}\"",
     "typecheck": "turbo run typecheck",
     "set-version": "bun scripts/set-version.ts",
+    "link:truapi": "bun scripts/link-truapi-local.ts",
+    "unlink:truapi": "bun scripts/unlink-truapi-local.ts",
     "clean": "find . -type d \\( -name node_modules -o -name dist \\) -prune -exec rm -rf {} +"
   },
   "devDependencies": {
diff --git a/scripts/link-truapi-local.ts b/scripts/link-truapi-local.ts
new file mode 100644
index 00000000..e9681ffc
--- /dev/null
+++ b/scripts/link-truapi-local.ts
@@ -0,0 +1,60 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const dotliRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const truapiRoot = resolve(
+  process.env.TRUAPI_REPO ?? resolve(dotliRoot, "../.."),
+);
+
+const packages = [
+  {
+    name: "@parity/truapi",
+    path: resolve(truapiRoot, "js/packages/truapi"),
+  },
+  {
+    name: "@parity/truapi-host",
+    path: resolve(truapiRoot, "js/packages/truapi-host"),
+  },
+];
+
+function run(args: string[], cwd: string): void {
+  const result = spawnSync("bun", args, { cwd, stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+function assertPackage(expectedName: string, path: string): void {
+  const packageJsonPath = resolve(path, "package.json");
+  if (!existsSync(packageJsonPath)) {
+    throw new Error(
+      `Cannot find ${expectedName} at ${path}. Set TRUAPI_REPO=/path/to/truapi if dotli is not inside the truapi checkout.`,
+    );
+  }
+
+  const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8")) as {
+    name?: string;
+  };
+  if (packageJson.name !== expectedName) {
+    throw new Error(
+      `Expected ${packageJsonPath} to be ${expectedName}, got ${packageJson.name ?? "<missing>"}.`,
+    );
+  }
+}
+
+for (const pkg of packages) {
+  assertPackage(pkg.name, pkg.path);
+  run(["link"], pkg.path);
+}
+
+const packageNames = packages.map((pkg) => pkg.name);
+run(["link", ...packageNames], dotliRoot);
+
+for (const name of ["truapi", "truapi-host"]) {
+  rmSync(resolve(dotliRoot, "packages/ui/node_modules/@parity", name), {
+    force: true,
+    recursive: true,
+  });
+}
diff --git a/scripts/unlink-truapi-local.ts b/scripts/unlink-truapi-local.ts
new file mode 100644
index 00000000..618126fc
--- /dev/null
+++ b/scripts/unlink-truapi-local.ts
@@ -0,0 +1,25 @@
+import { spawnSync } from "node:child_process";
+import { rmSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const dotliRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const packageNames = ["truapi", "truapi-host"];
+const installRoots = [
+  resolve(dotliRoot, "node_modules/@parity"),
+  resolve(dotliRoot, "packages/ui/node_modules/@parity"),
+];
+
+for (const root of installRoots) {
+  for (const name of packageNames) {
+    rmSync(resolve(root, name), { force: true, recursive: true });
+  }
+}
+
+const result = spawnSync("bun", ["install", "--force"], {
+  cwd: dotliRoot,
+  stdio: "inherit",
+});
+if (result.status !== 0) {
+  process.exit(result.status ?? 1);
+}

From 95e8bacc9dc87c86d7dfabf7b819a64c1af31853 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:54:35 +0200
Subject: [PATCH 16/17] refactor(config): keep base formatting for unchanged
 gateway helpers

getActiveGatewayChains and its doc comment match the pre-port source;
only the core gateway set is new.
---
 packages/config/src/network.ts               | 13 +++++++++----
 packages/config/tests/gateway-chains.test.ts |  2 +-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/packages/config/src/network.ts b/packages/config/src/network.ts
index b601a3d1..f1da563b 100644
--- a/packages/config/src/network.ts
+++ b/packages/config/src/network.ts
@@ -270,13 +270,18 @@ export function getActiveSupportedGenesisHashes(): Set<string> {
 
