From b40969683ad809e3dda84e940d942855c1eb06ea Mon Sep 17 00:00:00 2001
From: Siphamandla Mjoli <siphamandla@parity.io>
Date: Mon, 10 Aug 2026 21:46:30 +0200
Subject: [PATCH 1/2] feat: make the TLD network-configurable via the protocol
 registry

The TLD was a compile-time constant in DotnsConstants, so every network
rendered names as `<label>.dot` and testnets were indistinguishable from
mainnet.

Move the TLD onto DotnsProtocolRegistry as the single on-chain authority.
`initialize` takes a bare TLD label, derives the TLD node and suffix, and
exposes `tldNode()` and `tld()`. Every consumer reads them live rather than
compiling in a constant, so LabelUtils no longer folds a fixed node and the
`TLD`/`DOT_NODE` constants are removed. The deploy pipeline sources the label
from the `DOTNS_TLD` env var (default `dot`), keyed off the operator rather
than the chain id since networks can share one chain id.
---
 contracts/escrow/DotnsNameEscrow.sol          |  4 +-
 contracts/escrow/IDotnsNameEscrow.sol         |  2 +-
 contracts/registrars/DotnsPopController.sol   | 12 ++--
 contracts/registrars/DotnsRegistrar.sol       |  6 +-
 .../registrars/DotnsRegistrarController.sol   | 12 ++--
 .../registrars/IDotnsRegistrarController.sol  |  2 +-
 contracts/registry/DotnsProtocolRegistry.sol  | 41 ++++++++++--
 contracts/registry/DotnsRegistry.sol          | 12 ++--
 contracts/registry/IDotnsProtocolRegistry.sol | 15 ++++-
 contracts/registry/IDotnsRegistry.sol         |  4 +-
 contracts/resolvers/DotnsReverseResolver.sol  | 12 ++--
 contracts/resolvers/IDotnsReverseResolver.sol |  4 +-
 contracts/utils/DotnsConstants.sol            | 18 ++----
 contracts/utils/LabelUtils.sol                | 63 +++++++++----------
 contracts/utils/RegistrationUtils.sol         |  2 +-
 scripts/deploy/BaseDeployer.s.sol             | 10 +++
 scripts/deploy/DeployCore.s.sol               |  2 +-
 scripts/deploy/DotnsDeployer.s.sol            |  2 +-
 test/base/BaseDotns.t.sol                     | 50 +++++++++------
 .../registrar/DotnsPopControllerFuzz.t.sol    |  3 +-
 .../registry/DotnsProtocolRegistryFuzz.t.sol  | 25 +++++++-
 test/intergration/PopLifecycleFlow.t.sol      | 11 ++--
 .../DotnsPopControllerInvariant.t.sol         |  3 +-
 .../DotnsRegistrarControllerInvariant.t.sol   |  3 +-
 .../registrar/PopControllerHandler.t.sol      | 24 ++++---
 .../RegistrarControllerHandler.t.sol          | 16 +++--
 .../registry/DotnsRegistryInvariant.t.sol     |  9 ++-
 test/invariant/registry/RegistryHandler.t.sol | 17 +++--
 .../unit/deploy/DeterministicDeployment.t.sol | 10 +--
 test/unit/registrar/DotnsPopController.t.sol  | 21 ++++---
 30 files changed, 260 insertions(+), 155 deletions(-)

diff --git a/contracts/escrow/DotnsNameEscrow.sol b/contracts/escrow/DotnsNameEscrow.sol
index e7cd5071..cc9e5102 100644
--- a/contracts/escrow/DotnsNameEscrow.sol
+++ b/contracts/escrow/DotnsNameEscrow.sol
@@ -17,8 +17,8 @@ import {IDotnsProtocolRegistry} from "../registry/IDotnsProtocolRegistry.sol";
 import {DotnsConstants} from "../utils/DotnsConstants.sol";
 
 /// @title Dotns Name Escrow
-/// @notice Holds refundable deposits for .dot names and manages the release/reclaim lifecycle.
-/// @custom:security-contact admin@parity.io
+/// @notice Holds refundable deposits for registered names and manages the release/reclaim
+/// lifecycle. @custom:security-contact admin@parity.io
 contract DotnsNameEscrow is
     Initializable,
     UUPSUpgradeable,
diff --git a/contracts/escrow/IDotnsNameEscrow.sol b/contracts/escrow/IDotnsNameEscrow.sol
index 77e88af2..69623dc2 100644
--- a/contracts/escrow/IDotnsNameEscrow.sol
+++ b/contracts/escrow/IDotnsNameEscrow.sol
@@ -2,7 +2,7 @@
 pragma solidity ^0.8.34;
 
 /// @title Dotns Name Escrow Interface
-/// @notice Escrows refundable deposits for .dot registrations and manages the release lifecycle.
+/// @notice Escrows refundable deposits for registered names and manages the release lifecycle.
 /// @custom:security-contact admin@parity.io
 interface IDotnsNameEscrow {
     /// @notice Parameters for recording a deposit position.
diff --git a/contracts/registrars/DotnsPopController.sol b/contracts/registrars/DotnsPopController.sol
index 444a6fb2..7baf162d 100644
--- a/contracts/registrars/DotnsPopController.sol
+++ b/contracts/registrars/DotnsPopController.sol
@@ -430,7 +430,7 @@ contract DotnsPopController is
         returns (address)
     {
         bytes32 labelhash = LabelUtils.labelhashMemory(label);
-        bytes32 node = LabelUtils.namehash(labelhash);
+        bytes32 node = LabelUtils.namehashUnder(protocolRegistry.tldNode(), labelhash);
         if (store == address(0)) {
             store = factory.deployLabelStoreFor(user);
         }
@@ -651,7 +651,7 @@ contract DotnsPopController is
     /// @param label Bare DNS label (no TLD); the TLD is appended on write.
     function _writeRecord(address store, bytes32 node, string memory label) internal {
         if (ILabelStore(store).isLocked(node)) return;
-        ILabelStore(store).storeLabel(node, string.concat(label, DotnsConstants.TLD));
+        ILabelStore(store).storeLabel(node, string.concat(label, protocolRegistry.tld()));
     }
 
     /// @notice Appends a deferred binding for `user` and adds them to the enumeration set.
@@ -796,22 +796,22 @@ contract DotnsPopController is
     /// @notice Validates a lite-person `NAMEXX` label and derives `(labelhash, node)`.
     function _validateLiteLabel(string memory liteLabel)
         internal
-        pure
+        view
         returns (bytes32 labelhash, bytes32 node)
     {
         require(liteLabel.isLitePersonLabelMemory(), InvalidLiteLabel());
         labelhash = LabelUtils.labelhashMemory(liteLabel);
-        node = LabelUtils.namehash(labelhash);
+        node = LabelUtils.namehashUnder(protocolRegistry.tldNode(), labelhash);
     }
 
     /// @notice Validates a base (full-person) DNS label and derives `(labelhash, node)`.
     function _validateBaseLabel(string calldata baseLabel)
         internal
-        pure
+        view
         returns (bytes32 labelhash, bytes32 node)
     {
         require(baseLabel.isSingleLabel(), InvalidBaseLabel());
-        (labelhash, node) = LabelUtils.deriveNode(baseLabel);
+        (labelhash, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), baseLabel);
     }
 
     /// @notice Reverts when a non-empty chat key is not exactly `CHAT_KEY_LENGTH` bytes.
diff --git a/contracts/registrars/DotnsRegistrar.sol b/contracts/registrars/DotnsRegistrar.sol
index 11b0069e..521a2e5a 100644
--- a/contracts/registrars/DotnsRegistrar.sol
+++ b/contracts/registrars/DotnsRegistrar.sol
@@ -136,7 +136,7 @@ contract DotnsRegistrar is
     function labelOf(uint256 tokenId) external view override returns (string memory) {
         address holder = _ownerOf(tokenId);
         if (holder == address(0)) return "";
-        return LabelUtils.stripDotTld(_readLabel(tokenId, holder));
+        return LabelUtils.stripTld(protocolRegistry.tld(), _readLabel(tokenId, holder));
     }
 
     /// @inheritdoc IDotnsRegistrar
@@ -352,7 +352,7 @@ contract DotnsRegistrar is
     /// the registry would have already broken every other call site).
     function _writeOwnerLabel(address owner, uint256 tokenId, string calldata label) private {
         _storeFactory()
-            .writeLabel(owner, bytes32(tokenId), string.concat(label, DotnsConstants.TLD));
+            .writeLabel(owner, bytes32(tokenId), string.concat(label, protocolRegistry.tld()));
     }
 
     /// @notice Quotes the friction fee required for a transfer.
@@ -404,7 +404,7 @@ contract DotnsRegistrar is
         // No label means there is no label-derived price to charge against; treat as a zero-fee
         // move (typical of gateway-cold PoP mints that have not yet claimed a `LabelStore`).
         if (bytes(fullName).length == 0) return (0, 0);
-        string memory label = LabelUtils.stripDotTld(fullName);
+        string memory label = LabelUtils.stripTld(registry.tld(), fullName);
         if (bytes(label).length == 0) return (0, 0);
 
         reachFloor =
diff --git a/contracts/registrars/DotnsRegistrarController.sol b/contracts/registrars/DotnsRegistrarController.sol
index d5fade58..9a56f6e0 100644
--- a/contracts/registrars/DotnsRegistrarController.sol
+++ b/contracts/registrars/DotnsRegistrarController.sol
@@ -22,12 +22,12 @@ import {RegistrationUtils} from "../utils/RegistrationUtils.sol";
 import {StoreUtils} from "../utils/StoreUtils.sol";
 
