diff --git a/.env.example b/.env.example
index cbf19192a..6ecaea953 100644
--- a/.env.example
+++ b/.env.example
@@ -163,11 +163,16 @@ NUXT_PUBLIC_CONFIG_LOGO_URL=
 # Recommended: 1200x630 or larger (2400x1260), PNG or JPG. Must be publicly
 # reachable — X, Slack, Discord fetch it directly. Empty = no preview image.
 NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL=
-NUXT_PUBLIC_CONFIG_LABELS_REPO="euler-xyz/euler-labels"
-NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH="master"
-# Base URL for labels data (S3/CDN). When set, LABELS_REPO and LABELS_REPO_BRANCH are ignored.
-# Must serve the same directory structure (e.g. {baseUrl}/{chainId}/products.json, {baseUrl}/logo/{file}).
-NUXT_PUBLIC_CONFIG_LABELS_BASE_URL=
+# Hosted mode reads V3 only. Forks can select their own static label files.
+LABELS_SOURCE=v3
+# V3 metadata dataset and default publication (latest or an immutable published version key).
+# Geo policies, visibility and governance addresses remain live and shared.
+LABELS_V3_SET=public
+LABELS_V3_VERSION=latest
+# Enabled DEPRECATED_CHAINS use V3 metadata with Lite on-chain verification.
+# They must also be in ONCHAIN_SDK_CHAINS. Other enabled chains use V3 assessments.
+# Required only for LABELS_SOURCE=static: operator-owned five-file labels directory.
+STATIC_LABELS_BASE_URL=
 # Full URL for EulerChains.json (contract addresses). Takes precedence over
 # EULER_SDK_EULER_INTERFACES_BRANCH and its public aliases — it is the
 # emergency repoint lever when the default GitHub source is unavailable.
@@ -224,3 +229,7 @@ SUBGRAPH_URL_80094="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn
 SUBGRAPH_URL_8453="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-base/latest/gn"
 SUBGRAPH_URL_9745="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-plasma/latest/gn"
 SUBGRAPH_URL_999=https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-hyperevm/1.0.2/gn
+
+# Mount this directory on persistent storage to retain geo policies across redeploys.
+# Default: .data/geo-policies (survives process restarts only on the same filesystem).
+GEO_POLICY_CACHE_DIR=
diff --git a/README.md b/README.md
index 28e352495..fc05a8dc8 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,8 @@ Euler Lite uses the [Euler V2 SDK](https://github.com/euler-xyz/euler-sdks) for
 | `TENDERLY_ACCESS_KEY`, `TENDERLY_ACCOUNT_SLUG`, `TENDERLY_PROJECT_SLUG` | Optional Tenderly simulation configuration. |
 | `FUUL_API_URL` or `NUXT_PUBLIC_FUUL_API_URL` | Optional Fuul API upstream override. |
 | `INCENTRA_API_URL` or `NUXT_PUBLIC_INCENTRA_API_URL` | Optional Incentra/Brevis API upstream override. |
+| `LABELS_SOURCE` | `v3` (default) or `static`; selects the shared label snapshot producer. |
+| `STATIC_LABELS_BASE_URL` | Required directory URL for static authoring files; unused by hosted V3 mode. |
 | `TURTLE_EARN_API_URL` or `NUXT_PUBLIC_TURTLE_EARN_API_URL` | Optional Turtle reward-proof upstream override; defaults to `https://earn.turtle.xyz/v1`. |
 
