diff --git a/Cargo.lock b/Cargo.lock
index 3fd3b5a09..2a3a0e2f2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5102,6 +5102,7 @@ dependencies = [
  "anyhow",
  "arboard",
  "async-trait",
+ "base64",
  "bip39",
  "clap",
  "crossterm",
diff --git a/hosts/dotli b/hosts/dotli
index 29ef38b6c..3592073c2 160000
--- a/hosts/dotli
+++ b/hosts/dotli
@@ -1 +1 @@
-Subproject commit 29ef38b6c144b2048c17f9404878801b1492fed0
+Subproject commit 3592073c29121a8fdaabdfce2314dcded42e2a46
diff --git a/ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift b/ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift
index 9ae61ebfc..8aba9428a 100644
--- a/ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift
+++ b/ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift
@@ -1118,7 +1118,7 @@ public struct SessionUiInfo: Equatable, Hashable {
      */
     public var publicKey: Bytes32
     /**
-     * Wallet identity account id used for People-chain username lookup.
+     * Wallet identity account id used for the dotNS username lookup on Asset Hub.
      */
     public var identityAccountId: Bytes32?
     /**
@@ -1139,11 +1139,11 @@ public struct SessionUiInfo: Equatable, Hashable {
      */
     public var peerStatementAccountId: Bytes32?
     /**
-     * Short username from the People-chain identity record.
+     * Short username from the dotNS identity record on Asset Hub.
      */
     public var liteUsername: String?
     /**
-     * Fully qualified username from the People-chain identity record.
+     * Fully qualified username from the dotNS identity record on Asset Hub.
      */
     public var fullUsername: String?
 
@@ -1154,7 +1154,7 @@ public struct SessionUiInfo: Equatable, Hashable {
          * 32-byte sr25519 root public key of the active session.
          */publicKey: Bytes32,
         /**
-         * Wallet identity account id used for People-chain username lookup.
+         * Wallet identity account id used for the dotNS username lookup on Asset Hub.
          */identityAccountId: Bytes32?,
         /**
          * X25519 public key addressing this identity in chat. Public counterpart
@@ -1171,10 +1171,10 @@ public struct SessionUiInfo: Equatable, Hashable {
          * device discriminator; use [`Self::device_enc_public_key`] for that.
          */peerStatementAccountId: Bytes32?,
         /**
-         * Short username from the People-chain identity record.
+         * Short username from the dotNS identity record on Asset Hub.
          */liteUsername: String?,
         /**
-         * Fully qualified username from the People-chain identity record.
+         * Fully qualified username from the dotNS identity record on Asset Hub.
          */fullUsername: String?) {
         self.publicKey = publicKey
         self.identityAccountId = identityAccountId
diff --git a/js/packages/truapi-host/src/runtime.ts b/js/packages/truapi-host/src/runtime.ts
index a8ca98fe6..dde284138 100644
--- a/js/packages/truapi-host/src/runtime.ts
+++ b/js/packages/truapi-host/src/runtime.ts
@@ -81,7 +81,7 @@ export interface ProductRuntimeConfig {
     /** Platform or operating-system version. */
     version?: string;
   };
-  /** People-chain configuration used for identity lookup. */
+  /** People-chain configuration used for statement-store SSO. */
   people: {
     /** People-chain genesis hash. */
     genesisHash: string | Uint8Array;
@@ -91,6 +91,11 @@ export interface ProductRuntimeConfig {
     /** Bulletin-chain genesis hash. */
     genesisHash: string | Uint8Array;
   };
+  /** Asset Hub configuration used to resolve session usernames from dotNS. */
+  assetHub: {
+    /** Asset Hub genesis hash. */
+    genesisHash: string | Uint8Array;
+  };
   /** Wallet pairing configuration. */
   pairing: {
     /** URI scheme used for wallet pairing deeplinks. */
diff --git a/js/packages/truapi-host/src/web/worker-provider.test.ts b/js/packages/truapi-host/src/web/worker-provider.test.ts
index 6b73524f3..4fc18d4a3 100644
--- a/js/packages/truapi-host/src/web/worker-provider.test.ts
+++ b/js/packages/truapi-host/src/web/worker-provider.test.ts
@@ -96,6 +96,10 @@ function runtimeConfig(
       genesisHash:
         "0xbbcccc1cbe333151b8ed63b17e9e0dec61ee53b57296f1fbe2d161ae3e6fb4dc",
     },
+    assetHub: {
+      genesisHash:
+        "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+    },
     pairing: {
       deeplinkScheme: "polkadotapp",
     },
diff --git a/js/packages/truapi-host/src/worker-runtime.ts b/js/packages/truapi-host/src/worker-runtime.ts
index 3062a4611..4cb318e52 100644
--- a/js/packages/truapi-host/src/worker-runtime.ts
+++ b/js/packages/truapi-host/src/worker-runtime.ts
@@ -108,7 +108,7 @@ interface WorkerChainConnection {
  * Worker-side half of the host chain-connect bridge.
  *
  * The Rust core runs in this worker but owns no socket. When it needs chain
- * access (chainHead v1 for People-chain identity / statement-store SSO) it
+ * access (chainHead v1 for dotNS identity on Asset Hub / statement-store SSO) it
  * calls this; the actual transport lives on the host main thread and is reached
  * over postMessage. The data crossing here is JSON-RPC strings, not SCALE: only
  * the product<->core wire is SCALE.
@@ -117,7 +117,7 @@ interface WorkerChainConnection {
  *   +-------------------+  SCALE  +--------------------------+      +--------------------------------+
  *   | Product (iframe)  |<------->| truapi-server WASM core  |      | host.connect() (ChainProvider) |
  *   | speaks TrUAPI     |  frames | chainHead v1, SSO,       |      | host-owned JSON-RPC transport  |
- *   | never sees chains |         | People-chain identity    |      | remote RPC, native client, ... |
+ *   | never sees chains |         | dotNS identity (AH)      |      | remote RPC, native client, ... |
  *   +-------------------+         +--------------------------+      +--------------------------------+
  *                                      |   ^  JSON-RPC strings (not SCALE)        ^   |
  *                       chainConnect() |   | onResponse(json)           connect   |   | responses()
diff --git a/playground/src/lib/example-helpers.ts b/playground/src/lib/example-helpers.ts
index 47e436ccd..f624522fc 100644
--- a/playground/src/lib/example-helpers.ts
+++ b/playground/src/lib/example-helpers.ts
@@ -1,6 +1,6 @@
 import { Observable } from "rxjs";
 import { err, ok, type Result } from "neverthrow";
-import { PASEO_NEXT_V2_INDIVIDUALITY } from "@parity/truapi";
+import { PASEO_NEXT_V2_ASSET_HUB } from "@parity/truapi";
 import {
   AccountId,
   Blake2128Concat,
@@ -51,7 +51,10 @@ export type BuildCreateTransactionPayload = (opts: {
   callData: HexString;
 }) => Promise<Result<ProductAccountTxPayload, Error>>;
 
-const usernameOwnerOfStorage = Storage("Resources")("UsernameOwnerOf", [
+// Lite usernames are keyed by their dotted label ("alice.01") on the Asset
+// Hub gateway pallet. Full-person ownership lives contract-side as H160 only.
+// Name→account resolution therefore covers lite usernames.
+const liteLabelOwnerStorage = Storage("DotnsGateway")("LiteLabelOwner", [
   Bytes(),
   Blake2128Concat,
 ]);
@@ -113,7 +116,7 @@ export function createAccountIdForDotNsUsername(
       return err(new Error("DotNS username is empty"));
     }
 
-    const key = usernameOwnerOfStorage.enc(
+    const key = liteLabelOwnerStorage.enc(
       new TextEncoder().encode(dotNsUsername),
     ) as HexString;
 
@@ -137,7 +140,7 @@ export function createAccountIdForDotNsUsername(
         switch (item.tag) {
           case "Initialized": {
             const result = await truapi.chain.getHeadStorage({
-              genesisHash: PASEO_NEXT_V2_INDIVIDUALITY.genesis,
+              genesisHash: PASEO_NEXT_V2_ASSET_HUB.genesis,
               followSubscriptionId: sub.subscriptionId,
               hash: item.value.finalizedBlockHashes[0],
               items: [{ key, queryType: "Value" }],
@@ -188,7 +191,7 @@ export function createAccountIdForDotNsUsername(
       const sub = truapi.chain
         .followHeadSubscribe({
           request: {
-            genesisHash: PASEO_NEXT_V2_INDIVIDUALITY.genesis,
+            genesisHash: PASEO_NEXT_V2_ASSET_HUB.genesis,
             withRuntime: false,
           },
         })
diff --git a/rust/crates/truapi-codegen/tests/golden/host-callbacks.ts b/rust/crates/truapi-codegen/tests/golden/host-callbacks.ts
index d31dc2f1a..ef084e64e 100644
--- a/rust/crates/truapi-codegen/tests/golden/host-callbacks.ts
+++ b/rust/crates/truapi-codegen/tests/golden/host-callbacks.ts
@@ -370,7 +370,7 @@ export interface SessionUiInfo {
   publicKey: Bytes32;
 
   /**
-   * Wallet identity account id used for People-chain username lookup.
+   * Wallet identity account id used for the dotNS username lookup on Asset Hub.
    */
   identityAccountId?: Bytes32;
 
@@ -395,12 +395,12 @@ export interface SessionUiInfo {
   peerStatementAccountId?: Bytes32;
 
   /**
-   * Short username from the People-chain identity record.
+   * Short username from the dotNS identity record on Asset Hub.
    */
   liteUsername?: string;
 
   /**
-   * Fully qualified username from the People-chain identity record.
+   * Fully qualified username from the dotNS identity record on Asset Hub.
    */
   fullUsername?: string;
 }
diff --git a/rust/crates/truapi-host-cli/Cargo.toml b/rust/crates/truapi-host-cli/Cargo.toml
index c07962f5e..8c5fe62d4 100644
--- a/rust/crates/truapi-host-cli/Cargo.toml
+++ b/rust/crates/truapi-host-cli/Cargo.toml
@@ -19,6 +19,7 @@ truapi-server = { path = "../truapi-server" }
 anyhow = "1"
 arboard = { version = "3.6.1", default-features = false }
 async-trait = "0.1"
+base64 = "0.22"
 bip39 = { version = "2", features = ["rand"] }
 clap = { version = "4", features = ["derive", "env"] }
 crossterm = { version = "0.29", features = ["event-stream"] }
diff --git a/rust/crates/truapi-host-cli/README.md b/rust/crates/truapi-host-cli/README.md
index 2dae02e58..b10c001d1 100644
--- a/rust/crates/truapi-host-cli/README.md
+++ b/rust/crates/truapi-host-cli/README.md
@@ -21,7 +21,8 @@ One binary, `truapi-host`:
 | --- | --- |
 | `pairing-host` | Seedless host: serves product frames, emits pairing deeplinks, and can run product scripts. |
 | `signing-host` | Wallet-local host: owns signer identity, can run product scripts, accepts pairing deeplinks, registers statement allowance on-chain, signs. |
-| `identity-check` | Probe the root and canonical `uid.dot` identity account for a registered username. |
+| `identity-check` | Probe the root and canonical `uid.dot` identity account for a registered username (read from the dotNS contracts on Asset Hub). |
+| `register-name` | Register a full-person username via `DotnsGateway.register_name` on Asset Hub, linked to a lite username or standalone with a chat key. |
 | `alloc-check` | Diagnose (or `--submit`) on-chain statement-store allowance: ring membership, chosen slot, and the `set_statement_store_account` extrinsic. On a full period it prints each occupied slot's age and which one would be replaced. |
 | `pgas-check` | Diagnose (or `--submit`) an Asset Hub PGAS allowance claim: ring membership on People, whether Asset Hub has imported that ring revision, the day's first unclaimed slot, and the `Pgas.claim_pgas` extrinsic. |
 
@@ -174,7 +175,9 @@ New auto-managed accounts use the session name as their Lite username prefix;
 characters other than lowercase letters are omitted. For example, session
 `pgtest` creates usernames beginning with `pgtest`. An explicit
 `--lite-username-prefix` takes precedence, and `default` retains the historical
-`headless` prefix.
+`headless` prefix. `--reserved-username <label>` additionally reserves a
+full-person base name on dotNS for a newly created account, to be claimed later
+with `register-name`; the CLI refuses labels the registrar has already minted.
 The selected username and last script reference are cached in `session.json`
 inside the displayed session path. Scratch scripts use a portable filename;
 explicit scripts use an absolute path. On restart, an
@@ -458,20 +461,15 @@ The network preset owns the identity backend URL, the People, Bulletin and Asset
 Hub RPCs, and their genesis hashes; there is
 no public `--statement-store` flag. Pick `previewnet` when a product's runtime
 descriptors target previewnet, so its statements, its host chain routes and its
-own chain reads all land on one network. Sessions are per preset, so each network
-gets its own signer identity on the same machine.
-
-One limit on `previewnet` today: its identity backend requires a bearer token for
-write requests, so auto-provisioning a fresh lite username fails with
-
-```
-username registration failed (401 Unauthorized): Missing Authorization Header
-```
-
-Reads against it work, and everything that does not go through the backend works
-normally, so use `--mnemonic` (or `HOST_CLI_SIGNER_MNEMONIC`) with an account that
-already carries a previewnet username. `paseo-next-v2` still provisions on its
-own, unauthenticated. Both also accept `--frame-listen <address>`
+own chain reads all land on one network — it is also the only preset whose
+identity backend currently onboards new auto accounts through the dotNS gateway
+(the CLI mints the backend's bearer token itself; SPEC.md §12.3). Sessions are
+per preset, so each network gets its own signer identity on the same machine.
+`HOST_CLI_IDENTITY_BACKEND_BASE` swaps only
+the identity backend (for a local one); `HOST_CLI_IDENTITY_BACKEND_TOKEN`
+supplies its bearer token instead of the CLI minting one; and
+`HOST_CLI_DOTNS_POP_CONTROLLER` overrides on-chain `DotnsPopController`
+discovery (see SPEC.md §21). Both also accept `--frame-listen <address>`
 to opt into a TCP product-frame WebSocket; without it, the CLI creates and
 cleans up a unique temporary Unix socket.
 
@@ -525,8 +523,8 @@ one-shot modes.
 - **Ring-VRF product-account aliases and proofs** are implemented by the
   signing host via the `verifiable` crate (`get_account_alias` and
   `create_account_proof`).
-- **`get_user_id`** resolves the signing account's username from People-chain
-  `Resources.Consumers`. Auto-managed signing accounts register fresh lite
+- **`get_user_id`** resolves the signing account's username from the dotNS
+  contracts on Asset Hub. Auto-managed signing accounts register fresh lite
   usernames via the identity backend (`src/attestation.rs`); first registration
   is backend-async and can take minutes (ring onboarding). `truapi-host
   identity-check --mnemonic <m>` probes which derivation carries a username.
diff --git a/rust/crates/truapi-host-cli/SPEC.md b/rust/crates/truapi-host-cli/SPEC.md
index 21b805186..7ba38f1ce 100644
--- a/rust/crates/truapi-host-cli/SPEC.md
+++ b/rust/crates/truapi-host-cli/SPEC.md
@@ -114,7 +114,7 @@ as the paired path.
 `truapi-host-cli` owns:
 
 - argument and slash-command parsing;
-- the single supported network preset;
+- the supported network presets (`paseo-next-v2`, `previewnet`);
 - local signer selection and onboarding;
 - local persistence and account-store locking;
 - approvals and `--auto-accept`;
@@ -198,7 +198,8 @@ Commands:
 | --- | --- |
 | `pairing-host` | Run the seedless product-facing host. |
 | `signing-host` | Run the wallet-local signing host. |
-| `identity-check` | Probe People-chain identity records for a mnemonic. |
+| `identity-check` | Probe dotNS identity records on Asset Hub for a mnemonic. |
+| `register-name` | Register a full-person username via `DotnsGateway.register_name`. |
 | `alloc-check` | Inspect or submit Statement Store allowance registration. |
 | `pgas-check` | Inspect or submit an Asset Hub PGAS allowance claim. |
 
@@ -231,7 +232,7 @@ truapi-host pairing-host [options]
 | `--product-id <id>` | `headless-playground.dot` | Initial product scope. |
 | `--frame-listen <socket>` | none | Opt into a TCP product WebSocket listener. When omitted, use a private per-process Unix socket. Port `0` selects an available TCP port. |
 | `--base-path <path>` | section 12.1 | Root for network, identity, core, script, and product state. |
-| `--network <preset>` | `paseo-next-v2` | Select the complete endpoint/genesis preset. |
+| `--network <preset>` | `paseo-next-v2` | Select the complete endpoint/genesis preset (`paseo-next-v2`, `previewnet`). |
 | `--auto-accept` | off | Approve platform confirmations automatically. |
 
 Without `--script`, both stdin and stdout must be terminals. The command enters
@@ -268,8 +269,9 @@ truapi-host signing-host [options] [exec '<slash-command>']
 | `--account <name>` | none | Use one named account from the default account store. |
 | `--session <name>` | remembered session | Restore or create a managed session. |
 | `--lite-username-prefix <prefix>` | session-derived | Prefix for newly generated Lite username bases. |
+| `--reserved-username <label>` | none | Full-person base name a newly created auto account reserves on dotNS alongside its lite username (§12.3). |
 | `--base-path <path>` | section 12.1 | Root for account, session, core, script, and product state. |
-| `--network <preset>` | `paseo-next-v2` | Select the complete endpoint/genesis preset. |
+| `--network <preset>` | `paseo-next-v2` | Select the complete endpoint/genesis preset (`paseo-next-v2`, `previewnet`). |
 | `--frame-listen <socket>` | none | Opt into a TCP product WebSocket listener. When omitted, use a private per-process Unix socket. Port `0` is allowed. |
 | `--auto-accept` | off | Approve platform confirmations automatically. |
 
@@ -283,9 +285,11 @@ startup:
 - `--script` with `exec`;
 - `--mnemonic` with `--account`;
 - `--mnemonic` with `--session`;
-- `--mnemonic` with `--lite-username-prefix`;
-- `--account` with `--session`; and
-- `--account` with `--lite-username-prefix`.
+- `--mnemonic` with `--lite-username-prefix` or `--reserved-username`;
+- `--account` with `--session`;
+- `--account` with `--lite-username-prefix` or `--reserved-username`; and
+- a `--reserved-username` that is not a full-person base label (lowercase ASCII
+  letters only, 6 to 32 bytes).
 
 The same conflicts apply when the mnemonic came from
 `HOST_CLI_SIGNER_MNEMONIC`.
@@ -813,14 +817,31 @@ A new auto account:
 4. chooses `auto-<n>` as its local name;
 5. tries up to eight available Lite username bases;
 6. saves a pending account record;
-7. builds and submits identity-backend registration proofs;
-8. polls `Resources.Consumers` for the final `name.discriminator`;
+7. builds and submits identity-backend registration proofs, including the dotNS
+   gateway reservation signature timestamped with Asset Hub chain time. A
+   reserved base name (`--reserved-username`) must be a full-person label and
+   unminted on the dotNS registrar (`DotnsRegistrar.ownerOf` reverts for its
+   node under the network TLD): a reservation for a registered name could never
+   be claimed and would hold that stem's reservation queue for the whole
+   reservation window;
+8. polls the dotNS contracts on Asset Hub for the final `name.discriminator`;
 9. waits for inclusion in a personhood ring; and
 10. marks and saves the account as attested.
 
 Identity and ring polling each allow 10 attempts with four seconds between
 attempts. Identity-backend HTTP clients use a 30-second timeout.
 
+The backend's username routes are bearer-gated. Unless
+`HOST_CLI_IDENTITY_BACKEND_TOKEN` supplies one, the CLI mints an access token
+once per process. It takes a challenge from `auth/challenges`. It answers
+`auth/token` with an sr25519 proof over
+`SHA256(challenge || clientId || SHA256(body))`, signed by a throwaway keypair.
+
+The token's subject only identifies the calling app instance. The username claim
+carries its own candidate account. A fresh subject per run therefore stays clear
+of the backend's per-subject device gate and rate limit. Availability answers are
+the flat `{base: "AVAILABLE" | …}` map.
+
 The default Lite username prefix is `headless`. For a non-default session, the
 prefix is its lowercase letters with digits and separators removed; a name
 with no letters becomes `session`. `--lite-username-prefix` overrides this and
@@ -1099,7 +1120,16 @@ selection files.
 
 ### 14.1 Network presets
 
-`--network` selects one of two presets. `paseo-next-v2` is the default.
+`--network` selects one of two presets. `paseo-next-v2` is the default. Every
+preset is a test network; the account store keeps BIP-39 entropy for
+disposable test identities only.
+
+Auto-account onboarding (§12.3) needs an identity backend that records the
+lite username on the dotNS gateway. The `paseo-next-v2` backend answers
+`POST /usernames` with "dotNS gateway is not enabled in this environment", so
+new auto accounts cannot be onboarded there until that changes; the CLI reports
+it and points at `previewnet`, whose backend has the gateway enabled. Reads
+(`identity-check`, session usernames) work on both presets.
 
 #### `paseo-next-v2`
 
@@ -1135,20 +1165,21 @@ signer provisioned on one preset is not visible from the other. Two presets mean
 two identities on one machine, which is deliberate: the lite username and the
 statement-store allowance are per chain.
 
-`previewnet`'s identity backend requires a bearer token for write requests, which
-the CLI does not send, so auto-managed account creation fails there with
-`401 Unauthorized (Missing Authorization Header)`. Reads against the backend
-succeed, and every non-backend path is unaffected, so a `previewnet` signer needs
-`--mnemonic` for an account that already holds a username on that chain.
+The backend's username routes are bearer-gated; the CLI mints the access token
+itself through the backend's `auth/challenges` → `auth/token` handshake
+(§12.3), or takes one from `HOST_CLI_IDENTITY_BACKEND_TOKEN`, so auto-managed
+account creation works here.
 
-There are no public endpoint override flags.
+There are no public endpoint override flags. `HOST_CLI_IDENTITY_BACKEND_BASE`
+replaces only the identity backend base URL (§21).
 
 Every role the preset serves — People, Bulletin and Asset Hub — is always routed,
 because host internals require all three: statement-store traffic addressed to the
-People genesis, preimage submission, and PGAS claims respectively. The SSO sentinel is
+People genesis, preimage submission, and PGAS claims plus dotNS username reads
+respectively. The SSO sentinel is
 a separate case — it is an unmapped genesis and reaches People through the fallback
 below, not through People's own route. `E2E_LIVE_CHAIN=1` only widens routing to endpoints the
-preset carries without serving them as a role, of which `paseo-next-v2` has none.
+preset carries without serving them as a role, of which neither preset has any.
 
 The all-zero SSO sentinel and every genesis hash not present in the active
 route map fall back to the People RPC.
@@ -1481,7 +1512,50 @@ IDENTITY_ERROR path=<path> account=<ss58> error=<reason>
 Per-path RPC errors are printed and do not make the command itself fail.
 Mnemonic parsing failures do fail the command. The mnemonic is not persisted.
 