 /// @title Dotns Registrar Controller
-/// @notice Allocates .dot labels using a commit reveal scheme.
+/// @notice Allocates top-level labels using a commit reveal scheme.
 /// @dev Orchestrates allocation, PoP validation, pricing enforcement, forward registry
 /// wiring, default reverse resolution, and immutable store writing.
 ///
 /// Tokenisation: the minted ERC721 tokenId is `uint256(node)`, where
-/// `node = namehash(DOT_NODE, labelhash)`. The registry stores a sentinel owner
+/// `node = namehash(tldNode, labelhash)`. The registry stores a sentinel owner
 /// (`address(0)`) for tokenised nodes and derives ownership from the ERC721 registrar for
 /// authorisation.
 /// @custom:security-contact admin@parity.io
@@ -324,12 +324,12 @@ contract DotnsRegistrarController is
     /// the policy minimum" from "shape-valid but already minted".
     function _validatedLabelNode(string calldata label)
         internal
-        pure
+        view
         returns (bytes32 labelhash, bytes32 node)
     {
         require(label.isSingleLabel(), InvalidLabel());
         require(bytes(label).length >= 3, LabelTooShort(label));
-        (labelhash, node) = LabelUtils.deriveNode(label);
+        (labelhash, node) = LabelUtils.deriveNode(protocolRegistry.tldNode(), label);
     }
 
     function _requireAvailableLabel(string calldata label)
@@ -395,13 +395,13 @@ contract DotnsRegistrarController is
             // @custom:function register) so the registry's `ownerOf` check sees the new holder.
             IStoreFactory factory =
                 IStoreFactory(protocolRegistry.get(DotnsConstants.STORE_FACTORY));
-            string memory fullName = string.concat(registration.label, DotnsConstants.TLD);
+            string memory fullName = string.concat(registration.label, protocolRegistry.tld());
             labelStore = factory.writeLabel(registration.owner, node, fullName);
         }
 
         if (setReverseRecord) {
             reverse.setReverseName(
-                registration.owner, string.concat(registration.label, DotnsConstants.TLD)
+                registration.owner, string.concat(registration.label, protocolRegistry.tld())
             );
         }
 
diff --git a/contracts/registrars/IDotnsRegistrarController.sol b/contracts/registrars/IDotnsRegistrarController.sol
index 7bd1121d..dacaf6d8 100644
--- a/contracts/registrars/IDotnsRegistrarController.sol
+++ b/contracts/registrars/IDotnsRegistrarController.sol
@@ -5,7 +5,7 @@ import {IDotnsController} from "./IDotnsController.sol";
 import {IPopRules} from "../pop/IPopRules.sol";
 
 /// @title Dotns Registrar Controller
-/// @notice Interface for registering .dot labels using a commit reveal scheme.
+/// @notice Interface for registering top-level labels using a commit reveal scheme.
 /// @dev Defines allocation only; forward resolution, reverse lookup, pricing mechanics, PoP
 /// validation, and store writing are handled by external contracts. Users commit a hash of
 /// registration parameters and, after a minimum delay, reveal the same parameters to register.
diff --git a/contracts/registry/DotnsProtocolRegistry.sol b/contracts/registry/DotnsProtocolRegistry.sol
index 46dd697f..3d08753f 100644
--- a/contracts/registry/DotnsProtocolRegistry.sol
+++ b/contracts/registry/DotnsProtocolRegistry.sol
@@ -8,13 +8,18 @@ import {
 } from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 
 import {IDotnsProtocolRegistry} from "./IDotnsProtocolRegistry.sol";
+import {LabelUtils} from "../utils/LabelUtils.sol";
+import {StringUtils} from "../utils/StringUtils.sol";
 
 /// @title Dotns Protocol Registry
 /// @author Parity
-/// @notice Upgradeable address registry for all DotNS protocol contracts.
+/// @notice Upgradeable address registry for all DotNS protocol contracts, and the authority for
+///         the network's top-level domain.
 /// @dev Single source of truth for sibling-contract lookups. All siblings resolve each other via
 ///      well-known `bytes32` constants in `DotnsConstants` rather than holding direct addresses,
-///      so an upgrade or rewire only mutates this contract.
+///      so an upgrade or rewire only mutates this contract. The TLD node and suffix are set once
+///      at initialisation and read live by every consumer, so a network runs one TLD without
+///      recompiling its contracts.
 /// @custom:security-contact admin@parity.io
 contract DotnsProtocolRegistry is
     Initializable,
@@ -22,6 +27,8 @@ contract DotnsProtocolRegistry is
     OwnableUpgradeable,
     IDotnsProtocolRegistry
 {
+    using StringUtils for string;
+
     /// @notice Address stored for each well-known protocol key.
     mapping(bytes32 key => address addr) private _addresses;
 
@@ -30,6 +37,12 @@ contract DotnsProtocolRegistry is
     ///      multiple keys without being treated as deregistered when only one key is rewired.
     mapping(address addr => uint256 refcount) private _registeredRefcount;
 
+    /// @notice Namehash of the TLD node, `namehash(0, keccak256(bytes(tldLabel)))`.
+    bytes32 private _tldNode;
+
+    /// @notice TLD suffix including the leading dot, e.g. `.dot`.
+    string private _tld;
+
     uint256[50] private __gap;
 
     /// @custom:oz-upgrades-unsafe-allow constructor
@@ -37,11 +50,19 @@ contract DotnsProtocolRegistry is
         _disableInitializers();
     }
 
-    /// @notice Initialises the protocol registry.
+    /// @notice Initialises the protocol registry and fixes the network's TLD.
     /// @dev Callable exactly once via `Initializable`, otherwise
-    ///      @custom:reverts InvalidInitialization. Sets the deployer as owner.
-    function initialize() external initializer {
+    ///      @custom:reverts InvalidInitialization. Sets the deployer as owner. `tldLabel` is the
+    ///      bare label without a dot (e.g. `dot`, `paseo`); it must be a single DNS label,
+    ///      otherwise @custom:reverts InvalidTld. The TLD is fixed here because changing it after
+    ///      names exist would reroot every node.
+    /// @param tldLabel Bare TLD label, without the leading dot.
+    function initialize(string calldata tldLabel) external initializer {
         __Ownable_init(msg.sender);
+
+        require(tldLabel.isSingleLabel(), InvalidTld());
+        _tldNode = LabelUtils.namehashUnder(bytes32(0), LabelUtils.labelhash(tldLabel));
+        _tld = string.concat(".", tldLabel);
     }
 
     /// @inheritdoc IDotnsProtocolRegistry
@@ -70,6 +91,16 @@ contract DotnsProtocolRegistry is
         return addr != address(0) && _registeredRefcount[addr] > 0;
     }
 
+    /// @inheritdoc IDotnsProtocolRegistry
+    function tldNode() external view override returns (bytes32 node) {
+        return _tldNode;
+    }
+
+    /// @inheritdoc IDotnsProtocolRegistry
+    function tld() external view override returns (string memory suffix) {
+        return _tld;
+    }
+
     /// @notice Returns implementation version.
     /// @return versionString Current version string.
     function version() external pure virtual returns (string memory versionString) {
diff --git a/contracts/registry/DotnsRegistry.sol b/contracts/registry/DotnsRegistry.sol
index b2e535e5..0d50a4ae 100644
--- a/contracts/registry/DotnsRegistry.sol
+++ b/contracts/registry/DotnsRegistry.sol
@@ -101,12 +101,13 @@ contract DotnsRegistry is Initializable, UUPSUpgradeable, OwnableUpgradeable, ID
 
             if (newOwner != previousOwner) {
                 string memory fullName =
-                    string.concat(subLabel, ".", parentLabel, DotnsConstants.TLD);
+                    string.concat(subLabel, ".", parentLabel, protocolRegistry.tld());
                 _writeSubnodeToStore(newOwner, subnode, fullName);
             }
         } else {
             records[subnode] = Record({owner: newOwner, resolver: reverseResolver, exists: true});
-            string memory fullName = string.concat(subLabel, ".", parentLabel, DotnsConstants.TLD);
+            string memory fullName =
+                string.concat(subLabel, ".", parentLabel, protocolRegistry.tld());
             _writeSubnodeToStore(newOwner, subnode, fullName);
         }
 
@@ -209,15 +210,16 @@ contract DotnsRegistry is Initializable, UUPSUpgradeable, OwnableUpgradeable, ID
         factory.writeLabel(storeOwner, node, fullName);
     }
 
-    /// @notice Computes the namehash of `parentLabel` rooted at the configured TLD.
+    /// @notice Computes the namehash of `parentLabel` rooted at the network's TLD node.
     /// @dev Walks the label right-to-left in calldata using memory-safe assembly to avoid the
     ///      cost of slicing into intermediate `bytes` and to keep gas linear in the label depth.
-    function _parentNamehash(string calldata parentLabel) internal pure returns (bytes32 node) {
+    ///      Reads the TLD node from the protocol registry, so it is a view rather than pure.
+    function _parentNamehash(string calldata parentLabel) internal view returns (bytes32 node) {
         bytes calldata labels = bytes(parentLabel);
         uint256 end = labels.length;
         require(end != 0, ParentLabelMismatch());
 
