Disable ENS CCIP Read so resolver-controlled gateway URLs cannot cause backend HTTP requests. Onchain ENS forward and reverse lookups remain available; CCIP-only names fall back to a wallet address.
Operator scripts use encrypted Foundry keystores, private logs, strict address parsing and atomic JSON writes. Uncertain broadcasts are not retried automatically. See docs/OPERATOR_SCRIPTS.md before the next authorized onchain operator action. No real keys were migrated.
Guard pending commitments in the UI and treasury keeper, settle reveal/renew before new commits, replay events in chain order, and expose pending diagnostics. These guards do not fix the deployed contract: direct calls and races can bypass them; historical orphaned pending slots and reveal ordering remain limitations.
Validation: full application gate, ABI/renderer fixtures, Foundry, regression tests against local RPC/provider mocks, operator script tests and shell syntax checks. No Solidity or renderer changes, no contract deployment, no test mainnet transactions.