 /**
  * Chains a sandboxed dApp can reach in **RPC-gateway** mode: the curated
- * system chains that have configured WSS RPC endpoints.
+ * system chains that have configured WSS RPC endpoints. The Bulletin chain is
+ * intentionally excluded even when it has an RPC - its content is served
+ * through IPFS gateways, not a chain RPC connection - so gateway mode never
+ * advertises it as a connectable dApp chain.
+ *
+ * Single source of truth shared by the host's chain-support advertisement
+ * (`isRemoteChainSupported`) and the gateway provider factory
+ * (`createRpcChainProvider`).
  */
 export function getActiveGatewayChains(): ChainService[] {
   const cfg = getActiveServicesConfig();
-  return [cfg.relay, cfg.assethub, cfg.people].filter(
-    (chain) => chain.rpcs.length > 0,
-  );
+  return [cfg.relay, cfg.assethub, cfg.people].filter((c) => c.rpcs.length > 0);
 }
 
 /** Genesis hashes (lowercased) a dApp can reach in RPC-gateway mode. */
diff --git a/packages/config/tests/gateway-chains.test.ts b/packages/config/tests/gateway-chains.test.ts
index a6ce4d58..45767ac9 100644
--- a/packages/config/tests/gateway-chains.test.ts
+++ b/packages/config/tests/gateway-chains.test.ts
@@ -30,7 +30,7 @@ describe("gateway-supported chains (rpc-gateway mode)", () => {
     expect(hashes.has(v2.people.genesis.toLowerCase())).toBe(true);
   });
 
-  it("does not advertise the Bulletin chain to sandboxed dApps", () => {
+  it("excludes the Bulletin chain (content served via IPFS, not chain RPC)", () => {
     const hashes = getActiveGatewaySupportedGenesisHashes();
     expect(hashes.has(v2.bulletin.genesis.toLowerCase())).toBe(false);
   });

From d1640a1db448b05478247cb0388b6b970632885a Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Thu, 16 Jul 2026 08:56:46 +0200
Subject: [PATCH 17/17] fix(ui): translate legacy Nova follow ids

Nova exposes synthetic follow ids to legacy products, while the Rust core requires the subscription wire request id. Translate only at the legacy window boundary so existing product-sdk apps keep working without weakening core validation.
---
 packages/ui/src/bridge.ts                    |  11 +-
 packages/ui/src/legacy-host-bridge.ts        | 189 ++++++++++++-
 packages/ui/tests/legacy-host-bridge.test.ts | 273 +++++++++++++++++++
 3 files changed, 465 insertions(+), 8 deletions(-)
 create mode 100644 packages/ui/tests/legacy-host-bridge.test.ts

diff --git a/packages/ui/src/bridge.ts b/packages/ui/src/bridge.ts
index 3a4d838e..abeb2aaf 100644
--- a/packages/ui/src/bridge.ts
+++ b/packages/ui/src/bridge.ts
@@ -43,7 +43,10 @@ import { dispatchAuthState } from "./host-callbacks/AuthState";
 import { onStoredSessionChanged } from "./host-callbacks/SessionStore";
 import { LoginRequestError } from "./login-request-error";
 import { createTruapiRuntimeConfig } from "./runtime-config";
-import { createWindowMessageProvider } from "./legacy-host-bridge";
+import {
+  createLegacyNovaChainHeadProvider,
+  createWindowMessageProvider,
+} from "./legacy-host-bridge";
 