-        node = DotnsConstants.DOT_NODE;
+        node = protocolRegistry.tldNode();
 
         while (true) {
             uint256 start = end;
diff --git a/contracts/registry/IDotnsProtocolRegistry.sol b/contracts/registry/IDotnsProtocolRegistry.sol
index f0f4c5e7..55208cc8 100644
--- a/contracts/registry/IDotnsProtocolRegistry.sol
+++ b/contracts/registry/IDotnsProtocolRegistry.sol
@@ -6,7 +6,8 @@ pragma solidity ^0.8.34;
 /// @notice Interface for the DotNS protocol-level address registry.
 /// @dev Single source of truth for sibling lookups. Contracts resolve each other via well-known
 ///      `bytes32` constants in `DotnsConstants` so an upgrade or rewire only mutates the
-///      registry, never the consumers.
+///      registry, never the consumers. The registry also holds the network's top-level domain,
+///      so every consumer reads one TLD rather than compiling its own.
 /// @custom:security-contact admin@parity.io
 interface IDotnsProtocolRegistry {
     /// @notice Emitted when a protocol address is set or updated.
@@ -15,6 +16,9 @@ interface IDotnsProtocolRegistry {
     /// @notice Thrown when a zero address is provided where one is not allowed.
     error ZeroAddress();
 
+    /// @notice Thrown when the TLD label supplied at initialisation is not a single DNS label.
+    error InvalidTld();
+
     /// @notice Returns the address stored for a given key.
     /// @dev Returns `address(0)` when the key is unset; callers must validate when non-zero is
     ///      required.
@@ -35,4 +39,13 @@ interface IDotnsProtocolRegistry {
     ///      registered return true. Treats `address(0)` as never registered regardless of
     ///      refcount.
     function isRegisteredAddress(address addr) external view returns (bool registered);
+
+    /// @notice Returns the namehash of the network's TLD node.
+    /// @dev `namehash(0, keccak256(bytes(tldLabel)))`, fixed at initialisation. Consumers use it
+    ///      as the root parent when deriving a name's node.
+    function tldNode() external view returns (bytes32 node);
+
+    /// @notice Returns the network's TLD suffix, including the leading dot (e.g. `.dot`).
+    /// @dev Fixed at initialisation. Consumers append it when rendering a label as a full name.
+    function tld() external view returns (string memory suffix);
 }
diff --git a/contracts/registry/IDotnsRegistry.sol b/contracts/registry/IDotnsRegistry.sol
index d8288731..7979744f 100644
--- a/contracts/registry/IDotnsRegistry.sol
+++ b/contracts/registry/IDotnsRegistry.sol
@@ -10,7 +10,7 @@ pragma solidity ^0.8.34;
 interface IDotnsRegistry {
     /// @notice Record describing a subnode creation request.
     /// @param subLabel Human readable subnode label e.g "alice".
-    /// @param parentLabel Canonical parent name without the `.dot` suffix e.g. bob or child.bob.
+    /// @param parentLabel Canonical parent name without the TLD suffix e.g. bob or child.bob.
     /// @param owner Address to assign as owner of the created subnode.
     struct SubnodeRecord {
         bytes32 parentNode;
@@ -60,7 +60,7 @@ interface IDotnsRegistry {
 
     /// @notice Record describing a subnode resolver update request.
     /// @param subLabel Human-readable subnode label e.g "alice".
-    /// @param parentLabel Canonical parent name without `.dot` suffix e.g bob or child.bob.
+    /// @param parentLabel Canonical parent name without the TLD suffix e.g bob or child.bob.
     /// @param resolver Resolver contract address (zero clears).
     struct SubnodeResolverRecord {
         bytes32 parentNode;
diff --git a/contracts/resolvers/DotnsReverseResolver.sol b/contracts/resolvers/DotnsReverseResolver.sol
index 48763b45..3d3beeff 100644
--- a/contracts/resolvers/DotnsReverseResolver.sol
+++ b/contracts/resolvers/DotnsReverseResolver.sol
@@ -16,7 +16,7 @@ import {DotnsConstants} from "../utils/DotnsConstants.sol";
 import {LabelUtils} from "../utils/LabelUtils.sol";
 
 /// @title Dotns Reverse Resolver
-/// @notice Resolves an address to its associated .dot name.
+/// @notice Resolves an address to its associated name under the network TLD.
 /// @dev Writes are gated on a fixed writer address resolved from the protocol
 ///      registry (the registrar or its controller), not on node ownership.
 ///      Reverse records bind to an EOA rather than a registry node, so authority
@@ -72,12 +72,12 @@ contract DotnsReverseResolver is
     /// @inheritdoc IDotnsReverseResolver
     function claimReverseRecord(string calldata label) external override {
         bytes32 labelhash = LabelUtils.labelhash(label);
-        uint256 tokenId = uint256(LabelUtils.namehash(labelhash));
+        uint256 tokenId = uint256(LabelUtils.namehashUnder(protocolRegistry.tldNode(), labelhash));
 
         IERC721 registrar = IERC721(protocolRegistry.get(DotnsConstants.REGISTRAR));
         require(registrar.ownerOf(tokenId) == msg.sender, NotNameOwner(msg.sender, tokenId));
 
-        string memory fullName = string.concat(label, DotnsConstants.TLD);
+        string memory fullName = string.concat(label, protocolRegistry.tld());
         reverseNames[msg.sender] = fullName;
         emit ReverseNameSet(msg.sender, fullName);
     }
@@ -87,13 +87,13 @@ contract DotnsReverseResolver is
         string memory stored = reverseNames[addr];
         if (bytes(stored).length == 0) return "";
 
-        // Strip the `.dot` suffix and validate against current ownership so a transferred-away
+        // Strip the TLD suffix and validate against current ownership so a transferred-away
         // name never resolves under a stale reverse record.
-        string memory label = LabelUtils.stripDotTld(stored);
+        string memory label = LabelUtils.stripTld(protocolRegistry.tld(), stored);
         if (bytes(label).length == 0) return "";
 
         bytes32 labelhash = LabelUtils.labelhashMemory(label);
-        uint256 tokenId = uint256(LabelUtils.namehash(labelhash));
+        uint256 tokenId = uint256(LabelUtils.namehashUnder(protocolRegistry.tldNode(), labelhash));
 
         IERC721 registrar = IERC721(protocolRegistry.get(DotnsConstants.REGISTRAR));
         try registrar.ownerOf(tokenId) returns (address currentOwner) {
diff --git a/contracts/resolvers/IDotnsReverseResolver.sol b/contracts/resolvers/IDotnsReverseResolver.sol
index d1e87925..3920624b 100644
--- a/contracts/resolvers/IDotnsReverseResolver.sol
+++ b/contracts/resolvers/IDotnsReverseResolver.sol
@@ -32,13 +32,13 @@ interface IDotnsReverseResolver {
     /// @param name The human-readable name associated with the address.
     function setReverseName(address addr, string calldata name) external;
 
-    /// @notice Self-service claim: associates `msg.sender` with `<label>.dot`.
+    /// @notice Self-service claim: associates `msg.sender` with `<label>` under the network TLD.
     /// @dev The caller must currently own the NFT for `label` per the configured registrar,
     ///      otherwise @custom:reverts NotNameOwner. Overwrites any existing record for the caller
     ///      and emits @custom:emits ReverseNameSet on every successful write. Transferring the
     ///      name away does not eagerly clear the record; @custom:function nameOf fails closed at
     ///      read time when the stored record no longer matches current ownership.
-    /// @param label The label (without `.dot`) the caller is claiming a reverse record for.
+    /// @param label The label (without the TLD suffix) the caller is claiming a reverse record for.
     function claimReverseRecord(string calldata label) external;
 
     /// @notice Returns the reverse name for an address, fail-closed against current ownership.
diff --git a/contracts/utils/DotnsConstants.sol b/contracts/utils/DotnsConstants.sol
index a2e69f42..d535936d 100644
--- a/contracts/utils/DotnsConstants.sol
+++ b/contracts/utils/DotnsConstants.sol
@@ -3,21 +3,13 @@ pragma solidity ^0.8.34;
 
 /// @title DotNS Constants
 /// @notice Protocol-level invariants shared across DotNS contracts.
-/// @dev Centralises the namehash of the `.dot` TLD, the TLD suffix string, and the
-///      well-known protocol-registry keys that every contract uses to discover its
-///      siblings (registrar, controller, registry, resolvers, etc.). Each key is a
+/// @dev Centralises the well-known protocol-registry keys that every contract uses to discover
+///      its siblings (registrar, controller, registry, resolvers, etc.). Each key is a
 ///      role address resolved at call time, so rotating an implementation is a
-///      single `set` on the protocol registry without redeploying consumers.
+///      single `set` on the protocol registry without redeploying consumers. The TLD is not a
+///      constant here: it is set per network on the protocol registry and read by every consumer.
 /// @custom:security-contact admin@parity.io
 library DotnsConstants {
-    /// @notice Namehash of the .dot TLD node.
-    /// @dev keccak256(abi.encodePacked(bytes32(0), keccak256("dot"))).
-    bytes32 internal constant DOT_NODE =
-        0x3fce7d1364a893e213bc4212792b517ffc88f5b13b86c8ef9c8d390c3a1370ce;
-
-    /// @notice TLD suffix appended to labels when building full domain names.
-    string internal constant TLD = ".dot";
-
     /// @notice Address of revive's System precompile, exposed by every revive runtime
     ///         that opts the precompile in.
     /// @dev Mirrors the upstream `SYSTEM_ADDR` constant in
@@ -53,7 +45,7 @@ library DotnsConstants {
     bytes32 internal constant WHITELIST_OPERATOR_ROLE = keccak256("DOTNS_WHITELIST_OPERATOR_ROLE");
 