-### 19.2 `alloc-check`
+### 19.2 `register-name`
+
+```text
+truapi-host register-name \
+  --mnemonic <BIP-39> \
+  --label <base-label> \
+  [--network paseo-next-v2] \
+  [--link-lite <name.NN> | --chat-key <65-byte-hex>]
+```
+
+Registers `label` as the full-person username of the mnemonic's RFC-0022
+`uid.dot` identity account, through `DotnsGateway.register_name` on Asset Hub.
+The account must be a recognized full person: its ring-VRF key must be built
+into a People-collection ring root on People, and Asset Hub's
+`members-subscriber` must already hold that root revision (the command waits for
+it). The People ring, its members and its root revision are read at one
+finalized People block.
+
+`--link-lite` links the new name to a dotted lite username, inheriting that
+name's chat key; without it and without `--chat-key`, the account's own lite
+username (from dotNS) is linked. `--chat-key` registers standalone with the
+given ECDH key. The two are mutually exclusive.
+
+The transaction is a General (v5) extrinsic authorized by the `AsDotnsGateway`
+extension: `RegisterFullName { proof, ring_index, revision, signature }`, where
+`signature` is the account's sr25519 signature over the inherited-implication
+digest and `proof` the ring-VRF membership proof, built for the `revision` read
+above. `RestrictOrigins` carries `true`. Success prints:
+
+```text
+REGISTER_SUBMITTED label=<label> block=<hash>
+REGISTER_ALIAS alias=0x<alias>
+REGISTER_CONFIRMED label=<label> full_username=<name>
+```
+
+`REGISTER_ALIAS` is printed once `DotnsGateway.AccountAlias` records the
+account, `REGISTER_CONFIRMED` once the dotNS contracts return the name (or
+`<pending>`). Before signing: the label must be unminted on `DotnsRegistrar` (a
+pending reservation is not a mint and stays claimable); the account must not
+already hold a `DotnsGateway.AccountAlias`; a linked lite username must be
+owned by the account per `DotnsGateway.LiteLabelOwner`; and runtimes whose
+`RegisterFullName` shape differs are rejected.
+
+### 19.3 `alloc-check`
 
 ```text
 truapi-host alloc-check \
@@ -1551,13 +1625,16 @@ ended. This preserves the child status but bypasses later Rust destructors.
 | `TRUAPI_HOST_LOG` | Default `--log-level`. |
 | `RUST_LOG` | Full startup tracing filter. |
 | `TRUAPI_HOST_BASE_PATH` | Default `--base-path`. |
-| `HOST_CLI_SIGNER_MNEMONIC` | Signing, identity, and allowance mnemonic input. |
+| `HOST_CLI_SIGNER_MNEMONIC` | Mnemonic for `signing-host`, `identity-check`, `register-name`, `alloc-check` and `pgas-check` when `--mnemonic` is omitted. |
+| `HOST_CLI_IDENTITY_BACKEND_BASE` | Identity backend base URL override, including `/api/v1`, for instance a local backend. Chain endpoints stay on the preset. |
+| `HOST_CLI_IDENTITY_BACKEND_TOKEN` | Bearer token for the identity backend's username routes. Unset, the CLI mints one itself through the backend's `auth/challenges` → `auth/token` sr25519 handshake with a throwaway keypair. |
+| `HOST_CLI_DOTNS_POP_CONTROLLER` | `DotnsPopController` H160 override, skipping on-chain discovery (`DotnsGateway.DispatcherAddress` → dispatcher `TARGET()`). Only needed where discovery fails. The controller is `0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b` on paseo-next-v2 and previewnet; `DEPLOYMENTS.md` in paritytech/dotns is the authority per network. |
 | `XDG_STATE_HOME` | Preferred default state parent. |
 | `HOME` | Fallback default state parent. |
 | `VISUAL` | Preferred script editor. |
 | `EDITOR` | Fallback script editor. |
 | `TRUAPI_HOST_RUNNER` | Override `js/runner.ts`. |
-| `E2E_LIVE_CHAIN` | Value `1` widens routing to endpoints the preset does not serve as a role; no effect on `paseo-next-v2`. |
+| `E2E_LIVE_CHAIN` | Value `1` widens routing to endpoints the preset does not serve as a role; no effect on either preset. |
 | `NO_COLOR` | Disable CLI semantic colors and battery reporter color. |
 | `COLORFGBG` | Infer TUI background color. |
 | `COLORTERM` | Select true-color TUI rendering. |
@@ -1569,7 +1646,9 @@ ended. This preserves the child status but bypasses later Rust destructors.
 
 These are part of the as-built specification:
 
-- only `paseo-next-v2` is selectable;
+- only the `paseo-next-v2` and `previewnet` test presets are selectable; there is no mainnet preset;
+- auto-account onboarding works on `previewnet` only, until the `paseo-next-v2`
+  identity backend enables the dotNS gateway (§14.1);
 - product scripts require Bun and, by default, the source checkout;
 - there is no structured/JSON output mode;
 - there is no `--version`;
diff --git a/rust/crates/truapi-host-cli/src/accounts.rs b/rust/crates/truapi-host-cli/src/accounts.rs
index 538abdccf..1734cd463 100644
--- a/rust/crates/truapi-host-cli/src/accounts.rs
+++ b/rust/crates/truapi-host-cli/src/accounts.rs
@@ -65,6 +65,9 @@ pub struct ResolveSignerConfig<'a> {
     pub account: Option<String>,
     /// Prefix for generated Lite usernames in auto mode.
     pub lite_username_prefix: Option<String>,
+    /// Full-person base name a newly created auto account reserves on dotNS
+    /// alongside its lite username.
+    pub reserved_username: Option<String>,
 }
 
 impl fmt::Debug for ResolveSignerConfig<'_> {
@@ -76,6 +79,7 @@ impl fmt::Debug for ResolveSignerConfig<'_> {
             .field("mnemonic", &self.mnemonic.as_ref().map(|_| REDACTED))
             .field("account", &self.account)
             .field("lite_username_prefix", &self.lite_username_prefix)
+            .field("reserved_username", &self.reserved_username)
             .finish()
     }
 }
@@ -296,18 +300,36 @@ pub async fn resolve_signer(config: ResolveSignerConfig<'_>) -> Result<ResolvedS
             .get(config.network.id, &name)
             .cloned()
             .with_context(|| format!("account {name:?} not found for {}", config.network.id))?;
-        let record = ensure_record_ready(&mut store, config.network, &record).await?;
+        let record = ensure_record_ready(
+            &mut store,
+            config.network,
+            &record,
+            config.reserved_username.as_deref(),
+        )
+        .await?;
         return resolved_from_record(record, false);
     }
 
     let period = current_statement_period()?;
     if let Some(record) = store.auto_candidate(config.network.id, period) {
-        let record = ensure_record_ready(&mut store, config.network, &record).await?;
+        let record = ensure_record_ready(
+            &mut store,
+            config.network,
+            &record,
+            config.reserved_username.as_deref(),
+        )
+        .await?;
         return resolved_from_record(record, true);
     }
 
     if let Some(record) = store.pending_auto_candidate(config.network.id) {
-        let refreshed = ensure_record_ready(&mut store, config.network, &record).await?;
+        let refreshed = ensure_record_ready(
+            &mut store,
+            config.network,
+            &record,
+            config.reserved_username.as_deref(),
+        )
+        .await?;
         return resolved_from_record(refreshed, true);
     }
 
@@ -318,6 +340,7 @@ pub async fn resolve_signer(config: ResolveSignerConfig<'_>) -> Result<ResolvedS
             .lite_username_prefix
             .as_deref()
             .unwrap_or(DEFAULT_USERNAME_PREFIX),
+        config.reserved_username.as_deref(),
     )
     .await?;
     resolved_from_record(record, true)
@@ -368,6 +391,7 @@ async fn create_auto_account(
     store: &mut AccountStore,
     network: NetworkConfig,
     username_prefix: &str,
+    reserved_username: Option<&str>,
 ) -> Result<AccountRecord> {
     validate_username_prefix(username_prefix)?;
     let name = store.next_auto_name(network.id);
@@ -407,7 +431,7 @@ async fn create_auto_account(
             "created auto signer account"
         );
 
-        record.lite_username = attest_record(network, &record).await?;
+        record.lite_username = attest_record(network, &record, reserved_username).await?;
         wait_for_ring_membership(network.people_ws, &identity.entropy).await?;
         record.attested = true;
         store.upsert(record.clone());
@@ -422,15 +446,16 @@ async fn ensure_record_ready(
     store: &mut AccountStore,
     network: NetworkConfig,
     record: &AccountRecord,
+    reserved_username: Option<&str>,
 ) -> Result<AccountRecord> {
     let identity = identity_from_mnemonic(&record.mnemonic)?;
     let mut record = record.clone();
     if !record.attested {
-        record.lite_username = attest_record(network, &record).await?;
+        record.lite_username = attest_record(network, &record, reserved_username).await?;
         record.attested = true;
     } else {
         record.lite_username =
-            attestation::registered_lite_username(network.people_ws, &identity.entropy)
+            attestation::registered_lite_username(network.asset_hub_ws, &identity.entropy)
                 .await
                 .with_context(|| format!("resolve Lite username for account {}", record.name))?;
     }
@@ -445,13 +470,18 @@ async fn ensure_record_ready(
     Ok(record)
 }
 
-async fn attest_record(network: NetworkConfig, record: &AccountRecord) -> Result<String> {
+async fn attest_record(
+    network: NetworkConfig,
+    record: &AccountRecord,
+    reserved_username: Option<&str>,
+) -> Result<String> {
     let entropy = mnemonic_entropy(&record.mnemonic)?;
     let lite_username = attestation::attest(&attestation::AttestConfig {
         backend_base: network.identity_backend_base.to_string(),
-        people_ws: network.people_ws.to_string(),
+        asset_hub_ws: network.asset_hub_ws.to_string(),
         entropy,
         username_base: record.lite_username.clone(),
+        reserved_username: reserved_username.map(str::to_string),
     })
     .await
     .with_context(|| format!("attest account {}", record.name))?;
@@ -718,6 +748,7 @@ mod tests {
             mnemonic: Some(MNEMONIC.to_string()),
             account: None,
             lite_username_prefix: None,
+            reserved_username: None,
         };
         let rendered = format!("{config:?}");
         assert!(!rendered.contains("abandon"), "mnemonic leaked: {rendered}");
diff --git a/rust/crates/truapi-host-cli/src/attestation.rs b/rust/crates/truapi-host-cli/src/attestation.rs
index ad906e270..8b08b7150 100644
--- a/rust/crates/truapi-host-cli/src/attestation.rs
+++ b/rust/crates/truapi-host-cli/src/attestation.rs
@@ -1,35 +1,167 @@
-//! Lite-username attestation against the People-chain identity backend.
+//! Lite-username attestation against the identity backend.
 //!
-//! Ports signing-bot `attestation.ts`: fetch the backend verifier, build the
-//! client proofs (`truapi_server::host_logic::attestation`), POST them to
-//! `/usernames`, then poll People-chain `Resources.Consumers` until the record
-//! lands. Registers the signing host's RFC-0022 `uid.dot` identity account so
-//! the paired host can resolve its username via `get_user_id`.
+//! Fetches the backend verifier. Builds the client proofs
+//! (`truapi_server::host_logic::attestation`), including the dotNS gateway
+//! reservation signature timestamped with Asset Hub chain time. POSTs them to
+//! `/usernames`. Polls the dotNS contracts on Asset Hub until the lite username
+//! lands.
+//!
+//! Registers the signing host's RFC-0022 `uid.dot` identity account. The paired
+//! host can then resolve its username via `get_user_id`.
 
 use std::time::Duration;
 
 use anyhow::{Context, Result, bail};
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use bip39::Mnemonic;
 use serde_json::{Value, json};
-use subxt_rpcs::client::{RpcClient, rpc_params};
+use sha2::{Digest as _, Sha256};
+use std::sync::Mutex;
 use tracing::{debug, warn};
 use truapi_server::host_logic::attestation::build_lite_registration;
-use truapi_server::host_logic::identity::{
-    decode_people_identity, resources_consumers_storage_key,
+use truapi_server::host_logic::dotns_gateway::{
+    MAX_BASE_LABEL_LEN, MIN_PERSON_LABEL_LEN, is_registrable_full_label,
 };
 use truapi_server::host_logic::product_account::{
-    derive_identity_keypair, derive_root_keypair_from_entropy, product_public_key_to_address,
+    SR25519_SIGNING_CONTEXT, derive_identity_keypair, derive_root_keypair_from_entropy,
+    product_public_key_to_address,
 };
 
+use crate::dotns_read::AssetHubReader;
+
+/// Env var carrying an optional bearer token for the identity backend.
+/// Set it to reuse a token minted elsewhere. Unset, the CLI runs the sr25519
+/// auth handshake itself ([`backend_token`]).
+pub const IDENTITY_BACKEND_TOKEN_ENV: &str = "HOST_CLI_IDENTITY_BACKEND_TOKEN";
+
+/// Access tokens for the username routes, minted once per backend base and
+/// process. Keyed by base so two backends in one process never share a token.
+static BACKEND_TOKENS: Mutex<Vec<(String, &'static str)>> = Mutex::new(Vec::new());
+
+/// Bearer token for the identity backend's username routes.
+///
+/// The explicit env token wins. Otherwise the CLI completes the backend's
+/// `challenges` → `token` sr25519 handshake with a throwaway keypair. The JWT
+/// subject only identifies the calling app instance. The username claim carries
+/// its own candidate account. A fresh subject each run keeps repeat
+/// registrations clear of the per-subject device gate and rate limit.
+async fn backend_token(client: &reqwest::Client, backend_base: &str) -> Result<&'static str> {
+    if let Ok(token) = std::env::var(IDENTITY_BACKEND_TOKEN_ENV)
+        && !token.trim().is_empty()
+    {
+        return Ok(Box::leak(token.trim().to_string().into_boxed_str()));
+    }
+    let cached = BACKEND_TOKENS
+        .lock()
+        .expect("backend token cache mutex poisoned")
+        .iter()
+        .find(|(base, _)| base == backend_base)
+        .map(|(_, token)| *token);
+    if let Some(token) = cached {
+        return Ok(token);
+    }
+    let token: &'static str = Box::leak(
+        mint_backend_token(client, backend_base)
+            .await?
+            .into_boxed_str(),
+    );
+    BACKEND_TOKENS
+        .lock()
+        .expect("backend token cache mutex poisoned")
+        .push((backend_base.to_string(), token));
+    Ok(token)
+}
+
+/// Runs the backend's auth handshake and returns its access JWT.
+async fn mint_backend_token(client: &reqwest::Client, backend_base: &str) -> Result<String> {
+    let url = format!("{backend_base}/auth/challenges");
+    let body: Value = client
+        .post(&url)
+        .json(&json!({}))
+        .send()
+        .await
+        .with_context(|| format!("POST {url}"))?
+        .error_for_status()?
+        .json()
+        .await
+        .context("decoding challenge response")?;
+    let challenge = body
+        .get("challenge")
+        .and_then(Value::as_str)
+        .context("challenge response missing 'challenge' field")?
+        .to_string();
+    let challenge_bytes = BASE64
+        .decode(&challenge)
+        .context("challenge is not valid base64")?;
+
+    let entropy = Mnemonic::generate(12)
+        .context("generate throwaway auth mnemonic")?
+        .to_entropy();
+    let keypair = derive_root_keypair_from_entropy(&entropy)
+        .map_err(|err| anyhow::anyhow!("auth keypair derivation failed: {err}"))?;
+    let client_id = keypair.public.to_bytes();
+
+    // The proof signs SHA256(challenge || clientId || SHA256(body)). It must
+    // cover the exact bytes the request carries, so the body is serialized once.
+    let payload = b"{}";
+    let mut hasher = Sha256::new();
+    hasher.update(&challenge_bytes);
+    hasher.update(client_id);
+    hasher.update(Sha256::digest(payload));
+    let message: [u8; 32] = hasher.finalize().into();
+    let proof = keypair
+        .secret
+        .sign_simple(SR25519_SIGNING_CONTEXT, &message, &keypair.public)
+        .to_bytes();
+
+    let url = format!("{backend_base}/auth/token");
+    let response = client
+        .post(&url)
+        .header("Auth-ClientId", BASE64.encode(client_id))
+        .header("Auth-ClientProof", BASE64.encode(proof))
+        .header("Auth-Challenge", &challenge)
+        .header(reqwest::header::CONTENT_TYPE, "application/json")
+        .body(payload.as_slice())
+        .send()
+        .await
+        .with_context(|| format!("POST {url}"))?;
+    let status = response.status();
+    let body = response.text().await.unwrap_or_default();
+    if !status.is_success() {
+        bail!("identity backend auth handshake failed ({status}): {body}");
+    }
+    let body: Value = serde_json::from_str(&body).context("decoding token response")?;
+    let token = body
+        .get("token")
+        .and_then(Value::as_str)
+        .context("token response missing 'token' field")?;
+    debug!("minted identity backend access token");
+    Ok(token.to_string())
+}
+
+/// Attaches the identity backend bearer token to `request`.
+async fn with_backend_auth(
+    client: &reqwest::Client,
+    backend_base: &str,
+    request: reqwest::RequestBuilder,
+) -> Result<reqwest::RequestBuilder> {
+    Ok(request.bearer_auth(backend_token(client, backend_base).await?))
+}
+
 /// Inputs for one attestation run.
 pub struct AttestConfig {
     /// Identity backend base URL including `/api/v1`.
     pub backend_base: String,
-    /// People-chain WebSocket URL for the `Resources.Consumers` poll.
-    pub people_ws: String,
+    /// Asset Hub WebSocket URL for the reservation timestamp and the dotNS
+    /// username poll.
+    pub asset_hub_ws: String,
     /// BIP-39 entropy of the signing host's root account.
     pub entropy: Vec<u8>,
     /// Requested lite username base (6+ lowercase letters, no digits).
     pub username_base: String,
+    /// Optional base name to queue on dotNS for a later full-person claim.
+    pub reserved_username: Option<String>,
 }
 
 /// Check whether a lite username base is available through the identity
@@ -40,35 +172,74 @@ pub async fn lite_username_available(backend_base: &str, username_base: &str) ->
         .build()?;
     let url = format!("{backend_base}/usernames/available");
     let body = json!({ "usernames": [username_base] });
-    let response = client
-        .post(&url)
-        .json(&body)
+    let response = with_backend_auth(&client, backend_base, client.post(&url).json(&body))
+        .await?
         .send()
         .await
-        .with_context(|| format!("POST {url}"))?
-        .error_for_status()
-        .with_context(|| format!("username availability check failed for {username_base}"))?;
+        .with_context(|| format!("POST {url}"))?;
+    let status = response.status();
+    if !status.is_success() {
+        let text = response.text().await.unwrap_or_default();
+        bail!("username availability check failed for {username_base} ({status}): {text}");
+    }
     let body: Value = response
         .json()
         .await
         .context("decoding availability response")?;
-    Ok(body
-        .get(username_base)
-        .and_then(Value::as_str)
-        .is_some_and(|status| status == "AVAILABLE"))
+    Ok(availability_status(&body, username_base) == Some("AVAILABLE"))
+}
+
+/// Reads one base's status out of the availability response, a flat
+/// `{base: "AVAILABLE" | …}` map.
+fn availability_status<'a>(body: &'a Value, username_base: &str) -> Option<&'a str> {
+    body.get(username_base).and_then(Value::as_str)
 }
 
-/// Register (or confirm) the signing host's lite username and wait until the
-/// People-chain `Resources.Consumers` record exists. Returns the Lite username
-/// assigned on chain (including its discriminator).
+/// Registers (or confirms) the signing host's lite username. Waits until the
+/// dotNS contracts on Asset Hub record it. Returns the lite username assigned on
+/// chain, including its discriminator.
 pub async fn attest(config: &AttestConfig) -> Result<String> {
     let client = reqwest::Client::builder()
         .timeout(Duration::from_secs(30))
         .build()?;
 
+    let mut reader = AssetHubReader::connect(&config.asset_hub_ws).await?;
+    // Timestamping the reservation signature with Asset Hub chain time. The
+    // gateway rejects values ahead of the chain.
+    let signed_at = reader
+        .timestamp_secs()
+        .await
+        .context("read Asset Hub Timestamp.Now")?;
+
+    // A reserved base name that is already registered can never be claimed,
+    // yet the reservation would hold that stem's queue for the whole
+    // reservation window; neither the backend nor the gateway checks it. Ask
+    // the registrar first.
+    if let Some(reserved) = config.reserved_username.as_deref() {
+        if !is_registrable_full_label(reserved) {
+            bail!(
+                "reserved username {reserved:?} is not a reservable base label (lowercase ASCII \
+                 letters only, {MIN_PERSON_LABEL_LEN} to {MAX_BASE_LABEL_LEN} bytes); the \
+                 gateway would reject the whole attestation"
+            );
+        }
+        if !reader.label_available(reserved).await? {
+            bail!(
+                "reserved username {reserved:?} is already registered on dotNS; a reservation \
+                 for it could never be claimed and would lock the stem's reservation queue"
+            );
+        }
+    }
+
     let verifier = fetch_verifier(&client, &config.backend_base).await?;
-    let registration = build_lite_registration(&config.entropy, verifier, &config.username_base)
-        .map_err(|reason| anyhow::anyhow!("failed to build registration params: {reason}"))?;
+    let registration = build_lite_registration(
+        &config.entropy,
+        verifier,
+        &config.username_base,
+        config.reserved_username.as_deref(),
+        signed_at,
+    )
+    .map_err(|reason| anyhow::anyhow!("failed to build registration params: {reason}"))?;
     debug!(
         candidate = %registration.candidate_account_id,
         "attesting lite username '{}'",
@@ -79,51 +250,42 @@ pub async fn attest(config: &AttestConfig) -> Result<String> {
         &client,
         &config.backend_base,
         &config.username_base,
+        config.reserved_username.as_deref(),
+        signed_at,
         &registration,
     )
     .await?;
 
-    let storage_key = format!(
-        "0x{}",
-        hex::encode(resources_consumers_storage_key(
-            &registration.candidate_public_key
-        ))
-    );
-    let identity = wait_for_consumer_record(&config.people_ws, &storage_key).await?;
+    let identity = wait_for_dotns_username(&mut reader, &registration.candidate_public_key).await?;
     debug!("lite username registered and confirmed on-chain");
     identity
         .lite_username
-        .context("registered People-chain identity has no Lite username")
+        .context("registered dotNS identity has no lite username")
 }
 
-/// Resolve the on-chain Lite username for an already-attested signer.
-///
-/// Older CLI account records stored the requested username base rather than
-/// the final `name.discriminator` assigned by the People chain. Reading the
-/// consumer record repairs those records without re-attesting the account.
-pub async fn registered_lite_username(people_ws: &str, entropy: &[u8]) -> Result<String> {
+/// Resolves the on-chain lite username for an already-attested signer: the
+/// discriminated `name.NN` the dotNS contracts hold for its identity account,
+/// whatever base the account record asked for.
+pub async fn registered_lite_username(asset_hub_ws: &str, entropy: &[u8]) -> Result<String> {
     let identity = derive_identity_keypair(entropy)
         .map_err(|err| anyhow::anyhow!("uid.dot identity derivation failed: {err}"))?;
-    let storage_key = format!(
-        "0x{}",
-        hex::encode(resources_consumers_storage_key(&identity.public.to_bytes()))
-    );
-    let value = query_storage(people_ws, &storage_key)
+    let mut reader = AssetHubReader::connect(asset_hub_ws).await?;
+    reader
+        .dotns_identity(&identity.public.to_bytes())
         .await?
-        .context("attested signer has no Resources.Consumers record")?;
-    decode_identity_hex(&value)?
         .lite_username
-        .context("registered People-chain identity has no Lite username")
+        .context("attested signer has no dotNS lite username")
 }
 
-/// Probe the People chain for the bare root and canonical RFC-0022 `uid.dot`
-/// identity account, printing any `Resources.Consumers` record. Used to
-/// confirm a pre-onboarded account.
-pub async fn check_identity(people_ws: &str, entropy: &[u8]) -> Result<()> {
+/// Probes the dotNS contracts for the bare root and canonical RFC-0022 `uid.dot`
+/// identity account. Prints any recorded usernames. Used to confirm a
+/// pre-onboarded account.
+pub async fn check_identity(asset_hub_ws: &str, entropy: &[u8]) -> Result<()> {
     let root = derive_root_keypair_from_entropy(entropy)
         .map_err(|err| anyhow::anyhow!("invalid entropy: {err}"))?;
     let identity = derive_identity_keypair(entropy)
         .map_err(|err| anyhow::anyhow!("uid.dot identity derivation failed: {err}"))?;
+    let mut reader = AssetHubReader::connect(asset_hub_ws).await?;
 
     for (label, public) in [
         ("<root>", root.public.to_bytes()),
@@ -132,23 +294,15 @@ pub async fn check_identity(people_ws: &str, entropy: &[u8]) -> Result<()> {
             identity.public.to_bytes(),
         ),
     ] {
-        let key = format!(
-            "0x{}",
-            hex::encode(resources_consumers_storage_key(&public))
-        );
         let address = product_public_key_to_address(public);
-        match query_storage(people_ws, &key).await {
-            Ok(Some(value)) => {
-                let decoded = hex::decode(value.strip_prefix("0x").unwrap_or(&value))
-                    .ok()
-                    .and_then(|bytes| decode_people_identity(&bytes).ok());
-                let username = decoded
-                    .and_then(|id| id.full_username.or(id.lite_username))
-                    .unwrap_or_else(|| "<record present, no username>".to_string());
-                println!("IDENTITY_FOUND path={label} account={address} username={username}");
-            }
-            Ok(None) => println!("IDENTITY_NONE path={label} account={address}"),
-            Err(err) => println!("IDENTITY_ERROR path={label} account={address} error={err}"),
+        match reader.dotns_identity(&public).await {
+            Ok(identity) => match identity.full_username.or(identity.lite_username) {
+                Some(username) => {
+                    println!("IDENTITY_FOUND path={label} account={address} username={username}")
+                }
+                None => println!("IDENTITY_NONE path={label} account={address}"),
+            },
+            Err(err) => println!("IDENTITY_ERROR path={label} account={address} error={err:#}"),
         }
     }
     Ok(())
@@ -179,9 +333,18 @@ async fn submit_registration(
     client: &reqwest::Client,
     backend_base: &str,
     username_base: &str,
+    reserved_username: Option<&str>,
+    signed_at: u64,
     reg: &truapi_server::host_logic::attestation::LiteRegistration,
 ) -> Result<()> {
     let url = format!("{backend_base}/usernames");
+    let mut dotns = json!({
+        "signature": hex0x(&reg.dotns_signature),
+        "signedAt": signed_at,
+    });
+    if let Some(reserved) = reserved_username {
+        dotns["reservedUsername"] = json!(reserved);
+    }
     let body = json!({
         "username": username_base,
         "candidateAccountId": reg.candidate_account_id,
@@ -190,10 +353,10 @@ async fn submit_registration(
         "proofOfOwnership": hex0x(&reg.proof_of_ownership),
         "identifierKey": hex0x(&reg.identifier_key),
         "consumerRegistrationSignature": hex0x(&reg.consumer_registration_signature),
+        "dotns": dotns,
     });
-    let response = client
-        .post(&url)
-        .json(&body)
+    let response = with_backend_auth(client, backend_base, client.post(&url).json(&body))
+        .await?
         .send()
         .await
         .with_context(|| format!("POST {url}"))?;
@@ -207,9 +370,19 @@ async fn submit_registration(
     // Already-registered is a soft success; the on-chain poll confirms it.
     if text.contains("already") || text.contains("AlreadyRegistered") || text.contains("duplicate")
     {
-        warn!(%status, "username already registered; confirming on-chain");
+        warn!(%status, body = %text, "username already registered; confirming on-chain");
         return Ok(());
     }
+    if text.contains("dotNS gateway is not enabled") {
+        bail!(
+            "username registration failed ({status}): {text}\n\
+             This identity backend does not record usernames on the dotNS gateway, and the \
+             host reads usernames only from dotNS on Asset Hub, so no username can be \
+             resolved for accounts registered through it. Use a preset whose backend has \
+             the gateway enabled (`--network previewnet`), or point \
+             HOST_CLI_IDENTITY_BACKEND_BASE at one that does."
+        );
+    }
     bail!("username registration failed ({status}): {text}");
 }
 
@@ -217,60 +390,55 @@ fn hex0x(bytes: &[u8]) -> String {
     format!("0x{}", hex::encode(bytes))
 }
 
-async fn wait_for_consumer_record(
-    people_ws: &str,
-    storage_key: &str,
-) -> Result<truapi_server::host_logic::identity::PeopleIdentity> {
+async fn wait_for_dotns_username(
+    reader: &mut AssetHubReader,
+    candidate: &[u8; 32],
+) -> Result<truapi_server::host_logic::dotns_gateway::DotnsIdentity> {
     // First-time lite registration is backend-async and can lag the HTTP
-    // response. The record is permanent once written, so later runs resolve on
-    // the first poll.
+    // response. The record is permanent once written. Later runs therefore
+    // resolve on the first poll.
     const MAX_ATTEMPTS: usize = 10;
     for attempt in 1..=MAX_ATTEMPTS {
-        match query_storage(people_ws, storage_key).await {
-            Ok(Some(value)) => {
+        match reader.dotns_identity(candidate).await {
+            Ok(identity) if identity.lite_username.is_some() => {
                 crate::terminal_ui::update_activity(
                     "signer",
                     "Setting up signer",
-                    Some("People-chain identity ready".to_string()),
+                    Some("dotNS identity ready".to_string()),
                     crate::terminal_ui::ActivityState::Running,
                 );
-                return decode_identity_hex(&value);
+                return Ok(identity);
             }
-            Ok(None) => {
+            Ok(_) => {
                 crate::terminal_ui::update_activity(
                     "signer",
                     "Setting up signer",
                     Some(format!(
-                        "Waiting for People-chain identity · attempt {attempt}/{MAX_ATTEMPTS}"
+                        "Waiting for dotNS username · attempt {attempt}/{MAX_ATTEMPTS}"
                     )),
                     crate::terminal_ui::ActivityState::Running,
                 );
-                debug!("Resources.Consumers poll {attempt}/{MAX_ATTEMPTS}: empty");
+                debug!("dotNS username poll {attempt}/{MAX_ATTEMPTS}: empty");
             }
-            Err(err) => warn!(%err, "Resources.Consumers poll attempt {attempt} failed"),
+            Err(err) => warn!(%err, "dotNS username poll attempt {attempt} failed"),
         }
         if attempt < MAX_ATTEMPTS {
             tokio::time::sleep(Duration::from_secs(4)).await;
         }
     }
-    bail!("Resources.Consumers record did not appear after attestation")
+    bail!("dotNS username did not appear on Asset Hub after attestation")
 }
 
-fn decode_identity_hex(value: &str) -> Result<truapi_server::host_logic::identity::PeopleIdentity> {
-    let bytes = hex::decode(value.strip_prefix("0x").unwrap_or(value))