 #### Branding & Feature Flags
@@ -95,9 +97,6 @@ These settings use `NUXT_PUBLIC_CONFIG_*` env vars. Branding and announcement va
 | `NUXT_PUBLIC_CONFIG_APP_DESCRIPTION`        | `Lightweight interface for Euler Finance.` | App description                                       |
 | `NUXT_PUBLIC_CONFIG_LOGO_URL`               | —                                          | Custom logo URL (falls back to built-in Euler logo)   |
 | `NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL`       | —                                          | Absolute URL to social share image (og:image / twitter:image), 1200×630+ |
-| `NUXT_PUBLIC_CONFIG_LABELS_REPO`            | `euler-xyz/euler-labels`                   | GitHub labels repo                                    |
-| `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH`     | `master`                                   | Branch to fetch labels from                           |
-| `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL`        | —                                          | S3/CDN base URL for labels (overrides repo/branch)    |
 | `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL`       | —                                          | Explicit URL for EulerChains.json; takes precedence over the Euler interfaces branch |
 | `NUXT_PUBLIC_CONFIG_EULER_ABIS_BASE_URL` | — | Base URL serving `{contract}.json` for runtime ABIs; takes precedence over the Euler interfaces branch. |
 | `NUXT_PUBLIC_CONFIG_DOCS_URL`               | —                                          | Documentation link                                    |
@@ -219,27 +218,11 @@ The resolution order in `getAssetLogoUrl(address, symbol)`:
 2. `logoURI` from the unified token list (Euler SDK token list > DefiLlama > Uniswap > Merkl)
 3. Empty string (component shows initials fallback)
 
-#### EulerEarn Vaults
+#### Public Labels
 
-If using a custom labels repository, create chain-specific `earn-vaults.json` files to curate which EulerEarn vaults appear:
+Vault inventory, products, entities, hosted logos, tags, campaigns, and deprecation metadata come from the versioned Public Labels API at `V3_API_URL`. Lite resolves `version=latest` to one immutable publication before fetching a chain bundle and follows every paginated list through `meta.total`.
 
-```
-your-labels-repo/
-├── 1/earn-vaults.json          # Ethereum
-├── 42161/earn-vaults.json      # Arbitrum
-└── 8453/earn-vaults.json       # Base
-```
-
-Each file is a JSON array of vault addresses:
-
-```json
-[
-  "0x1234567890123456789012345678901234567890",
-  "0xabcdefabcdefabcdefabcdefabcdefabcdefabcd"
-]
-```
-
-When using the default `euler-xyz/euler-labels` repository, all verified EulerEarn vaults are shown automatically.
+Hosted labels, visibility and geo policies come exclusively from V3. Fork deployments can set `LABELS_SOURCE=static` and provide their own authoring files through `STATIC_LABELS_BASE_URL`. See [Static labels](docs/static-labels.md) for the format, failure semantics and on-chain data options.
 
 ### 4. Development
 
diff --git a/app.vue b/app.vue
index 91891a3de..81d6916c0 100644
--- a/app.vue
+++ b/app.vue
@@ -14,7 +14,7 @@ let isAnnouncementOpen = false
 const { loadEulerConfig, chainId } = useEulerAddresses()
 const { loadVaults, isReady: isVaultsReady, resetVaultsState, refreshVaults, setShowAllLabelEntries } = useVaults()
 const { loadTokenList, isLoaded: isTokenListLoaded } = useTokenList()
-const { loadLabels, retryLabels, isReady: isLabelsReady, isLoading: isLabelsLoading, loadError: labelsLoadError } = useEulerLabels()
+const { loadLabels, refreshLabelsIfStale, retryLabels, isReady: isLabelsReady, isLoading: isLabelsLoading, loadError: labelsLoadError } = useEulerLabels()
 const { loadCountry } = useGeoBlock()
 const { updateBalances, resetBalances } = useWallets()
 const { isConnected, address } = useWagmi()
@@ -162,6 +162,23 @@ watch([chainId, showAllLabelEntries], () => {
   })
 }, { immediate: true })
 