 // DEPRECATED: enables the legacy Nova host-api transport shim for products that
 // have not yet migrated to `@parity/truapi`. Remove once they have.
@@ -571,11 +574,13 @@ async function createHost(args: {
         legacyProbeCleanup?.();
         // Drop the unused modern MessagePort pipe before rewiring.
         cleanupProductSide();
-        const legacyProvider = createWindowMessageProvider(targetWindow);
+        const windowProvider = createWindowMessageProvider(targetWindow);
+        const legacyProvider =
+          createLegacyNovaChainHeadProvider(windowProvider);
         productProvider = legacyProvider;
         disposePipe = pipeProviders(legacyProvider, coreProvider, pipeArgs);
         // Replay the handshake frame the probe just consumed.
-        legacyProvider.injectInbound(event.data);
+        windowProvider.injectInbound(event.data);
       } else if (
         (event.data as { type?: unknown } | null)?.type === "truapi-ready"
       ) {
diff --git a/packages/ui/src/legacy-host-bridge.ts b/packages/ui/src/legacy-host-bridge.ts
index 9d67628d..dc0ab35a 100644
--- a/packages/ui/src/legacy-host-bridge.ts
+++ b/packages/ui/src/legacy-host-bridge.ts
@@ -2,15 +2,102 @@
 //
 // The TrUAPI host shuttles product frames over a transferred `MessagePort`.
 // Products built on the older Nova host-api stack (the `@novasamatech` packages;
-// e.g. apps still on `@parity/product-sdk`) instead shuttle the SAME wire bytes
-// the old way: raw `Uint8Array` frames to/from `window.parent`. Only the
-// transport differs, so this is a pure byte bridge — no per-method translation,
-// no `@novasamatech/*` dependency.
+// e.g. apps still on `@parity/product-sdk`) instead shuttle raw `Uint8Array`
+// frames to/from `window.parent`. Nova also exposes synthetic chain-head follow
+// ids to PAPI, so the legacy provider translates those ids back to their TrUAPI
+// subscription wire ids. No `@novasamatech/*` dependency is needed.
 //
 // Remove this file (and the probe in `bridge.ts`) once products migrate to
 // `@parity/truapi`.
 
-import type { WireProvider } from "@parity/truapi";
+import {
+  decodeWireMessage,
+  encodeWireMessage,
+  VersionedRemoteChainHeadBodyRequest,
+  VersionedRemoteChainHeadCallRequest,
+  VersionedRemoteChainHeadContinueRequest,
+  VersionedRemoteChainHeadFollowRequest,
+  VersionedRemoteChainHeadHeaderRequest,
+  VersionedRemoteChainHeadStopOperationRequest,
+  VersionedRemoteChainHeadStorageRequest,
+  VersionedRemoteChainHeadUnpinRequest,
+  type Codec,
+  type WireProvider,
+} from "@parity/truapi";
+import {
+  CHAIN_CALL_HEAD,
+  CHAIN_CONTINUE_HEAD,
+  CHAIN_FOLLOW_HEAD_SUBSCRIBE,
+  CHAIN_GET_HEAD_BODY,
+  CHAIN_GET_HEAD_HEADER,
+  CHAIN_GET_HEAD_STORAGE,
+  CHAIN_STOP_HEAD_OPERATION,
+  CHAIN_UNPIN_HEAD,
+} from "@parity/truapi/wire-table";
+
+interface VersionedFollowBoundRequest {
+  tag: "V1";
+  value: {
+    genesisHash: string;
+    followSubscriptionId: string;
+  };
+}
+
+interface DecodedFollowBoundRequest {
+  genesisHash: string;
+  withFollowSubscriptionId(followSubscriptionId: string): Uint8Array;
+}
+
+type FollowBoundDecoder = (payload: Uint8Array) => DecodedFollowBoundRequest;
+
+function createFollowBoundDecoder<T extends VersionedFollowBoundRequest>(
+  codec: Codec<T>,
+): FollowBoundDecoder {
+  return (payload) => {
+    const request = codec.dec(payload);
+    return {
+      genesisHash: request.value.genesisHash,
+      withFollowSubscriptionId(followSubscriptionId) {
+        if (request.value.followSubscriptionId === followSubscriptionId) {
+          return payload;
+        }
+        request.value.followSubscriptionId = followSubscriptionId;
+        return codec.enc(request);
+      },
+    };
+  };
+}
+
+const followBoundDecoders = new Map<number, FollowBoundDecoder>([
+  [
+    CHAIN_GET_HEAD_HEADER.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadHeaderRequest),
+  ],
+  [
+    CHAIN_GET_HEAD_BODY.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadBodyRequest),
+  ],
+  [
+    CHAIN_GET_HEAD_STORAGE.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadStorageRequest),
+  ],
+  [
+    CHAIN_CALL_HEAD.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadCallRequest),
+  ],
+  [
+    CHAIN_UNPIN_HEAD.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadUnpinRequest),
+  ],
+  [
+    CHAIN_CONTINUE_HEAD.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadContinueRequest),
+  ],
+  [
+    CHAIN_STOP_HEAD_OPERATION.request,
+    createFollowBoundDecoder(VersionedRemoteChainHeadStopOperationRequest),
+  ],
+]);
 