-        .context("Resources.Consumers value is not valid hex")?;
-    decode_people_identity(&bytes).map_err(anyhow::Error::msg)
-}
+#[cfg(test)]
+mod tests {
+    use super::*;
 
-/// One `state_getStorage` request over a fresh RPC connection; returns the value
-/// hex when present.
-async fn query_storage(people_ws: &str, storage_key: &str) -> Result<Option<String>> {
-    let rpc = RpcClient::from_insecure_url(people_ws)
-        .await
-        .with_context(|| format!("connect {people_ws}"))?;
-    let value = rpc
-        .request::<Value>("state_getStorage", rpc_params![storage_key])
-        .await
-        .context("rpc state_getStorage")?;
-    Ok(value.as_str().map(str::to_string))
+    /// The availability response is a flat `{base: status}` map.
+    #[test]
+    fn availability_reads_the_flat_status_map() {
+        let flat = json!({ "pntest": "EXHAUSTED", "other": "AVAILABLE" });
+        assert_eq!(availability_status(&flat, "pntest"), Some("EXHAUSTED"));
+        assert_eq!(availability_status(&flat, "other"), Some("AVAILABLE"));
+        assert_eq!(availability_status(&flat, "missing"), None);
+    }
 }
diff --git a/rust/crates/truapi-host-cli/src/dotns_read.rs b/rust/crates/truapi-host-cli/src/dotns_read.rs
new file mode 100644
index 000000000..7a99f889a
--- /dev/null
+++ b/rust/crates/truapi-host-cli/src/dotns_read.rs
@@ -0,0 +1,203 @@
+//! Asset Hub dotNS reads over plain RPC (`state_getStorage` / `state_call`).
+//!
+//! The transport half of username resolution. This module supplies the two RPC
+//! primitives. `truapi_server::host_logic::dotns_gateway` walks the contract
+//! chain over them. The CLI and the in-core `chainHead_v1` lookup therefore
+//! resolve identically.
+
+use anyhow::{Context, Result};
+use serde_json::Value;
+use subxt_rpcs::client::{RpcClient, rpc_params};
+use truapi_platform::async_trait;
+use truapi_server::host_logic::dotns_gateway::{
+    DotnsIdentity, DotnsTransport, DotnsViewError, VIEW_CALL_ORIGIN, account_alias_key,
+    classify_labels, discover_pop_controller, encode_revive_call, label_available,
+    lite_label_owner_key, resolve_labels, timestamp_now_key, view_output,
+};
+
+/// Env var overriding the `DotnsPopController` H160 (hex), skipping on-chain
+/// discovery.
+///
+/// Discovery reads `DotnsGateway.DispatcherAddress` and asks the dispatcher
+/// for its `TARGET()`; the override is for networks where that fails. The
+/// controller is `0xCC932348606cc1f3318cADeC5A5Cd2CA447f8a4b` on paseo-next-v2
+/// and previewnet; `DEPLOYMENTS.md` in paritytech/dotns is the authority per
+/// network.
+pub const DOTNS_POP_CONTROLLER_ENV: &str = "HOST_CLI_DOTNS_POP_CONTROLLER";
+
+/// One Asset Hub RPC connection for a batch of dotNS reads.
+pub struct AssetHubReader {
+    rpc: RpcClient,
+    /// `DotnsPopController` once resolved; it does not change within a run.
+    pop_controller: Option<[u8; 20]>,
+}
+
+impl AssetHubReader {
+    /// Connects to the Asset Hub WebSocket endpoint.
+    pub async fn connect(asset_hub_ws: &str) -> Result<Self> {
+        let rpc = RpcClient::from_insecure_url(asset_hub_ws)
+            .await
+            .with_context(|| format!("connect {asset_hub_ws}"))?;
+        Ok(Self {
+            rpc,
+            pop_controller: None,
+        })
+    }
+
+    /// Asset Hub chain time in Unix seconds. `Timestamp.Now` itself is
+    /// milliseconds.
+    pub async fn timestamp_secs(&self) -> Result<u64> {
+        let value = self
+            .raw_storage(&timestamp_now_key())
+            .await?
+            .context("Timestamp.Now is unset")?;
+        let millis: [u8; 8] = value
+            .as_slice()
+            .try_into()
+            .map_err(|_| anyhow::anyhow!("Timestamp.Now is not a u64"))?;
+        Ok(u64::from_le_bytes(millis) / 1000)
+    }
+
+    /// Alias `account` registered with, per `DotnsGateway.AccountAlias`.
+    pub async fn account_alias(&self, account: &[u8; 32]) -> Result<Option<[u8; 32]>> {
+        let value = self.raw_storage(&account_alias_key(account)).await?;
+        account_id_value("DotnsGateway.AccountAlias", value)
+    }
+
+    /// Account that reserved the dotted lite username `lite_label` through the
+    /// gateway, per `DotnsGateway.LiteLabelOwner`.
+    pub async fn lite_label_owner(&self, lite_label: &str) -> Result<Option<[u8; 32]>> {
+        let value = self
+            .raw_storage(&lite_label_owner_key(lite_label.as_bytes()))
+            .await?;
+        account_id_value("DotnsGateway.LiteLabelOwner", value)
+    }
+
+    /// Usernames of `account` as recorded by the dotNS contracts.
+    pub async fn dotns_identity(&mut self, account: &[u8; 32]) -> Result<DotnsIdentity> {
+        let controller = self.pop_controller().await?;
+        let labels = resolve_labels(self, &controller, account)
+            .await
+            .map_err(anyhow::Error::msg)?;
+        Ok(classify_labels(labels))
+    }
+
+    /// Whether the registrar would still mint `label` under the network TLD.
+    /// `false` once the name is registered, whichever flow minted it.
+    pub async fn label_available(&mut self, label: &str) -> Result<bool> {
+        let controller = self.pop_controller().await?;
+        label_available(self, &controller, label)
+            .await
+            .map_err(anyhow::Error::msg)
+    }
+
+    /// `DotnsPopController` address, resolved once per reader. The env override
+    /// wins, otherwise on-chain discovery through the dispatcher's `TARGET()`
+    /// getter.
+    async fn pop_controller(&mut self) -> Result<[u8; 20]> {
+        if let Some(controller) = self.pop_controller {
+            return Ok(controller);
+        }
+        let controller = self.resolve_pop_controller().await?;
+        self.pop_controller = Some(controller);
+        Ok(controller)
+    }
+
+    async fn resolve_pop_controller(&mut self) -> Result<[u8; 20]> {
+        if let Ok(value) = std::env::var(DOTNS_POP_CONTROLLER_ENV) {
+            let trimmed = value.trim();
+            if !trimmed.is_empty() {
+                let bytes = hex::decode(trimmed.strip_prefix("0x").unwrap_or(trimmed))
+                    .with_context(|| format!("{DOTNS_POP_CONTROLLER_ENV} is not valid hex"))?;
+                return bytes.try_into().map_err(|bytes: Vec<u8>| {
+                    anyhow::anyhow!(
+                        "{DOTNS_POP_CONTROLLER_ENV} must be 20 bytes, got {}",
+                        bytes.len()
+                    )
+                });
+            }
+        }
+        discover_pop_controller(self)
+            .await
+            .map_err(anyhow::Error::msg)?
+            .with_context(|| {
+                format!(
+                    "dotNS gateway has no reachable controller; set \
+                     {DOTNS_POP_CONTROLLER_ENV} to the DotnsPopController H160"
+                )
+            })
+    }
+
+    /// Dry-runs a contract view via the `ReviveApi_call` runtime API and returns
+    /// its data.
+    ///
+    /// Views originate from the synthetic always-mapped account. They work
+    /// regardless of the queried account's revive mapping.
+    async fn raw_view(&self, dest: &[u8; 20], input: Vec<u8>) -> Result<Vec<u8>, DotnsViewError> {
+        let args = encode_revive_call(&VIEW_CALL_ORIGIN, dest, &input);
+        let output: Value = self
+            .rpc
+            .request(
+                "state_call",
+                rpc_params!["ReviveApi_call", format!("0x{}", hex::encode(args))],
+            )
+            .await
+            .map_err(|err| {
+                DotnsViewError::Failed(format!("rpc state_call ReviveApi_call: {err}"))
+            })?;
+        let Some(output) = output.as_str() else {
+            return Err(DotnsViewError::Failed(
+                "state_call returned a non-string response".to_string(),
+            ));
+        };
+        let bytes = hex::decode(output.strip_prefix("0x").unwrap_or(output)).map_err(|err| {
+            DotnsViewError::Failed(format!("state_call output is not valid hex: {err}"))
+        })?;
+        view_output(&bytes)
+    }
+
+    /// One `state_getStorage` read at the best block.
+    async fn raw_storage(&self, key: &[u8]) -> Result<Option<Vec<u8>>> {
+        let value: Value = self
+            .rpc
+            .request(
+                "state_getStorage",
+                rpc_params![format!("0x{}", hex::encode(key))],
+            )
+            .await
+            .context("rpc state_getStorage")?;
+        value
+            .as_str()
+            .map(|hex_value| {
+                hex::decode(hex_value.strip_prefix("0x").unwrap_or(hex_value))
+                    .context("storage value is not valid hex")
+            })
+            .transpose()
+    }
+}
+
+/// Decodes an optional 32-byte account id storage value. A value of another
+/// length is an error, not "absent": treating it as absent would let a
+/// registration proceed that the gateway then rejects.
+fn account_id_value(entry: &str, value: Option<Vec<u8>>) -> Result<Option<[u8; 32]>> {
+    value
+        .map(|bytes| {
+            let len = bytes.len();
+            <[u8; 32]>::try_from(bytes)
+                .map_err(|_| anyhow::anyhow!("{entry} value is {len} bytes, expected 32"))
+        })
+        .transpose()
+}
+
+#[async_trait]
+impl DotnsTransport for AssetHubReader {
+    async fn storage(&mut self, key: Vec<u8>) -> Result<Option<Vec<u8>>, String> {
+        self.raw_storage(&key)
+            .await
+            .map_err(|err| format!("{err:#}"))
+    }
+
+    async fn view(&mut self, dest: &[u8; 20], input: Vec<u8>) -> Result<Vec<u8>, DotnsViewError> {
+        self.raw_view(dest, input).await
+    }
+}
diff --git a/rust/crates/truapi-host-cli/src/main.rs b/rust/crates/truapi-host-cli/src/main.rs
index 3cb41dfbf..9255fe0b7 100644
--- a/rust/crates/truapi-host-cli/src/main.rs
+++ b/rust/crates/truapi-host-cli/src/main.rs
@@ -7,17 +7,20 @@
 //! - `signing-host`: a wallet-local host that answers a pairing deeplink and
 //!   auto-signs, replacing the external signing-bot in e2e.
 //!
-//! Plus three diagnostics: `identity-check` for People-chain identity records,
-//! `alloc-check` for statement-store allowance, and `pgas-check` for an Asset Hub
-//! PGAS allowance claim.
+//! Plus the diagnostics and one-shot commands: `identity-check` for the dotNS
+//! usernames of a mnemonic's accounts, `register-name` for a full-person
+//! username, `alloc-check` for statement-store allowance, and `pgas-check` for
+//! an Asset Hub PGAS allowance claim.
 
 mod accounts;
 mod attestation;
 mod chain;
 mod chat;
+mod dotns_read;
 mod frame_server;
 mod network;
 mod platform;
+mod register_name;
 mod script_runner;
 mod sessions;
 mod signing_shell;
@@ -38,6 +41,9 @@ use tracing_subscriber::Layer;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
 use truapi_platform::{ChatPlatform, HostInfo, PlatformInfo, ProductExecutionKind};
+use truapi_server::host_logic::dotns_gateway::{
+    MAX_BASE_LABEL_LEN, MIN_PERSON_LABEL_LEN, is_registrable_full_label,
+};
 use truapi_server::statement_allowance as alloc;
 use truapi_server::subscription::Spawner;
 use truapi_server::{
@@ -154,7 +160,8 @@ enum Command {
     /// specified, and can accept pairing deeplinks. With `--script`, exits with
     /// the script's status; otherwise stays interactive.
     SigningHost(SigningHostArgs),
-    /// Probe the People chain for a mnemonic's registered identity/username.
+    /// Probe the dotNS contracts on Asset Hub for a mnemonic's registered
+    /// identity/username.
     IdentityCheck {
         /// BIP-39 mnemonic to probe.
         #[arg(long, env = "HOST_CLI_SIGNER_MNEMONIC")]
@@ -163,6 +170,28 @@ enum Command {
         #[arg(long, value_enum, default_value = "paseo-next-v2")]
         network: Network,
     },
+    /// Register a full-person username on dotNS via
+    /// `DotnsGateway.register_name` on Asset Hub. Requires a recognized full
+    /// person. That person's People ring must have propagated to Asset Hub.
+    RegisterName {
+        /// BIP-39 mnemonic of the recognized full person.
+        #[arg(long, env = "HOST_CLI_SIGNER_MNEMONIC")]
+        mnemonic: String,
+        /// Network preset to use.
+        #[arg(long, value_enum, default_value = "paseo-next-v2")]
+        network: Network,
+        /// Base label to register (lowercase ASCII letters only).
+        #[arg(long)]
+        label: String,
+        /// Dotted lite username to link (`name.NN`). Defaults to the
+        /// account's own lite username.
+        #[arg(long, conflicts_with = "chat_key")]
+        link_lite: Option<String>,
+        /// 65-byte ECDH chat key (hex). Use it for a standalone registration
+        /// with no lite-username link.
+        #[arg(long)]
+        chat_key: Option<String>,
+    },
     /// Check (and optionally submit) a statement-store allowance registration
     /// against the real People chain: ring membership, the chosen slot, and
     /// (with `--submit`) the `set_statement_store_account` extrinsic.
@@ -288,6 +317,10 @@ struct SigningHostArgs {
     /// Prefix for newly-created lite usernames in auto-account mode.
     #[arg(long = "lite-username-prefix")]
     lite_username_prefix: Option<String>,
+    /// Full-person base name a newly-created auto account reserves on dotNS
+    /// alongside its lite username, to claim later as a full person.
+    #[arg(long = "reserved-username")]
+    reserved_username: Option<String>,
     /// Root directory for CLI-managed account and host state.
     #[arg(long = "base-path", env = "TRUAPI_HOST_BASE_PATH")]
     base_path: Option<PathBuf>,
@@ -361,7 +394,35 @@ async fn main() -> Result<()> {
             let entropy = bip39::Mnemonic::parse(mnemonic.trim())
                 .context("invalid BIP-39 mnemonic")?
                 .to_entropy();
-            attestation::check_identity(network.config().people_ws, &entropy).await
+            attestation::check_identity(network.config().asset_hub_ws, &entropy).await
+        }
+        Command::RegisterName {
+            mnemonic,
+            network,
+            label,
+            link_lite,
+            chat_key,
+        } => {
+            let entropy = bip39::Mnemonic::parse(mnemonic.trim())
+                .context("invalid BIP-39 mnemonic")?
+                .to_entropy();
+            let chat_key = chat_key
+                .map(|value| -> Result<[u8; 65]> {
+                    let bytes = hex::decode(value.strip_prefix("0x").unwrap_or(&value))
+                        .context("chat key is not valid hex")?;
+                    bytes.try_into().map_err(|bytes: Vec<u8>| {
+                        anyhow::anyhow!("chat key must be 65 bytes, got {}", bytes.len())
+                    })
+                })
+                .transpose()?;
+            register_name::register_name(&register_name::RegisterNameConfig {
+                network: network.config(),
+                entropy,
+                label,
+                link_lite,
+                chat_key,
+            })
+            .await
         }
         Command::AllocCheck {
             mnemonic,
@@ -803,13 +864,14 @@ async fn run_pairing_host(
         approval_policy(args.auto_accept),
         ui_handle,
     );
-    // SSO and identity both run over the real People chain, so usernames always
-    // resolve from `Resources.Consumers` (host-spec G).
+    // SSO runs over the real People chain. Usernames resolve from the dotNS
+    // contracts on Asset Hub.
     let config = PairingHostConfig::new(
         host_info("Headless Pairing Host"),
         platform_info(),
         network.people_genesis,
         network.bulletin_genesis,
+        network.asset_hub_genesis,
         DEEPLINK_SCHEME.to_string(),
     )
     .context("invalid pairing host config")?;
@@ -1038,6 +1100,7 @@ struct SigningHostSession {
     mnemonic: Option<String>,
     default_account: Option<String>,
     lite_username_prefix: Option<String>,
+    reserved_username: Option<String>,
     approval: ApprovalPolicy,
     ui: Option<UiHandle>,
     /// Set when this host serves a chat product. Held across runtime rebuilds
@@ -1111,14 +1174,15 @@ async fn start_signing_host(
             mnemonic: mnemonic.clone(),
             account: None,
             lite_username_prefix: None,
+            reserved_username: None,
         })
         .await?;
-        match attestation::registered_lite_username(network.people_ws, &explicit_signer.entropy)
+        match attestation::registered_lite_username(network.asset_hub_ws, &explicit_signer.entropy)
             .await
         {
             Ok(user_id) => explicit_signer.lite_username = Some(user_id),
             Err(error) => {
-                tracing::warn!(%error, "explicit signer has no resolvable People-chain username")
+                tracing::warn!(%error, "explicit signer has no resolvable dotNS username")
             }
         }
         signer = Some(explicit_signer);
@@ -1186,6 +1250,7 @@ async fn start_signing_host(
         mnemonic,
         default_account,
         lite_username_prefix: normalized(args.lite_username_prefix.clone()),
+        reserved_username: normalized(args.reserved_username.clone()),
         approval,
         ui,
         chat,
@@ -1265,6 +1330,23 @@ fn validate_signing_args(args: &SigningHostArgs) -> Result<()> {
     if account.is_some() && prefix.is_some() {
         bail!("--lite-username-prefix only applies when --account is omitted");
     }
+    let reserved = normalized(args.reserved_username.clone());
+    if mnemonic.is_some() && reserved.is_some() {
+        bail!(
+            "--reserved-username cannot be used when --mnemonic or HOST_CLI_SIGNER_MNEMONIC is set"
+        );
+    }
+    if account.is_some() && reserved.is_some() {
+        bail!("--reserved-username only applies when --account is omitted");
+    }
+    if let Some(reserved) = &reserved
+        && !is_registrable_full_label(reserved)
+    {
+        bail!(
+            "--reserved-username {reserved:?} is not a reservable base label: lowercase ASCII \
+             letters only, {MIN_PERSON_LABEL_LEN} to {MAX_BASE_LABEL_LEN} bytes"
+        );
+    }
     Ok(())
 }
 
@@ -1351,6 +1433,7 @@ async fn ensure_signer(session: &mut SigningHostSession) -> Result<()> {
             mnemonic: session.mnemonic.clone(),
             account,
             lite_username_prefix,
+            reserved_username: session.reserved_username.clone(),
         })
         .await?,
     );
@@ -1482,6 +1565,7 @@ async fn prepare_pairing_response(session: &mut SigningHostSession, deeplink: &s
                         mnemonic: None,
                         account: None,
                         lite_username_prefix,
+                        reserved_username: session.reserved_username.clone(),
                     })
                     .await?,
                 );
@@ -1724,6 +1808,7 @@ async fn switch_session(session: &mut SigningHostSession, name: String) -> Resul
             None
         },
         lite_username_prefix,
+        reserved_username: session.reserved_username.clone(),
     })
     .await?;
     let profile = if let Some(user_id) = &signer.lite_username {
diff --git a/rust/crates/truapi-host-cli/src/network.rs b/rust/crates/truapi-host-cli/src/network.rs
index f38854b75..f0940e062 100644
--- a/rust/crates/truapi-host-cli/src/network.rs
+++ b/rust/crates/truapi-host-cli/src/network.rs
@@ -20,94 +20,118 @@ pub enum Network {
     Previewnet,
 }
 
+/// Env var overriding the identity backend base URL for every command. The URL
+/// includes `/api/v1`, for instance a local backend at
+/// `http://localhost:8080/api/v1`. Chain endpoints stay on the preset.
+pub const IDENTITY_BACKEND_BASE_ENV: &str = "HOST_CLI_IDENTITY_BACKEND_BASE";
+
 impl Network {
+    /// Preset resolved with any environment overrides applied.
     pub fn config(self) -> NetworkConfig {
+        apply_backend_override(self.preset(), std::env::var(IDENTITY_BACKEND_BASE_ENV).ok())
+    }
+
+    /// The unmodified preset values.
+    fn preset(self) -> NetworkConfig {
         match self {
             Self::PaseoNextV2 => NetworkConfig {
                 id: "paseo-next-v2",
                 identity_backend_base: "https://identity-backend-next.parity-testnet.parity.io/api/v1",
-                people_ws: "wss://paseo-people-next-system-rpc.polkadot.io",
-                bulletin_ws: "wss://paseo-bulletin-next-rpc.polkadot.io",
-                asset_hub_ws: "wss://paseo-asset-hub-next-rpc.polkadot.io",
-                people_genesis: hex_literal_genesis(
-                    "89a63b11fef2c0273fc72c0d864da0793a665dade5db153e0cab995348c5440f",
-                ),
-                bulletin_genesis: hex_literal_genesis(
-                    "8cfe6717dc4becfda2e13c488a1e2061ff2dfee96e7d031157f72d36716c0a22",
-                ),
-                asset_hub_genesis: hex_literal_genesis(
-                    "23e730eb1c6fecae09c917439a5038cb6122d0d48980e8b9bbf0ff56f94a2ca6",
-                ),
+                people_ws: PASEO_PEOPLE.ws,
+                bulletin_ws: PASEO_BULLETIN.ws,
+                asset_hub_ws: PASEO_ASSET_HUB.ws,
+                people_genesis: PASEO_PEOPLE.genesis,
+                bulletin_genesis: PASEO_BULLETIN.genesis,
+                asset_hub_genesis: PASEO_ASSET_HUB.genesis,
                 live_chain_endpoints: PASEO_NEXT_V2_CHAIN_ENDPOINTS,
             },
             Self::Previewnet => NetworkConfig {
                 id: "previewnet",
                 identity_backend_base: "https://polkadot-app-stg.parity.io/api/v1",
-                people_ws: "wss://previewnet.substrate.dev/people",
-                bulletin_ws: "wss://previewnet.substrate.dev/bulletin",
-                asset_hub_ws: "wss://previewnet.substrate.dev/asset-hub",
-                people_genesis: hex_literal_genesis(
-                    "34999c298555e25bf17a7f3ea20efe7f6fdab1dfec7f808fbcfd36ca8aa5d220",
-                ),
-                bulletin_genesis: hex_literal_genesis(
-                    "1144acd27f0e5b2c88da7dc12c111e396983dec036ccfb42da5bbb0dd7104e89",
-                ),
-                asset_hub_genesis: hex_literal_genesis(
-                    "627f54413120c81161261b2ca87f60f0020963107dc28367491e09ec2dd29659",
-                ),
+                people_ws: PREVIEWNET_PEOPLE.ws,
+                bulletin_ws: PREVIEWNET_BULLETIN.ws,
+                asset_hub_ws: PREVIEWNET_ASSET_HUB.ws,
+                people_genesis: PREVIEWNET_PEOPLE.genesis,
+                bulletin_genesis: PREVIEWNET_BULLETIN.genesis,
+                asset_hub_genesis: PREVIEWNET_ASSET_HUB.genesis,
                 live_chain_endpoints: PREVIEWNET_CHAIN_ENDPOINTS,
             },
         }
     }
 }
 
-const PASEO_NEXT_V2_CHAIN_ENDPOINTS: &[ChainEndpoint] = &[
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "23e730eb1c6fecae09c917439a5038cb6122d0d48980e8b9bbf0ff56f94a2ca6",
-        ),
-        ws: "wss://paseo-asset-hub-next-rpc.polkadot.io",
-        required_for_host: true,
-    },
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "89a63b11fef2c0273fc72c0d864da0793a665dade5db153e0cab995348c5440f",
-        ),
-        ws: "wss://paseo-people-next-system-rpc.polkadot.io",
-        required_for_host: true,
-    },
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "8cfe6717dc4becfda2e13c488a1e2061ff2dfee96e7d031157f72d36716c0a22",
-        ),
-        ws: "wss://paseo-bulletin-next-rpc.polkadot.io",
-        required_for_host: true,
-    },
-];
-
-const PREVIEWNET_CHAIN_ENDPOINTS: &[ChainEndpoint] = &[
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "627f54413120c81161261b2ca87f60f0020963107dc28367491e09ec2dd29659",
-        ),
-        ws: "wss://previewnet.substrate.dev/asset-hub",
-        required_for_host: true,
-    },
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "34999c298555e25bf17a7f3ea20efe7f6fdab1dfec7f808fbcfd36ca8aa5d220",
-        ),
-        ws: "wss://previewnet.substrate.dev/people",
-        required_for_host: true,
-    },
-    ChainEndpoint {
-        genesis: hex_literal_genesis(
-            "1144acd27f0e5b2c88da7dc12c111e396983dec036ccfb42da5bbb0dd7104e89",
-        ),
-        ws: "wss://previewnet.substrate.dev/bulletin",
-        required_for_host: true,
-    },
-];
+/// Replaces the preset's identity backend base with `base` when it carries a
+/// non-empty URL. Trailing slashes are stripped so path joins stay clean. The
+/// override string is leaked; the CLI reads it a handful of times per process.
+fn apply_backend_override(mut config: NetworkConfig, base: Option<String>) -> NetworkConfig {
+    if let Some(base) = base {
+        let trimmed = base.trim().trim_end_matches('/');
+        if !trimmed.is_empty() {
+            config.identity_backend_base = Box::leak(trimmed.to_string().into_boxed_str());
+        }
+    }
+    config
+}
+
+// Each chain is declared once and reused by both the preset fields and the
+// endpoint table. A genesis hash can therefore never drift from the URL it
+// routes to. Every route below is host-required: session identity (dotNS
+// usernames) resolves through Asset Hub, SSO through People, preimages through
+// Bulletin.
+
+const PASEO_ASSET_HUB: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "23e730eb1c6fecae09c917439a5038cb6122d0d48980e8b9bbf0ff56f94a2ca6",
+    ),
+    ws: "wss://paseo-asset-hub-next-rpc.polkadot.io",
+    required_for_host: true,
+};
+
+const PASEO_PEOPLE: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "89a63b11fef2c0273fc72c0d864da0793a665dade5db153e0cab995348c5440f",
+    ),
+    ws: "wss://paseo-people-next-system-rpc.polkadot.io",
+    required_for_host: true,
+};
+
+const PASEO_BULLETIN: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "8cfe6717dc4becfda2e13c488a1e2061ff2dfee96e7d031157f72d36716c0a22",
+    ),
+    ws: "wss://paseo-bulletin-next-rpc.polkadot.io",
+    required_for_host: true,
+};
+
+const PREVIEWNET_ASSET_HUB: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "627f54413120c81161261b2ca87f60f0020963107dc28367491e09ec2dd29659",
+    ),
+    ws: "wss://previewnet.substrate.dev/asset-hub",
+    required_for_host: true,
+};
+
+const PREVIEWNET_PEOPLE: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "34999c298555e25bf17a7f3ea20efe7f6fdab1dfec7f808fbcfd36ca8aa5d220",
+    ),
+    ws: "wss://previewnet.substrate.dev/people",
+    required_for_host: true,
+};
+
+const PREVIEWNET_BULLETIN: ChainEndpoint = ChainEndpoint {
+    genesis: hex_literal_genesis(
+        "1144acd27f0e5b2c88da7dc12c111e396983dec036ccfb42da5bbb0dd7104e89",
+    ),
+    ws: "wss://previewnet.substrate.dev/bulletin",
+    required_for_host: true,
+};
+
+const PASEO_NEXT_V2_CHAIN_ENDPOINTS: &[ChainEndpoint] =
+    &[PASEO_ASSET_HUB, PASEO_PEOPLE, PASEO_BULLETIN];
+
+const PREVIEWNET_CHAIN_ENDPOINTS: &[ChainEndpoint] =
+    &[PREVIEWNET_ASSET_HUB, PREVIEWNET_PEOPLE, PREVIEWNET_BULLETIN];
 
 /// Resolved RPC/backend/genesis values for one network preset.
 #[derive(Debug, Clone, Copy)]
@@ -311,8 +335,8 @@ mod tests {
                 let expected_row = format!("| {row} | `0x{}` |", hex::encode(expected));
                 assert!(
                     SPEC.contains(&expected_row),
-                    "SPEC.md is missing the row `{expected_row}` for preset `{}`; \
-                     the table and the preset have drifted",
+                    "SPEC.md is missing the row `{expected_row}` for {}; the table and \
+                     the preset have drifted",
                     config.id
                 );
             }
@@ -392,7 +416,8 @@ mod tests {
     #[test]
     fn every_preset_is_a_test_network() {
         for network in Network::value_variants() {
-            let config = network.config();
+            // Reading the raw preset. An exported backend override cannot leak in.
+            let config = network.preset();
             let mut routes = vec![
                 config.identity_backend_base,
                 config.people_ws,
@@ -559,4 +584,22 @@ mod tests {
              skipped one and this test stopped covering it"
         );
     }
+
+    #[test]
+    fn backend_override_replaces_only_the_backend_base() {
+        let preset = Network::PaseoNextV2.preset();
+        let overridden =
+            apply_backend_override(preset, Some("http://localhost:8080/api/v1/".to_string()));
+
+        assert_eq!(
+            overridden.identity_backend_base, "http://localhost:8080/api/v1",
+            "trailing slash is stripped"
+        );
+        assert_eq!(overridden.asset_hub_ws, preset.asset_hub_ws);
+        assert_eq!(
+            apply_backend_override(preset, Some("  ".to_string())).identity_backend_base,
+            preset.identity_backend_base,
+            "a blank override keeps the preset"
+        );
+    }
 }
diff --git a/rust/crates/truapi-host-cli/src/platform.rs b/rust/crates/truapi-host-cli/src/platform.rs
index 2f9ea1956..a9521d109 100644
--- a/rust/crates/truapi-host-cli/src/platform.rs
+++ b/rust/crates/truapi-host-cli/src/platform.rs
@@ -1198,7 +1198,7 @@ fn load_hex_key_map(path: &Path) -> HashMap<Vec<u8>, Vec<u8>> {
 
 /// Directory-safe name for one paired identity's storage namespace.
 ///
-/// The connected id is whatever the People-chain identity yields: a lite username
+/// The connected id is whatever the dotNS identity yields: a lite username
 /// when there is one, otherwise the free-form `full_username`. Only the former is
 /// guaranteed to satisfy [`crate::sessions::validate_name`], so a display name
 /// like `"Tarik Gul"` is rejected on both the space and the capitals.
diff --git a/rust/crates/truapi-host-cli/src/register_name.rs b/rust/crates/truapi-host-cli/src/register_name.rs
new file mode 100644
index 000000000..61c3cd26d
--- /dev/null
+++ b/rust/crates/truapi-host-cli/src/register_name.rs
@@ -0,0 +1,277 @@
+//! Full-person username registration through `DotnsGateway.register_name`.
+//!
+//! Builds and submits the v5 general transaction on Asset Hub. The signer's
+//! RFC-0022 `uid.dot` account is the call's `who`. The full-person bandersnatch
+//! key proves People-ring membership bound to the dotNS gateway context. A fresh
+//! sr25519 signature over the inherited-implication digest travels in the
+//! `AsDotnsGateway` extension.
+//!
+//! Requires a recognized full person. The account's full-person key must be
+//! `Included` in a People ring already propagated to Asset Hub.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result, bail};
+use tracing::debug;
+use truapi_server::host_logic::dotns_gateway::{
+    DOTNS_GATEWAY_CONTEXT, Link, MAX_BASE_LABEL_LEN, MIN_PERSON_LABEL_LEN,
+    build_register_proof_message, encode_register_full_name_extra, encode_register_name_call,
+    is_dotted_lite_username, is_registrable_full_label,
+};
+use truapi_server::host_logic::product_account::{
+    SR25519_SIGNING_CONTEXT, derive_full_person_ring_vrf_entropy, derive_identity_keypair,
+};
+use truapi_server::statement_allowance::collection::PersonhoodCollection;
+use truapi_server::statement_allowance::extension::AS_DOTNS_GATEWAY;
+use truapi_server::statement_allowance::{
+    self as alloc, extension, extrinsic, proof, ring, rpc::RpcClient,
+};
+
+use crate::dotns_read::AssetHubReader;
+use crate::network::NetworkConfig;
+
+/// Inputs for one full-person registration run.
+pub struct RegisterNameConfig {
+    /// Network preset providing the People and Asset Hub endpoints.
+    pub network: NetworkConfig,
+    /// BIP-39 entropy of the signing host's root account.
+    pub entropy: Vec<u8>,
+    /// Base label to register: lowercase ASCII letters only (`is_person_label`
+    /// in the gateway pallet), at most 32 bytes.
+    pub label: String,
+    /// Dotted lite username to link (`name.NN`). Without this and without
+    /// `chat_key`, the account's own lite username is looked up and linked.
+    pub link_lite: Option<String>,