     /// @notice Well-known key for the ERC721 registrar backing name ownership.
-    /// @dev Role: token-of-record for `.dot` names. Mints, burns, and tracks the
+    /// @dev Role: token-of-record for registered names. Mints, burns, and tracks the
     ///      `tokenId => label` mapping consumed by the forward registry on
     ///      transfer.
     /// forge-lint: disable-next-line(unsafe-typecast)
diff --git a/contracts/utils/LabelUtils.sol b/contracts/utils/LabelUtils.sol
index cfdb2dae..eca257fa 100644
--- a/contracts/utils/LabelUtils.sol
+++ b/contracts/utils/LabelUtils.sol
@@ -1,15 +1,14 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.34;
 
-import {DotnsConstants} from "./DotnsConstants.sol";
-
 /// @title DotNS Label Utilities Library
-/// @notice Canonical keccak labelhash and `.dot`-TLD namehash helpers shared by every
-///         DotNS contract that derives node identifiers from user-supplied labels.
+/// @notice Canonical keccak labelhash and namehash helpers shared by every DotNS contract that
+///         derives node identifiers from user-supplied labels.
 /// @dev Exists so that the identical inline-assembly keccak sequences don't need to
 ///      live in every controller, registrar, or resolver. Every caller that maps a
 ///      label to an on-chain node goes through this library, which is the single
-///      source of truth for how a label hashes.
+///      source of truth for how a label hashes. The TLD is supplied by the caller (read from the
+///      protocol registry), so this library holds no network-specific constant.
 /// @dev Deliberate non-goals:
 ///      - Validation (single-label checks, min-length rules, availability): each caller
 ///        owns its own validation policy alongside its own interface-declared errors.
@@ -45,10 +44,8 @@ library LabelUtils {
     }
 
     /// @notice Computes `namehash(parent, labelhash)` against an arbitrary parent.
-    /// @dev General form of @custom:function namehash; use when the parent is not the `.dot` TLD
-    ///      (e.g. subnode derivation under a non-TLD parent in the forward registry,
-    ///      or a PoP namespace root). For top-level `.dot` registrations prefer
-    ///      @custom:function namehash which hard-codes `DOT_NODE`.
+    /// @dev Pass the TLD node (from the protocol registry) as `parent` for a top-level
+    ///      registration, or a subnode/PoP-namespace node for a nested name.
     /// @param parent Parent node.
     /// @param labelhash_ `keccak256(bytes(label))`.
     /// @return node `namehash(parent, labelhash)`.
@@ -65,39 +62,41 @@ library LabelUtils {
         }
     }
 
-    /// @notice Computes `namehash(DOT_NODE, labelhash)` via memory-safe scratch space.
-    /// @dev Specialised to the `.dot` TLD; cheaper than @custom:function namehashUnder because
-    ///      the parent constant is folded in at compile time.
-    /// @param labelhash_ `keccak256(bytes(label))`.
-    /// @return node The node identifier under the `.dot` TLD.
-    function namehash(bytes32 labelhash_) internal pure returns (bytes32 node) {
-        bytes32 dotNode = DotnsConstants.DOT_NODE;
-        assembly ("memory-safe") {
-            let pointer := mload(0x40)
-            mstore(pointer, dotNode)
-            mstore(add(pointer, 0x20), labelhash_)
-            node := keccak256(pointer, 0x40)
-        }
-    }
-
-    /// @notice Derives `(labelhash, node)` from a label in one call.
+    /// @notice Derives `(labelhash, node)` for a label under a given TLD node in one call.
     /// @dev Convenience combinator for registration flows: hashes the label
     ///      exactly once and returns both identifiers callers need without
     ///      recomputing.
+    /// @param tldNode TLD node to root the name under, read from the protocol registry.
     /// @param label Label string.
     /// @return hash `keccak256(bytes(label))`.
-    /// @return node `namehash(DOT_NODE, hash)`.
-    function deriveNode(string calldata label) internal pure returns (bytes32 hash, bytes32 node) {
+    /// @return node `namehash(tldNode, hash)`.
+    function deriveNode(
+        bytes32 tldNode,
+        string calldata label
+    )
+        internal
+        pure
+        returns (bytes32 hash, bytes32 node)
+    {
         hash = labelhash(label);
-        node = namehash(hash);
+        node = namehashUnder(tldNode, hash);
     }
 
-    /// @notice Strips the configured `.dot` TLD suffix from a stored full name.
-    /// @dev Returns the empty string when the input does not end in the TLD; callers treat
+    /// @notice Strips the network's TLD suffix from a stored full name.
+    /// @dev Returns the empty string when the input does not end in `tld`; callers treat
     ///      an empty return as a "do not trust this record" signal.
-    function stripDotTld(string memory fullName) internal pure returns (string memory label) {
+    /// @param tldSuffix TLD suffix including the leading dot, read from the protocol registry.
+    /// @param fullName Stored full name to strip.
+    function stripTld(
+        string memory tldSuffix,
+        string memory fullName
+    )
+        internal
+        pure
+        returns (string memory label)
+    {
         bytes memory full = bytes(fullName);
-        bytes memory tld = bytes(DotnsConstants.TLD);
+        bytes memory tld = bytes(tldSuffix);
         if (full.length <= tld.length) return "";
 
         uint256 baseLength = full.length - tld.length;
diff --git a/contracts/utils/RegistrationUtils.sol b/contracts/utils/RegistrationUtils.sol
index 01f1dfd8..3ea9de0b 100644
--- a/contracts/utils/RegistrationUtils.sol
+++ b/contracts/utils/RegistrationUtils.sol
@@ -35,7 +35,7 @@ library RegistrationUtils {
     /// @param user Address receiving the name.
     /// @param label Human-readable label (without the TLD).
     /// @param labelhash `keccak256(bytes(label))`.
-    /// @param node `namehash(DOT_NODE, labelhash)`.
+    /// @param node `namehash(tldNode, labelhash)`.
     struct RegistrationContext {
         IDotnsProtocolRegistry protocolRegistry;
         address user;
diff --git a/scripts/deploy/BaseDeployer.s.sol b/scripts/deploy/BaseDeployer.s.sol
index c80d9923..0f39606a 100644
--- a/scripts/deploy/BaseDeployer.s.sol
+++ b/scripts/deploy/BaseDeployer.s.sol
@@ -62,6 +62,16 @@ abstract contract BaseDeployer is Script {
         subdirectory = vm.envOr("DEPLOYMENT_NETWORK", DeploymentNetwork.folder(block.chainid));
     }
 
+    /// @notice Resolves the bare TLD label to initialise the protocol registry with.
+    /// @dev Read from `DOTNS_TLD` because distinct networks can share one `block.chainid`, so the
+    ///      TLD cannot be keyed off the chain id. The operator sets `DOTNS_TLD=paseo` (or `test`,
+    ///      `dot`) per deployment; it defaults to `dot`. The label is passed straight into
+    ///      `DotnsProtocolRegistry.initialize`, which validates it as a single DNS label.
+    /// @return label Bare TLD label without the leading dot.
+    function tldLabel() internal view returns (string memory label) {
+        label = vm.envOr("DOTNS_TLD", string("dot"));
+    }
+
     /// @notice Loads the existing deployment manifest for `(subdirectory, filename)`
     ///         if one exists; otherwise begins a fresh in-memory object. Every
     ///         stage must call this first so subsequent `_readAddress` / `logDeployment`
diff --git a/scripts/deploy/DeployCore.s.sol b/scripts/deploy/DeployCore.s.sol
index 704b2d27..4c4d5fd0 100644
--- a/scripts/deploy/DeployCore.s.sol
+++ b/scripts/deploy/DeployCore.s.sol
@@ -49,7 +49,7 @@ contract DeployCore is BaseDeployer {
         proxy = _broadcastDeployUups(
             owner,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ()),
+            abi.encodeCall(DotnsProtocolRegistry.initialize, (tldLabel())),
             "DotnsProtocolRegistry"
         );
     }
diff --git a/scripts/deploy/DotnsDeployer.s.sol b/scripts/deploy/DotnsDeployer.s.sol
index a577951e..7cc9442d 100644
--- a/scripts/deploy/DotnsDeployer.s.sol
+++ b/scripts/deploy/DotnsDeployer.s.sol
@@ -139,7 +139,7 @@ contract DotnsDeployer is BaseDeployer {
         proxy = _broadcastDeployUups(
             owner,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ()),
+            abi.encodeCall(DotnsProtocolRegistry.initialize, (tldLabel())),
             "DotnsProtocolRegistry"
         );
         protocolRegistry = DotnsProtocolRegistry(proxy);
diff --git a/test/base/BaseDotns.t.sol b/test/base/BaseDotns.t.sol
index b5838876..105ebfa9 100644
--- a/test/base/BaseDotns.t.sol
+++ b/test/base/BaseDotns.t.sol
@@ -176,18 +176,20 @@ abstract contract BaseDotns is Test {
     /// @notice NoStatus classification label fixture B.
     string internal constant NOSTATUS_LABEL_B = "anothernostatus02";
 