 /**
  * A {@link WireProvider} over `window.postMessage`, matching the legacy Nova
@@ -22,6 +109,98 @@ export interface WindowMessageProvider extends WireProvider {
   injectInbound(message: Uint8Array): void;
 }
 
+/**
+ * Translate Nova's synthetic chain-head follow ids at the legacy transport
+ * boundary. The old Nova host selected the first active follow for a chain;
+ * retain that behavior while the Rust core requires the exact subscription
+ * start frame's request id.
+ */
+export function createLegacyNovaChainHeadProvider(
+  provider: WireProvider,
+): WireProvider {
+  const followIdsByGenesis = new Map<string, Set<string>>();
+
+  const rewrite = (message: Uint8Array): Uint8Array => {
+    const decoded = decodeWireMessage(message);
+    if (decoded.isErr()) {
+      return message;
+    }
+
+    const { requestId, payload } = decoded.value;
+    if (payload.id === CHAIN_FOLLOW_HEAD_SUBSCRIBE.start) {
+      let genesisHash: string;
+      try {
+        const request = VersionedRemoteChainHeadFollowRequest.dec(
+          payload.value,
+        );
+        genesisHash = request.value.genesisHash;
+      } catch {
+        // Let the core report malformed legacy frames.
+        return message;
+      }
+      const followIds = followIdsByGenesis.get(genesisHash) ?? new Set();
+      followIds.add(requestId);
+      followIdsByGenesis.set(genesisHash, followIds);
+      return message;
+    }
+
+    if (payload.id === CHAIN_FOLLOW_HEAD_SUBSCRIBE.stop) {
+      for (const [genesisHash, followIds] of followIdsByGenesis) {
+        followIds.delete(requestId);
+        if (followIds.size === 0) {
+          followIdsByGenesis.delete(genesisHash);
+        }
+      }
+      return message;
+    }
+
+    const decodeFollowBoundRequest = followBoundDecoders.get(payload.id);
+    if (!decodeFollowBoundRequest) {
+      return message;
+    }
+
+    try {
+      const request = decodeFollowBoundRequest(payload.value);
+      const followId = followIdsByGenesis
+        .get(request.genesisHash)
+        ?.values()
+        .next().value;
+      if (followId === undefined) {
+        return message;
+      }
+
+      const encoded = encodeWireMessage({
+        requestId,
+        payload: {
+          id: payload.id,
+          value: request.withFollowSubscriptionId(followId),
+        },
+      });
+      return encoded.isOk() ? encoded.value : message;
+    } catch {
+      return message;
+    }
+  };
+
+  const subscribeClose = provider.subscribeClose?.bind(provider);
+
+  return {
+    postMessage(message) {
+      provider.postMessage(message);
+    },
+    subscribe(callback) {
+      return provider.subscribe((message) => {
+        callback(rewrite(message));
+      });
+    },
+    subscribeClose,
+    dispose() {
+      followIdsByGenesis.clear();
+      provider.dispose();
+    },
+  };
+}
+
 let warned = false;
 