+    /// 65-byte ECDH chat key for a standalone (unlinked) registration.
+    pub chat_key: Option<[u8; 65]>,
+}
+
+/// Registers (or claims) `label` as a full-person username. Waits until the
+/// gateway records the account's alias on Asset Hub.
+pub async fn register_name(config: &RegisterNameConfig) -> Result<()> {
+    // The pallet and the contract reject malformed labels only at submission
+    // (as an invalid transaction or a revert), so check the cheap rules here.
+    let label = &config.label;
+    if !is_registrable_full_label(label) {
+        bail!(
+            "label {label:?} is not a registrable full-person base label: lowercase ASCII \
+             letters only, {MIN_PERSON_LABEL_LEN} to {MAX_BASE_LABEL_LEN} bytes"
+        );
+    }
+    if let Some(lite) = &config.link_lite
+        && !is_dotted_lite_username(lite)
+    {
+        bail!("--link-lite {lite:?} is not a dotted lite username (`name.NN`)");
+    }
+    let who = derive_identity_keypair(&config.entropy)
+        .map_err(|err| anyhow::anyhow!("uid.dot identity derivation failed: {err}"))?;
+    let who_public = who.public.to_bytes();
+
+    let mut reader = AssetHubReader::connect(config.network.asset_hub_ws).await?;
+    // Registered names (any flow) fail only at submission otherwise; a pending
+    // reservation of `label` is not a mint and stays claimable.
+    if !reader.label_available(label).await? {
+        bail!("label {label:?} is already registered on dotNS and cannot be registered again");
+    }
+    // The gateway rejects a second registration for the account and a lite
+    // link the account does not own; both are storage reads, so ask first.
+    if reader.account_alias(&who_public).await?.is_some() {
+        bail!("this account has already registered a full-person username on the gateway");
+    }
+    let link = resolve_link(config, &mut reader, &who_public).await?;
+    if let Link::LiteUsername(lite) = &link {
+        let lite = core::str::from_utf8(lite).unwrap_or_default();
+        match reader.lite_label_owner(lite).await? {
+            Some(owner) if owner == who_public => {}
+            Some(_) => bail!(
+                "lite username {lite:?} was reserved for another account; pass --chat-key for a \
+                 standalone registration"
+            ),
+            None => bail!(
+                "lite username {lite:?} was not reserved through the dotNS gateway on this \
+                 network; pass --chat-key for a standalone registration"
+            ),
+        }
+    }
+
+    // Reading the full-person member key's ring and its members from the People
+    // chain, pinned to one finalized block.
+    let people_rpc = RpcClient::connect(config.network.people_ws)
+        .await
+        .context("connect People RPC")?;
+    let people_metadata = alloc::fetch_metadata(&people_rpc).await?;
+    let at = people_rpc.finalized_head().await?;
+    let full_entropy = derive_full_person_ring_vrf_entropy(&config.entropy);
+    let member = proof::member_key(full_entropy);
+    let ring_index = ring::read_member_ring_index_at(
+        &people_rpc,
+        &people_metadata,
+        PersonhoodCollection::People,
+        &member,
+        &at,
+    )
+    .await
+    .context("resolve full-person ring membership (is the account a recognized person?)")?;
+    let members =
+        ring::read_ring_members_at(&people_rpc, PersonhoodCollection::People, ring_index, &at)
+            .await?;
+    // `Members.Members` reports a ring index as soon as the key is onboarded;
+    // the members read above is sliced to the keys already built into the
+    // ring's root, so a fresh member can be missing from it for a few blocks.
+    if !members.contains(&member) {
+        bail!(
+            "the account's full-person key is onboarded into People ring {ring_index} but \
+             not yet built into its root; retry once the next root revision is built"
+        );
+    }
+    // The revision of the root the proof is built against, at the same pinned
+    // block as the members read, so the two cannot disagree.
+    let revision = ring::read_ring_revision(
+        &people_rpc,
+        &people_metadata,
+        PersonhoodCollection::People,
+        ring_index,
+        &at,
+    )
+    .await?;
+    debug!(
+        ring_index,
+        revision,
+        members = members.len(),
+        "full-person ring resolved"
+    );
+
+    // Reading Asset Hub metadata, which asserts the RegisterFullName shape.
+    // Then the chain state and the exponent the subscriber verifies proofs
+    // against.
+    let ah_rpc = RpcClient::connect(config.network.asset_hub_ws)
+        .await
+        .context("connect Asset Hub RPC")?;
+    let ah_metadata = alloc::fetch_metadata(&ah_rpc).await?;
+    let chain_state = extension::ChainState {
+        // A restricted-origin general transaction. RestrictOrigins carries true.
+        restrict_origins: true,
+        ..alloc::fetch_chain_state(&ah_rpc).await?
+    };
+    let info_variant = ah_metadata.dotns_register_full_name_variant()?;
+    let exponent =
+        ring::read_subscriber_ring_exponent(&ah_rpc, &ah_metadata, PersonhoodCollection::People)
+            .await?;
+    let domain = proof::domain_for_ring_exponent(exponent)?;
+
+    let call_indices = ah_metadata.call_indices("DotnsGateway", "register_name")?;
+    let call = encode_register_name_call(call_indices, &who_public, config.label.as_bytes(), &link);
+
+    // Signing the inherited-implication digest with sr25519. The signature is
+    // carried in the AsDotnsGateway extension.
+    let digest = extension::build_proof_message_after_extension(
+        &ah_metadata,
+        &call,
+        &chain_state,
+        AS_DOTNS_GATEWAY,
+    )?;
+    let signature = who
+        .secret
+        .sign_simple(SR25519_SIGNING_CONTEXT, &digest, &who.public)
+        .to_bytes();
+
+    // Building the ring-VRF membership proof. It is bound to the gateway context
+    // and the registration intent.
+    let proof_message = build_register_proof_message(&who_public, config.label.as_bytes(), &link);
+    let ring_proof = proof::ring_vrf_proof(
+        domain,
+        full_entropy,
+        &members,
+        &DOTNS_GATEWAY_CONTEXT,
+        &proof_message,
+    )?;
+
+    // Asset Hub only verifies proofs against root revisions it has imported
+    // from People; wait for this one before submitting.
+    alloc::pgas::await_ring_revision(
+        &ah_rpc,
+        &ah_metadata,
+        PersonhoodCollection::People,
+        ring_index,
+        revision,
+    )
+    .await
+    .context("wait for Asset Hub to import the People ring root revision")?;
+
+    let extra = encode_register_full_name_extra(
+        info_variant,
+        &ring_proof,
+        ring_index,
+        revision,
+        &signature,
+    );
+    let extrinsic = extrinsic::build_unsigned_extrinsic_with_extra(
+        &ah_metadata,
+        &chain_state,
+        &call,
+        AS_DOTNS_GATEWAY,
+        &extra,
+    )?;
+
+    let block = ah_rpc.submit_and_watch(&extrinsic).await?;
+    println!("REGISTER_SUBMITTED label={} block={block}", config.label);
+
+    wait_for_alias(&reader, &who_public).await?;
+    let identity = reader.dotns_identity(&who_public).await?;
+    println!(
+        "REGISTER_CONFIRMED label={} full_username={}",
+        config.label,
+        identity.full_username.as_deref().unwrap_or("<pending>")
+    );
+    Ok(())
+}
+
+/// Resolves the `Link` argument. An explicit chat key wins, then an explicit
+/// lite label, then the account's own on-chain lite username.
+async fn resolve_link(
+    config: &RegisterNameConfig,
+    reader: &mut AssetHubReader,
+    who: &[u8; 32],
+) -> Result<Link> {
+    if let Some(chat_key) = config.chat_key {
+        return Ok(Link::None(chat_key));
+    }
+    if let Some(lite) = &config.link_lite {
+        return Ok(Link::LiteUsername(lite.as_bytes().to_vec()));
+    }
+    let identity = reader.dotns_identity(who).await?;
+    match identity.lite_username {
+        // The resolved name goes into the signed ring-VRF message, so it has
+        // to pass the same shape check as an explicit --link-lite: a store can
+        // hold a two-digit-suffixed label whose flattened form exceeds the
+        // gateway's BaseLabel bound.
+        Some(lite) if is_dotted_lite_username(&lite) => {
+            debug!(%lite, "linking the account's own lite username");
+            Ok(Link::LiteUsername(lite.into_bytes()))
+        }
+        Some(lite) => bail!(
+            "the account's lite username {lite:?} is not a linkable `name.NN` label; pass \
+             --chat-key <hex 65 bytes> for a standalone registration"
+        ),
+        None => bail!(
+            "account has no lite username to link; pass --link-lite <name.NN> or \
+             --chat-key <hex 65 bytes> for a standalone registration"
+        ),
+    }
+}
+
+/// Polls `DotnsGateway.AccountAlias[who]` until the registration lands.
+async fn wait_for_alias(reader: &AssetHubReader, who: &[u8; 32]) -> Result<()> {
+    const MAX_ATTEMPTS: usize = 10;
+    for attempt in 1..=MAX_ATTEMPTS {
+        if let Some(alias) = reader.account_alias(who).await? {
+            println!("REGISTER_ALIAS alias=0x{}", hex::encode(alias));
+            return Ok(());
+        }
+        debug!("DotnsGateway.AccountAlias poll {attempt}/{MAX_ATTEMPTS}: empty");
+        if attempt < MAX_ATTEMPTS {
+            tokio::time::sleep(Duration::from_secs(4)).await;
+        }
+    }
+    bail!("DotnsGateway.AccountAlias did not appear after registration")
+}
diff --git a/rust/crates/truapi-host-cli/tests/live_asset_hub.rs b/rust/crates/truapi-host-cli/tests/live_asset_hub.rs
index dfbce4fa6..e972e172e 100644
--- a/rust/crates/truapi-host-cli/tests/live_asset_hub.rs
+++ b/rust/crates/truapi-host-cli/tests/live_asset_hub.rs
@@ -14,6 +14,12 @@ use truapi_server::statement_allowance::collection::PersonhoodCollection;
 use truapi_server::statement_allowance::{self as alloc, extension::AS_PGAS, pgas};
 
 const ASSET_HUB_WS: &str = "wss://paseo-asset-hub-next-rpc.polkadot.io";
+
+/// `LIVE_ASSET_HUB_WS` points the dotNS checks at another Asset Hub, for
+/// instance previewnet's `wss://previewnet.substrate.dev/asset-hub`.
+fn asset_hub_ws() -> String {
+    std::env::var("LIVE_ASSET_HUB_WS").unwrap_or_else(|_| ASSET_HUB_WS.to_string())
+}
 const PEOPLE_WS: &str = "wss://paseo-people-next-system-rpc.polkadot.io";
 
 /// The ring our onboarded test identity sits in.
@@ -22,7 +28,7 @@ const RING_INDEX: u32 = 2;
 const COLLECTION: PersonhoodCollection = PersonhoodCollection::LitePeople;
 
 async fn asset_hub() -> (alloc::rpc::RpcClient, alloc::extension::Metadata) {
-    let rpc = alloc::rpc::RpcClient::connect(ASSET_HUB_WS)
+    let rpc = alloc::rpc::RpcClient::connect(&asset_hub_ws())
         .await
         .expect("connect to Asset Hub");
     let metadata = alloc::fetch_metadata(&rpc)
@@ -182,3 +188,178 @@ async fn live_asset_hub_reports_a_skipped_revision_as_pruned() {
         "a skipped revision should not be waited out: {err}"
     );
 }
+
+// ---------------------------------------------------------------------------
+// dotNS gateway: the register_name authorization shape and the username reads.
+// ---------------------------------------------------------------------------
+
+use truapi_server::host_logic::dotns_gateway::{
+    DotnsTransport, DotnsViewError, VIEW_CALL_ORIGIN, call_bytes32, classify_labels,
+    decode_address, discover_pop_controller, encode_revive_call, label_available, namehash_under,
+    resolve_labels, selector, view_output,
+};
+use truapi_server::statement_allowance::extension::AS_DOTNS_GATEWAY;
+
+/// The `DotnsRegistrar` (ERC721), the same CREATE3 address on every network
+/// per dotns `DEPLOYMENTS.md`. Only used to find an account that holds a
+/// settled name.
+const DOTNS_REGISTRAR: [u8; 20] = [
+    0x4f, 0x06, 0xe8, 0x18, 0xba, 0x3d, 0x98, 0x77, 0x04, 0xfd, 0x91, 0xcf, 0x3d, 0x86, 0x8e, 0x4b,
+    0x01, 0x91, 0x06, 0xab,
+];
+
+/// A label minted through the public registrar on the checked network, whose
+/// owner therefore has a settled `LabelStore`. `LIVE_MINTED_LABEL` overrides
+/// the paseo-next-v2 default (`e2epoolns01`); `LIVE_TLD` names the network TLD
+/// (`paseo` by default, `dot` on previewnet).
+fn minted_label() -> String {
+    std::env::var("LIVE_MINTED_LABEL").unwrap_or_else(|_| "e2epoolns01".to_string())
+}
+
+/// `namehash(<minted label>.<tld>)`, the registrar's token id.
+fn minted_node() -> [u8; 32] {
+    let tld = std::env::var("LIVE_TLD").unwrap_or_else(|_| "paseo".to_string());
+    namehash_under(&namehash_under(&[0u8; 32], &tld), &minted_label())
+}
+
+/// `DotnsTransport` over plain RPC, the same two primitives the CLI uses.
+struct PlainRpc(alloc::rpc::RpcClient);
+
+#[truapi_platform::async_trait]
+impl DotnsTransport for PlainRpc {
+    async fn storage(&mut self, key: Vec<u8>) -> Result<Option<Vec<u8>>, String> {
+        self.0
+            .get_storage(&key)
+            .await
+            .map_err(|err| err.to_string())
+    }
+
+    async fn view(&mut self, dest: &[u8; 20], input: Vec<u8>) -> Result<Vec<u8>, DotnsViewError> {
+        let args = encode_revive_call(&VIEW_CALL_ORIGIN, dest, &input);
+        let output = self
+            .0
+            .call(
+                "state_call",
+                serde_json::json!(["ReviveApi_call", format!("0x{}", hex::encode(args))]),
+            )
+            .await
+            .map_err(|err| DotnsViewError::Failed(err.to_string()))?;
+        let output = output
+            .as_str()
+            .ok_or_else(|| DotnsViewError::Failed("state_call output is not a string".into()))?;
+        let bytes = hex::decode(output.trim_start_matches("0x"))
+            .map_err(|err| DotnsViewError::Failed(err.to_string()))?;
+        view_output(&bytes)
+    }
+}
+
+/// `register_name` is authorized by `AsDotnsGatewayInfo::RegisterFullName`.
+/// The host asserts its exact field shape before signing, and the encoded
+/// extra has to match it field for field: a shorter payload is accepted
+/// locally and rejected (or worse) by the runtime. The vendored fixture is a
+/// snapshot; this is the live shape.
+#[tokio::test]
+#[ignore = "needs network access to a live Asset Hub"]
+async fn live_asset_hub_declares_the_register_full_name_shape() {
+    let (_rpc, metadata) = asset_hub().await;
+    let variant = metadata
+        .dotns_register_full_name_variant()
+        .expect("RegisterFullName is {proof, ring_index, revision, signature}");
+    assert_eq!(
+        metadata
+            .extension_info_field_count(AS_DOTNS_GATEWAY, "RegisterFullName")
+            .unwrap(),
+        4
+    );
+    metadata
+        .call_indices("DotnsGateway", "register_name")
+        .expect("DotnsGateway.register_name exists");
+    println!("live AsDotnsGateway: RegisterFullName={variant}");
+}
+
+/// End to end over the same resolution steps the CLI and the in-core runtime
+/// share: pallet storage → dispatcher `TARGET()` → controller → registry →
+/// store factory → the owner's `LabelStore` → bare labels. The owner is found
+/// through the registrar, so this covers the warm path (a settled store, whose
+/// labels carry the network TLD) rather than only pending claims.
+#[tokio::test]
+#[ignore = "needs network access to a live Asset Hub"]
+async fn live_asset_hub_resolves_a_settled_store_over_dotns_discovery() {
+    let (rpc, _metadata) = asset_hub().await;
+    let mut transport = PlainRpc(rpc);
+
+    let controller = discover_pop_controller(&mut transport)
+        .await
+        .expect("discovery")
+        .expect("the gateway is deployed with a dispatcher");
+    println!("live DotnsPopController: 0x{}", hex::encode(controller));
+
+    // ownerOf(namehash) on the ERC721 registrar. Eth-derived owners map back
+    // to an AccountId32 by `0xEE` padding, which `account_to_h160` truncates.
+    let owner_output = transport
+        .view(
+            &DOTNS_REGISTRAR,
+            call_bytes32("ownerOf(uint256)", &minted_node()),
+        )
+        .await
+        .expect("registrar ownerOf");
+    let owner = decode_address(&owner_output).expect("owner address");
+    let mut account = [0xEE; 32];
+    account[..20].copy_from_slice(&owner);
+    assert_eq!(hex::encode(selector("ownerOf(uint256)")), "6352211e");
+
+    let labels = resolve_labels(&mut transport, &controller, &account)
+        .await
+        .expect("resolve labels");
+    println!("live labels of 0x{}: {labels:?}", hex::encode(owner));
+    assert!(
+        labels.iter().any(|label| *label == minted_label()),
+        "the settled store label loses its network TLD: {labels:?}"
+    );
+    assert!(
+        labels.iter().all(|label| !label.contains('.')),
+        "no TLD or subname survives: {labels:?}"
+    );
+    // The default owner's store holds far more than one `getLabels` page, so
+    // this also proves the store is paged rather than read once.
+    if std::env::var("LIVE_MINTED_LABEL").is_err() {
+        assert!(
+            labels.len() > 16,
+            "expected the e2e pool store to span several pages, got {}",
+            labels.len()
+        );
+    }
+    let identity = classify_labels(&labels);
+    assert!(
+        identity.lite_username.is_some() || identity.full_username.is_some(),
+        "labels classify into a username"
+    );
+}
+
+/// A reservation or registration for a name the registrar already minted can
+/// never succeed, so the CLI asks the registrar first. `available` is read for
+/// the name's node under the network TLD (`namehash(label.tld)`), the same node the
+/// registrar minted.
+#[tokio::test]
+#[ignore = "needs network access to a live Asset Hub"]
+async fn live_asset_hub_reports_registered_names_as_unavailable() {
+    let (rpc, _metadata) = asset_hub().await;
+    let mut transport = PlainRpc(rpc);
+    let controller = discover_pop_controller(&mut transport)
+        .await
+        .expect("discovery")
+        .expect("gateway deployed");
+
+    assert!(
+        !label_available(&mut transport, &controller, &minted_label())
+            .await
+            .expect("available view"),
+        "a minted name is not available"
+    );
+    assert!(
+        label_available(&mut transport, &controller, "truapihostrebasecheckzz")
+            .await
+            .expect("available view"),
+        "an unminted name is available"
+    );
+}
diff --git a/rust/crates/truapi-platform/src/lib.rs b/rust/crates/truapi-platform/src/lib.rs
index bbb280e6a..9203bce32 100644
--- a/rust/crates/truapi-platform/src/lib.rs
+++ b/rust/crates/truapi-platform/src/lib.rs
@@ -69,6 +69,8 @@ pub struct PairingHostConfig {
     pub people_chain_genesis_hash: [u8; 32],
     /// Bulletin-chain genesis hash used for in-core preimage submission.
     pub bulletin_chain_genesis_hash: [u8; 32],
+    /// Asset Hub genesis hash used to resolve session usernames from dotNS.
+    pub asset_hub_chain_genesis_hash: [u8; 32],
     /// Deeplink URI scheme used in pairing QR payloads, without `://`.
     ///
     /// Host-spec L.2-L.3 define the `polkadotapp://pair` route and construction
@@ -182,6 +184,7 @@ impl PairingHostConfig {
         platform_info: PlatformInfo,
         people_chain_genesis_hash: [u8; 32],
         bulletin_chain_genesis_hash: [u8; 32],
+        asset_hub_chain_genesis_hash: [u8; 32],
         pairing_deeplink_scheme: String,
     ) -> Result<Self, RuntimeConfigValidationError> {
         require_non_empty("pairing_deeplink_scheme", &pairing_deeplink_scheme)?;
@@ -194,6 +197,7 @@ impl PairingHostConfig {
             host: HostRuntimeConfig::new(host_info, platform_info)?,
             people_chain_genesis_hash,
             bulletin_chain_genesis_hash,
+            asset_hub_chain_genesis_hash,
             pairing_deeplink_scheme,
         };
         Ok(config)
@@ -2329,7 +2333,7 @@ pub trait CoreStorage: Send + Sync {
 pub struct SessionUiInfo {
     /// 32-byte sr25519 root public key of the active session.
     pub public_key: Bytes32,
-    /// Wallet identity account id used for People-chain username lookup.
+    /// Wallet identity account id used for the dotNS username lookup on Asset Hub.
     pub identity_account_id: Option<Bytes32>,
     /// X25519 public key addressing this identity in chat. Public counterpart
     /// of the key [`CoreAdmin::get_session_chat_identity_key`] serves.
@@ -2342,9 +2346,9 @@ pub struct SessionUiInfo {
     /// wallet identity is the wallet's choice, so hosts must not treat it as a
     /// device discriminator; use [`Self::device_enc_public_key`] for that.
     pub peer_statement_account_id: Option<Bytes32>,
-    /// Short username from the People-chain identity record.
+    /// Short username from the dotNS identity record on Asset Hub.
     pub lite_username: Option<String>,
-    /// Fully qualified username from the People-chain identity record.
+    /// Fully qualified username from the dotNS identity record on Asset Hub.
     pub full_username: Option<String>,
 }
 
diff --git a/rust/crates/truapi-platform/tests/bounds.rs b/rust/crates/truapi-platform/tests/bounds.rs
index 175dafe86..85eb7ab33 100644
--- a/rust/crates/truapi-platform/tests/bounds.rs
+++ b/rust/crates/truapi-platform/tests/bounds.rs
@@ -97,6 +97,7 @@ fn pairing_config_validation_cases() {
             PlatformInfo::default(),
             [0xa2; 32],
             [0xbb; 32],
+            [0xcc; 32],
             case.pairing_deeplink_scheme.to_string(),
         )
         .map(|_| ());
diff --git a/rust/crates/truapi-server/src/chain_runtime.rs b/rust/crates/truapi-server/src/chain_runtime.rs
index dda599a03..a18e25399 100644
--- a/rust/crates/truapi-server/src/chain_runtime.rs
+++ b/rust/crates/truapi-server/src/chain_runtime.rs
@@ -1703,6 +1703,46 @@ pub(crate) async fn wait_for_chain_head_storage_value(
     }
 }
 
+/// Waits for one runtime-API call operation's output from a
+/// `chainHead_v1_follow` stream.
+pub(crate) async fn wait_for_chain_head_call_output(
+    follow: &mut BoxStream<'static, RemoteChainHeadFollowItem>,
+    operation_id: &str,
+    label: &'static str,
+    timeout: Duration,
+) -> Result<Vec<u8>, String> {
+    let timeout = futures_timer::Delay::new(timeout).fuse();
+    pin_mut!(timeout);
+    loop {
+        let next = follow.next().fuse();
+        pin_mut!(next);
+        futures::select! {
+            item = next => match item {
+                Some(RemoteChainHeadFollowItem::OperationCallDone { operation_id: item_operation_id, output })
+                    if item_operation_id == operation_id =>
+                {
+                    return Ok(output);
+                }
+                Some(RemoteChainHeadFollowItem::OperationInaccessible { operation_id: item_operation_id })
+                    if item_operation_id == operation_id =>
+                {
+                    return Err(format!("{label} runtime call was inaccessible"));
+                }
+                Some(RemoteChainHeadFollowItem::OperationError { operation_id: item_operation_id, error })
+                    if item_operation_id == operation_id =>
+                {
+                    return Err(error);
+                }
+                Some(RemoteChainHeadFollowItem::Stop) | None => {
+                    return Err(format!("{label} follow stopped during runtime call"));
+                }
+                _ => {}
+            },
+            () = timeout => return Err(format!("{label} runtime call timed out")),
+        }
+    }
+}
+
 #[cfg(test)]
 fn decode_hex(value: &str) -> Result<Vec<u8>, String> {
     hex::decode(value.strip_prefix("0x").unwrap_or(value)).map_err(|_| "invalid hex".to_string())
diff --git a/rust/crates/truapi-server/src/host_logic.rs b/rust/crates/truapi-server/src/host_logic.rs
index 3a65c9f79..7d01d8263 100644
--- a/rust/crates/truapi-server/src/host_logic.rs
+++ b/rust/crates/truapi-server/src/host_logic.rs
@@ -8,10 +8,10 @@ pub mod attestation;
 pub mod bulletin;
 pub mod device_key;
 pub mod dotns;
+pub mod dotns_gateway;
 pub mod entropy;
 pub mod extrinsic;
 pub mod features;
-pub mod identity;
 pub mod permissions;
 pub mod product_account;
 pub mod session;
diff --git a/rust/crates/truapi-server/src/host_logic/attestation.rs b/rust/crates/truapi-server/src/host_logic/attestation.rs
index 098edec4f..f047c070b 100644
--- a/rust/crates/truapi-server/src/host_logic/attestation.rs
+++ b/rust/crates/truapi-server/src/host_logic/attestation.rs
@@ -1,6 +1,6 @@
 //! Lite-person username registration parameters (signing host, native only).
 //!
-//! Builds the client-side proofs the People-chain identity backend needs to
+//! Builds the client-side proofs the identity backend needs to
 //! attest a lite username for an account: an sr25519 proof-of-ownership, a
 //! bandersnatch ring-VRF member key + plain-VRF proof, and an sr25519
 //! consumer-registration signature. The backend submits the on-chain
@@ -8,7 +8,8 @@
 //!
 //! Byte layout mirrors signing-bot `src/core/attestation.ts` for backend
 //! parity. The registered account is the account whose secret signs here; the
-//! paired host resolves the username from `Resources.Consumers[that account]`.
+//! paired host resolves the username from the dotNS contracts on Asset Hub
+//! (`host_logic::dotns_gateway`), where the backend's `reserve_name` records it.
 
 use parity_scale_codec::{Decode, Encode};
 use thiserror::Error;
@@ -16,6 +17,7 @@ use verifiable::Error as VerifiableError;
 use verifiable::GenerateVerifiable;
 use verifiable::ring::bandersnatch::BandersnatchVrfVerifiable;
 
+use crate::host_logic::dotns_gateway::build_reservation_message;
 use crate::host_logic::product_account::{
     ProductAccountError, SR25519_SIGNING_CONTEXT, derive_identity_keypair,
     derive_lite_person_ring_vrf_entropy, product_public_key_to_address,
@@ -48,7 +50,7 @@ struct ConsumerRegistrationSigningPayload {
 pub struct LiteRegistration {
     /// SS58 (prefix 42) of the candidate account.
     pub candidate_account_id: String,
-    /// Raw 32-byte candidate public key (the future `Resources.Consumers` key).
+    /// Raw 32-byte candidate public key (the account the username is recorded for).
     pub candidate_public_key: [u8; 32],
     /// sr25519 signature over `prefix ‖ candidate_pub ‖ ring_vrf_key`.
     pub candidate_signature: [u8; 64],
@@ -56,10 +58,14 @@ pub struct LiteRegistration {
     pub ring_vrf_key: [u8; 32],
     /// Plain bandersnatch VRF proof over the same proof message.
     pub proof_of_ownership: [u8; 64],
-    /// 65-byte uncompressed P-256 identifier key.
+    /// 65-byte uncompressed P-256 identifier key. It doubles as the dotNS chat
+    /// key.
     pub identifier_key: [u8; 65],
     /// sr25519 signature over the SCALE consumer-registration tuple.
     pub consumer_registration_signature: [u8; 64],
+    /// sr25519 signature over the dotNS gateway reservation message. It
+    /// authorizes `pallet_dotns_gateway::reserve_name` on Asset Hub.
+    pub dotns_signature: [u8; 64],
 }
 
 /// Error while building lite-person registration parameters.
@@ -78,10 +84,17 @@ pub enum LiteRegistrationError {
 
 /// Build the lite-person registration parameters for `username_base`
 /// (6+ lowercase letters, no digit suffix) against the backend `verifier`.
+///
+/// `reserved_username` optionally queues a base name for a later full-person
+/// claim on dotNS. `dotns_signed_at_secs` must be Asset Hub chain time, meaning
+/// `Timestamp.Now` in seconds. The local wall clock will not do: the gateway
+/// rejects signatures more than 30 seconds in the chain's future.
 pub fn build_lite_registration(
     entropy: &[u8],
     verifier_account_id: [u8; 32],
     username_base: &str,
+    reserved_username: Option<&str>,
+    dotns_signed_at_secs: u64,
 ) -> Result<LiteRegistration, LiteRegistrationError> {
     // Registration, local activation, and the SSO responder all use the
     // RFC-0022 `uid.dot` default product account.
@@ -111,7 +124,7 @@ pub fn build_lite_registration(
         verifier: verifier_account_id,
         identifier_key,
         username: username_base.as_bytes().to_vec(),
-        reserved_username: None,
+        reserved_username: reserved_username.map(|name| name.as_bytes().to_vec()),
     }
     .encode();
     let consumer_registration_signature = candidate
@@ -123,6 +136,23 @@ pub fn build_lite_registration(
         )
         .to_bytes();
 
+    let reservation_message = build_reservation_message(
+        &candidate_public_key,
+        &verifier_account_id,
+        username_base.as_bytes(),
+        &identifier_key,
+        reserved_username.map(str::as_bytes),
+        dotns_signed_at_secs,
+    );
+    let dotns_signature = candidate
+        .secret
+        .sign_simple(
+            SR25519_SIGNING_CONTEXT,
+            &reservation_message,
+            &candidate.public,
+        )
+        .to_bytes();
+
     Ok(LiteRegistration {
         candidate_account_id: product_public_key_to_address(candidate_public_key),
         candidate_public_key,
@@ -131,6 +161,7 @@ pub fn build_lite_registration(
         proof_of_ownership,
         identifier_key,
         consumer_registration_signature,
+        dotns_signature,
     })
 }
 
@@ -172,7 +203,9 @@ mod tests {
     #[test]
     fn registration_params_have_expected_shapes_and_verify() {
         let verifier = [0x11u8; 32];
-        let reg = build_lite_registration(&ENTROPY, verifier, "headlesstester").unwrap();
+        let reg =
+            build_lite_registration(&ENTROPY, verifier, "headlesstester", None, 1_749_573_123)
+                .unwrap();
         assert_eq!(
             reg.candidate_public_key,
             derive_identity_keypair(&ENTROPY).unwrap().public.to_bytes(),
@@ -235,6 +268,70 @@ mod tests {
                 .is_ok(),
             "consumer registration signature verifies against the runtime tuple"
         );
+
+        // dotnsSignature verifies over the gateway reservation message. The
+        // identifier key doubles as the chat key.
+        let reservation_message = build_reservation_message(
+            &reg.candidate_public_key,
+            &verifier,
+            b"headlesstester",
+            &reg.identifier_key,
+            None,
+            1_749_573_123,
+        );
+        let sig = Signature::from_bytes(&reg.dotns_signature).unwrap();
+        assert!(
+            public
+                .verify_simple(SR25519_SIGNING_CONTEXT, &reservation_message, &sig)
+                .is_ok(),
+            "dotns reservation signature verifies against the gateway message"
+        );
+    }
+
+    #[test]
+    fn reserved_username_threads_into_both_signed_payloads() {
+        let verifier = [0x33u8; 32];
+        let reg = build_lite_registration(
+            &ENTROPY,
+            verifier,
+            "headlesstester",
+            Some("reservedbase"),
+            77,
+        )
+        .unwrap();
+        let public = PublicKey::from_bytes(&reg.candidate_public_key).unwrap();
+
+        let consumer_message = (
+            reg.candidate_public_key,
+            verifier,
+            reg.identifier_key,
+            b"headlesstester".as_slice(),
+            Some(b"reservedbase".to_vec()),
+        )
+            .encode();
+        let sig = Signature::from_bytes(&reg.consumer_registration_signature).unwrap();
+        assert!(
+            public
+                .verify_simple(SR25519_SIGNING_CONTEXT, &consumer_message, &sig)
+                .is_ok(),
+            "consumer registration signature commits to the reserved username"
+        );
+
+        let reservation_message = build_reservation_message(
+            &reg.candidate_public_key,
+            &verifier,
+            b"headlesstester",
+            &reg.identifier_key,
+            Some(b"reservedbase"),
+            77,
+        );
+        let sig = Signature::from_bytes(&reg.dotns_signature).unwrap();