+// Refresh live label verdicts for an open tab and after returning from a
+// suspended/background tab. The labels store owns freshness and deduplication.
+let labelsRefreshInterval: ReturnType<typeof setInterval> | undefined
+const refreshVisibleLabels = () => {
+  if (document.visibilityState === 'visible') void refreshLabelsIfStale()
+}
+onMounted(() => {
+  labelsRefreshInterval = setInterval(refreshVisibleLabels, POLL_INTERVAL_60S_MS)
+  window.addEventListener('focus', refreshVisibleLabels)
+  document.addEventListener('visibilitychange', refreshVisibleLabels)
+})
+onUnmounted(() => {
+  clearInterval(labelsRefreshInterval)
+  window.removeEventListener('focus', refreshVisibleLabels)
+  document.removeEventListener('visibilitychange', refreshVisibleLabels)
+})
+
 // Refresh balances when token list finishes loading (includes new DefiLlama tokens)
 watch(isTokenListLoaded, (loaded) => {
   if (loaded && (isConnected.value || isVaultsReady.value)) {
diff --git a/components/entities/portfolio/PortfolioNotice.vue b/components/entities/portfolio/PortfolioNotice.vue
index 4fe840269..5ba74ced3 100644
--- a/components/entities/portfolio/PortfolioNotice.vue
+++ b/components/entities/portfolio/PortfolioNotice.vue
@@ -14,7 +14,7 @@ defineProps<{ notice: string }>()
       name="info-circle"
       class="!w-20 !h-20 text-accent-600 shrink-0"
     />
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <span
       class="text-accent-700 text-p4 auto-link"
       @click="stopLinkPropagation"
diff --git a/components/entities/vault/VaultBorrowItem.vue b/components/entities/vault/VaultBorrowItem.vue
index 3443020d5..11f337cde 100644
--- a/components/entities/vault/VaultBorrowItem.vue
+++ b/components/entities/vault/VaultBorrowItem.vue
@@ -367,6 +367,11 @@ const linkPath = computed(() => ({
             data-field="borrow-apy"
             :data-value="borrowApyWithRewards"
           >
+            <VaultPoints
+              class="mr-4"
+              :vault="pair.borrow"
+              campaign-type="borrow"
+            />
             <UiModalPreviewTrigger
               v-if="hasBorrowApyRewards"
               :component="VaultApyModal"
diff --git a/components/entities/vault/VaultPoints.vue b/components/entities/vault/VaultPoints.vue
index 0c7725849..a13b85155 100644
--- a/components/entities/vault/VaultPoints.vue
+++ b/components/entities/vault/VaultPoints.vue
@@ -1,22 +1,20 @@
 <script setup lang="ts">
 import type { EulerEarn, EVault, SecuritizeCollateralVault } from '@eulerxyz/euler-v2-sdk'
-import { getEulerLabelEntityLogo } from '~/entities/euler/labels'
+import { getEulerLabelPointLogo } from '~/entities/euler/labels'
 import { useModal } from '~/components/ui/composables/useModal'
 import { VaultPointsModal } from '#components'
 
-const { vault } = defineProps<{ vault: EVault | EulerEarn | SecuritizeCollateralVault }>()
+const { vault, campaignType = 'deposit' } = defineProps<{
+  vault: EVault | EulerEarn | SecuritizeCollateralVault
+  campaignType?: 'deposit' | 'borrow'
+}>()
 
-const points = useEulerPointsOfVault(vault.address)
+const allPoints = useEulerPointsOfVault(vault.address)
+const points = computed(() => allPoints.filter(point =>
+  point.type ? point.type === campaignType : campaignType === 'deposit',
+))
 const modal = useModal()
 
-const onLogoError = (event: Event, logoFileName: string) => {
-  const img = event.target as HTMLImageElement
-  if (!img.dataset.triedFallback) {
-    img.dataset.triedFallback = 'true'
-    img.src = getEulerLabelEntityLogo(logoFileName)
-  }
-}
-
 const onPointClick = (
   point: { name: string, logo: string },
   event: MouseEvent | TouchEvent,
@@ -27,6 +25,7 @@ const onPointClick = (
     props: {
       pointName: point.name,
       pointLogo: point.logo,
+      campaignType,
     },
   })
 }
@@ -37,18 +36,15 @@ const onPointClick = (
     v-if="points.length"
     class="text-p1 flex items-center gap-0 hover:gap-8 transition-[gap] duration-300 ease-in-out"
   >
-    <img
+    <BaseAvatar
       v-for="(point, index) in points"
       :key="point.name"
-      class="w-16 h-16 rounded-full cursor-pointer select-none"
+      class="icon--16 rounded-full cursor-pointer select-none"
       :class="{ '-ml-6': index > 0 }"
-      :src="`/entities/${point.logo}`"
-      alt="Points entity logo"
-      referrerpolicy="no-referrer"
-      draggable="false"
+      :src="getEulerLabelPointLogo(point.logo)"
+      :label="point.name"
       @click="onPointClick(point, $event)"
-      @error="onLogoError($event, point.logo)"
       @contextmenu.prevent
-    >
+    />
   </div>
 </template>
diff --git a/components/entities/vault/VaultPointsModal.vue b/components/entities/vault/VaultPointsModal.vue
index 6c2d25cd1..fb68569fe 100644
--- a/components/entities/vault/VaultPointsModal.vue
+++ b/components/entities/vault/VaultPointsModal.vue
@@ -1,20 +1,13 @@
 <script setup lang="ts">
-import { getEulerLabelEntityLogo } from '~/entities/euler/labels'
+import { getEulerLabelPointLogo } from '~/entities/euler/labels'
 