 export function createWindowMessageProvider(
diff --git a/packages/ui/tests/legacy-host-bridge.test.ts b/packages/ui/tests/legacy-host-bridge.test.ts
new file mode 100644
index 00000000..f91e6499
--- /dev/null
+++ b/packages/ui/tests/legacy-host-bridge.test.ts
@@ -0,0 +1,273 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  decodeWireMessage,
+  encodeWireMessage,
+  VersionedRemoteChainHeadBodyRequest,
+  VersionedRemoteChainHeadCallRequest,
+  VersionedRemoteChainHeadContinueRequest,
+  VersionedRemoteChainHeadFollowRequest,
+  VersionedRemoteChainHeadHeaderRequest,
+  VersionedRemoteChainHeadStopOperationRequest,
+  VersionedRemoteChainHeadStorageRequest,
+  VersionedRemoteChainHeadUnpinRequest,
+  type Codec,
+  type WireProvider,
+} from "@parity/truapi";
+import {
+  CHAIN_CALL_HEAD,
+  CHAIN_CONTINUE_HEAD,
+  CHAIN_FOLLOW_HEAD_SUBSCRIBE,
+  CHAIN_GET_HEAD_BODY,
+  CHAIN_GET_HEAD_HEADER,
+  CHAIN_GET_HEAD_STORAGE,
+  CHAIN_STOP_HEAD_OPERATION,
+  CHAIN_UNPIN_HEAD,
+} from "@parity/truapi/wire-table";
+import { createLegacyNovaChainHeadProvider } from "@dotli/ui/legacy-host-bridge";
+
+const genesisHash = `0x${"11".repeat(32)}` as const;
+const blockHash = `0x${"22".repeat(32)}` as const;
+
+type FollowBoundRequest = {
+  tag: "V1";
+  value: {
+    genesisHash: string;
+    followSubscriptionId: string;
+  };
+};
+
+function unwrap<T>(result: { isErr(): boolean; value: T; error: unknown }): T {
+  if (result.isErr()) {
+    throw result.error;
+  }
+  return result.value;
+}
+
+function createHarness(): {
+  adapted: WireProvider;
+  emit(message: Uint8Array): void;
+  received: Uint8Array[];
+  dispose: ReturnType<typeof vi.fn>;
+} {
+  let listener: ((message: Uint8Array) => void) | undefined;
+  const dispose = vi.fn();
+  const provider: WireProvider = {
+    postMessage: vi.fn(),
+    subscribe(callback) {
+      listener = callback;
+      return () => {
+        listener = undefined;
+      };
+    },
+    dispose,
+  };
+  const adapted = createLegacyNovaChainHeadProvider(provider);
+  const received: Uint8Array[] = [];
+  adapted.subscribe((message) => received.push(message));
+  return {
+    adapted,
+    emit(message) {
+      listener?.(message);
+    },
+    received,
+    dispose,
+  };
+}
+
+function frame(requestId: string, id: number, value: Uint8Array): Uint8Array {
+  return unwrap(
+    encodeWireMessage({
+      requestId,
+      payload: { id, value },
+    }),
+  );
+}
+
+function followStart(requestId: string): Uint8Array {
+  return frame(
+    requestId,
+    CHAIN_FOLLOW_HEAD_SUBSCRIBE.start,
+    VersionedRemoteChainHeadFollowRequest.enc({
+      tag: "V1",
+      value: { genesisHash, withRuntime: true },
+    }),
+  );
+}
+
+function followStop(requestId: string): Uint8Array {
+  return frame(requestId, CHAIN_FOLLOW_HEAD_SUBSCRIBE.stop, new Uint8Array());
+}
+
+function followBoundFrame<T extends FollowBoundRequest>(
+  requestId: string,
+  id: number,
+  codec: Codec<T>,
+  request: T,
+): Uint8Array {
+  return frame(requestId, id, codec.enc(request));
+}
+
+function decodedFollowId<T extends FollowBoundRequest>(
+  message: Uint8Array,
+  codec: Codec<T>,
+): string {
+  const decoded = unwrap(decodeWireMessage(message));
+  return codec.dec(decoded.payload.value).value.followSubscriptionId;
+}
+
+describe("createLegacyNovaChainHeadProvider", () => {
+  it("rewrites every follow-bound request to the active wire follow id", () => {
+    const harness = createHarness();
+    harness.emit(followStart("wire-follow"));