+        assert!(
+            public
+                .verify_simple(SR25519_SIGNING_CONTEXT, &reservation_message, &sig)
+                .is_ok(),
+            "dotns signature commits to the reserved username and signed_at"
+        );
     }
 
     #[test]
@@ -266,8 +363,8 @@ mod tests {
     #[test]
     fn registration_is_deterministic_per_entropy_and_username() {
         let verifier = [0x22u8; 32];
-        let first = build_lite_registration(&ENTROPY, verifier, "aliceheadless").unwrap();
-        let again = build_lite_registration(&ENTROPY, verifier, "aliceheadless").unwrap();
+        let first = build_lite_registration(&ENTROPY, verifier, "aliceheadless", None, 1).unwrap();
+        let again = build_lite_registration(&ENTROPY, verifier, "aliceheadless", None, 1).unwrap();
         assert_eq!(first.candidate_public_key, again.candidate_public_key);
         assert_eq!(first.ring_vrf_key, again.ring_vrf_key);
         assert_eq!(first.candidate_account_id, again.candidate_account_id);
diff --git a/rust/crates/truapi-server/src/host_logic/dotns_gateway.rs b/rust/crates/truapi-server/src/host_logic/dotns_gateway.rs
new file mode 100644
index 000000000..fdde69cc0
--- /dev/null
+++ b/rust/crates/truapi-server/src/host_logic/dotns_gateway.rs
@@ -0,0 +1,1489 @@
+//! dotNS gateway (Asset Hub) payload building and contract reads.
+//!
+//! Every host shares these helpers. They cover the candidate-signed
+//! reservation message for `pallet_dotns_gateway::reserve_name`, the ring-VRF
+//! proof message for `register_name`, the minimal Solidity ABI surface for
+//! reading usernames back through `ReviveApi_call`, and the raw storage keys of
+//! the gateway pallet.
+//!
+//! Username resolution ([`discover_pop_controller`], [`resolve_labels`]) is
+//! written once against the [`DotnsTransport`] trait. The headless CLI's
+//! plain-RPC reader and the in-core `chainHead_v1` lookup therefore walk the
+//! same contract chain.
+//!
+//! Byte layouts mirror `pallets/dotns-gateway` in `paritytech/individuality`
+//! and the dotNS contracts (`paritytech/dotns`).
+
+use parity_scale_codec::{Compact, Decode, Encode};
+use sp_crypto_hashing::{blake2_128, blake2_256, keccak_256, twox_128};
+use thiserror::Error;
+use tracing::warn;
+
+/// Ring-VRF context for `register_name` proofs.
+///
+/// The ASCII label, space-padded to 32 bytes. Matches `DOTNS_GATEWAY_CONTEXT`
+/// in the gateway pallet.
+pub const DOTNS_GATEWAY_CONTEXT: [u8; 32] = *b"pop:polkadot.network/dotns      ";
+
+/// Reservation message prefix, matching `RESERVE_MSG_PREFIX` in the gateway
+/// pallet.
+pub const RESERVE_MSG_PREFIX: &[u8] = b"pop:dotns-gateway:reserve";
+
+/// Origin for read-only `ReviveApi_call` dry-runs.
+///
+/// `pallet_revive` rejects unmapped signed origins with `AccountUnmapped`.
+/// Eth-derived accounts — trailing 12 bytes `0xEE` — are implicitly mapped.
+/// They need no on-chain state, so views work from this synthetic account on
+/// any network. The address half is non-zero: a revert is read as an answer
+/// here, and Solidity guards commonly reject `address(0)` outright.
+pub const VIEW_CALL_ORIGIN: [u8; 32] = [0xEE; 32];
+
+/// Builds the payload the candidate signs to authorize a lite-name
+/// reservation.
+///
+/// Commits to the *base* of the lite label only. The digit suffix is excluded,
+/// so the candidate can sign before the gateway assigns digits. Mirrors
+/// `Pallet::construct_reservation_message`: a SCALE tuple of
+/// `(prefix, candidate, attester, username_base, chat_key, reserved, signed_at)`.
+pub fn build_reservation_message(
+    candidate: &[u8; 32],
+    attester: &[u8; 32],
+    username_base: &[u8],
+    chat_key: &[u8; 65],
+    reserved_base_label: Option<&[u8]>,
+    signed_at_secs: u64,
+) -> Vec<u8> {
+    (
+        RESERVE_MSG_PREFIX,
+        candidate,
+        attester,
+        username_base,
+        chat_key.as_slice(),
+        reserved_base_label,
+        signed_at_secs,
+    )
+        .encode()
+}
+
+/// The `Link` argument of `register_name`: how the new full-person username
+/// relates to the account's previous lite identity.
+#[derive(Debug, Clone, PartialEq, Eq, Encode)]
+pub enum Link {
+    /// Links the full username to an existing lite username, in dotted form
+    /// such as `alice.01`. The chat key is inherited from the lite entry.
+    LiteUsername(Vec<u8>),
+    /// Standalone registration carrying a fresh 65-byte uncompressed ECDH
+    /// chat key.
+    None([u8; 65]),
+}
+
+/// Hashes the registration intent into the 32-byte ring-VRF proof message.
+/// Matches the pallet's `(who, label, link).using_encoded(blake2_256)`.
+pub fn build_register_proof_message(who: &[u8; 32], label: &[u8], link: &Link) -> [u8; 32] {
+    blake2_256(&(who, label, link).encode())
+}
+
+/// Encodes the `DotnsGateway.register_name { who, label, link }` call.
+/// Layout: dispatch indices, the raw account, the compact-prefixed label, then
+/// the link.
+pub fn encode_register_name_call(
+    call_indices: [u8; 2],
+    who: &[u8; 32],
+    label: &[u8],
+    link: &Link,
+) -> Vec<u8> {
+    let mut call = call_indices.to_vec();
+    (who, label, link).encode_to(&mut call);
+    call
+}
+
+/// Encodes the `AsDotnsGateway` extension extra.
+///
+/// The value is `Some(RegisterFullName { proof, ring_index, revision,
+/// signature })`; `revision` is the People-collection root revision the proof
+/// was built against, which Asset Hub's `members-subscriber` must hold. The
+/// signature is wrapped as `MultiSignature::Sr25519`.
+pub fn encode_register_full_name_extra(
+    info_variant: u8,
+    proof: &[u8],
+    ring_index: u32,
+    revision: u32,
+    signature: &[u8; 64],
+) -> Vec<u8> {
+    // Option::Some ‖ info variant ‖ Vec(proof) ‖ ring_index ‖ revision ‖
+    // Sr25519 ‖ sig.
+    let mut extra = vec![0x01, info_variant];
+    proof.encode_to(&mut extra);
+    ring_index.encode_to(&mut extra);
+    revision.encode_to(&mut extra);
+    extra.push(0x01);
+    extra.extend_from_slice(signature);
+    extra
+}
+
+/// Maps an AccountId32 to the H160 the contracts see.
+///
+/// Mirrors `pallet_revive::AccountId32Mapper::to_address`. Eth-derived
+/// accounts — trailing 12 bytes all `0xEE` — truncate. Everything else hashes.
+pub fn account_to_h160(public_key: &[u8; 32]) -> [u8; 20] {
+    if public_key[20..].iter().all(|byte| *byte == 0xEE) {
+        public_key[..20]
+            .try_into()
+            .expect("slice of first 20 bytes from a 32-byte array; qed")
+    } else {
+        keccak_256(public_key)[12..]
+            .try_into()
+            .expect("keccak_256 output is 32 bytes, tail slice is 20; qed")
+    }
+}
+
+/// Solidity `bytes32("name")` literal: ASCII left-aligned in a 32-byte word.
+/// The dotNS protocol registry keys (`storeFactory`, `registrar`, ...) use this
+/// form. They are not hashes.
+pub fn registry_key(name: &str) -> [u8; 32] {
+    let bytes = name.as_bytes();
+    assert!(bytes.len() <= 32, "registry key exceeds 32 bytes");
+    let mut out = [0u8; 32];
+    out[..bytes.len()].copy_from_slice(bytes);
+    out
+}
+
+/// First 4 bytes of `keccak256(signature)` — the Solidity function selector.
+pub fn selector(signature: &str) -> [u8; 4] {
+    keccak_256(signature.as_bytes())[..4]
+        .try_into()
+        .expect("keccak_256 output is 32 bytes, head slice is 4; qed")
+}
+
+/// Calldata for a view function without arguments.
+pub fn call_no_args(signature: &str) -> Vec<u8> {
+    selector(signature).to_vec()
+}
+
+/// Calldata for a view function taking one `address` argument.
+pub fn call_address(signature: &str, address: &[u8; 20]) -> Vec<u8> {
+    let mut data = call_no_args(signature);
+    data.extend_from_slice(&[0u8; 12]);
+    data.extend_from_slice(address);
+    data
+}
+
+/// Calldata for a view function taking one `bytes32` argument.
+pub fn call_bytes32(signature: &str, word: &[u8; 32]) -> Vec<u8> {
+    let mut data = call_no_args(signature);
+    data.extend_from_slice(word);
+    data
+}
+
+/// Calldata for a view function taking two `uint256` arguments.
+pub fn call_u256_pair(signature: &str, first: u64, second: u64) -> Vec<u8> {
+    let mut data = call_no_args(signature);
+    for value in [first, second] {
+        let mut word = [0u8; 32];
+        word[24..].copy_from_slice(&value.to_be_bytes());
+        data.extend_from_slice(&word);
+    }
+    data
+}
+
+/// Error decoding a dotNS contract round-trip.
+#[derive(Debug, Error)]
+pub enum DotnsContractError {
+    /// `ContractResult` bytes ended before the expected field.
+    #[error("ContractResult truncated at {context}")]
+    Truncated {
+        /// Field being decoded when the input ended.
+        context: &'static str,
+    },
+    /// The runtime rejected the call before reaching the contract.
+    #[error("ReviveApi_call dispatch failed: {detail}")]
+    Dispatch {
+        /// Raw hex of the `DispatchError` payload.
+        detail: String,
+    },
+    /// The contract executed but reverted.
+    #[error("contract reverted: {detail}")]
+    Reverted {
+        /// Rendered revert reason.
+        detail: String,
+    },
+    /// ABI return data did not match the expected shape.
+    #[error("ABI decode failed at {context}")]
+    Abi {
+        /// Value being decoded when the shape mismatched.
+        context: &'static str,
+    },
+    /// ABI return data was not valid UTF-8 where a string was expected.
+    #[error("ABI string is not UTF-8")]
+    AbiUtf8,
+}
+
+/// SCALE arguments for the `ReviveApi_call` runtime API.
+/// A zero-value, unlimited-gas dry-run of `input` against `dest` from `origin`.
+pub fn encode_revive_call(origin: &[u8; 32], dest: &[u8; 20], input: &[u8]) -> Vec<u8> {
+    let mut args = Vec::with_capacity(32 + 20 + 16 + 2 + 5 + input.len());
+    args.extend_from_slice(origin);
+    args.extend_from_slice(dest);
+    args.extend_from_slice(&0u128.to_le_bytes());
+    // gas_limit: Option<Weight> and storage_deposit_limit: Option<u128>.
+    // Both absent, so the node estimates.
+    args.push(0x00);
+    args.push(0x00);
+    input.encode_to(&mut args);
+    args
+}
+
+/// Extracts the contract return data from a `ReviveApi_call` output.
+/// The output is a `pallet_revive::ContractResult`. Dispatch errors and reverts
+/// are rejected.
+pub fn decode_revive_call_output(output: &[u8]) -> Result<Vec<u8>, DotnsContractError> {
+    let truncated = |context| DotnsContractError::Truncated { context };
+    let input = &mut &output[..];
+    // weight_consumed + weight_required. Weight is a compact ref_time plus a
+    // compact proof_size.
+    for _ in 0..4 {
+        Compact::<u64>::decode(input).map_err(|_| truncated("weight"))?;
+    }
+    // storage_deposit + max_storage_deposit. StorageDeposit is variant ‖ u128.
+    for _ in 0..2 {
+        <(u8, u128)>::decode(input).map_err(|_| truncated("storage_deposit"))?;
+    }
+    u128::decode(input).map_err(|_| truncated("gas_consumed"))?;
+    match u8::decode(input).map_err(|_| truncated("result"))? {
+        0 => {
+            let flags = u32::decode(input).map_err(|_| truncated("flags"))?;
+            let data = Vec::<u8>::decode(input).map_err(|_| truncated("data"))?;
+            // ReturnFlags::REVERT.
+            if flags & 1 == 1 {
+                return Err(DotnsContractError::Reverted {
+                    detail: describe_revert(&data),
+                });
+            }
+            Ok(data)
+        }
+        _ => Err(DotnsContractError::Dispatch {
+            detail: format!("0x{}", hex::encode(*input)),
+        }),
+    }
+}
+
+/// Renders a Solidity revert payload. Recognizes `Error(string)` and
+/// `Panic(uint256)`.
+fn describe_revert(data: &[u8]) -> String {
+    if data.is_empty() {
+        return "(empty)".to_string();
+    }
+    if data.starts_with(&[0x08, 0xc3, 0x79, 0xa0]) && data.len() >= 68 {
+        let len = u64::from_be_bytes(
+            data[60..68]
+                .try_into()
+                .expect("8-byte slice from a length-checked buffer; qed"),
+        ) as usize;
+        if let Some(message) = 68usize
+            .checked_add(len)
+            .and_then(|end| data.get(68..end))
+            .and_then(|bytes| core::str::from_utf8(bytes).ok())
+        {
+            return format!("Error({message:?})");
+        }
+    }
+    if data.starts_with(&[0x4e, 0x48, 0x7b, 0x71]) && data.len() >= 36 {
+        return format!("Panic(0x{})", hex::encode(&data[32..36]));
+    }
+    format!("0x{}", hex::encode(data))
+}
+
+/// Reads the 32-byte ABI word at index `index`.
+fn word(data: &[u8], index: usize) -> Result<&[u8], DotnsContractError> {
+    data.get(index * 32..(index + 1) * 32)
+        .ok_or(DotnsContractError::Abi { context: "word" })
+}
+
+/// Interprets an ABI word as a right-aligned usize offset or length.
+fn word_usize(data: &[u8], index: usize) -> Result<usize, DotnsContractError> {
+    usize::try_from(word_u64(data, index)?).map_err(|_| DotnsContractError::Abi {
+        context: "oversized word",
+    })
+}
+
+/// Decodes an ABI `string` at byte offset `at`.
+/// The layout is a length word followed by padded UTF-8 bytes.
+fn decode_string_at(data: &[u8], at: usize) -> Result<String, DotnsContractError> {
+    let region = data.get(at..).ok_or(DotnsContractError::Abi {
+        context: "string offset",
+    })?;
+    let len = word_usize(region, 0)?;
+    let bytes = 32usize
+        .checked_add(len)
+        .and_then(|end| region.get(32..end))
+        .ok_or(DotnsContractError::Abi {
+            context: "string bytes",
+        })?;
+    String::from_utf8(bytes.to_vec()).map_err(|_| DotnsContractError::AbiUtf8)
+}
+
+/// Decodes a single `string` return value (`ProtocolRegistry.tld()`).
+pub fn decode_string(data: &[u8]) -> Result<String, DotnsContractError> {
+    decode_string_at(data, word_usize(data, 0)?)
+}
+
+/// Decodes a single `bool` return value.
+pub fn decode_bool(data: &[u8]) -> Result<bool, DotnsContractError> {
+    let bytes = word(data, 0)?;
+    if bytes[..31].iter().any(|b| *b != 0) {
+        return Err(DotnsContractError::Abi { context: "bool" });
+    }
+    match bytes[31] {
+        0 => Ok(false),
+        1 => Ok(true),
+        _ => Err(DotnsContractError::Abi { context: "bool" }),
+    }
+}
+
+/// Decodes a single `address` return value.
+pub fn decode_address(data: &[u8]) -> Result<[u8; 20], DotnsContractError> {
+    let bytes = word(data, 0)?;
+    if bytes[..12].iter().any(|b| *b != 0) {
+        return Err(DotnsContractError::Abi { context: "address" });
+    }
+    Ok(bytes[12..]
+        .try_into()
+        .expect("20-byte tail of a 32-byte word; qed"))
+}
+
+/// Decodes a `string[]` return value (`LabelStore.getLabels`).
+pub fn decode_string_array(data: &[u8]) -> Result<Vec<String>, DotnsContractError> {
+    let array_at = word_usize(data, 0)?;
+    let array = data.get(array_at..).ok_or(DotnsContractError::Abi {
+        context: "array offset",
+    })?;
+    let len = word_usize(array, 0)?;
+    let elements = array.get(32..).ok_or(DotnsContractError::Abi {
+        context: "array elements",
+    })?;
+    (0..len)
+        .map(|i| decode_string_at(elements, word_usize(elements, i)?))
+        .collect()
+}
+
+/// Decodes `DotnsPopController.pendingClaims(address)`, an ABI
+/// `(string label, uint64 mintedAt)[]`, as `(label, minted_at)` pairs.
+pub fn decode_pending_claims_array(data: &[u8]) -> Result<Vec<(String, u64)>, DotnsContractError> {
+    let array_at = word_usize(data, 0)?;
+    let array = data.get(array_at..).ok_or(DotnsContractError::Abi {
+        context: "claims offset",
+    })?;
+    let len = word_usize(array, 0)?;
+    let elements = array.get(32..).ok_or(DotnsContractError::Abi {
+        context: "claims elements",
+    })?;
+    (0..len)
+        .map(|i| {
+            let claim =
+                elements
+                    .get(word_usize(elements, i)?..)
+                    .ok_or(DotnsContractError::Abi {
+                        context: "claim offset",
+                    })?;
+            let label = decode_string_at(claim, word_usize(claim, 0)?)?;
+            let minted_at = word_u64(claim, 1)?;
+            Ok((label, minted_at))
+        })
+        .collect()
+}
+
+/// Decodes a single `uint64` (or narrower) return value.
+pub fn decode_u64(data: &[u8]) -> Result<u64, DotnsContractError> {
+    word_u64(data, 0)
+}
+
+/// Reads the 32-byte ABI word at `index` as a `u64`; wider values are an error.
+fn word_u64(data: &[u8], index: usize) -> Result<u64, DotnsContractError> {
+    let bytes = word(data, index)?;
+    if bytes[..24].iter().any(|b| *b != 0) {
+        return Err(DotnsContractError::Abi {
+            context: "oversized word",
+        });
+    }
+    Ok(u64::from_be_bytes(
+        bytes[24..]
+            .try_into()
+            .expect("8-byte tail of a 32-byte word; qed"),
+    ))
+}
+
+/// Usernames of one account as recorded by the dotNS contracts.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct DotnsIdentity {
+    /// Dotted lite username (`alice.01`), if any.
+    pub lite_username: Option<String>,
+    /// Full-person username, if any.
+    pub full_username: Option<String>,
+}
+
+/// Classifies bare contract labels into lite and full usernames.
+///
+/// The gateway flattens a lite username `stem.NN` (a DNS-label stem plus exactly
+/// two digits, `StringUtils.isSingleDotLiteLabel`) into the flat label `stemNN`
+/// before minting, so a flat label whose last two characters are digits after a
+/// DNS-label stem is read back as a lite username and re-dotted (`alice01` →
+/// `alice.01`). Every other canonical DNS label is a full username; anything
+/// that is not one — oversized, non-ASCII, control characters, markup, or a
+/// dotted subname — is skipped, so no unscreened contract string becomes a
+/// username. First hit per slot wins. Labels are expected bare:
+/// [`resolve_labels`] strips the network TLD.
+///
+/// Lite and public names share one namespace on the contract side, so a public
+/// name ending in two digits is indistinguishable from a flattened lite name
+/// here; the contract documents that ambiguity as accepted.
+///
+/// TODO(dotns): the full username is the first letters-only label, which a
+/// self-registered or purchased name older than the gateway name can win.
+/// `chatKey(node)` proves gateway provenance but survives transfers, so it is
+/// not a filter either. Once `DotnsPopController` exposes
+/// `usernameNodeOf(address)`, read the full username from it instead.
+pub fn classify_labels<I>(labels: I) -> DotnsIdentity
+where
+    I: IntoIterator,
+    I::Item: AsRef<str>,
+{
+    let mut identity = DotnsIdentity::default();
+    for label in labels {
+        let label = label.as_ref();
+        // Contract data is untrusted and these strings reach host UI
+        // (`SessionUiInfo`): anything that is not a canonical DNS label —
+        // oversized, control characters, markup, dots — is not a username.
+        if !is_dns_label(label) {
+            continue;
+        }
+        let (stem, digits) = label.split_at(label.len().saturating_sub(2));
+        let is_lite =
+            is_dns_label(stem) && digits.len() == 2 && digits.chars().all(|c| c.is_ascii_digit());
+        if is_lite {
+            identity
+                .lite_username
+                .get_or_insert_with(|| format!("{stem}.{digits}"));
+        } else if !label.is_empty() {
+            identity
+                .full_username
+                .get_or_insert_with(|| label.to_string());
+        }
+    }
+    identity
+}
+
+/// RFC 1035 label bound the contracts enforce (`StringUtils.MAX_DNS_LABEL_OCTETS`).
+const MAX_DNS_LABEL_LEN: usize = 63;
+
+/// A canonical DNS label: lowercase ASCII letters, digits and hyphens, neither
+/// starting nor ending with a hyphen, at most [`MAX_DNS_LABEL_LEN`] octets
+/// (`StringUtils._isDnsLabel`).
+pub fn is_dns_label(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= MAX_DNS_LABEL_LEN
+        && !value.starts_with('-')
+        && !value.ends_with('-')
+        && value
+            .chars()
+            .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-')
+}
+
+/// Longest label the gateway pallet accepts (`BaseLabel = BoundedVec<u8, 32>`).
+pub const MAX_BASE_LABEL_LEN: usize = 32;
+
+/// Whether `label` is a full-person base label as the gateway pallet accepts
+/// it (`is_person_label`): non-empty, lowercase ASCII letters only, no digits
+/// or hyphens, at most [`MAX_BASE_LABEL_LEN`] bytes.
+pub fn is_full_person_label(label: &str) -> bool {
+    !label.is_empty()
+        && label.len() <= MAX_BASE_LABEL_LEN
+        && label.chars().all(|c| c.is_ascii_lowercase())
+}
+
+/// Shortest base a person can register or reserve: `PopRules` classifies bases
+/// of five characters or fewer as reserved for governance.
+pub const MIN_PERSON_LABEL_LEN: usize = 6;
+
+/// Whether `label` can be registered as a full-person username, or reserved
+/// for a later claim through the gateway (`PopRules.reserveBaseNameForPop`):
+/// the pallet's [`is_full_person_label`] plus the governance-reserved tier.
+pub fn is_registrable_full_label(label: &str) -> bool {
+    is_full_person_label(label) && label.len() >= MIN_PERSON_LABEL_LEN
+}
+
+/// Whether `value` is a dotted lite username, `stem.NN`: a DNS-label stem, one
+/// dot, exactly two digits (`StringUtils.isSingleDotLiteLabel`), and at most
+/// [`MAX_BASE_LABEL_LEN`] bytes once flattened.
+pub fn is_dotted_lite_username(value: &str) -> bool {
+    match value.rsplit_once('.') {
+        Some((stem, digits)) => {
+            is_dns_label(stem)
+                && digits.len() == 2
+                && digits.chars().all(|c| c.is_ascii_digit())
+                && stem.len() + 2 <= MAX_BASE_LABEL_LEN
+        }
+        None => false,
+    }
+}
+
+/// Page size for `LabelStore.getLabels`.
+const LABEL_PAGE_LIMIT: u64 = 16;
+/// Upper bound on pages read from one `LabelStore`. The store is an append-only
+/// ledger shared with public registrations and incoming transfers, so it can
+/// grow well past the one lite and one full name a gateway user holds.
+const LABEL_PAGE_MAX: u64 = 16;
+
+/// Why a contract view returned no data.
+///
+/// A revert is an answer from the contract (the view refused, or the address
+/// has no such function); anything else means the answer is unknown.
+#[derive(Debug, Error)]
+pub enum DotnsViewError {
+    /// The contract executed and reverted.
+    #[error("{0}")]
+    Reverted(DotnsContractError),
+    /// The view could not be dry-run or its output could not be decoded.
+    #[error("{0}")]
+    Failed(String),
+}
+
+impl From<DotnsViewError> for String {
+    fn from(error: DotnsViewError) -> Self {
+        error.to_string()
+    }
+}
+
+/// Splits a `ReviveApi_call` output into return data, a revert, or a failure,
+/// for [`DotnsTransport::view`] implementations.
+pub fn view_output(output: &[u8]) -> Result<Vec<u8>, DotnsViewError> {
+    decode_revive_call_output(output).map_err(|err| match err {
+        DotnsContractError::Reverted { .. } => DotnsViewError::Reverted(err),
+        other => DotnsViewError::Failed(other.to_string()),
+    })
+}
+
+/// How a caller reaches Asset Hub for dotNS reads.
+///
+/// The surface is one storage read plus one contract view. The headless CLI
+/// implements it over plain RPC. The in-core runtime implements it over a
+/// `chainHead_v1` follow. The resolution steps below are written once.
+#[truapi_platform::async_trait]
+pub trait DotnsTransport {
+    /// Reads one storage value. `None` when the entry is absent.
+    async fn storage(&mut self, key: Vec<u8>) -> Result<Option<Vec<u8>>, String>;
+
+    /// Dry-runs a contract view against `dest` and returns its return data.
+    async fn view(&mut self, dest: &[u8; 20], input: Vec<u8>) -> Result<Vec<u8>, DotnsViewError>;
+}
+
+/// Resolves the `DotnsPopController` address: `DotnsGateway.DispatcherAddress`
+/// names the `RootGatewayDispatcher`, whose `TARGET()` is the controller.
+/// `None` when the gateway is not deployed on the chain at all.
+pub async fn discover_pop_controller<T: DotnsTransport + ?Sized>(
+    transport: &mut T,
+) -> Result<Option<[u8; 20]>, String> {
+    let Some(value) = transport.storage(dispatcher_address_key()).await? else {
+        return Ok(None);
+    };
+    let dispatcher: [u8; 20] = value.try_into().map_err(|value: Vec<u8>| {
+        format!("DotnsGateway.DispatcherAddress is {} bytes", value.len())
+    })?;
+    let output = transport
+        .view(&dispatcher, call_no_args("TARGET()"))
+        .await
+        .map_err(|err| format!("RootGatewayDispatcher.TARGET(): {err}"))?;
+    decode_address(&output)
+        .map(Some)
+        .map_err(|err| format!("RootGatewayDispatcher.TARGET(): {err}"))
+}
+
+/// Resolves the bare contract labels `account` holds.
+///
+/// Two sources are merged. The controller's pending claims hold gateway-minted
+/// names the user has not settled into a `LabelStore` yet (`claimLabelStore`);
+/// those come first. A claim older than the controller's `reservationDuration`
+/// is lapsed — `claimLabelStore` skips it and `expirePendingClaim` will sweep
+/// it — so it is not a username here either, whether or not it has been swept. The user's `LabelStore`, when deployed, holds every name
+/// written for them: gateway names once settled, plus public registrations and
+/// incoming transfers. Store labels carry the network TLD (`alice01.paseo`),
+/// which is stripped here; subnames (`app.alice`) are dropped.
+///
+/// A store alone is not proof that pending claims are settled: a public
+/// registration or an incoming transfer deploys the store while gateway names
+/// stay pending, so both sources are always read. The store is append-only,
+/// so a name transferred away is still listed; ownership is not re-checked
+/// here.
+pub async fn resolve_labels<T: DotnsTransport + ?Sized>(
+    transport: &mut T,
+    controller: &[u8; 20],
+    account: &[u8; 32],
+) -> Result<Vec<String>, String> {
+    let user = account_to_h160(account);
+
+    let mut labels = pending_claim_labels(transport, controller, &user).await?;
+
+    let registry_output = transport
+        .view(controller, call_no_args("protocolRegistry()"))
+        .await
+        .map_err(|err| format!("DotnsPopController.protocolRegistry: {err}"))?;
+    let registry = decode_address(&registry_output)
+        .map_err(|err| format!("DotnsPopController.protocolRegistry(): {err}"))?;
+
+    let factory_output = transport
+        .view(
+            &registry,
+            call_bytes32("get(bytes32)", &registry_key("storeFactory")),
+        )
+        .await
+        .map_err(|err| format!("ProtocolRegistry.get(storeFactory): {err}"))?;
+    let factory = decode_address(&factory_output)
+        .map_err(|err| format!("ProtocolRegistry.get(storeFactory): {err}"))?;
+
+    let store_output = transport
+        .view(&factory, call_address("getLabelStore(address)", &user))
+        .await
+        .map_err(|err| format!("StoreFactory.getLabelStore: {err}"))?;
+    let store = decode_address(&store_output)
+        .map_err(|err| format!("StoreFactory.getLabelStore: {err}"))?;
+    if store == [0u8; 20] {
+        return Ok(labels);
+    }
+
+    let tld = network_tld(transport, &registry).await?;
+
+    for page in 0..LABEL_PAGE_MAX {
+        let labels_output = transport
+            .view(
+                &store,
+                call_u256_pair(
+                    "getLabels(uint256,uint256)",
+                    page * LABEL_PAGE_LIMIT,
+                    LABEL_PAGE_LIMIT,
+                ),
+            )
+            .await
+            .map_err(|err| format!("LabelStore.getLabels: {err}"))?;
+        let stored = decode_string_array(&labels_output)
+            .map_err(|err| format!("LabelStore.getLabels: {err}"))?;
+        let short_page = (stored.len() as u64) < LABEL_PAGE_LIMIT;
+        for label in stored {
+            if let Some(bare) = bare_store_label(&label, &tld)
+                && !labels.iter().any(|known| known == bare)
+            {
+                labels.push(bare.to_string());
+            }
+        }
+        if short_page {
+            break;
+        }
+        if page + 1 == LABEL_PAGE_MAX {
+            warn!(
+                store = %hex::encode(store),
+                read = LABEL_PAGE_MAX * LABEL_PAGE_LIMIT,
+                "LabelStore holds more labels than the pages read; a name past this point is not resolved"
+            );
+        }
+    }
+    Ok(labels)
+}
+
+/// Strips the network TLD from a `LabelStore` label. `None` for labels that do
+/// not carry it or that still hold a dot afterwards (subnames).
+fn bare_store_label<'a>(label: &'a str, tld: &str) -> Option<&'a str> {
+    let bare = if tld.is_empty() {
+        label
+    } else {
+        label.strip_suffix(tld)?
+    };
+    (!bare.is_empty() && !bare.contains('.')).then_some(bare)
+}
+
+/// The TLD of networks whose `DotnsProtocolRegistry` has no `tld()` view;
+/// previewnet is one.
+const TLD_WITHOUT_VIEW: &str = ".dot";
+
+/// The network TLD with its leading dot (`.paseo`), read from
+/// `ProtocolRegistry.tld()`. A registry without that view reverts; the fall
+/// back to [`TLD_WITHOUT_VIEW`] is then verified rather than guessed —
+/// `DotnsRegistry.recordExists(namehash("dot"))` must hold the TLD's own
+/// record, or the resolution errors. Any other failure is an error: a wrong
+/// TLD would drop every label carrying the real one.
+async fn network_tld<T: DotnsTransport + ?Sized>(
+    transport: &mut T,
+    registry: &[u8; 20],
+) -> Result<String, String> {
+    match transport.view(registry, call_no_args("tld()")).await {
+        Ok(output) => {
+            return decode_string(&output).map_err(|err| format!("ProtocolRegistry.tld(): {err}"));
+        }
+        Err(DotnsViewError::Reverted(_)) => {}
+        Err(DotnsViewError::Failed(reason)) => {
+            return Err(format!("ProtocolRegistry.tld(): {reason}"));
+        }
+    }
+    let dotns_registry_output = transport
+        .view(
+            registry,
+            call_bytes32("get(bytes32)", &registry_key("registry")),
+        )
+        .await
+        .map_err(|err| format!("ProtocolRegistry.get(registry): {err}"))?;
+    let dotns_registry = decode_address(&dotns_registry_output)
+        .map_err(|err| format!("ProtocolRegistry.get(registry): {err}"))?;
+    let exists_output = transport
+        .view(
+            &dotns_registry,
+            call_bytes32("recordExists(bytes32)", &tld_node(TLD_WITHOUT_VIEW)),
+        )
+        .await
+        .map_err(|err| format!("DotnsRegistry.recordExists: {err}"))?;
+    if decode_bool(&exists_output).map_err(|err| format!("DotnsRegistry.recordExists: {err}"))? {
+        Ok(TLD_WITHOUT_VIEW.to_string())
+    } else {
+        Err(format!(
+            "ProtocolRegistry has no tld() view and the registry holds no record for \
+             {TLD_WITHOUT_VIEW:?}; the network TLD cannot be determined"
+        ))
+    }
+}
+
+/// The node of the network TLD: `namehash(tld)` for a single-label TLD.
+fn tld_node(tld: &str) -> [u8; 32] {
+    namehash_under(&[0u8; 32], tld.trim_start_matches('.'))
+}
+
+/// ENS-style node of `label` directly under `parent`:
+/// `keccak256(parent ‖ keccak256(label))`.
+pub fn namehash_under(parent: &[u8; 32], label: &str) -> [u8; 32] {
+    keccak_256(&[parent.as_slice(), &keccak_256(label.as_bytes())].concat())
+}
+
+/// Whether the gateway could still mint `label` on this network: the name's
+/// node under the network TLD (`namehash(label.tld)`, derived locally) does
+/// not exist on the `DotnsRegistrar` (`exists(uint256)`, a total view, so a
+/// revert is a broken deployment and an error, never "available"). A minted
+/// name is taken whoever holds it, the name escrow included: the gateway's
+/// registration path only mints fresh ids.
+///