-    /// @notice Label hash for "dot".
-    /// @dev Computed during setup as `keccak256(bytes("dot"))`.
+    /// @notice The bare TLD label the whole suite runs against.
+    /// @dev Single definition point for the fixture's TLD. Change this one line to run every test
+    ///      under a different network TLD; the registry is initialised with it and all node and
+    ///      full-name derivations follow from it (see `_tldNode` and `_nodeOf`).
+    string public constant TLD_LABEL = "dot";
+
+    /// @notice Label hash of @custom:constant TLD_LABEL.
+    /// @dev Computed during setup as `keccak256(bytes(TLD_LABEL))`.
     bytes32 public dotLabel;
 
-    /// @notice Node hash for the ".dot" TLD.
-    /// @dev Computed during setup as `_namehash(ZERO_HASH, dotLabel)`.
+    /// @notice Node hash of the suite's TLD.
+    /// @dev Computed during setup as `_tldNode()`.
     bytes32 public dotNode;
 
-    /// @notice Default node hash for the ".dot" TLD.
-    /// @dev Included to cross-check against computed `dotNode` where relevant.
-    bytes32 private constant DOT_NODE = DotnsConstants.DOT_NODE;
-
     /// @notice Deploys and wires every protocol contract used by the test suite.
     /// @dev Provisions UUPS proxies for each module, registers them under their
     ///      canonical keys on the protocol registry, and installs default
@@ -200,8 +202,8 @@ abstract contract BaseDotns is Test {
         tiago = _createUser("tiago");
         owner = _createUser("owner");
 
-        dotLabel = keccak256(bytes("dot"));
-        dotNode = _namehash(ZERO_HASH, dotLabel);
+        dotLabel = LabelUtils.labelhashMemory(TLD_LABEL);
+        dotNode = _tldNode();
 
         vm.startPrank(owner);
         // Deploy protocol registry first so every downstream proxy can bind to
@@ -209,10 +211,14 @@ abstract contract BaseDotns is Test {
         // initialisers might otherwise race with the key lookups.
         address protocolRegistryAddress = Upgrades.deployUUPSProxy(
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ())
+            abi.encodeCall(DotnsProtocolRegistry.initialize, (TLD_LABEL))
         );
         protocolRegistry = DotnsProtocolRegistry(protocolRegistryAddress);
         vm.label(protocolRegistryAddress, "DotnsProtocolRegistry");
+        // Anchor the fixture to the deployed TLD authority: consumers read these live, so a
+        // fixture whose derived node or suffix disagreed would test the wrong protocol.
+        assertEq(protocolRegistry.tldNode(), dotNode);
+        assertEq(protocolRegistry.tld(), string.concat(".", TLD_LABEL));
         IDotnsProtocolRegistry registry = IDotnsProtocolRegistry(protocolRegistryAddress);
 
         storeFactory = new StoreFactory(protocolRegistryAddress, owner);
@@ -343,21 +349,29 @@ abstract contract BaseDotns is Test {
     }
 
     /// @notice Computes the ERC721 tokenId used by DotnsRegistrar for a given label.
-    /// @dev DotnsRegistrar mints tokenId = uint256(node), where node = namehash(DOT_NODE,
+    /// @dev DotnsRegistrar mints tokenId = uint256(node), where node = namehash(tldNode,
     ///      labelhash). This helper prevents tests from accidentally using uint256(node) as
     ///      the tokenId.
-    /// @param label The label to compute for (without the `.dot` suffix).
+    /// @param label The label to compute for (without the TLD suffix).
     /// @return tokenId The ERC721 tokenId (uint256(node)).
     function _tokenIdForLabel(string memory label) internal pure returns (uint256 tokenId) {
         tokenId = uint256(_nodeOf(label));
     }
 
-    /// @notice Computes `namehash(DOT_NODE, keccak256(label))` for a flat label.
-    /// @dev Shared across test suites that need the node identifier for a .dot label.
-    /// @param label Label (without the `.dot` suffix).
-    /// @return node The node identifier under the `.dot` TLD.
+    /// @notice Node hash of the suite's TLD, derived from @custom:constant TLD_LABEL.
+    /// @dev `namehash(0, keccak256(TLD_LABEL))`. Derived rather than a literal so the single
+    ///      definition point drives every node; stays pure because keccak runs in a pure body.
+    /// @return node The TLD node the registry is initialised with.
+    function _tldNode() internal pure returns (bytes32 node) {
+        node = LabelUtils.namehashUnder(ZERO_HASH, LabelUtils.labelhashMemory(TLD_LABEL));
+    }
+
+    /// @notice Computes `namehash(tldNode, keccak256(label))` for a flat label.
+    /// @dev Shared across test suites that need the node identifier for a top-level label.
+    /// @param label Label (without the TLD suffix).
+    /// @return node The node identifier under the suite's TLD.
     function _nodeOf(string memory label) internal pure returns (bytes32 node) {
-        node = LabelUtils.namehashUnder(DOT_NODE, LabelUtils.labelhashMemory(label));
+        node = LabelUtils.namehashUnder(_tldNode(), LabelUtils.labelhashMemory(label));
     }
 
     /// @notice Returns a valid 65-byte chat key seeded with `seed`.
diff --git a/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol b/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
index bf59b76d..55801745 100644
--- a/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
+++ b/test/fuzz/registrar/DotnsPopControllerFuzz.t.sol
@@ -9,7 +9,6 @@ import {IDotnsPopController} from "../../../contracts/registrars/IDotnsPopContro
 import {IPopRules} from "../../../contracts/pop/IPopRules.sol";
 import {ILabelStore} from "../../../contracts/store/ILabelStore.sol";
 import {StringUtils} from "../../../contracts/utils/StringUtils.sol";
-import {DotnsConstants} from "../../../contracts/utils/DotnsConstants.sol";
 import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
 import {Vm} from "forge-std/Vm.sol";
 
@@ -373,7 +372,7 @@ contract DotnsPopControllerFuzz is BaseDotns {
         bytes32 node = _nodeOf(label);
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
-        assertEq(ILabelStore(store).getLabel(node), string.concat(label, DotnsConstants.TLD));
+        assertEq(ILabelStore(store).getLabel(node), string.concat(label, protocolRegistry.tld()));
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
         assertEq(dotnsPopController.pendingClaims(ed).length, 0);
     }
diff --git a/test/fuzz/registry/DotnsProtocolRegistryFuzz.t.sol b/test/fuzz/registry/DotnsProtocolRegistryFuzz.t.sol
index a58a75ed..6ada1f14 100644
--- a/test/fuzz/registry/DotnsProtocolRegistryFuzz.t.sol
+++ b/test/fuzz/registry/DotnsProtocolRegistryFuzz.t.sol
@@ -2,11 +2,34 @@
 pragma solidity ^0.8.34;
 
 import {BaseDotns} from "../../base/BaseDotns.t.sol";
+import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
+import {DotnsProtocolRegistry} from "../../../contracts/registry/DotnsProtocolRegistry.sol";
+import {IDotnsProtocolRegistry} from "../../../contracts/registry/IDotnsProtocolRegistry.sol";
 
 /// @title DotnsProtocolRegistryFuzzTest
 /// @notice Property-based tests for @custom:contract DotnsProtocolRegistry reference-counted
-/// registration.
+/// registration, plus TLD-initialisation guards.
 contract DotnsProtocolRegistryFuzzTest is BaseDotns {
+    /// @notice Deploys an uninitialised registry behind a bare proxy.
+    /// @dev Wires the proxy directly so `initialize` is called in the open and its revert
+    ///      surfaces raw, rather than wrapped by the upgrades plugin's deploy helper.
+    function _uninitialisedRegistry() internal returns (DotnsProtocolRegistry registry) {
+        DotnsProtocolRegistry implementation = new DotnsProtocolRegistry();
+        registry = DotnsProtocolRegistry(address(new ERC1967Proxy(address(implementation), "")));
+    }
+
+    function test_initialise_reverts_on_empty_tld() public {
+        DotnsProtocolRegistry registry = _uninitialisedRegistry();
+        vm.expectRevert(IDotnsProtocolRegistry.InvalidTld.selector);
+        registry.initialize("");
+    }
+
+    function test_initialise_reverts_on_multi_label_tld() public {
+        DotnsProtocolRegistry registry = _uninitialisedRegistry();
+        vm.expectRevert(IDotnsProtocolRegistry.InvalidTld.selector);
+        registry.initialize("bad.label");
+    }
+
     function testFuzz_isRegisteredAddress_matches_ground_truth(
         bytes32 k1,
         bytes32 k2,
diff --git a/test/intergration/PopLifecycleFlow.t.sol b/test/intergration/PopLifecycleFlow.t.sol
index 6de574ca..5b1dc591 100644
--- a/test/intergration/PopLifecycleFlow.t.sol
+++ b/test/intergration/PopLifecycleFlow.t.sol
@@ -7,7 +7,6 @@ import {IDotnsPopController} from "../../contracts/registrars/IDotnsPopControlle
 import {IDotnsRegistry} from "../../contracts/registry/IDotnsRegistry.sol";
 import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
 import {ILabelStore} from "../../contracts/store/ILabelStore.sol";
-import {DotnsConstants} from "../../contracts/utils/DotnsConstants.sol";
 import {LabelUtils} from "../../contracts/utils/LabelUtils.sol";
 