+
+    const cases = [
+      {
+        id: CHAIN_GET_HEAD_HEADER.request,
+        codec: VersionedRemoteChainHeadHeaderRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            hash: blockHash,
+          },
+        },
+      },
+      {
+        id: CHAIN_GET_HEAD_BODY.request,
+        codec: VersionedRemoteChainHeadBodyRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            hash: blockHash,
+          },
+        },
+      },
+      {
+        id: CHAIN_GET_HEAD_STORAGE.request,
+        codec: VersionedRemoteChainHeadStorageRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            hash: blockHash,
+            items: [],
+          },
+        },
+      },
+      {
+        id: CHAIN_CALL_HEAD.request,
+        codec: VersionedRemoteChainHeadCallRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            hash: blockHash,
+            function: "Metadata_metadata",
+            callParameters: "0x" as const,
+          },
+        },
+      },
+      {
+        id: CHAIN_UNPIN_HEAD.request,
+        codec: VersionedRemoteChainHeadUnpinRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            hashes: [blockHash],
+          },
+        },
+      },
+      {
+        id: CHAIN_CONTINUE_HEAD.request,
+        codec: VersionedRemoteChainHeadContinueRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            operationId: "operation-1",
+          },
+        },
+      },
+      {
+        id: CHAIN_STOP_HEAD_OPERATION.request,
+        codec: VersionedRemoteChainHeadStopOperationRequest,
+        request: {
+          tag: "V1",
+          value: {
+            genesisHash,
+            followSubscriptionId: "follow_0",
+            operationId: "operation-1",
+          },
+        },
+      },
+    ] as const;
+
+    for (const [index, item] of cases.entries()) {
+      harness.emit(
+        followBoundFrame(
+          `request-${index}`,
+          item.id,
+          item.codec as Codec<FollowBoundRequest>,
+          item.request,
+        ),
+      );
+      expect(
+        decodedFollowId(
+          harness.received.at(-1)!,
+          item.codec as Codec<FollowBoundRequest>,
+        ),
+      ).toBe("wire-follow");
+    }
+  });
+
+  it("retains the first follow until that exact subscription stops", () => {
+    const harness = createHarness();
+    const request = {
+      tag: "V1",
+      value: { genesisHash, followSubscriptionId: "follow_0", hash: blockHash },
+    } as const;
+    const emitHeader = (): string => {
+      harness.emit(
+        followBoundFrame(
+          "header-request",
+          CHAIN_GET_HEAD_HEADER.request,
+          VersionedRemoteChainHeadHeaderRequest,
+          request,
+        ),
+      );
+      return decodedFollowId(
+        harness.received.at(-1)!,
+        VersionedRemoteChainHeadHeaderRequest,
+      );
+    };
+
+    harness.emit(followStart("wire-first"));
+    harness.emit(followStart("wire-second"));
+    expect(emitHeader()).toBe("wire-first");
+
+    harness.emit(followStop("wire-second"));
+    expect(emitHeader()).toBe("wire-first");
+
+    harness.emit(followStop("wire-first"));
+    expect(emitHeader()).toBe("follow_0");
+
+    harness.emit(followStart("wire-refollow"));
+    expect(emitHeader()).toBe("wire-refollow");
+  });
+
+  it("owns and disposes the wrapped provider", () => {
+    const harness = createHarness();
+
+    harness.adapted.dispose();
+
+    expect(harness.dispose).toHaveBeenCalledOnce();
+  });
+});