+/// A lite-name reservation carrying a `reserved_base_label` that is already
+/// registered can never be claimed, yet it holds the reservation queue for
+/// that stem for the whole reservation window. The gateway pallet does not
+/// check this, so callers ask before attesting or registering.
+pub async fn label_available<T: DotnsTransport + ?Sized>(
+    transport: &mut T,
+    controller: &[u8; 20],
+    label: &str,
+) -> Result<bool, String> {
+    let registry_output = transport
+        .view(controller, call_no_args("protocolRegistry()"))
+        .await?;
+    let registry = decode_address(&registry_output)
+        .map_err(|err| format!("DotnsPopController.protocolRegistry(): {err}"))?;
+
+    let tld = network_tld(transport, &registry).await?;
+
+    let registrar_output = transport
+        .view(
+            &registry,
+            call_bytes32("get(bytes32)", &registry_key("registrar")),
+        )
+        .await?;
+    let registrar = decode_address(&registrar_output)
+        .map_err(|err| format!("ProtocolRegistry.get(registrar): {err}"))?;
+
+    let node = namehash_under(&tld_node(&tld), label);
+    let output = transport
+        .view(&registrar, call_bytes32("exists(uint256)", &node))
+        .await
+        .map_err(|err| format!("DotnsRegistrar.exists({label}): {err}"))?;
+    decode_bool(&output)
+        .map(|exists| !exists)
+        .map_err(|err| format!("DotnsRegistrar.exists({label}): {err}"))
+}
+
+/// Gateway-minted labels of `user` still waiting for `claimLabelStore`, from
+/// `DotnsPopController.pendingClaims(address)`, without the entries that have
+/// lapsed (`mintedAt + reservationDuration < now`, the controller's own
+/// `_isExpired`; `now` is `Timestamp.Now` at the pinned block).
+async fn pending_claim_labels<T: DotnsTransport + ?Sized>(
+    transport: &mut T,
+    controller: &[u8; 20],
+    user: &[u8; 20],
+) -> Result<Vec<String>, String> {
+    // A revert is the controller's answer: no readable pending claims. The
+    // store is a separate source, so it is still read.
+    let output = match transport
+        .view(controller, call_address("pendingClaims(address)", user))
+        .await
+    {
+        Ok(output) => output,
+        Err(DotnsViewError::Reverted(reason)) => {
+            warn!(%reason, "DotnsPopController.pendingClaims reverted; reading the store only");
+            return Ok(Vec::new());
+        }
+        Err(DotnsViewError::Failed(reason)) => {
+            return Err(format!("DotnsPopController.pendingClaims: {reason}"));
+        }
+    };
+    let claims = decode_pending_claims_array(&output)
+        .map_err(|err| format!("DotnsPopController.pendingClaims: {err}"))?;
+    if claims.is_empty() {
+        return Ok(Vec::new());
+    }
+    let duration_output = transport
+        .view(controller, call_no_args("reservationDuration()"))
+        .await
+        .map_err(|err| format!("DotnsPopController.reservationDuration: {err}"))?;
+    let duration = decode_u64(&duration_output)
+        .map_err(|err| format!("DotnsPopController.reservationDuration: {err}"))?;
+    let now = chain_time_secs(transport).await?;
+    Ok(claims
+        .into_iter()
+        .filter(|(_, minted_at)| !claim_lapsed(*minted_at, duration, now))
+        .map(|(label, _)| label)
+        .collect())
+}
+
+/// Whether a pending claim minted at `minted_at` has lapsed at chain time
+/// `now`, mirroring `DotnsPopController._isExpired`.
+fn claim_lapsed(minted_at: u64, duration: u64, now: u64) -> bool {
+    minted_at.saturating_add(duration) < now
+}
+
+/// Asset Hub chain time in Unix seconds, from `Timestamp.Now` (milliseconds).
+async fn chain_time_secs<T: DotnsTransport + ?Sized>(transport: &mut T) -> Result<u64, String> {
+    let value = transport
+        .storage(timestamp_now_key())
+        .await?
+        .ok_or("Timestamp.Now is unset")?;
+    let millis: [u8; 8] = value
+        .as_slice()
+        .try_into()
+        .map_err(|_| "Timestamp.Now is not a u64".to_string())?;
+    Ok(u64::from_le_bytes(millis) / 1000)
+}
+
+/// `DotnsGateway.DispatcherAddress` storage key.
+/// The entry holds the `RootGatewayDispatcher`, whose `TARGET()` is the
+/// `DotnsPopController`.
+pub fn dispatcher_address_key() -> Vec<u8> {
+    plain_key(b"DotnsGateway", b"DispatcherAddress")
+}
+
+/// `DotnsGateway.AccountAlias[account]` storage key.
+/// The value is the 32-byte alias the account registered with.
+pub fn account_alias_key(account: &[u8; 32]) -> Vec<u8> {
+    let mut key = plain_key(b"DotnsGateway", b"AccountAlias");
+    key.extend_from_slice(&blake2_128(account));
+    key.extend_from_slice(account);
+    key
+}
+
+/// `DotnsGateway.LiteLabelOwner[lite_label]` storage key, the dotted lite
+/// username (`alice.01`) as a `BaseLabel`. The value is the owning account.
+pub fn lite_label_owner_key(lite_label: &[u8]) -> Vec<u8> {
+    let encoded = lite_label.encode();
+    let mut key = plain_key(b"DotnsGateway", b"LiteLabelOwner");
+    key.extend_from_slice(&blake2_128(&encoded));
+    key.extend_from_slice(&encoded);
+    key
+}
+
+/// `Timestamp.Now` storage key. The value is a u64 of Unix milliseconds.
+pub fn timestamp_now_key() -> Vec<u8> {
+    plain_key(b"Timestamp", b"Now")
+}
+
+/// `twox128(pallet) ‖ twox128(entry)`.
+fn plain_key(pallet: &[u8], entry: &[u8]) -> Vec<u8> {
+    [twox_128(pallet).as_slice(), twox_128(entry).as_slice()].concat()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Golden vectors from the validated reference implementation in
+    // pop-dotns-testing: reservation.ts, proof.ts, verify.ts, abi.ts.
+    const RESERVATION_WITH_RESERVED: &str = "64706f703a646f746e732d676174657761793a72657365727665111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222221c616c696365626305013333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333013072657365727665646e616d65035e486800000000";
+    const RESERVATION_NO_RESERVED: &str = "64706f703a646f746e732d676174657761793a72657365727665111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222221c616c69636562630501333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333300035e486800000000";
+
+    #[test]
+    fn reservation_message_matches_reference_vectors() {
+        let with_reserved = build_reservation_message(
+            &[0x11; 32],
+            &[0x22; 32],
+            b"alicebc",
+            &[0x33; 65],
+            Some(b"reservedname"),
+            1749573123,
+        );
+        assert_eq!(hex::encode(&with_reserved), RESERVATION_WITH_RESERVED);
+
+        let without = build_reservation_message(
+            &[0x11; 32],
+            &[0x22; 32],
+            b"alicebc",
+            &[0x33; 65],
+            None,
+            1749573123,
+        );
+        assert_eq!(hex::encode(&without), RESERVATION_NO_RESERVED);
+    }
+
+    #[test]
+    fn link_and_proof_message_match_reference_vectors() {
+        let lite = Link::LiteUsername(b"alice.01".to_vec());
+        assert_eq!(hex::encode(lite.encode()), "0020616c6963652e3031");
+        assert_eq!(
+            hex::encode(build_register_proof_message(&[0x44; 32], b"alicebc", &lite)),
+            "506fe3afcb13b2e4fd182d49ff165bc9c834f9dd21d0d545eccb925993b68675"
+        );
+
+        let standalone = Link::None([0x55; 65]);
+        assert_eq!(
+            hex::encode(standalone.encode()),
+            format!("01{}", hex::encode([0x55; 65]))
+        );
+        assert_eq!(
+            hex::encode(build_register_proof_message(
+                &[0x44; 32],
+                b"alicebc",
+                &standalone
+            )),
+            "255da65ea6687123d5ac035a438a5c6fa18f7d04f23433611095a0fe58c479ab"
+        );
+    }
+
+    #[test]
+    fn register_name_call_and_extension_extra_have_the_reference_layout() {
+        let link = Link::LiteUsername(b"alice.01".to_vec());
+        let call = encode_register_name_call([0x6a, 0x01], &[0x44; 32], b"alicebc", &link);
+        assert_eq!(&call[..2], &[0x6a, 0x01]);
+        assert_eq!(&call[2..34], &[0x44; 32]);
+        assert_eq!(
+            &call[34..],
+            &[b"alicebc".to_vec().encode(), link.encode()].concat()[..]
+        );
+
+        // Layout: 0x01 (Some) ‖ variant ‖ compact-len proof ‖ ring_index LE ‖
+        // revision LE ‖ 0x01 (Sr25519) ‖ signature, the AsDotnsGatewayInfo::
+        // RegisterFullName field order.
+        let extra = encode_register_full_name_extra(0, &[0xEE; 785], 3, 5, &[0xAB; 64]);
+        assert_eq!(
+            extra,
+            [
+                vec![0x01, 0x00],
+                vec![0xEEu8; 785].encode(),
+                3u32.to_le_bytes().to_vec(),
+                5u32.to_le_bytes().to_vec(),
+                vec![0x01],
+                vec![0xAB; 64],
+            ]
+            .concat()
+        );
+    }
+
+    #[test]
+    fn selectors_match_reference_vectors() {
+        assert_eq!(hex::encode(selector("getLabelStore(address)")), "4fc5dce9");
+        assert_eq!(
+            hex::encode(selector("getLabels(uint256,uint256)")),
+            "2d7b5794"
+        );
+        assert_eq!(hex::encode(selector("protocolRegistry()")), "7656419f");
+        assert_eq!(hex::encode(selector("get(bytes32)")), "8eaa6ac0");
+        assert_eq!(hex::encode(selector("TARGET()")), "cc1f2afa");
+        assert_eq!(hex::encode(selector("pendingClaims(address)")), "ca78533d");
+        assert_eq!(hex::encode(selector("tld()")), "2d551432");
+        assert_eq!(hex::encode(selector("recordExists(bytes32)")), "f79fe538");
+        assert_eq!(hex::encode(selector("ownerOf(uint256)")), "6352211e");
+        assert_eq!(hex::encode(selector("exists(uint256)")), "4f558e79");
+    }
+
+    #[test]
+    fn namehash_matches_the_reference_derivation() {
+        // `cast namehash paseo` and `cast namehash alicebc.paseo`.
+        let tld_node = namehash_under(&[0u8; 32], "paseo");
+        assert_eq!(
+            hex::encode(tld_node),
+            "096b436ee9a398429fe33ad4b359bad4398dd74b412ec1dd043c93dfbf581874"
+        );
+        assert_eq!(
+            hex::encode(namehash_under(&tld_node, "alicebc")),
+            "d3b106171373cd9fea783acd85f69def1bb2085f81cf5f2a65088b0ce4edd82e"
+        );
+        assert_eq!(super::tld_node(".paseo"), tld_node);
+        assert_eq!(super::tld_node("paseo"), tld_node);
+    }
+
+    #[test]
+    fn calldata_encoders_place_arguments_in_padded_words() {
+        let address_call = call_address("getLabelStore(address)", &[0xAA; 20]);
+        assert_eq!(address_call.len(), 4 + 32);
+        assert_eq!(&address_call[..4], &selector("getLabelStore(address)"));
+        assert!(address_call[4..16].iter().all(|b| *b == 0));
+        assert_eq!(&address_call[16..], &[0xAA; 20]);
+
+        let pair_call = call_u256_pair("getLabels(uint256,uint256)", 0, 16);
+        assert_eq!(pair_call.len(), 4 + 64);
+        assert_eq!(pair_call[35], 0);
+        assert_eq!(pair_call[67], 16);
+
+        let key_call = call_bytes32("get(bytes32)", &registry_key("storeFactory"));
+        assert_eq!(&key_call[4..16], b"storeFactory");
+        assert!(key_call[16..36].iter().all(|b| *b == 0));
+    }
+
+    #[test]
+    fn account_to_h160_follows_the_revive_mapper() {
+        let mut eth_derived = [0x0Fu8; 32];
+        eth_derived[20..].fill(0xEE);
+        assert_eq!(account_to_h160(&eth_derived), [0x0F; 20]);
+
+        let hashed = account_to_h160(&[0x11; 32]);
+        assert_eq!(hashed, keccak_256(&[0x11; 32])[12..]);
+    }
+
+    /// Encodes a `ContractResult` prefix followed by `result`.
+    fn contract_result(result: &[u8]) -> Vec<u8> {
+        let mut out = Vec::new();
+        for _ in 0..4 {
+            Compact(7u64).encode_to(&mut out);
+        }
+        for _ in 0..2 {
+            (1u8, 0u128).encode_to(&mut out);
+        }
+        0u128.encode_to(&mut out);
+        out.extend_from_slice(result);
+        out
+    }
+
+    #[test]
+    fn revive_call_output_surfaces_data_reverts_and_dispatch_errors() {
+        let mut ok = vec![0u8];
+        0u32.encode_to(&mut ok);
+        vec![0xABu8, 0xCD].encode_to(&mut ok);
+        assert_eq!(
+            decode_revive_call_output(&contract_result(&ok)).unwrap(),
+            vec![0xAB, 0xCD]
+        );
+
+        // Error("nope") revert payload under ReturnFlags::REVERT.
+        let mut revert_data = vec![0x08, 0xc3, 0x79, 0xa0];
+        revert_data.extend_from_slice(&{
+            let mut word = [0u8; 32];
+            word[31] = 0x20;
+            word
+        });
+        revert_data.extend_from_slice(&{
+            let mut word = [0u8; 32];
+            word[31] = 4;
+            word
+        });
+        revert_data.extend_from_slice(b"nope");
+        revert_data.extend_from_slice(&[0u8; 28]);
+        let mut reverted = vec![0u8];
+        1u32.encode_to(&mut reverted);
+        revert_data.encode_to(&mut reverted);
+        let err = decode_revive_call_output(&contract_result(&reverted)).unwrap_err();
+        assert!(
+            matches!(&err, DotnsContractError::Reverted { detail } if detail == "Error(\"nope\")"),
+            "unexpected error: {err}"
+        );
+
+        let dispatch = contract_result(&[0x01, 0x02, 0x03]);
+        assert!(matches!(
+            decode_revive_call_output(&dispatch).unwrap_err(),
+            DotnsContractError::Dispatch { .. }
+        ));
+    }
+
+    /// ABI word with `value` right-aligned.
+    fn abi_word(value: u64) -> [u8; 32] {
+        let mut word = [0u8; 32];
+        word[24..].copy_from_slice(&value.to_be_bytes());
+        word
+    }
+
+    /// ABI string tail: a length word plus padded bytes.
+    fn abi_string(value: &str) -> Vec<u8> {
+        let mut out = abi_word(value.len() as u64).to_vec();
+        out.extend_from_slice(value.as_bytes());
+        out.resize(out.len().div_ceil(32) * 32, 0);
+        out
+    }
+
+    #[test]
+    fn abi_decoders_handle_addresses_string_arrays_and_pending_claims() {
+        let mut address = [0u8; 32];
+        address[12..].fill(0xBC);
+        assert_eq!(decode_address(&address).unwrap(), [0xBC; 20]);
+        assert!(decode_address(&[0xFF; 32]).is_err());
+
+        // string[] = ["alice01", "bob"].
+        let mut array = abi_word(0x20).to_vec();
+        array.extend_from_slice(&abi_word(2));
+        array.extend_from_slice(&abi_word(0x40));
+        array.extend_from_slice(&abi_word(0x40 + 0x40));
+        array.extend_from_slice(&abi_string("alice01"));
+        array.extend_from_slice(&abi_string("bob"));
+        assert_eq!(
+            decode_string_array(&array).unwrap(),
+            vec!["alice01".to_string(), "bob".to_string()]
+        );
+        assert_eq!(
+            decode_string_array(&[abi_word(0x20), abi_word(0)].concat()).unwrap(),
+            Vec::<String>::new()
+        );
+
+        // pendingClaims = [("alice01", 42), ("bob", 7)].
+        let struct_a = [
+            abi_word(0x40).to_vec(),
+            abi_word(42).to_vec(),
+            abi_string("alice01"),
+        ]
+        .concat();
+        let struct_b = [
+            abi_word(0x40).to_vec(),
+            abi_word(7).to_vec(),
+            abi_string("bob"),
+        ]
+        .concat();
+        let mut claims = abi_word(0x20).to_vec();
+        claims.extend_from_slice(&abi_word(2));
+        claims.extend_from_slice(&abi_word(0x40));
+        claims.extend_from_slice(&abi_word(0x40 + struct_a.len() as u64));
+        claims.extend_from_slice(&struct_a);
+        claims.extend_from_slice(&struct_b);
+        assert_eq!(
+            decode_pending_claims_array(&claims).unwrap(),
+            vec![("alice01".to_string(), 42), ("bob".to_string(), 7)]
+        );
+        assert_eq!(
+            decode_pending_claims_array(&[abi_word(0x20), abi_word(0)].concat()).unwrap(),
+            Vec::<(String, u64)>::new()
+        );
+        assert_eq!(decode_u64(&abi_word(604_800)).unwrap(), 604_800);
+        assert!(decode_u64(&[0xff; 32]).is_err());
+    }
+
+    #[test]
+    fn bool_words_decode_strictly() {
+        assert!(decode_bool(&abi_word(1)).unwrap());
+        assert!(!decode_bool(&abi_word(0)).unwrap());
+        assert!(decode_bool(&abi_word(2)).is_err());
+        let mut high = abi_word(1);
+        high[5] = 1;
+        assert!(decode_bool(&high).is_err());
+    }
+
+    #[test]
+    fn a_pending_claim_lapses_after_the_reservation_duration() {
+        // DotnsPopController._isExpired: mintedAt + reservationDuration < now.
+        assert!(!claim_lapsed(1_000, 100, 1_100));
+        assert!(claim_lapsed(1_000, 100, 1_101));
+        assert!(!claim_lapsed(u64::MAX, 100, u64::MAX));
+    }
+
+    #[test]
+    fn labels_classify_into_lite_and_full_usernames() {
+        let identity = classify_labels(["alice01", "myproject"]);
+        assert_eq!(identity.lite_username.as_deref(), Some("alice.01"));
+        assert_eq!(identity.full_username.as_deref(), Some("myproject"));
+
+        // Dotted labels are not base names and are skipped; a DNS stem may hold
+        // digits and hyphens (`isSingleDotLiteLabel`), a hyphen may not lead or
+        // trail it.
+        let identity = classify_labels([
+            "bobby42.dot",
+            "app.web3app",
+            "aé01",
+            "web3app",
+            "a2b34",
+            "-x01",
+        ]);
+        assert_eq!(identity.lite_username.as_deref(), Some("a2b.34"));
+        assert_eq!(identity.full_username.as_deref(), Some("web3app"));
+
+        assert_eq!(
+            classify_labels(Vec::<String>::new()),
+            DotnsIdentity::default()
+        );
+
+        // Hostile store data never becomes a username: oversized labels,
+        // control characters, markup, ANSI escapes, interior NULs.
+        let identity = classify_labels([
+            "a".repeat(5000),
+            "admin\r\nx".to_string(),
+            "a\0b".to_string(),
+            "\x1b[31mred\x1b[0m".to_string(),
+            "<img src=x onerror=alert(1)>".to_string(),
+            "Upper".to_string(),
+        ]);
+        assert_eq!(identity, DotnsIdentity::default());
+        // The 63-octet DNS bound is the cut-off.
+        assert!(classify_labels(["a".repeat(63)]).full_username.is_some());
+        assert!(classify_labels(["a".repeat(64)]).full_username.is_none());
+        // One trailing digit is not lite format.
+        let identity = classify_labels(["alice1"]);
+        assert_eq!(identity.lite_username, None);
+        assert_eq!(identity.full_username.as_deref(), Some("alice1"));
+    }
+
+    #[test]
+    fn label_validators_follow_the_contract_rules() {
+        assert!(is_full_person_label("alicebc"));
+        assert!(is_full_person_label(&"a".repeat(32)));
+        assert!(!is_full_person_label("web3-app"), "no digits or hyphens");
+        assert!(!is_full_person_label("alice01"));
+        assert!(!is_full_person_label("Alice"));
+        assert!(!is_full_person_label(""));
+
+        // PopRules: five letters or fewer are governance-reserved; longer
+        // bases can be registered and reserved alike.
+        assert!(is_registrable_full_label("george"));
+        assert!(is_registrable_full_label("georgeabc"));
+        assert!(is_registrable_full_label(&"a".repeat(32)));
+        assert!(!is_registrable_full_label("alice"));
+        assert!(!is_full_person_label("alice.bc"));
+        assert!(!is_full_person_label("-alice"));
+        assert!(!is_full_person_label(&"a".repeat(33)));
+
+        assert!(is_dotted_lite_username("alice.01"));
+        assert!(is_dotted_lite_username("a2b.34"));
+        assert!(!is_dotted_lite_username("alice01"));
+        assert!(!is_dotted_lite_username("alice.1"));
+        assert!(!is_dotted_lite_username("alice.012"));
+        assert!(!is_dotted_lite_username("a.lice.01"));
+        assert!(!is_dotted_lite_username(".01"));
+        assert!(!is_dotted_lite_username(&format!("{}.01", "a".repeat(31))));
+    }
+
+    /// A transport answering views by selector: `tld()` with a scripted
+    /// result, `get(bytes32)` with a registry address, `recordExists(bytes32)`
+    /// with a scripted bool.
+    struct ScriptedTld {
+        tld: fn() -> Result<Vec<u8>, DotnsViewError>,
+        dot_record_exists: bool,
+    }
+
+    #[truapi_platform::async_trait]
+    impl DotnsTransport for ScriptedTld {
+        async fn storage(&mut self, _key: Vec<u8>) -> Result<Option<Vec<u8>>, String> {
+            Ok(None)
+        }
+
+        async fn view(
+            &mut self,
+            _dest: &[u8; 20],
+            input: Vec<u8>,
+        ) -> Result<Vec<u8>, DotnsViewError> {
+            let sel: [u8; 4] = input[..4].try_into().expect("selector prefix; qed");
+            if sel == selector("tld()") {
+                (self.tld)()
+            } else if sel == selector("get(bytes32)") {
+                let mut word = [0u8; 32];
+                word[12..].copy_from_slice(&[0xd0; 20]);
+                Ok(word.to_vec())
+            } else if sel == selector("recordExists(bytes32)") {
+                assert_eq!(&input[4..36], &tld_node(TLD_WITHOUT_VIEW));
+                Ok(abi_word(self.dot_record_exists as u64).to_vec())
+            } else {
+                panic!("unscripted view {}", hex::encode(sel));
+            }
+        }
+    }
+
+    #[test]
+    fn the_tld_falls_back_only_when_the_view_reverts_and_the_record_exists() {
+        let registry = [0x9e; 20];
+        fn reverted() -> Result<Vec<u8>, DotnsViewError> {
+            Err(DotnsViewError::Reverted(DotnsContractError::Reverted {
+                detail: "(empty)".to_string(),
+            }))
+        }
+
+        let served = futures::executor::block_on(network_tld(
+            &mut ScriptedTld {
+                tld: || Ok([abi_word(32).to_vec(), abi_string(".paseo")].concat()),
+                dot_record_exists: false,
+            },
+            &registry,
+        ));
+        assert_eq!(served.as_deref(), Ok(".paseo"));
+
+        // The fallback is verified: the registry must hold the ".dot" record.
+        let verified = futures::executor::block_on(network_tld(
+            &mut ScriptedTld {
+                tld: reverted,
+                dot_record_exists: true,
+            },
+            &registry,
+        ));
+        assert_eq!(verified.as_deref(), Ok(TLD_WITHOUT_VIEW));
+
+        let unverified = futures::executor::block_on(network_tld(
+            &mut ScriptedTld {
+                tld: reverted,
+                dot_record_exists: false,
+            },
+            &registry,
+        ));
+        assert!(unverified.is_err(), "{unverified:?}");
+
+        // A transport failure is not an answer: no guessing.
+        let failed = futures::executor::block_on(network_tld(
+            &mut ScriptedTld {
+                tld: || Err(DotnsViewError::Failed("timed out".to_string())),
+                dot_record_exists: true,
+            },
+            &registry,
+        ));
+        assert!(failed.is_err(), "{failed:?}");
+    }
+
+    /// The full availability walk, scripted: tld → get(registrar) → exists.
+    struct ScriptedAvailability {
+        exists: fn() -> Result<Vec<u8>, DotnsViewError>,
+    }
+
+    #[truapi_platform::async_trait]
+    impl DotnsTransport for ScriptedAvailability {
+        async fn storage(&mut self, _key: Vec<u8>) -> Result<Option<Vec<u8>>, String> {
+            Ok(None)
+        }
+
+        async fn view(
+            &mut self,
+            _dest: &[u8; 20],
+            input: Vec<u8>,
+        ) -> Result<Vec<u8>, DotnsViewError> {
+            let sel: [u8; 4] = input[..4].try_into().expect("selector prefix; qed");
+            if sel == selector("protocolRegistry()") {
+                let mut word = [0u8; 32];
+                word[12..].copy_from_slice(&[0x9e; 20]);
+                Ok(word.to_vec())
+            } else if sel == selector("tld()") {
+                Ok([abi_word(32).to_vec(), abi_string(".paseo")].concat())
+            } else if sel == selector("get(bytes32)") {
+                let mut word = [0u8; 32];
+                word[12..].copy_from_slice(&[0xd1; 20]);
+                Ok(word.to_vec())
+            } else if sel == selector("exists(uint256)") {
+                assert_eq!(
+                    &input[4..36],
+                    &namehash_under(&tld_node(".paseo"), "george")
+                );
+                (self.exists)()
+            } else {
+                panic!("unscripted view {}", hex::encode(sel));
+            }
+        }
+    }
+
+    /// `available` must fail closed: a registrar that reverts (a wrong or
+    /// undeployed entry) is an error, never "available", or the already-minted
+    /// guard would pass for every name.
+    #[test]
+    fn availability_fails_closed_when_the_registrar_does_not_answer() {
+        let controller = [0xc0; 20];
+        let run = |exists: fn() -> Result<Vec<u8>, DotnsViewError>| {
+            futures::executor::block_on(label_available(
+                &mut ScriptedAvailability { exists },
+                &controller,
+                "george",
+            ))
+        };
+
+        assert_eq!(run(|| Ok(abi_word(0).to_vec())), Ok(true));
+        assert_eq!(run(|| Ok(abi_word(1).to_vec())), Ok(false));
+        let reverted = run(|| {
+            Err(DotnsViewError::Reverted(DotnsContractError::Reverted {
+                detail: "(empty)".to_string(),
+            }))
+        });
+        assert!(reverted.is_err(), "{reverted:?}");
+        let failed = run(|| Err(DotnsViewError::Failed("timed out".to_string())));
+        assert!(failed.is_err(), "{failed:?}");
+    }
+
+    #[test]
+    fn view_output_separates_reverts_from_failures() {
+        let reverted = contract_result(&{
+            let mut out = vec![0x00];
+            1u32.encode_to(&mut out); // ReturnFlags::REVERT
+            Vec::<u8>::new().encode_to(&mut out);
+            out
+        });
+        assert!(matches!(
+            view_output(&reverted),
+            Err(DotnsViewError::Reverted(
+                DotnsContractError::Reverted { .. }
+            ))
+        ));
+        assert!(matches!(
+            view_output(&[0x01]),
+            Err(DotnsViewError::Failed(_))
+        ));
+        let returned = contract_result(&{
+            let mut out = vec![0x00];
+            0u32.encode_to(&mut out);
+            vec![1u8, 2, 3, 4].encode_to(&mut out);
+            out
+        });
+        assert_eq!(view_output(&returned).unwrap(), vec![1, 2, 3, 4]);
+    }
+
+    #[test]
+    fn store_labels_lose_the_network_tld_and_subnames_are_dropped() {
+        assert_eq!(bare_store_label("alice01.paseo", ".paseo"), Some("alice01"));
+        assert_eq!(bare_store_label("alice01.dot", ".dot"), Some("alice01"));
+        // Wrong TLD, subname, or nothing left after the TLD.
+        assert_eq!(bare_store_label("alice01.dot", ".paseo"), None);
+        assert_eq!(bare_store_label("app.alice.paseo", ".paseo"), None);
+        assert_eq!(bare_store_label(".paseo", ".paseo"), None);
+        // An empty TLD leaves bare labels as they are.
+        assert_eq!(bare_store_label("alice01", ""), Some("alice01"));
+    }
+
+    #[test]
+    fn storage_keys_have_the_expected_layout() {
+        // Blake2_128Concat over the SCALE-encoded BaseLabel (compact length ‖ bytes).
+        let owner_key = lite_label_owner_key(b"alice.01");
+        let encoded = [&[0x20u8][..], b"alice.01"].concat();
+        assert_eq!(
+            &owner_key[..32],
+            [
+                twox_128(b"DotnsGateway").as_slice(),
+                twox_128(b"LiteLabelOwner").as_slice(),
+            ]
+            .concat()
+        );
+        assert_eq!(&owner_key[32..48], &blake2_128(&encoded));
+        assert_eq!(&owner_key[48..], &encoded);
+
+        let alias_key = account_alias_key(&[0x11; 32]);
+        let prefix = [
+            twox_128(b"DotnsGateway").as_slice(),
+            twox_128(b"AccountAlias").as_slice(),
+        ]
+        .concat();
+        assert_eq!(&alias_key[..32], prefix.as_slice());
+        // Blake2_128Concat over the raw account bytes.
+        assert_eq!(&alias_key[48..], &[0x11; 32]);
+
+        assert_eq!(dispatcher_address_key().len(), 32);
+        assert_eq!(timestamp_now_key().len(), 32);
+    }
+
+    #[test]
+    fn revive_call_args_encode_origin_dest_and_input() {
+        let args = encode_revive_call(&[0x11; 32], &[0x22; 20], &[0xAB, 0xCD]);
+        assert_eq!(&args[..32], &[0x11; 32]);
+        assert_eq!(&args[32..52], &[0x22; 20]);
+        assert_eq!(&args[52..68], &[0u8; 16], "value is zero");
+        assert_eq!(&args[68..70], &[0x00, 0x00], "no gas or deposit limit");
+        assert_eq!(&args[70..], vec![0xABu8, 0xCD].encode().as_slice());
+    }
+}
diff --git a/rust/crates/truapi-server/src/host_logic/extrinsic.rs b/rust/crates/truapi-server/src/host_logic/extrinsic.rs
index 1437e1cb7..1d9b1bb18 100644
--- a/rust/crates/truapi-server/src/host_logic/extrinsic.rs
+++ b/rust/crates/truapi-server/src/host_logic/extrinsic.rs
@@ -829,6 +829,7 @@ pub(crate) mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         }
     }
 
diff --git a/rust/crates/truapi-server/src/host_logic/identity.rs b/rust/crates/truapi-server/src/host_logic/identity.rs
deleted file mode 100644
index bcf0d834a..000000000
--- a/rust/crates/truapi-server/src/host_logic/identity.rs
+++ /dev/null
@@ -1,148 +0,0 @@
-//! People-chain identity lookup for paired SSO sessions.
-//!
-//! The previous host-papp path read `Resources.Consumers[account]` from
-//! the People chain and used only the username fields. Keep this module narrow:
-//! it builds that storage key and decodes the leading username fields from the
-//! SCALE value. The record begins with a fixed identifier public key; credibility
-//! and statement-store slots are intentionally ignored.
-//! Host-spec G defines the cross-host identity model and lookup behavior:
-//! <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/G-identity.md?plain=1#L5-L47>
-
-use parity_scale_codec::{Decode, Encode};
-use sp_crypto_hashing::{blake2_128, twox_128};
-
-/// Username fields read from a People-chain `Resources.Consumers` record.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PeopleIdentity {
-    /// Lite username; `None` when the record stores an empty string.
-    pub lite_username: Option<String>,
-    /// Full username, when the account has registered one.
-    pub full_username: Option<String>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
-struct ConsumerUsernamePrefix {
-    identifier_key: [u8; 65],
-    full_username: Option<Vec<u8>>,
-    lite_username: Vec<u8>,
-}
-
-/// Build the People-chain `Resources.Consumers` storage key for `account_id`.
-pub fn resources_consumers_storage_key(account_id: &[u8; 32]) -> Vec<u8> {
-    let mut key = Vec::with_capacity(32 + 16 + account_id.len());
-    key.extend_from_slice(&twox_128(b"Resources"));
-    key.extend_from_slice(&twox_128(b"Consumers"));
-    key.extend_from_slice(&blake2_128(account_id));
-    key.extend_from_slice(account_id);
-    key
-}
-
-/// Decode the username fields from a `Resources.Consumers` storage value.
-pub fn decode_people_identity(value: &[u8]) -> Result<PeopleIdentity, String> {
-    if value.len() < 65 {
-        return Err(format!(
-            "invalid Resources.Consumers record: expected 65-byte identifier key, got {} bytes",
-            value.len()
-        ));
-    }
-
-    let mut input = value;
-    let decoded = ConsumerUsernamePrefix::decode(&mut input)
-        .map_err(|err| format!("invalid Resources.Consumers record: {err}"))?;
-    let lite_username = non_empty_string(decoded.lite_username)?;
-    let full_username = decoded
-        .full_username
-        .map(non_empty_string)
-        .transpose()?
-        .flatten();
-    Ok(PeopleIdentity {
-        lite_username,
-        full_username,
-    })
-}
-
-fn non_empty_string(bytes: Vec<u8>) -> Result<Option<String>, String> {
-    if bytes.is_empty() {
-        return Ok(None);
-    }