 /// @title PopLifecycleFlow
@@ -45,7 +44,7 @@ contract PopLifecycleFlow is BaseDotns {
         assertEq(dotnsPopResolver.chatKey(fullNode), CHAT_KEY);
         // Same label mirrored in the owner's Store under the canonical store key.
         ILabelStore ownerStore = ILabelStore(storeFactory.getLabelStore(owner));
-        assertEq(ownerStore.getLabel(fullNode), string.concat(FULL_LABEL, DotnsConstants.TLD));
+        assertEq(ownerStore.getLabel(fullNode), string.concat(FULL_LABEL, protocolRegistry.tld()));
     }
 
     function test_pop_full_name_is_first_class_erc721_name() public {
@@ -96,7 +95,7 @@ contract PopLifecycleFlow is BaseDotns {
         // stays under the original owner's Store even after transfer.
         ILabelStore edStore = ILabelStore(storeFactory.getLabelStore(ed));
         assertEq(
-            edStore.getLabel(_nodeOf(FULL_LABEL)), string.concat(FULL_LABEL, DotnsConstants.TLD)
+            edStore.getLabel(_nodeOf(FULL_LABEL)), string.concat(FULL_LABEL, protocolRegistry.tld())
         );
     }
 
@@ -127,7 +126,7 @@ contract PopLifecycleFlow is BaseDotns {
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
         assertEq(
-            ILabelStore(store).getLabel(liteNode), string.concat(LITE_LABEL, DotnsConstants.TLD)
+            ILabelStore(store).getLabel(liteNode), string.concat(LITE_LABEL, protocolRegistry.tld())
         );
         assertEq(dotnsPopResolver.chatKey(liteNode), CHAT_KEY);
         assertEq(dotnsPopController.pendingClaims(ed).length, 0);
@@ -192,7 +191,9 @@ contract PopLifecycleFlow is BaseDotns {
         address edStore = storeFactory.getLabelStore(ed);
         assertTrue(edStore != address(0));
         bytes32 node = _nodeOf(LITE_LABEL);
-        assertEq(ILabelStore(edStore).getLabel(node), string.concat(LITE_LABEL, DotnsConstants.TLD));
+        assertEq(
+            ILabelStore(edStore).getLabel(node), string.concat(LITE_LABEL, protocolRegistry.tld())
+        );
     }
 
     function test_lapsed_pending_claim_is_swept_without_deploying_store() public {
diff --git a/test/invariant/registrar/DotnsPopControllerInvariant.t.sol b/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
index b755cb79..13a2b5ab 100644
--- a/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
+++ b/test/invariant/registrar/DotnsPopControllerInvariant.t.sol
@@ -26,7 +26,8 @@ contract DotnsPopControllerInvariant is BaseDotns {
             handlerActors[i] = makeAddr(string.concat("popActor", vm.toString(i)));
         }
 
-        handler = new PopControllerHandler(dotnsPopController, handlerActors);
+        handler =
+            new PopControllerHandler(dotnsPopController, handlerActors, protocolRegistry.tldNode());
         targetContract(address(handler));
 
         bytes4[] memory selectors = new bytes4[](8);
diff --git a/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol b/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
index f4b35ecd..7252fe01 100644
--- a/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
+++ b/test/invariant/registrar/DotnsRegistrarControllerInvariant.t.sol
@@ -25,7 +25,8 @@ contract DotnsRegistrarControllerInvariantTest is BaseDotns {
             dotnsRegistrar,
             dotnsReverseResolver,
             popRules,
-            storeFactory
+            storeFactory,
+            protocolRegistry.tldNode()
         );
 
         vm.deal(address(handler), 1000 ether);
diff --git a/test/invariant/registrar/PopControllerHandler.t.sol b/test/invariant/registrar/PopControllerHandler.t.sol
index fe50063a..d3e0a491 100644
--- a/test/invariant/registrar/PopControllerHandler.t.sol
+++ b/test/invariant/registrar/PopControllerHandler.t.sol
@@ -20,6 +20,10 @@ import {IPersonhood} from "../../../contracts/external/personhood/IPersonhood.so
 contract PopControllerHandler is Test {
     /// @notice The PoP controller under test.
     DotnsPopController public immutable CONTROLLER;
+    /// @notice Node hash of the suite's TLD, injected from the deployed protocol registry.
+    /// @dev Keeps the handler rooted at the same TLD the protocol under test uses, without a
+    ///      second TLD definition.
+    bytes32 private immutable TLD_NODE;
     /// @notice Mirrors the controller's MAX_RESERVATION_QUEUE for queue-bound
     ///         assertions without re-importing the contract constant.
     uint16 public constant MAX_QUEUE = 64;
@@ -70,8 +74,10 @@ contract PopControllerHandler is Test {
     ///         every action call admits both lite and base classifications.
     /// @param controller_ The PoP controller under test.
     /// @param actors_ Pool of accounts the handler cycles through.
-    constructor(DotnsPopController controller_, address[] memory actors_) {
+    /// @param tldNode_ Node hash of the suite's TLD, from the deployed protocol registry.
+    constructor(DotnsPopController controller_, address[] memory actors_, bytes32 tldNode_) {
         CONTROLLER = controller_;
+        TLD_NODE = tldNode_;
         actors = actors_;
         // baselength 8, no trailing digits: PopFull classification.
         baseLabels.push("alicebob");
@@ -176,9 +182,7 @@ contract PopControllerHandler is Test {
 
         if (_callReserveBaseName(params, useBytes)) {
             if (attachReservation) _track(keccak256(bytes(reservedBase)));
-            bytes32 node = LabelUtils.namehashUnder(
-                DotnsConstants.DOT_NODE, LabelUtils.labelhashMemory(liteLabel)
-            );
+            bytes32 node = LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(liteLabel));
             mintedLiteTokenIds.push(uint256(node));
             priorLiteLabels.push(liteLabel);
             _trackPendingActor(actor);
@@ -225,14 +229,10 @@ contract PopControllerHandler is Test {
         if (!_callRegisterBaseName(fullParams, useBytes)) return;
 
         bytes32 liteLabelhash = LabelUtils.labelhashMemory(liteLabel);
-        bytes32 fullNode = LabelUtils.namehashUnder(
-            DotnsConstants.DOT_NODE, LabelUtils.labelhashMemory(baseLabel)
-        );
+        bytes32 fullNode = LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
         claimedLiteLabelhashes.push(liteLabelhash);
         claimedFullNodes.push(fullNode);
-        mintedLiteTokenIds.push(
-            uint256(LabelUtils.namehashUnder(DotnsConstants.DOT_NODE, liteLabelhash))
-        );
+        mintedLiteTokenIds.push(uint256(LabelUtils.namehashUnder(TLD_NODE, liteLabelhash)));
         mintedLiteTokenIds.push(uint256(fullNode));
         priorLiteLabels.push(liteLabel);
     }
@@ -270,9 +270,7 @@ contract PopControllerHandler is Test {
         if (!_callRegisterBaseName(params, useBytes)) return;
 
         bytes32 liteLabelhash = LabelUtils.labelhashMemory(liteLabel);
-        bytes32 fullNode = LabelUtils.namehashUnder(
-            DotnsConstants.DOT_NODE, LabelUtils.labelhashMemory(baseLabel)
-        );
+        bytes32 fullNode = LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(baseLabel));
         claimedLiteLabelhashes.push(liteLabelhash);
         claimedFullNodes.push(fullNode);
         mintedLiteTokenIds.push(uint256(fullNode));
diff --git a/test/invariant/registrar/RegistrarControllerHandler.t.sol b/test/invariant/registrar/RegistrarControllerHandler.t.sol
index b1f99451..3f5822d2 100644
--- a/test/invariant/registrar/RegistrarControllerHandler.t.sol
+++ b/test/invariant/registrar/RegistrarControllerHandler.t.sol
@@ -21,8 +21,11 @@ import {IPersonhood} from "../../../contracts/external/personhood/IPersonhood.so
 /// @dev Maintains ghost state to track registrations, commitments, transfers,
 ///      and actors for invariant checks.
 contract RegistrarControllerHandler is Test {
-    /// @notice Namehash of the .dot TLD.
-    bytes32 private constant DOT_NODE = DotnsConstants.DOT_NODE;
+    /// @notice Node hash of the suite's TLD, injected from the deployed protocol registry.
+    /// @dev Keeps the handler rooted at the same TLD the protocol under test uses, without a
+    ///      second TLD definition.
+    bytes32 private immutable TLD_NODE;
+
     /// @notice The registrar controller under test.
     IDotnsRegistrarController public controller;
 
@@ -96,14 +99,17 @@ contract RegistrarControllerHandler is Test {
     /// @param _reverseResolver The reverse resolver.
     /// @param _popRules The PoP rules contract.
     /// @param _storeFactory The store factory.
+    /// @param _tldNode Node hash of the suite's TLD, from the deployed protocol registry.
     constructor(
         DotnsRegistrarController _controller,
         IDotnsRegistry _registry,
         DotnsRegistrar _registrar,
         IDotnsReverseResolver _reverseResolver,
         IPopRules _popRules,
-        IStoreFactory _storeFactory
+        IStoreFactory _storeFactory,
+        bytes32 _tldNode
     ) {
+        TLD_NODE = _tldNode;
         controller = _controller;
         registry = _registry;
         registrar = _registrar;
@@ -332,7 +338,7 @@ contract RegistrarControllerHandler is Test {
         if (recipient == address(0)) return;
 
         bytes32 labelhash = keccak256(bytes(label));
-        bytes32 node = LabelUtils.namehashUnder(DOT_NODE, labelhash);
+        bytes32 node = LabelUtils.namehashUnder(TLD_NODE, labelhash);
         uint256 tokenId = uint256(node);
 
         vm.prank(currentOwner);
@@ -359,7 +365,7 @@ contract RegistrarControllerHandler is Test {
         address currentOwner = _registeredOwners[index];
 
         bytes32 labelhash = keccak256(bytes(label));
-        bytes32 node = LabelUtils.namehashUnder(DOT_NODE, labelhash);
+        bytes32 node = LabelUtils.namehashUnder(TLD_NODE, labelhash);
         uint256 tokenId = uint256(node);
 
         // Transfer through 2 to 4 hops
diff --git a/test/invariant/registry/DotnsRegistryInvariant.t.sol b/test/invariant/registry/DotnsRegistryInvariant.t.sol
index b8cf40e2..e0d0c7c9 100644
--- a/test/invariant/registry/DotnsRegistryInvariant.t.sol
+++ b/test/invariant/registry/DotnsRegistryInvariant.t.sol
@@ -19,8 +19,13 @@ contract DotnsRegistryInvariantTest is BaseDotns {
     function setUp() public override {
         super.setUp();
 
-        handler =
-            new RegistryHandler(dotnsRegistrarController, dotnsRegistry, dotnsRegistrar, popRules);
+        handler = new RegistryHandler(
+            dotnsRegistrarController,
+            dotnsRegistry,
+            dotnsRegistrar,
+            popRules,
+            protocolRegistry.tldNode()
+        );
 
         vm.deal(address(handler), 1000 ether);
 
diff --git a/test/invariant/registry/RegistryHandler.t.sol b/test/invariant/registry/RegistryHandler.t.sol
index 33e95f70..c23b0e71 100644
--- a/test/invariant/registry/RegistryHandler.t.sol
+++ b/test/invariant/registry/RegistryHandler.t.sol
@@ -18,8 +18,10 @@ import {IPersonhood} from "../../../contracts/external/personhood/IPersonhood.so
 /// @notice Executes bounded random actions on the registry: register base domains,
 ///         create subnodes, reassign subnodes, set resolvers, and transfer base domains.
 contract RegistryHandler is Test {
-    /// @notice Namehash of the .dot TLD.
-    bytes32 private constant DOT_NODE = DotnsConstants.DOT_NODE;
+    /// @notice Node hash of the suite's TLD, injected from the deployed protocol registry.
+    /// @dev Keeps the handler rooted at the same TLD the protocol under test uses, without a
+    ///      second TLD definition.
+    bytes32 private immutable TLD_NODE;
 
     /// @notice The registrar controller driving registrations.
     DotnsRegistrarController public controller;
@@ -65,12 +67,15 @@ contract RegistryHandler is Test {
     /// @param _registry The hierarchical registry.
     /// @param _registrar The base registrar.
     /// @param _popRules The PoP rules contract.
+    /// @param _tldNode Node hash of the suite's TLD, from the deployed protocol registry.
     constructor(
         DotnsRegistrarController _controller,
         DotnsRegistry _registry,
         DotnsRegistrar _registrar,
-        IPopRules _popRules
+        IPopRules _popRules,
+        bytes32 _tldNode
     ) {
+        TLD_NODE = _tldNode;
         controller = _controller;
         registry = _registry;
         registrar = _registrar;
@@ -265,10 +270,10 @@ contract RegistryHandler is Test {
         _subnodeOwners.push(subnodeOwner);
     }
 
-    /// @notice Computes the namehash for `label` under the .dot TLD.
+    /// @notice Computes the namehash for `label` under the suite's TLD.
     /// @param label Label whose node hash is required.
-    function _computeNode(string memory label) internal pure returns (bytes32) {
-        return LabelUtils.namehashUnder(DOT_NODE, LabelUtils.labelhashMemory(label));
+    function _computeNode(string memory label) internal view returns (bytes32) {
+        return LabelUtils.namehashUnder(TLD_NODE, LabelUtils.labelhashMemory(label));
     }
 
     /// @notice Generates a unique label for each registration in the run.
diff --git a/test/unit/deploy/DeterministicDeployment.t.sol b/test/unit/deploy/DeterministicDeployment.t.sol
index f9013395..4386ccd8 100644
--- a/test/unit/deploy/DeterministicDeployment.t.sol
+++ b/test/unit/deploy/DeterministicDeployment.t.sol
@@ -61,7 +61,7 @@ contract DeterministicDeploymentTest is Test {
     }
 
     function test_predictionsMatchCreate3Deployments() public {
-        bytes memory initData = abi.encodeCall(DotnsProtocolRegistry.initialize, ());
+        bytes memory initData = abi.encodeCall(DotnsProtocolRegistry.initialize, ("dot"));
         address predicted = deployer.predictCreate3("DotnsProtocolRegistry", "proxy");
 
         address deployed = deployer.deployUups(
@@ -81,7 +81,7 @@ contract DeterministicDeploymentTest is Test {
         address protocolRegistry = deployer.deployUups(
             owner,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ()),
+            abi.encodeCall(DotnsProtocolRegistry.initialize, ("dot")),
             "DotnsProtocolRegistry"
         );
         deployer.registerCreate3Factory(owner, protocolRegistry, address(factory));
@@ -205,7 +205,7 @@ contract DeterministicDeploymentTest is Test {
     }
 
     function test_reDeployAdoptsProxyWithoutReinitialising() public {
-        bytes memory initData = abi.encodeCall(DotnsProtocolRegistry.initialize, ());
+        bytes memory initData = abi.encodeCall(DotnsProtocolRegistry.initialize, ("dot"));
         address first = deployer.deployUups(
             owner,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
@@ -228,7 +228,7 @@ contract DeterministicDeploymentTest is Test {
         return deployer.deployUups(
             deployerAccount,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ()),
+            abi.encodeCall(DotnsProtocolRegistry.initialize, ("dot")),
             "DotnsProtocolRegistry"
         );
     }
@@ -264,7 +264,7 @@ contract DeterministicDeploymentTest is Test {
         addr.protocolRegistry = deployer.deployUups(
             owner,
             "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
-            abi.encodeCall(DotnsProtocolRegistry.initialize, ()),
+            abi.encodeCall(DotnsProtocolRegistry.initialize, ("dot")),
             "DotnsProtocolRegistry"
         );
 
diff --git a/test/unit/registrar/DotnsPopController.t.sol b/test/unit/registrar/DotnsPopController.t.sol
index 2a32c85e..65ec014c 100644
--- a/test/unit/registrar/DotnsPopController.t.sol
+++ b/test/unit/registrar/DotnsPopController.t.sol
@@ -10,7 +10,6 @@ import {
 import {IDotnsRegistry} from "../../../contracts/registry/IDotnsRegistry.sol";
 import {IPopRules} from "../../../contracts/pop/IPopRules.sol";
 import {ILabelStore} from "../../../contracts/store/ILabelStore.sol";
-import {DotnsConstants} from "../../../contracts/utils/DotnsConstants.sol";
 import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
 import {Vm} from "forge-std/Vm.sol";
 
@@ -1154,7 +1153,9 @@ contract DotnsPopControllerTests is BaseDotns {
         assertTrue(store != address(0));
 
         bytes32 node = _nodeOf(LITE_LABEL_A);
-        assertEq(ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, DotnsConstants.TLD));
+        assertEq(
+            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, protocolRegistry.tld())
+        );
         assertEq(dotnsPopResolver.chatKey(node), chatKey);
 
         IDotnsPopController.PendingClaim[] memory pending = dotnsPopController.pendingClaims(ed);
@@ -1273,11 +1274,11 @@ contract DotnsPopControllerTests is BaseDotns {
         assertTrue(store != address(0));
         assertEq(
             ILabelStore(store).getLabel(_nodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, DotnsConstants.TLD)
+            string.concat(LITE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(
             ILabelStore(store).getLabel(_nodeOf(LITE_LABEL_B)),
-            string.concat(LITE_LABEL_B, DotnsConstants.TLD)
+            string.concat(LITE_LABEL_B, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaims(ed).length, 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);
@@ -1322,11 +1323,11 @@ contract DotnsPopControllerTests is BaseDotns {
         assertTrue(store != address(0));
         assertEq(
             ILabelStore(store).getLabel(_nodeOf(LITE_LABEL_A)),
-            string.concat(LITE_LABEL_A, DotnsConstants.TLD)
+            string.concat(LITE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(
             ILabelStore(store).getLabel(_nodeOf(BASE_LABEL_A)),
-            string.concat(BASE_LABEL_A, DotnsConstants.TLD)
+            string.concat(BASE_LABEL_A, protocolRegistry.tld())
         );
         assertEq(dotnsPopController.pendingClaims(ed).length, 0);
     }
@@ -1492,7 +1493,9 @@ contract DotnsPopControllerTests is BaseDotns {
         bytes32 node = _nodeOf(LITE_LABEL_A);
         address store = storeFactory.getLabelStore(ed);
         assertTrue(store != address(0));
-        assertEq(ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, DotnsConstants.TLD));
+        assertEq(
+            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_A, protocolRegistry.tld())
+        );
         assertEq(dotnsPopResolver.chatKey(node).length, 0);
     }
 
@@ -1517,7 +1520,9 @@ contract DotnsPopControllerTests is BaseDotns {
         );
 
         bytes32 node = _nodeOf(LITE_LABEL_B);
-        assertEq(ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_B, DotnsConstants.TLD));
+        assertEq(
+            ILabelStore(store).getLabel(node), string.concat(LITE_LABEL_B, protocolRegistry.tld())
+        );
         assertEq(dotnsPopResolver.chatKey(node), secondChatKey);
         assertEq(dotnsPopController.pendingClaims(ed).length, 0);
         assertEq(dotnsPopController.pendingClaimUserCount(), 0);