-    let value = String::from_utf8(bytes)
-        .map_err(|err| format!("Resources.Consumers username is not UTF-8: {err}"))?;
-    Ok(Some(value))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn resources_consumers_key_uses_expected_prefix() {
-        let key = resources_consumers_storage_key(&[0x42; 32]);
-
-        assert_eq!(key.len(), 80);
-        assert_eq!(&key[..16], &twox_128(b"Resources"));
-        assert_eq!(&key[16..32], &twox_128(b"Consumers"));
-        assert_eq!(&key[48..], &[0x42; 32]);
-    }
-
-    #[test]
-    fn twox128_matches_substrate_storage_prefix_vector() {
-        assert_eq!(
-            hex::encode(twox_128(b"System")),
-            "26aa394eea5630e07c48ae0c9558cef7"
-        );
-    }
-
-    #[test]
-    fn decodes_username_prefix_and_ignores_trailing_fields() {
-        let mut value = vec![0x04; 65];
-        value.extend((Some(b"Alice Smith".to_vec()), b"alice.01".to_vec()).encode());
-        value.extend_from_slice(&[0xff; 8]);
-
-        let decoded = decode_people_identity(&value).expect("identity should decode");
-
-        assert_eq!(decoded.full_username.as_deref(), Some("Alice Smith"));
-        assert_eq!(decoded.lite_username.as_deref(), Some("alice.01"));
-    }
-
-    #[test]
-    fn consumer_username_prefix_matches_runtime_field_codec() {
-        let prefix = ConsumerUsernamePrefix {
-            identifier_key: [0x04; 65],
-            full_username: Some(b"Alice Smith".to_vec()),
-            lite_username: b"alice.01".to_vec(),
-        };
-        let encoded = prefix.encode();
-        let runtime_fields = (
-            prefix.identifier_key,
-            prefix.full_username.as_ref(),
-            prefix.lite_username.as_slice(),
-        )
-            .encode();
-
-        assert_eq!(encoded, runtime_fields);
-        assert_eq!(
-            ConsumerUsernamePrefix::decode(&mut encoded.as_slice()).unwrap(),
-            prefix
-        );
-    }
-
-    #[test]
-    fn empty_full_username_is_none() {
-        let mut value = vec![0x04; 65];
-        value.extend((Some(Vec::<u8>::new()), b"alice.01".to_vec()).encode());
-
-        let decoded = decode_people_identity(&value).expect("identity should decode");
-
-        assert_eq!(decoded.full_username, None);
-        assert_eq!(decoded.lite_username.as_deref(), Some("alice.01"));
-    }
-
-    #[test]
-    fn rejects_missing_identifier_key() {
-        let value = (None::<Vec<u8>>, b"alice.01".to_vec()).encode();
-
-        let error = decode_people_identity(&value).expect_err("identity should reject");
-
-        assert!(error.contains("65-byte identifier key"));
-    }
-}
diff --git a/rust/crates/truapi-server/src/host_logic/product_account.rs b/rust/crates/truapi-server/src/host_logic/product_account.rs
index d542e3265..e4c18ea00 100644
--- a/rust/crates/truapi-server/src/host_logic/product_account.rs
+++ b/rust/crates/truapi-server/src/host_logic/product_account.rs
@@ -24,9 +24,9 @@ pub const IDENTITY_PRODUCT_ID: &str = "uid.dot";
 pub const PERSONHOOD_PRODUCT_ID: &str = "peopl.dot";
 const RING_VRF_ROOT_KEY: &[u8] = b"ring-vrf";
 
-/// Substrate sr25519 signing-context string, shared by every sr25519 signature
-/// the core produces (statement store, product raw signing).
-pub(crate) const SR25519_SIGNING_CONTEXT: &[u8] = b"substrate";
+/// Substrate sr25519 signing-context string. Shared by every sr25519 signature
+/// the core produces: statement store, product raw signing, dotNS gateway.
+pub const SR25519_SIGNING_CONTEXT: &[u8] = b"substrate";
 
 /// Error deriving product accounts or keys.
 #[derive(Debug, Error, PartialEq, Eq)]
diff --git a/rust/crates/truapi-server/src/host_logic/session.rs b/rust/crates/truapi-server/src/host_logic/session.rs
index be590c05a..4dd60b018 100644
--- a/rust/crates/truapi-server/src/host_logic/session.rs
+++ b/rust/crates/truapi-server/src/host_logic/session.rs
@@ -20,7 +20,7 @@ use truapi::versioned::account::HostAccountConnectionStatusSubscribeItem as Vers
 
 /// Session info for a pairing host's active signing-host session. The 32-byte
 /// sr25519 public key plus optional usernames are sourced from the signing host
-/// and People-chain identity record.
+/// and dotNS identity record (read from Asset Hub).
 #[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
 pub struct SessionInfo {
     /// 32-byte sr25519 root public key owned by the signing host.
@@ -30,7 +30,7 @@ pub struct SessionInfo {
     pub sso: Option<SsoSessionInfo>,
     /// Wallet-provided source for deterministic product entropy.
     pub root_entropy_source: Option<[u8; 32]>,
-    /// Wallet identity account id used for People-chain username lookup.
+    /// Wallet identity account id used for the dotNS username lookup on Asset Hub.
     pub identity_account_id: Option<[u8; 32]>,
     /// X25519 private key addressing this identity in chat. A pairing host
     /// retains what the handshake shares and cannot recompute it.
@@ -106,7 +106,7 @@ pub struct ExternalPairedSession {
     pub sso: SsoSessionInfo,
     /// Wallet-provided source for deterministic product entropy.
     pub root_entropy_source: [u8; 32],
-    /// Wallet identity account id used for People-chain username lookup.
+    /// Wallet identity account id used for the dotNS username lookup on Asset Hub.
     pub identity_account_id: [u8; 32],
     /// Wallet-supplied X25519 private key addressing this identity in chat,
     /// when the external runtime captured it during its own handshake.
diff --git a/rust/crates/truapi-server/src/host_logic/sso/messages.rs b/rust/crates/truapi-server/src/host_logic/sso/messages.rs
index 524ea153a..d16c4a526 100644
--- a/rust/crates/truapi-server/src/host_logic/sso/messages.rs
+++ b/rust/crates/truapi-server/src/host_logic/sso/messages.rs
@@ -1976,6 +1976,7 @@ mod tests {
             PlatformInfo::default(),
             [0; 32],
             [0xbb; 32],
+            [0xcc; 32],
             "polkadotapp".to_string(),
         )
         .expect("test pairing config is valid");
diff --git a/rust/crates/truapi-server/src/host_logic/sso/pairing.rs b/rust/crates/truapi-server/src/host_logic/sso/pairing.rs
index 84b5cedb3..a7ec09c1c 100644
--- a/rust/crates/truapi-server/src/host_logic/sso/pairing.rs
+++ b/rust/crates/truapi-server/src/host_logic/sso/pairing.rs
@@ -647,6 +647,7 @@ mod tests {
             },
             [0; 32],
             [0xbb; 32],
+            [0xcc; 32],
             "polkadotapp".to_string(),
         )
         .expect("test runtime config is valid")
diff --git a/rust/crates/truapi-server/src/runtime.rs b/rust/crates/truapi-server/src/runtime.rs
index c16266f9b..6680d3dde 100644
--- a/rust/crates/truapi-server/src/runtime.rs
+++ b/rust/crates/truapi-server/src/runtime.rs
@@ -402,6 +402,7 @@ impl ProductRuntimeHost {
             truapi_platform::PlatformInfo::default(),
             [0; 32],
             [0xbb; 32],
+            [0xcc; 32],
             "polkadotapp".to_string(),
         )
         .expect("compat runtime config is valid")
diff --git a/rust/crates/truapi-server/src/runtime/authority.rs b/rust/crates/truapi-server/src/runtime/authority.rs
index 100d4ee8d..7593eaed0 100644
--- a/rust/crates/truapi-server/src/runtime/authority.rs
+++ b/rust/crates/truapi-server/src/runtime/authority.rs
@@ -91,9 +91,9 @@ pub(crate) struct AuthoritySession {
     pub public_key: [u8; 32],
     /// Identity account resolved from the signing host, when available.
     pub identity_account_id: Option<[u8; 32]>,
-    /// Lightweight username resolved from People-chain identity, when available.
+    /// Lightweight username resolved from the dotNS contracts on Asset Hub, when available.
     pub lite_username: Option<String>,
-    /// Fully qualified username resolved from People-chain identity, when available.
+    /// Fully qualified username resolved from the dotNS contracts on Asset Hub, when available.
     pub full_username: Option<String>,
     /// Opaque session token used to reject stale pre-confirmation snapshots.
     pub validation_id: Vec<u8>,
diff --git a/rust/crates/truapi-server/src/runtime/identity.rs b/rust/crates/truapi-server/src/runtime/identity.rs
index c783c603e..c5a919e2d 100644
--- a/rust/crates/truapi-server/src/runtime/identity.rs
+++ b/rust/crates/truapi-server/src/runtime/identity.rs
@@ -1,4 +1,13 @@
-//! People-chain identity lookup used to resolve usernames for a paired session.
+//! dotNS identity lookup used to resolve usernames for a paired session.
+//!
+//! Usernames live in the dotNS contracts on Asset Hub. The gateway pallet
+//! storage anchors the `DotnsPopController`. The protocol registry locates the
+//! `StoreFactory`. The account's labels come from its `LabelStore` on the warm
+//! path. On the cold path they come from its pending claim on the controller,
+//! covering gateway-minted names before the user settles their store.
+//!
+//! All reads run over one `chainHead_v1` follow via `ReviveApi_call` dry-runs.
+//! No chain metadata is needed.
 
 use std::sync::atomic::{AtomicU64, Ordering};
 #[cfg(not(target_arch = "wasm32"))]
@@ -8,106 +17,124 @@ use web_time::Duration;
 
 use crate::chain_runtime::{
     ChainHeadStorageValue, ChainHeadStorageValueLookup, ChainRuntime,
-    wait_for_chain_head_best_hash, wait_for_chain_head_storage_value,
+    wait_for_chain_head_best_hash, wait_for_chain_head_call_output,
+    wait_for_chain_head_storage_value,
 };
-use crate::host_logic::identity::{
-    PeopleIdentity, decode_people_identity, resources_consumers_storage_key,
+use crate::host_logic::dotns_gateway::{
+    DotnsIdentity, DotnsTransport, DotnsViewError, VIEW_CALL_ORIGIN, classify_labels,
+    discover_pop_controller, encode_revive_call, resolve_labels, view_output,
 };
 use crate::host_logic::session::SessionInfo;
 
+use futures::stream::BoxStream;
 use futures::{FutureExt, pin_mut};
 use tracing::{debug, instrument, warn};
 use truapi::latest::{
-    OperationStartedResult, RemoteChainHeadFollowRequest, RemoteChainHeadStorageRequest,
-    StorageQueryItem, StorageQueryType,
+    OperationStartedResult, RemoteChainHeadCallRequest, RemoteChainHeadFollowItem,
+    RemoteChainHeadFollowRequest, RemoteChainHeadStorageRequest, StorageQueryItem,
+    StorageQueryType,
 };
 
-/// Budget for the whole People-chain lookup (best block + storage read).
-const LOOKUP_TIMEOUT: Duration = Duration::from_secs(10);
-const LOOKUP_RETRY_INTERVAL: Duration = Duration::from_secs(2);
+/// Budget for the whole username resolution of one session: every attempt for
+/// the identity account plus the root-key fallback share it, so a slow or dead
+/// endpoint delays session installation by at most this long.
+const LOOKUP_BUDGET: Duration = Duration::from_secs(45);
+/// Budget for one step of it: opening the follow, one storage read, one
+/// contract view. A step that stalls this long is not going to answer.
+const OPERATION_TIMEOUT: Duration = Duration::from_secs(10);
 const BEST_BLOCK_TIMEOUT: Duration = Duration::from_secs(2);
 
-/// Monotonic salt for local identity lookup follow ids, avoiding collisions
-/// between concurrent People-chain identity lookups.
+/// Monotonic salt for local identity lookup follow ids. It keeps concurrent
+/// dotNS identity lookups from colliding.
 static IDENTITY_LOOKUP_COUNTER: AtomicU64 = AtomicU64::new(1);
 
-enum ConsumerRecordLookup {
-    Found(Vec<u8>),
-    Missing,
-    Inaccessible,
-}
-
-/// Fill in missing usernames by querying the people chain; returns the
-/// session unchanged when it already carries a username or no people chain
-/// is configured.
+/// Fills in missing usernames by querying the dotNS contracts on Asset Hub.
+/// Returns the session unchanged when it already carries a username. Also
+/// returns it unchanged when no Asset Hub is configured.
 #[instrument(skip_all, fields(runtime.method = "session.identity.resolve_with_chain"))]
 pub(super) async fn resolve_session_identity_with_chain(
     chain: &ChainRuntime,
-    people_chain_genesis_hash: [u8; 32],
+    asset_hub_chain_genesis_hash: [u8; 32],
     mut session: SessionInfo,
 ) -> SessionInfo {
-    if session.has_username() || people_chain_genesis_hash == [0; 32] {
+    if session.has_username() || asset_hub_chain_genesis_hash == [0; 32] {
         return session;
     }
 
-    let preferred_account = session.identity_account_id.unwrap_or(session.public_key);
-    if lookup_and_apply(
-        chain,
-        people_chain_genesis_hash,
-        preferred_account,
-        &mut session,
-        "identity",
-    )
-    .await
-        == LookupOutcome::NoRecord
-        && preferred_account != session.public_key
     {
-        let public_key = session.public_key;
-        lookup_and_apply(
-            chain,
-            people_chain_genesis_hash,
-            public_key,
-            &mut session,
-            "root identity",
-        )
-        .await;
+        let budget = futures_timer::Delay::new(LOOKUP_BUDGET).fuse();
+        pin_mut!(budget);
+        let resolve = async {
+            let preferred_account = session.identity_account_id.unwrap_or(session.public_key);
+            if lookup_and_apply(
+                chain,
+                asset_hub_chain_genesis_hash,
+                preferred_account,
+                &mut session,
+                "identity",
+            )
+            .await
+                == LookupOutcome::NoRecord
+                && preferred_account != session.public_key
+            {
+                let public_key = session.public_key;
+                lookup_and_apply(
+                    chain,
+                    asset_hub_chain_genesis_hash,
+                    public_key,
+                    &mut session,
+                    "root identity",
+                )
+                .await;
+            }
+        }
+        .fuse();
+        pin_mut!(resolve);
+        futures::select! {
+            () = resolve => {}
+            () = budget => {
+                warn!(
+                    "dotNS username resolution ran out of budget; the session installs without one"
+                );
+            }
+        }
     }
 
     session
 }
 
 /// Maximum lookup attempts per account on transient failure. The first attempt
-/// warms the People-chain connection (cached per genesis), so a retry after a
-/// cold-start timeout usually resolves immediately.
+/// warms the Asset Hub connection, cached per genesis. A retry after a cold-start
+/// timeout therefore usually resolves immediately.
 const IDENTITY_LOOKUP_MAX_ATTEMPTS: usize = 3;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum LookupOutcome {
     /// A username record was found and applied.
     Applied,
-    /// The account has no consumer record (definitive; do not retry).
+    /// The account has no dotNS labels. Definitive, not worth a retry.
     NoRecord,
     /// The lookup failed transiently after exhausting retries.
     Failed,
 }
 
-/// Look up `account`'s people-chain identity and apply any usernames to
-/// `session`, retrying transient failures against the warmed connection.
+/// Looks up `account`'s dotNS identity and applies any usernames to `session`.
+/// Transient failures are retried against the warmed connection.
 async fn lookup_and_apply(
     chain: &ChainRuntime,
-    people_chain_genesis_hash: [u8; 32],
+    asset_hub_chain_genesis_hash: [u8; 32],
     account: [u8; 32],
     session: &mut SessionInfo,
     label: &str,
 ) -> LookupOutcome {
     for attempt in 1..=IDENTITY_LOOKUP_MAX_ATTEMPTS {
-        match lookup_people_identity(chain, people_chain_genesis_hash, account).await {
+        match lookup_dotns_identity(chain, asset_hub_chain_genesis_hash, account).await {
             Ok(Some(identity)) => {
                 debug!(
                     account = %hex::encode(account),
                     lite_username = identity.lite_username.as_deref().unwrap_or(""),
                     full_username = identity.full_username.as_deref().unwrap_or(""),
-                    "People-chain {label} lookup found username"
+                    "dotNS {label} lookup found username"
                 );
                 session.apply_usernames(identity.lite_username, identity.full_username);
                 return LookupOutcome::Applied;
@@ -115,7 +142,7 @@ async fn lookup_and_apply(
             Ok(None) => {
                 debug!(
                     account = %hex::encode(account),
-                    "People-chain {label} lookup found no consumer record"
+                    "dotNS {label} lookup found no labels"
                 );
                 return LookupOutcome::NoRecord;
             }
@@ -124,7 +151,7 @@ async fn lookup_and_apply(
                     account = %hex::encode(account),
                     attempt,
                     %reason,
-                    "People-chain {label} lookup failed"
+                    "dotNS {label} lookup failed"
                 );
             }
         }
@@ -132,100 +159,525 @@ async fn lookup_and_apply(
     LookupOutcome::Failed
 }
 
+/// Resolves `account_id`'s usernames from the dotNS contracts at a fresh Asset
+/// Hub head. Each step carries [`OPERATION_TIMEOUT`]; the caller's
+/// [`LOOKUP_BUDGET`] bounds the whole resolution. Returns `None` when the
+/// gateway is not deployed. Also returns `None` when the account holds no
+/// labels.
 #[instrument(skip_all, fields(runtime.method = "session.identity.lookup"))]
-async fn lookup_people_identity(
+async fn lookup_dotns_identity(
     chain: &ChainRuntime,
-    people_chain_genesis_hash: [u8; 32],
+    asset_hub_chain_genesis_hash: [u8; 32],
     account_id: [u8; 32],
-) -> Result<Option<PeopleIdentity>, String> {
-    let timeout = futures_timer::Delay::new(LOOKUP_TIMEOUT).fuse();
-    pin_mut!(timeout);
-    loop {
-        let lookup = fetch_consumer_record(chain, people_chain_genesis_hash, account_id).fuse();
-        pin_mut!(lookup);
-        let lookup = futures::select! {
-            value = lookup => value?,
-            () = timeout => return Err("People-chain identity lookup timed out".to_string()),
+) -> Result<Option<DotnsIdentity>, String> {
+    let lookup = async {
+        let mut lookup =
+            DotnsLookup::pinned_to_best_block(chain, asset_hub_chain_genesis_hash, account_id)
+                .await?;
+        let Some(controller) = discover_pop_controller(&mut lookup).await? else {
+            return Ok(None);
         };
-        match lookup {
-            ConsumerRecordLookup::Found(value) => {
-                return decode_people_identity(&value).map(Some);
-            }
-            ConsumerRecordLookup::Missing => return Ok(None),
-            ConsumerRecordLookup::Inaccessible => {}
-        }
-
-        let retry = futures_timer::Delay::new(LOOKUP_RETRY_INTERVAL).fuse();
-        pin_mut!(retry);
-        futures::select! {
-            () = retry => {},
-            () = timeout => return Err("People-chain identity lookup timed out".to_string()),
+        let labels = resolve_labels(&mut lookup, &controller, &account_id).await?;
+        if labels.is_empty() {
+            return Ok(None);
         }
+        Ok(Some(classify_labels(labels)))
     }
+    .fuse();
+    pin_mut!(lookup);
+    lookup.await
 }
 
-/// Read the raw `Resources.Consumers` record for `account_id` at a fresh
-/// People-chain head. The key is built locally, so the read never needs the
-/// People-chain metadata.
-async fn fetch_consumer_record(
-    chain: &ChainRuntime,
-    people_chain_genesis_hash: [u8; 32],
-    account_id: [u8; 32],
-) -> Result<ConsumerRecordLookup, String> {
-    let genesis_hash = people_chain_genesis_hash.to_vec();
-    let key = resources_consumers_storage_key(&account_id);
-    let lookup_id = IDENTITY_LOOKUP_COUNTER.fetch_add(1, Ordering::Relaxed);
-    let follow_id = format!("truapi:identity:{lookup_id}:{}", hex::encode(account_id));
-    let mut follow = chain.remote_chain_head_follow(
-        follow_id.clone(),
-        RemoteChainHeadFollowRequest {
-            genesis_hash: genesis_hash.clone(),
-            with_runtime: false,
-        },
-    );
-
-    let hash = wait_for_chain_head_best_hash(
-        &mut follow,
-        "People-chain",
-        LOOKUP_TIMEOUT,
-        BEST_BLOCK_TIMEOUT,
-    )
-    .await?;
-    let response = chain
-        .remote_chain_head_storage(RemoteChainHeadStorageRequest {
-            genesis_hash: genesis_hash.clone(),
-            follow_subscription_id: follow_id.clone(),
+/// One pinned-block context for the dotNS lookup steps. It owns the
+/// `chainHead_v1` follow every read and view runs over.
+struct DotnsLookup<'a> {
+    chain: &'a ChainRuntime,
+    follow: BoxStream<'static, RemoteChainHeadFollowItem>,
+    genesis_hash: Vec<u8>,
+    follow_id: String,
+    hash: Vec<u8>,
+}
+
+impl<'a> DotnsLookup<'a> {
+    /// Opens a follow on Asset Hub and pins it to the current best block.
+    async fn pinned_to_best_block(
+        chain: &'a ChainRuntime,
+        asset_hub_chain_genesis_hash: [u8; 32],
+        account_id: [u8; 32],
+    ) -> Result<Self, String> {
+        let genesis_hash = asset_hub_chain_genesis_hash.to_vec();
+        let lookup_id = IDENTITY_LOOKUP_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let follow_id = format!("truapi:identity:{lookup_id}:{}", hex::encode(account_id));
+        let mut follow = chain.remote_chain_head_follow(
+            follow_id.clone(),
+            RemoteChainHeadFollowRequest {
+                genesis_hash: genesis_hash.clone(),
+                with_runtime: true,
+            },
+        );
+        let hash = wait_for_chain_head_best_hash(
+            &mut follow,
+            "Asset Hub",
+            OPERATION_TIMEOUT,
+            BEST_BLOCK_TIMEOUT,
+        )
+        .await?;
+        Ok(Self {
+            chain,
+            follow,
+            genesis_hash,
+            follow_id,
             hash,
-            items: vec![StorageQueryItem {
-                key: key.clone(),
-                query_type: StorageQueryType::Value,
-            }],
-            child_trie: None,
         })
+    }
+}
+
+#[truapi_platform::async_trait]
+impl DotnsTransport for DotnsLookup<'_> {
+    /// Reads one storage value at the pinned block. `Ok(None)` when absent.
+    async fn storage(&mut self, key: Vec<u8>) -> Result<Option<Vec<u8>>, String> {
+        let response = self
+            .chain
+            .remote_chain_head_storage(RemoteChainHeadStorageRequest {
+                genesis_hash: self.genesis_hash.clone(),
+                follow_subscription_id: self.follow_id.clone(),
+                hash: self.hash.clone(),
+                items: vec![StorageQueryItem {
+                    key: key.clone(),
+                    query_type: StorageQueryType::Value,
+                }],
+                child_trie: None,
+            })
+            .await
+            .map_err(|failure| failure.reason())?;
+        let operation_id = started_operation_id(response.operation)?;
+        let value = wait_for_chain_head_storage_value(
+            &mut self.follow,
+            ChainHeadStorageValueLookup {
+                chain: self.chain,
+                genesis_hash: &self.genesis_hash,
+                follow_subscription_id: &self.follow_id,
+                operation_id: &operation_id,
+                key: &key,
+                label: "Asset Hub",
+                timeout: OPERATION_TIMEOUT,
+            },
+        )
+        .await?;
+        match value {
+            ChainHeadStorageValue::Found(value) => Ok(Some(value)),
+            ChainHeadStorageValue::Missing => Ok(None),
+            ChainHeadStorageValue::Inaccessible => {
+                Err("Asset Hub storage was inaccessible".to_string())
+            }
+        }
+    }
+
+    /// Dry-runs a contract view via `ReviveApi_call` at the pinned block and
+    /// returns its data.
+    ///
+    /// Views originate from the synthetic always-mapped account. They work
+    /// regardless of the queried account's revive mapping.
+    async fn view(&mut self, dest: &[u8; 20], input: Vec<u8>) -> Result<Vec<u8>, DotnsViewError> {
+        let response = self
+            .chain
+            .remote_chain_head_call(RemoteChainHeadCallRequest {
+                genesis_hash: self.genesis_hash.clone(),
+                follow_subscription_id: self.follow_id.clone(),
+                hash: self.hash.clone(),
+                function: "ReviveApi_call".to_string(),
+                call_parameters: encode_revive_call(&VIEW_CALL_ORIGIN, dest, &input),
+            })
+            .await
+            .map_err(|failure| DotnsViewError::Failed(failure.reason()))?;
+        let operation_id =
+            started_operation_id(response.operation).map_err(DotnsViewError::Failed)?;
+        let output = wait_for_chain_head_call_output(
+            &mut self.follow,
+            &operation_id,
+            "Asset Hub",
+            OPERATION_TIMEOUT,
+        )
         .await
-        .map_err(|failure| failure.reason())?;
-    let operation_id = match response.operation {
-        OperationStartedResult::Started { operation_id } => operation_id,
+        .map_err(DotnsViewError::Failed)?;
+        view_output(&output)
+    }
+}
+
+/// Unwraps a started operation id. `LimitReached` maps to an error.
+fn started_operation_id(operation: OperationStartedResult) -> Result<String, String> {
+    match operation {
+        OperationStartedResult::Started { operation_id } => Ok(operation_id),
         OperationStartedResult::LimitReached => {
-            return Err("People-chain storage lookup limit reached".to_string());
+            Err("Asset Hub operation limit reached".to_string())
         }
+    }
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod tests {
+    //! The in-core lookup drives every dotNS read over one `chainHead_v1`
+    //! follow. This scripts the Asset Hub node end of that follow: storage
+    //! items for the pallet keys and `ReviveApi_call` outputs for the contract
+    //! views, so the whole chain from follow to classified usernames runs
+    //! without a network.
+
+    use super::*;
+    use crate::chain_runtime::{RuntimeChainProvider, RuntimeFailure};
+    use crate::host_logic::dotns_gateway::{
+        account_to_h160, dispatcher_address_key, selector, timestamp_now_key,
     };
-    let value = wait_for_chain_head_storage_value(
-        &mut follow,
-        ChainHeadStorageValueLookup {
-            chain,
-            genesis_hash: &genesis_hash,
-            follow_subscription_id: &follow_id,
-            operation_id: &operation_id,
-            key: &key,
-            label: "People-chain",
-            timeout: LOOKUP_TIMEOUT,
-        },
-    )
-    .await?;
-    Ok(match value {
-        ChainHeadStorageValue::Found(value) => ConsumerRecordLookup::Found(value),
-        ChainHeadStorageValue::Missing => ConsumerRecordLookup::Missing,
-        ChainHeadStorageValue::Inaccessible => ConsumerRecordLookup::Inaccessible,
-    })
+    use crate::subscription::thread_per_subscription_spawner;
+    use async_trait::async_trait;
+    use futures::StreamExt;
+    use futures::channel::mpsc;
+    use parity_scale_codec::{Compact, Decode, Encode};
+    use serde_json::{Value as JsonValue, json};
+    use std::sync::{Arc, Mutex};
+    use truapi_platform::JsonRpcConnection;
+
+    const FOLLOW_ID: &str = "ah-follow";
+    const BEST_HASH: &str = "0x1111111111111111111111111111111111111111111111111111111111111111";
+    const DISPATCHER: [u8; 20] = [0xd1; 20];
+    const CONTROLLER: [u8; 20] = [0xc0; 20];
+    const REGISTRY: [u8; 20] = [0x9e; 20];
+    const FACTORY: [u8; 20] = [0xfa; 20];
+    const STORE: [u8; 20] = [0x57; 20];
+    const ACCOUNT: [u8; 32] = [0xaa; 32];
+
+    fn abi_word(value: u64) -> [u8; 32] {
+        let mut word = [0u8; 32];
+        word[24..].copy_from_slice(&value.to_be_bytes());
+        word
+    }
+
+    fn abi_address(address: &[u8; 20]) -> Vec<u8> {
+        let mut word = [0u8; 32];
+        word[12..].copy_from_slice(address);
+        word.to_vec()
+    }
+
+    /// ABI string tail: a length word plus padded bytes.
+    fn abi_string_tail(value: &str) -> Vec<u8> {
+        let mut out = abi_word(value.len() as u64).to_vec();
+        out.extend_from_slice(value.as_bytes());
+        out.resize(out.len().div_ceil(32) * 32, 0);
+        out
+    }
+
+    /// A single `string` return value.
+    fn abi_string(value: &str) -> Vec<u8> {
+        [abi_word(32).to_vec(), abi_string_tail(value)].concat()
+    }
+
+    /// A `string[]` return value.
+    fn abi_string_array(values: &[&str]) -> Vec<u8> {
+        let tails: Vec<Vec<u8>> = values.iter().map(|v| abi_string_tail(v)).collect();
+        let mut out = abi_word(32).to_vec();
+        out.extend_from_slice(&abi_word(values.len() as u64));
+        let mut offset = 32 * values.len();
+        for tail in &tails {
+            out.extend_from_slice(&abi_word(offset as u64));
+            offset += tail.len();
+        }
+        for tail in tails {
+            out.extend_from_slice(&tail);
+        }
+        out
+    }
+
+    /// A `(string label, uint64 mintedAt)[]` return value.
+    fn abi_pending_claims(claims: &[(&str, u64)]) -> Vec<u8> {
+        let structs: Vec<Vec<u8>> = claims
+            .iter()
+            .map(|(label, minted_at)| {
+                [
+                    abi_word(64).to_vec(),
+                    abi_word(*minted_at).to_vec(),
+                    abi_string_tail(label),
+                ]
+                .concat()
+            })
+            .collect();
+        let mut out = abi_word(32).to_vec();
+        out.extend_from_slice(&abi_word(claims.len() as u64));
+        let mut offset = 32 * claims.len();
+        for element in &structs {
+            out.extend_from_slice(&abi_word(offset as u64));
+            offset += element.len();
+        }
+        for element in structs {
+            out.extend_from_slice(&element);
+        }
+        out
+    }
+
+    /// Chain time the scripted `Timestamp.Now` reports, in seconds.
+    const NOW_SECS: u64 = 1_800_000_000;
+    /// The scripted controller's `reservationDuration()`.
+    const RESERVATION_DURATION: u64 = 604_800;
+
+    /// `ReviveApi_call` output carrying successful return `data`.
+    fn contract_result(data: &[u8]) -> Vec<u8> {
+        let mut out = Vec::new();
+        for _ in 0..4 {
+            Compact(7u64).encode_to(&mut out);
+        }
+        for _ in 0..2 {
+            (1u8, 0u128).encode_to(&mut out);
+        }
+        0u128.encode_to(&mut out);
+        out.push(0x00);
+        0u32.encode_to(&mut out);
+        data.encode_to(&mut out);
+        out
+    }
+
+    /// The scripted contract side: `(dest, selector)` → return data.
+    fn view_output(dest: &[u8; 20], input: &[u8]) -> Vec<u8> {
+        let sel: [u8; 4] = input[..4].try_into().unwrap();
+        let data = match (*dest, sel) {
+            (DISPATCHER, s) if s == selector("TARGET()") => abi_address(&CONTROLLER),
+            (CONTROLLER, s) if s == selector("pendingClaims(address)") => {
+                // The user argument is the mapped H160 of the identity account.
+                assert_eq!(&input[16..36], account_to_h160(&ACCOUNT));
+                // One live claim and one that lapsed a second ago.
+                abi_pending_claims(&[
+                    ("alice01", NOW_SECS - 10),
+                    ("stale01", NOW_SECS - RESERVATION_DURATION - 1),
+                ])
+            }
+            (CONTROLLER, s) if s == selector("reservationDuration()") => {
+                abi_word(RESERVATION_DURATION).to_vec()
+            }
+            (CONTROLLER, s) if s == selector("protocolRegistry()") => abi_address(&REGISTRY),
+            (REGISTRY, s) if s == selector("get(bytes32)") => abi_address(&FACTORY),
+            (REGISTRY, s) if s == selector("tld()") => abi_string(".paseo"),
+            (FACTORY, s) if s == selector("getLabelStore(address)") => {
+                assert_eq!(&input[16..36], account_to_h160(&ACCOUNT));
+                abi_address(&STORE)
+            }
+            (STORE, s) if s == selector("getLabels(uint256,uint256)") => {
+                abi_string_array(&["myproject.paseo", "app.myproject.paseo"])
+            }
+            (dest, sel) => panic!(
+                "unscripted view {} on 0x{}",
+                hex::encode(sel),
+                hex::encode(dest)
+            ),
+        };
+        contract_result(&data)
+    }
+
+    struct ScriptedAssetHub {
+        sent: Arc<Mutex<Vec<String>>>,
+        follow_with_runtime: Arc<Mutex<Option<bool>>>,
+        sender: Arc<Mutex<Option<mpsc::UnboundedSender<String>>>>,
+        receiver: Arc<Mutex<Option<mpsc::UnboundedReceiver<String>>>>,
+        next_operation: Arc<Mutex<u64>>,
+    }
+
+    impl ScriptedAssetHub {
+        fn new() -> Self {
+            let (sender, receiver) = mpsc::unbounded();
+            Self {
+                sent: Arc::new(Mutex::new(Vec::new())),
+                follow_with_runtime: Arc::new(Mutex::new(None)),
+                sender: Arc::new(Mutex::new(Some(sender))),
+                receiver: Arc::new(Mutex::new(Some(receiver))),
+                next_operation: Arc::new(Mutex::new(0)),
+            }
+        }
+
+        fn share(&self) -> Self {
+            Self {
+                sent: self.sent.clone(),
+                follow_with_runtime: self.follow_with_runtime.clone(),
+                sender: self.sender.clone(),
+                receiver: self.receiver.clone(),
+                next_operation: self.next_operation.clone(),
+            }
+        }
+
+        fn frames(&self, request: &str) -> Vec<String> {
+            let request: JsonValue = serde_json::from_str(request).unwrap();
+            let id = request.get("id").cloned().unwrap_or(JsonValue::Null);
+            let method = request["method"].as_str().unwrap();
+            let response = |result: JsonValue| {
+                json!({"jsonrpc": "2.0", "id": id, "result": result}).to_string()
+            };
+            let follow_event = |result: JsonValue| {
+                json!({
+                    "jsonrpc": "2.0",
+                    "method": "chainHead_v1_followEvent",
+                    "params": {"subscription": FOLLOW_ID, "result": result}
+                })
+                .to_string()
+            };
+            let mut next_operation = self.next_operation.lock().unwrap();
+            match method {
+                "chainHead_v1_follow" => {
+                    *self.follow_with_runtime.lock().unwrap() = request["params"][0].as_bool();
+                    vec![
+                        response(json!(FOLLOW_ID)),
+                        follow_event(json!({
+                            "event": "initialized",
+                            "finalizedBlockHashes": [BEST_HASH],
+                            "finalizedBlockRuntime": null
+                        })),
+                        follow_event(json!({
+                            "event": "bestBlockChanged",
+                            "bestBlockHash": BEST_HASH
+                        })),
+                    ]
+                }
+                "chainHead_v1_storage" => {
+                    *next_operation += 1;
+                    let operation_id = format!("storage-{}", *next_operation);
+                    let key = request["params"][2][0]["key"].as_str().unwrap();
+                    let key_bytes = hex::decode(key.trim_start_matches("0x")).unwrap();
+                    let mut frames = vec![response(
+                        json!({"result": "started", "operationId": operation_id}),
+                    )];
+                    if key_bytes == timestamp_now_key() {
+                        frames.push(follow_event(json!({
+                            "event": "operationStorageItems",
+                            "operationId": operation_id,
+                            "items": [{"key": key, "value": format!("0x{}", hex::encode((NOW_SECS * 1_000).to_le_bytes()))}]
+                        })));
+                    }
+                    if key_bytes == dispatcher_address_key() {
+                        frames.push(follow_event(json!({
+                            "event": "operationStorageItems",
+                            "operationId": operation_id,
+                            "items": [{"key": key, "value": format!("0x{}", hex::encode(DISPATCHER))}]
+                        })));
+                    }
+                    frames.push(follow_event(json!({
+                        "event": "operationStorageDone",
+                        "operationId": operation_id
+                    })));
+                    frames
+                }
+                "chainHead_v1_call" => {
+                    *next_operation += 1;
+                    let operation_id = format!("call-{}", *next_operation);
+                    assert_eq!(request["params"][2].as_str(), Some("ReviveApi_call"));
+                    let args = hex::decode(
+                        request["params"][3]
+                            .as_str()
+                            .unwrap()
+                            .trim_start_matches("0x"),
+                    )
+                    .unwrap();
+                    // origin[32] ‖ dest[20] ‖ value u128 ‖ None ‖ None ‖ Vec(input).
+                    assert_eq!(&args[..32], VIEW_CALL_ORIGIN.as_slice());
+                    assert_eq!(
+                        &args[52..70],
+                        &[0u8; 18],
+                        "zero value, no gas or deposit limit"
+                    );
+                    let dest: [u8; 20] = args[32..52].try_into().unwrap();
+                    let input = Vec::<u8>::decode(&mut &args[70..]).unwrap();
+                    vec![
+                        response(json!({"result": "started", "operationId": operation_id})),
+                        follow_event(json!({
+                            "event": "operationCallDone",
+                            "operationId": operation_id,
+                            "output": format!("0x{}", hex::encode(view_output(&dest, &input)))
+                        })),
+                    ]
+                }
+                "chainHead_v1_unpin" | "chainHead_v1_unfollow" => vec![response(JsonValue::Null)],
+                other => panic!("unscripted method {other}"),
+            }
+        }
+    }
+
+    struct ScriptedConnection {
+        provider: ScriptedAssetHub,
+        receiver: Mutex<Option<mpsc::UnboundedReceiver<String>>>,
+    }
+
+    impl JsonRpcConnection for ScriptedConnection {
+        fn send(&self, request: String) {
+            self.provider.sent.lock().unwrap().push(request.clone());
+            let frames = self.provider.frames(&request);
+            if let Some(sender) = self.provider.sender.lock().unwrap().as_ref() {
+                for frame in frames {
+                    sender.unbounded_send(frame).unwrap();
+                }
+            }
+        }
+
+        fn responses(&self) -> BoxStream<'static, String> {
+            self.receiver
+                .lock()
+                .unwrap()
+                .take()
+                .expect("responses called once")
+                .boxed()
+        }
+
+        fn close(&self) {
+            self.provider.sender.lock().unwrap().take();
+        }
+    }
+
+    #[async_trait]
+    impl RuntimeChainProvider for ScriptedAssetHub {
+        async fn connect(
+            &self,
+            _genesis_hash: Vec<u8>,
+        ) -> Result<Arc<dyn JsonRpcConnection>, RuntimeFailure> {
+            Ok(Arc::new(ScriptedConnection {
+                receiver: Mutex::new(self.receiver.lock().unwrap().take()),
+                provider: self.share(),
+            }))
+        }
+    }
+
+    #[test]
+    fn in_core_lookup_resolves_usernames_over_one_runtime_follow() {
+        let provider = Arc::new(ScriptedAssetHub::new());
+        let chain = ChainRuntime::new(provider.clone(), thread_per_subscription_spawner());
+        let session = SessionInfo {
+            public_key: [0x11; 32],
+            sso: None,
+            root_entropy_source: None,
+            identity_account_id: Some(ACCOUNT),
+            identity_chat_private_key: None,
+            device_enc_public_key: None,
+            lite_username: None,
+            full_username: None,
+        };
+
+        let resolved = futures::executor::block_on(resolve_session_identity_with_chain(
+            &chain, [0xcc; 32], session,
+        ));
+
+        // The pending claim yields the lite name; the settled store yields the
+        // full name with the network TLD stripped and the subname dropped.
+        assert_eq!(resolved.lite_username.as_deref(), Some("alice.01"));
+        assert_eq!(resolved.full_username.as_deref(), Some("myproject"));
+        // `chainHead_v1_call` is only served on follows opened with runtime.
+        assert_eq!(
+            *provider.follow_with_runtime.lock().unwrap(),
+            Some(true),
+            "the identity follow must be opened withRuntime=true or every view fails"
+        );
+        let calls = provider
+            .sent
+            .lock()
+            .unwrap()
+            .iter()
+            .filter(|request| request.contains("chainHead_v1_call"))
+            .count();
+        // TARGET, pendingClaims, reservationDuration, protocolRegistry,
+        // get(storeFactory), getLabelStore, tld, one short getLabels page.
+        assert_eq!(
+            calls, 8,
+            "the discovery and label chain is exactly eight views"
+        );
+    }
 }
diff --git a/rust/crates/truapi-server/src/runtime/pairing_host.rs b/rust/crates/truapi-server/src/runtime/pairing_host.rs
index 3a1e5e592..508def3bf 100644
--- a/rust/crates/truapi-server/src/runtime/pairing_host.rs
+++ b/rust/crates/truapi-server/src/runtime/pairing_host.rs
@@ -455,7 +455,7 @@ impl PairingHost {
         let activation_epoch = self.advance_session_lifecycle();
         let resolved = resolve_session_identity_with_chain(
             &self.chain,
-            self.host_config.people_chain_genesis_hash,
+            self.host_config.asset_hub_chain_genesis_hash,
             session,
         )
         .await;
@@ -524,7 +524,7 @@ impl PairingHost {
         };
         let resolved = resolve_session_identity_with_chain(
             &self.chain,
-            self.host_config.people_chain_genesis_hash,
+            self.host_config.asset_hub_chain_genesis_hash,
             session,
         )
         .await;
@@ -1206,13 +1206,13 @@ impl PairingHost {
 
     async fn refresh_current_session_identity(&self) -> Option<AuthoritySession> {
         let current = self.session_state.current()?;
-        if current.has_username() || self.host_config.people_chain_genesis_hash == [0; 32] {
+        if current.has_username() || self.host_config.asset_hub_chain_genesis_hash == [0; 32] {
             return Some(authority_session(&current));
         }
 
         let resolved = resolve_session_identity_with_chain(
             &self.chain,
-            self.host_config.people_chain_genesis_hash,
+            self.host_config.asset_hub_chain_genesis_hash,
             current.clone(),
         )
         .await;
diff --git a/rust/crates/truapi-server/src/runtime/sso_pairing.rs b/rust/crates/truapi-server/src/runtime/sso_pairing.rs
index cb2f64236..d5cb2eb64 100644
--- a/rust/crates/truapi-server/src/runtime/sso_pairing.rs
+++ b/rust/crates/truapi-server/src/runtime/sso_pairing.rs
@@ -242,7 +242,7 @@ impl<'a> SsoPairingFlow<'a> {
         };
         let resolve_session = resolve_session_identity_with_chain(
             &self.host.chain,
-            self.host.host_config.people_chain_genesis_hash,
+            self.host.host_config.asset_hub_chain_genesis_hash,
             session,
         )
         .fuse();
diff --git a/rust/crates/truapi-server/src/runtime/statement_allowance.rs b/rust/crates/truapi-server/src/runtime/statement_allowance.rs
index 4faabf9d4..8b7824400 100644
--- a/rust/crates/truapi-server/src/runtime/statement_allowance.rs
+++ b/rust/crates/truapi-server/src/runtime/statement_allowance.rs
@@ -213,6 +213,7 @@ pub async fn fetch_chain_state(rpc: &RpcClient) -> Result<ChainState, StatementA
         transaction_version,
         genesis_hash,
         nonce: 0,
+        restrict_origins: false,
     })
 }
 
@@ -317,6 +318,7 @@ impl ChainContextCache {
                 transaction_version,
                 genesis_hash,
                 nonce: 0,
+                restrict_origins: false,
             },
         };
         self.entries
@@ -1602,6 +1604,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         let ring = RingParams {
@@ -1686,6 +1689,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let memberships = pooled_memberships();
         let candidates = pooled_candidates();
@@ -1726,6 +1730,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let memberships = pooled_memberships();
         let candidates = pooled_candidates();
@@ -2228,6 +2233,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         let ring = RingParams {
@@ -2286,6 +2292,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         let ring = RingParams {
@@ -2342,6 +2349,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         let ring = RingParams {
@@ -2391,6 +2399,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         let ring = RingParams {
diff --git a/rust/crates/truapi-server/src/runtime/statement_allowance/extension.rs b/rust/crates/truapi-server/src/runtime/statement_allowance/extension.rs
index 2ed01cb82..1153cc2a5 100644
--- a/rust/crates/truapi-server/src/runtime/statement_allowance/extension.rs
+++ b/rust/crates/truapi-server/src/runtime/statement_allowance/extension.rs
@@ -31,6 +31,10 @@ pub const AS_PGAS: &str = "AsPgas";
 /// Signed-extension identifier that carries the `AsResources` authorization.
 pub const AS_RESOURCES: &str = "AsResources";
 
+/// Signed-extension identifier that carries the `AsDotnsGateway`
+/// authorization on Asset Hub.
+pub const AS_DOTNS_GATEWAY: &str = "AsDotnsGateway";
+
 /// Error while decoding runtime metadata or resolving allowance-specific
 /// metadata entries.
 #[derive(Debug, Error)]
@@ -87,6 +91,15 @@ pub enum MetadataError {
         /// Variant name.
         variant: String,
     },
+    /// `AsDotnsGatewayInfo::RegisterFullName` did not have the expected field shape.
+    #[error(
+        "AsDotnsGatewayInfo::RegisterFullName fields are [{actual}], expected \
+         [proof, ring_index, revision, signature]; the runtime shape drifted"
+    )]
+    RegisterFullNameShapeDrift {
+        /// Actual comma-separated field names.
+        actual: String,
+    },
     /// Info variant carried no enum field holding the requested variant.
     #[error(
         "{identifier} info variant {variant} carries no field enum with a {field_variant} variant"
@@ -154,6 +167,11 @@ pub struct ChainState {
     pub genesis_hash: [u8; 32],
     /// Account nonce (CheckNonce extra); ignored by the unsigned path.
     pub nonce: u32,
+    /// `RestrictOrigins` extra value. `false` for statement-store allowance
+    /// calls on People. `true` for restricted-origin dotNS gateway registrations
+    /// on Asset Hub. It is part of both the signed digest and the extrinsic
+    /// body, so it lives here to keep the two in lockstep.
+    pub restrict_origins: bool,
 }
 
 /// A signed extension's identifier plus the type ids of its `extra` and
@@ -550,6 +568,28 @@ impl Metadata {
         Ok(self.extension_info_variant(identifier, variant)?.index)
     }
 
+    /// Resolve `AsDotnsGatewayInfo::RegisterFullName` to its variant index.
+    ///
+    /// Asserts the exact `{proof, ring_index, revision, signature}` field shape
+    /// (the People-collection root revision the proof was built against). A
+    /// runtime that changes the variant then fails loudly instead of
+    /// mis-encoding.
+    pub fn dotns_register_full_name_variant(&self) -> Result<u8, StatementAllowanceError> {
+        let variant = self.extension_info_variant(AS_DOTNS_GATEWAY, "RegisterFullName")?;
+        let fields: Vec<&str> = variant
+            .fields
+            .iter()
+            .map(|field| field.name.as_deref().unwrap_or("<unnamed>"))
+            .collect();
+        if fields != ["proof", "ring_index", "revision", "signature"] {
+            return Err(MetadataError::RegisterFullNameShapeDrift {
+                actual: fields.join(", "),
+            }
+            .into());
+        }
+        Ok(variant.index)
+    }
+
     /// Resolve one named authorization variant on an extension shaped as
     /// `Wrapper(Option<Info>)`, with or without the struct wrapper.
     fn extension_info_variant(
@@ -667,8 +707,8 @@ impl Metadata {
             "VerifyMultiSignature" => (vec![0x00], Vec::new()),
             // extra = { tip: compact(0), asset_id: None } = 0x00 0x00.
             "ChargeAssetTxPayment" => (vec![0x00, 0x00], Vec::new()),
-            // extra = bool false = 0x00.
-            "RestrictOrigins" => (vec![0x00], Vec::new()),
+            // extra = bool. See `ChainState::restrict_origins`.
+            "RestrictOrigins" => (vec![state.restrict_origins as u8], Vec::new()),
             _ => (
                 self.encode_default(ext.extra_type),
                 self.encode_default(ext.additional_signed_type),
@@ -805,6 +845,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         }
     }
 
@@ -1177,6 +1218,59 @@ mod tests {
         );
     }
 
+    /// Asset Hub fixture metadata (V16, spec 2000036; previewnet serves the
+    /// same runtime). The dotNS gateway flows are validated against it.
+    const AH_FIXTURE: &[u8] =
+        include_bytes!("../../../tests/fixtures/paseo-next-asset-hub-metadata.scale");
+
+    #[test]
+    fn dotns_gateway_pipeline_matches_the_reference_transaction_layout() {
+        let metadata = Metadata::decode(AH_FIXTURE).unwrap();
+        let state = ChainState {
+            restrict_origins: true,
+            ..fixture_state()
+        };
+
+        // RegisterFullName resolves with the asserted field shape.
+        assert_eq!(metadata.dotns_register_full_name_variant().unwrap(), 0);
+        assert!(
+            metadata
+                .call_indices("DotnsGateway", "register_name")
+                .is_ok()
+        );
+
+        // The extension tail after AsDotnsGateway encodes exactly the bytes the
+        // reference implementation registerTx.ts hand-builds. Extras are
+        // RestrictOrigin(true) ‖ CheckEra(Immortal) ‖ CheckNonce(0) ‖
+        // ChargePGAS(tip 0, asset None) ‖ CheckMetadataHash(Disabled). The
+        // implicit half is specVersion ‖ txVersion ‖ genesis ‖ genesis ‖
+        // metadata-hash None.
+        let all = metadata.encode_signed_extensions(&state);
+        let tail_start = metadata.extension_index(AS_DOTNS_GATEWAY).unwrap() + 1;
+        let tail = &all[tail_start..];
+        let extras: Vec<u8> = tail.iter().flat_map(|e| e.extra.clone()).collect();
+        assert_eq!(
+            hex::encode(extras),
+            "010000000000",
+            "tail extras: RestrictOrigin true, era, nonce, tip, asset, metadata hash"
+        );
+        let implicit: Vec<u8> = tail
+            .iter()
+            .flat_map(|e| e.additional_signed.clone())
+            .collect();
+        assert_eq!(
+            implicit,
+            [
+                state.spec_version.to_le_bytes().to_vec(),
+                state.transaction_version.to_le_bytes().to_vec(),
+                state.genesis_hash.to_vec(),
+                state.genesis_hash.to_vec(),
+                vec![0x00],
+            ]
+            .concat()
+        );
+    }
+
     #[test]
     fn dropping_the_version_byte_changes_the_hash() {
         let metadata = Metadata::decode(FIXTURE).unwrap();
diff --git a/rust/crates/truapi-server/src/runtime/statement_allowance/extrinsic.rs b/rust/crates/truapi-server/src/runtime/statement_allowance/extrinsic.rs
index 48a287f8e..56ab1e4f5 100644
--- a/rust/crates/truapi-server/src/runtime/statement_allowance/extrinsic.rs
+++ b/rust/crates/truapi-server/src/runtime/statement_allowance/extrinsic.rs
@@ -272,6 +272,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         }
     }
 
diff --git a/rust/crates/truapi-server/src/runtime/statement_allowance/renewal.rs b/rust/crates/truapi-server/src/runtime/statement_allowance/renewal.rs
index fcfa8898a..befe31196 100644
--- a/rust/crates/truapi-server/src/runtime/statement_allowance/renewal.rs
+++ b/rust/crates/truapi-server/src/runtime/statement_allowance/renewal.rs
@@ -363,6 +363,7 @@ mod tests {
             transaction_version: 1,
             genesis_hash: [0xab; 32],
             nonce: 0,
+            restrict_origins: false,
         };
         let entropy = [0x11; 32];
         // One collection, so this stays a test of cross-target protection rather
diff --git a/rust/crates/truapi-server/src/runtime/statement_allowance/ring.rs b/rust/crates/truapi-server/src/runtime/statement_allowance/ring.rs
index fed9eb229..534f08c59 100644
--- a/rust/crates/truapi-server/src/runtime/statement_allowance/ring.rs
+++ b/rust/crates/truapi-server/src/runtime/statement_allowance/ring.rs
@@ -48,6 +48,18 @@ pub enum RingError {
     /// Ring status included field failed to decode.
     #[error("ring status: {0}")]
     RingStatus(#[source] parity_scale_codec::Error),
+    /// Member has no `Members.Members` record for the collection.
+    #[error("member has no Members.Members record for the collection")]
+    MemberRecordMissing,
+    /// Member is not included in a ring yet.
+    #[error("member is not included in a ring (status: {status})")]
+    MemberNotIncluded {
+        /// Onboarding or suspended.
+        status: &'static str,
+    },
+    /// Subscriber ring exponent was absent for the collection.
+    #[error("MembersSubscriber.RingCollectionExponents missing for the collection")]
+    SubscriberExponentMissing,
 }
 
 /// Ring member public key length.
@@ -158,6 +170,29 @@ fn ring_keys_key(collection: PersonhoodCollection, ring_index: u32, page: u32) -
     .concat()
 }
 
+/// `Members.Members[(id, member)]` storage key.
+/// The hashers are `Identity` then `Blake2_128Concat`.
+fn member_record_key(collection: PersonhoodCollection, member: &[u8; 32]) -> Vec<u8> {
+    [
+        twox_128(b"Members").as_slice(),
+        twox_128(b"Members").as_slice(),
+        collection.identifier().as_slice(),
+        &blake2_128_concat(member),
+    ]
+    .concat()
+}
+
+/// `MembersSubscriber.RingCollectionExponents[id]` storage key.
+/// It lives on the subscriber chain, Asset Hub.
+fn subscriber_exponent_key(collection: PersonhoodCollection) -> Vec<u8> {
+    [
+        twox_128(b"MembersSubscriber").as_slice(),
+        twox_128(b"RingCollectionExponents").as_slice(),
+        &blake2_128_concat(collection.identifier()),
+    ]
+    .concat()
+}
+
 /// `Blake2_128Concat(x)` = `blake2_128(x) ‖ x`.
 pub(super) fn blake2_128_concat(x: &[u8]) -> Vec<u8> {
     [blake2_128(x).as_slice(), x].concat()
@@ -277,6 +312,91 @@ pub async fn read_ring_members_at(
     Ok(members)
 }
 
+/// Ring coordinates of one member. Projected from the runtime's `RingPosition`
+/// enum.
+#[derive(Debug, PartialEq, Eq, DecodeAsType)]
+enum MemberRingPosition {
+    /// Waiting in the onboarding queue.
+    Onboarding {},
+    /// Included in a built ring.
+    Included { ring_index: u32 },
+    /// Suspended from all rings.
+    Suspended,
+}
+
+/// Reads the ring index `member` is included in for `collection`, from
+/// `Members.Members`, pinned to block `at`. Errors when the member has no
+/// record. Errors too when the member is not `Included` yet.
+///
+/// TODO(#334): second reader of `Members.Members` next to the subxt-typed one
+/// in `signing_host/ring_vrf.rs`; converge them (they also differ on
+/// non-`Included` members — this errors, that one skips).
+pub async fn read_member_ring_index_at(
+    rpc: &RpcClient,
+    metadata: &Metadata,
+    collection: PersonhoodCollection,
+    member: &[u8; 32],
+    at: &str,
+) -> Result<u32, StatementAllowanceError> {
+    let value = rpc
+        .get_storage_at(&member_record_key(collection, member), at)
+        .await?
+        .ok_or(RingError::MemberRecordMissing)?;
+    let value_type = metadata.storage_value_type("Members", "Members").ok_or(
+        MetadataError::MissingStorageType {
+            pallet: "Members",
+            entry: "Members",
+        },
+    )?;
+    let mut input = value.as_slice();
+    let position = MemberRingPosition::decode_as_type(&mut input, value_type, metadata.registry())
+        .map_err(|err| RingError::DecodeAsType {
+            context: "Members.Members",
+            source: err,
+        })?;
+    match position {
+        MemberRingPosition::Included { ring_index, .. } => Ok(ring_index),
+        MemberRingPosition::Onboarding {} => Err(RingError::MemberNotIncluded {
+            status: "onboarding",
+        }
+        .into()),
+        MemberRingPosition::Suspended => Err(RingError::MemberNotIncluded {
+            status: "suspended",
+        }
+        .into()),
+    }
+}
+
+/// Reads the ring exponent the subscriber chain, Asset Hub, verifies
+/// `collection` against. The source is
+/// `MembersSubscriber.RingCollectionExponents` at the current best block.
+pub async fn read_subscriber_ring_exponent(
+    rpc: &RpcClient,
+    metadata: &Metadata,
+    collection: PersonhoodCollection,
+) -> Result<u8, StatementAllowanceError> {
+    let value = rpc
+        .get_storage(&subscriber_exponent_key(collection))
+        .await?
+        .ok_or(RingError::SubscriberExponentMissing)?;
+    let value_type = metadata
+        .storage_value_type("MembersSubscriber", "RingCollectionExponents")
+        .ok_or(MetadataError::MissingStorageType {
+            pallet: "MembersSubscriber",
+            entry: "RingCollectionExponents",
+        })?;
+    let mut input = value.as_slice();
+    RingExponent::decode_as_type(&mut input, value_type, metadata.registry())
+        .map(RingExponent::exponent)
+        .map_err(|err| {
+            RingError::DecodeAsType {
+                context: "MembersSubscriber.RingCollectionExponents",
+                source: err,
+            }
+            .into()
+        })
+}
+
 /// Read `Members.Root[collection][ring_index].revision` pinned to block `at`
 /// (absent => 0).
 pub async fn read_ring_revision(
@@ -385,6 +505,42 @@ mod tests {
         // from the projection and variant-name decoding is exercised.
         let _ = SourceRingExponent::R2e14;
         let _ = SourceRingExponent::R2e9;
+
+        // `Members.Members` value: the runtime's `RingPosition`, of which only
+        // `Included.ring_index` is read.
+        #[allow(dead_code)]
+        #[derive(Encode, TypeInfo)]
+        enum SourceRingPosition {
+            Onboarding {
+                queue_page: u32,
+                queued_at: u64,
+            },
+            Included {
+                ring_index: u32,
+                ring_page: u32,
+                ring_position: u32,
+            },
+            Suspended,
+        }
+        assert_eq!(
+            decode_as::<_, MemberRingPosition>(SourceRingPosition::Included {
+                ring_index: 7,
+                ring_page: 2,
+                ring_position: 300,
+            }),
+            MemberRingPosition::Included { ring_index: 7 }
+        );
+        assert_eq!(
+            decode_as::<_, MemberRingPosition>(SourceRingPosition::Onboarding {
+                queue_page: 1,
+                queued_at: 99,
+            }),
+            MemberRingPosition::Onboarding {}
+        );
+        assert_eq!(
+            decode_as::<_, MemberRingPosition>(SourceRingPosition::Suspended),
+            MemberRingPosition::Suspended
+        );
     }
 
     #[test]
diff --git a/rust/crates/truapi-server/src/test_support.rs b/rust/crates/truapi-server/src/test_support.rs
index af42352dc..e789508ed 100644
--- a/rust/crates/truapi-server/src/test_support.rs
+++ b/rust/crates/truapi-server/src/test_support.rs
@@ -208,6 +208,7 @@ pub(crate) fn runtime_config(product_id: &str) -> (PairingHostConfig, ProductCon
             PlatformInfo::default(),
             [0; 32],
             [0xbb; 32],
+            [0xcc; 32],
             "polkadotapp".to_string(),
         )
         .expect("test host runtime config is valid"),
diff --git a/rust/crates/truapi-server/src/wasm.rs b/rust/crates/truapi-server/src/wasm.rs
index 9c090ae77..364654d88 100644
--- a/rust/crates/truapi-server/src/wasm.rs
+++ b/rust/crates/truapi-server/src/wasm.rs
@@ -465,6 +465,7 @@ fn pairing_host_config_from_js(value: &JsValue) -> Result<PairingHostConfig, JsV
     let platform = get_optional_object(value, "platform", "runtimeConfig.platform")?;
     let people = get_required_object(value, "people", "runtimeConfig.people")?;
     let bulletin = get_required_object(value, "bulletin", "runtimeConfig.bulletin")?;
+    let asset_hub = get_required_object(value, "assetHub", "runtimeConfig.assetHub")?;
     let pairing = get_required_object(value, "pairing", "runtimeConfig.pairing")?;
 
     PairingHostConfig::new(
@@ -491,6 +492,11 @@ fn pairing_host_config_from_js(value: &JsValue) -> Result<PairingHostConfig, JsV
             "genesisHash",
             "runtimeConfig.bulletin.genesisHash",
         )?,
+        get_required_bytes32_at(
+            &asset_hub,
+            "genesisHash",
+            "runtimeConfig.assetHub.genesisHash",
+        )?,
         get_required_string_at(
             &pairing,
             "deeplinkScheme",
@@ -568,6 +574,7 @@ fn runtime_config_field_to_js(field: &str) -> &str {
         "pairing_deeplink_scheme" => "pairing.deeplinkScheme",
         "people_chain_genesis_hash" => "people.genesisHash",
         "bulletin_chain_genesis_hash" => "bulletin.genesisHash",
+        "asset_hub_chain_genesis_hash" => "assetHub.genesisHash",
         other => other,
     }
 }
diff --git a/rust/crates/truapi-server/tests/common/mod.rs b/rust/crates/truapi-server/tests/common/mod.rs
index 78c30a95c..a1c30b6d2 100644
--- a/rust/crates/truapi-server/tests/common/mod.rs
+++ b/rust/crates/truapi-server/tests/common/mod.rs
@@ -58,6 +58,7 @@ pub fn test_runtime_config() -> (PairingHostConfig, ProductContext) {
             PlatformInfo::default(),
             [0xa2; 32],
             [0xbb; 32],
+            [0xcc; 32],
             "polkadotapp".to_string(),
         )
         .expect("test host runtime config is valid"),
diff --git a/rust/crates/truapi-server/tests/wasm_crypto_vectors.rs b/rust/crates/truapi-server/tests/wasm_crypto_vectors.rs
index 2f1756b6c..37b849362 100644
--- a/rust/crates/truapi-server/tests/wasm_crypto_vectors.rs
+++ b/rust/crates/truapi-server/tests/wasm_crypto_vectors.rs
@@ -53,6 +53,7 @@ fn runtime_config() -> PairingHostConfig {
         },
         [0xa2; 32],
         [0xbb; 32],
+        [0xcc; 32],
         "polkadotapp".to_string(),
     )
     .expect("test runtime config is valid")
diff --git a/rust/crates/truapi/src/lib.rs b/rust/crates/truapi/src/lib.rs
index 6876c08a1..826ee1d97 100644
--- a/rust/crates/truapi/src/lib.rs
+++ b/rust/crates/truapi/src/lib.rs
@@ -169,6 +169,8 @@ pub mod latest {
     pub type PreimageSubmitError = LatestOf<versioned::preimage::RemotePreimageSubmitError>;
     /// Transaction creation payload for a product account.
     pub type ProductAccountTxPayload = LatestOf<versioned::signing::HostCreateTransactionRequest>;
+    /// Chain-head runtime-API call request.
+    pub type RemoteChainHeadCallRequest = LatestOf<versioned::chain::RemoteChainHeadCallRequest>;
     /// Chain-head subscription item.
     pub type RemoteChainHeadFollowItem = LatestOf<versioned::chain::RemoteChainHeadFollowItem>;
     /// Chain-identifier resolution error.