From ca15c3cd1e7c35bb855eddb38a020b51e3e2eced Mon Sep 17 00:00:00 2001
From: Siphamandla Mjoli <siphamandla@parity.io>
Date: Tue, 11 Aug 2026 18:57:39 +0200
Subject: [PATCH 2/2] refactor: address TLD PR review comments

---
 .env.example                                  |  6 +++
 .github/workflows/deploy-contracts.yml        |  4 ++
 contracts/registrars/DotnsRegistrar.sol       |  5 +-
 scripts/deploy/BaseDeployer.s.sol             | 16 +++++-
 .../unit/registry/DotnsProtocolRegistry.t.sol | 52 +++++++++++++++++++
 5 files changed, 80 insertions(+), 3 deletions(-)
 create mode 100644 test/unit/registry/DotnsProtocolRegistry.t.sol

diff --git a/.env.example b/.env.example
index ad1339a3..736308a1 100644
--- a/.env.example
+++ b/.env.example
@@ -42,6 +42,12 @@ WHITELIST_OPERATOR=0xd908e5a6c88e9263f8fd0756bd0b77916008bb72
 #   RPC_URL=https://rpc.example.org
 RPC_URL=paseo_local
 
+# Required. Bare TLD label the protocol registry is initialised with, without the
+# leading dot (for example `dot`, `paseo`, or `test`). Distinct networks can share
+# a chain id, so the TLD is set explicitly per deploy rather than derived. The
+# deploy aborts if this is unset or empty, and no setter can correct it afterwards.
+DOTNS_TLD=dot
+
 # Optional. Manifest subdirectory under `deployments/`. Set it when two chains
 # share a chain id (for example a previewnet and a next environment both reach
 # 420420417 through the local adapter) so each keeps its own manifest. Defaults
diff --git a/.github/workflows/deploy-contracts.yml b/.github/workflows/deploy-contracts.yml
index edcb5317..52e4184c 100644
--- a/.github/workflows/deploy-contracts.yml
+++ b/.github/workflows/deploy-contracts.yml
@@ -32,6 +32,10 @@ jobs:
     env:
       ACCOUNT_NAME: anvil-default-7
       ACCOUNT_PASSWORD: anvil-default-password
+      # Required by the deploy scripts (BaseDeployer.tldLabel). The TLD is passed
+      # to DotnsProtocolRegistry.initialize as init calldata, which does not affect
+      # any CREATE3 address, so the reproduction still lands the canonical set.
+      DOTNS_TLD: dot
       WHITELIST_OPERATOR: "0x14dC79964da2C08b23698B3D3cc7Ca32193d9955"
       FACTORY_DEPLOYER: "0xd498F7BC5bB3cBdd0068c3deEbbd814b69C3F164"
       PINNED_FACTORY: "0x8533c79E058c5a6489CAFeCA86dc600E029D75f5"
diff --git a/contracts/registrars/DotnsRegistrar.sol b/contracts/registrars/DotnsRegistrar.sol
index 521a2e5a..98a80791 100644
--- a/contracts/registrars/DotnsRegistrar.sol
+++ b/contracts/registrars/DotnsRegistrar.sol
@@ -404,8 +404,11 @@ contract DotnsRegistrar is
         // No label means there is no label-derived price to charge against; treat as a zero-fee
         // move (typical of gateway-cold PoP mints that have not yet claimed a `LabelStore`).
         if (bytes(fullName).length == 0) return (0, 0);
+        // A stored full name always carries the registry TLD suffix, so an empty strip means the
+        // name is malformed for this registry (a wrong or missing suffix); fail loudly rather than
+        // mis-pricing the move as zero-fee.
         string memory label = LabelUtils.stripTld(registry.tld(), fullName);
-        if (bytes(label).length == 0) return (0, 0);
+        require(bytes(label).length != 0, InvalidLabel());
 
         reachFloor =
             IPopRules(registry.get(DotnsConstants.POP_RULES)).transferFloor(label, from, to);
diff --git a/scripts/deploy/BaseDeployer.s.sol b/scripts/deploy/BaseDeployer.s.sol
index 0f39606a..b9e0c076 100644
--- a/scripts/deploy/BaseDeployer.s.sol
+++ b/scripts/deploy/BaseDeployer.s.sol
@@ -65,11 +65,16 @@ abstract contract BaseDeployer is Script {
     /// @notice Resolves the bare TLD label to initialise the protocol registry with.
     /// @dev Read from `DOTNS_TLD` because distinct networks can share one `block.chainid`, so the
     ///      TLD cannot be keyed off the chain id. The operator sets `DOTNS_TLD=paseo` (or `test`,
-    ///      `dot`) per deployment; it defaults to `dot`. The label is passed straight into
+    ///      `dot`) per deployment; it is required, with no default, so an unset or empty value
+    ///      aborts the deploy rather than silently landing the wrong TLD, which no setter can
+    ///      correct afterwards. The label is passed straight into
     ///      `DotnsProtocolRegistry.initialize`, which validates it as a single DNS label.
     /// @return label Bare TLD label without the leading dot.
     function tldLabel() internal view returns (string memory label) {
-        label = vm.envOr("DOTNS_TLD", string("dot"));
+        label = vm.envString("DOTNS_TLD");
+        require(
+            bytes(label).length != 0, "DOTNS_TLD must be set to a bare TLD label (for example dot)"
+        );
     }
 
     /// @notice Loads the existing deployment manifest for `(subdirectory, filename)`
@@ -198,6 +203,13 @@ abstract contract BaseDeployer is Script {
                     revert(add(ret, 32), mload(ret))
                 }
             }
+        } else if (proxyExisted && initialiserCalldata.length != 0) {
+            // The proxy keeps the configuration its first deploy set, so every
+            // initialiser argument computed for this run is discarded. Values
+            // without a setter (such as the TLD) cannot be corrected afterwards,
+            // so surface it rather than reporting success.
+            console.log("WARNING: adopted existing proxy, initialiser skipped for", label);
+            console.log("         on-chain configuration may differ from this run's inputs");
         }
         vm.stopBroadcast();
         vm.label(proxy, label);
diff --git a/test/unit/registry/DotnsProtocolRegistry.t.sol b/test/unit/registry/DotnsProtocolRegistry.t.sol
new file mode 100644
index 00000000..d9e80a35
--- /dev/null
+++ b/test/unit/registry/DotnsProtocolRegistry.t.sol
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {BaseDotns} from "../../base/BaseDotns.t.sol";
+import {Upgrades} from "openzeppelin-foundry-upgrades/Upgrades.sol";
+import {DotnsProtocolRegistry} from "../../../contracts/registry/DotnsProtocolRegistry.sol";
+import {IDotnsProtocolRegistry} from "../../../contracts/registry/IDotnsProtocolRegistry.sol";
+import {LabelUtils} from "../../../contracts/utils/LabelUtils.sol";
+
+/// @title DotnsProtocolRegistryTldTests
+/// @notice Unit coverage for the protocol registry as the per-network TLD authority: a registry
+///         initialised with a different TLD label derives a different node and token id for the
+///         same second-level label, so two networks never collide on one another's names.
+contract DotnsProtocolRegistryTldTests is BaseDotns {
+    /// @notice Deploys a protocol registry initialised with @custom:param tldLabel behind a UUPS
+    ///         proxy, mirroring the fixture's own registry deployment.
+    /// @param tldLabel Bare TLD label without the leading dot.
+    /// @return registry The initialised registry.
+    function _deployRegistry(string memory tldLabel)
+        private
+        returns (IDotnsProtocolRegistry registry)
+    {
+        address proxy = Upgrades.deployUUPSProxy(
+            "DotnsProtocolRegistry.sol:DotnsProtocolRegistry",
+            abi.encodeCall(DotnsProtocolRegistry.initialize, (tldLabel))
+        );
+        registry = IDotnsProtocolRegistry(proxy);
+    }
+
+    /// @notice The same second-level label resolves to a distinct node and token id under two
+    ///         registries whose TLDs differ, and the two TLD authorities never coincide.
+    /// @dev The fixture's `protocolRegistry` already runs under @custom:constant TLD_LABEL (`dot`),
+    ///      so it stands up a second authority under a different TLD and compares derivations.
+    function test_same_label_derives_distinct_node_and_token_id_per_tld() public {
+        IDotnsProtocolRegistry dotRegistry = IDotnsProtocolRegistry(address(protocolRegistry));
+        IDotnsProtocolRegistry ethRegistry = _deployRegistry("eth");
+
+        // Distinct TLDs must not share a TLD node or suffix.
+        assertTrue(dotRegistry.tldNode() != ethRegistry.tldNode());
+        assertEq(dotRegistry.tld(), ".dot");
+        assertEq(ethRegistry.tld(), ".eth");
+
+        bytes32 labelHash = LabelUtils.labelhashMemory("alice");
+        bytes32 dotNodeOfLabel = LabelUtils.namehashUnder(dotRegistry.tldNode(), labelHash);
+        bytes32 ethNodeOfLabel = LabelUtils.namehashUnder(ethRegistry.tldNode(), labelHash);
+
+        // Same label under a different TLD yields a different node, and therefore a different
+        // token id (the token id is the node cast to uint256).
+        assertTrue(dotNodeOfLabel != ethNodeOfLabel);
+        assertTrue(uint256(dotNodeOfLabel) != uint256(ethNodeOfLabel));
+    }
+}