 defineEmits(['close'])
-const { pointName, pointLogo } = defineProps<{
+const { pointName, pointLogo, campaignType = 'deposit' } = defineProps<{
   pointName: string
   pointLogo: string
+  campaignType?: 'deposit' | 'borrow'
 }>()
 
-const onLogoError = (event: Event) => {
-  const img = event.target as HTMLImageElement
-  if (!img.dataset.triedFallback) {
-    img.dataset.triedFallback = 'true'
-    img.src = getEulerLabelEntityLogo(pointLogo)
-  }
-}
-
 const escapeHtml = (unsafe: string): string => {
   return unsafe
     .replace(/&/g, '&amp;')
@@ -67,15 +60,13 @@ const formattedPointName = computed(() => convertMarkdownLinks(pointName))
     @close="$emit('close')"
   >
     <div class="flex items-center gap-12">
-      <span class="text-p2">Supply earns</span>
-      <img
-        :src="`/entities/${pointLogo}`"
-        alt="Point logo"
-        referrerpolicy="no-referrer"
-        class="w-20 h-20 rounded-full"
-        @error="onLogoError"
-      >
-      <!-- eslint-disable vue/no-v-html -- trusted label content -->
+      <span class="text-p2">{{ campaignType === 'borrow' ? 'Borrowing earns' : 'Supply earns' }}</span>
+      <BaseAvatar
+        :src="getEulerLabelPointLogo(pointLogo)"
+        :label="pointName"
+        class="icon--20 rounded-full"
+      />
+      <!-- eslint-disable vue/no-v-html -- formattedPointName escapes campaign text before adding links -->
       <span
         class="text-p2"
         v-html="formattedPointName"
diff --git a/components/entities/vault/discovery/DiscoveryMarketCard.vue b/components/entities/vault/discovery/DiscoveryMarketCard.vue
index 78b92cea3..24e7f412a 100644
--- a/components/entities/vault/discovery/DiscoveryMarketCard.vue
+++ b/components/entities/vault/discovery/DiscoveryMarketCard.vue
@@ -69,7 +69,7 @@ const getMaxRoeModalData = (result: BestMaxRoeResult) => ({
           class="icon--40 shrink-0"
           :class="{ 'opacity-20': isGovernanceLimited }"
           :src="marketEntities.logos"
-          :label="marketEntities.name"
+          :label="marketEntities.labels"
         />
         <div
           class="flex-grow min-w-0"
diff --git a/components/entities/vault/overview/SecuritizeVaultOverview.vue b/components/entities/vault/overview/SecuritizeVaultOverview.vue
index 8b4df7d51..e2efc32d8 100644
--- a/components/entities/vault/overview/SecuritizeVaultOverview.vue
+++ b/components/entities/vault/overview/SecuritizeVaultOverview.vue
@@ -150,7 +150,7 @@ const supplyCapPercentageDisplay = computed(() => {
         v-if="description"
         class="w-full rounded-12 p-16 bg-surface-tertiary"
       >
-        <!-- eslint-disable vue/no-v-html -- trusted label content -->
+        <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
         <p
           class="text-p3 text-content-secondary auto-link"
           v-html="autoLink(description)"
diff --git a/components/entities/vault/overview/VaultDeprecationBanner.vue b/components/entities/vault/overview/VaultDeprecationBanner.vue
index 17d8f6370..0de813786 100644
--- a/components/entities/vault/overview/VaultDeprecationBanner.vue
+++ b/components/entities/vault/overview/VaultDeprecationBanner.vue
@@ -11,7 +11,7 @@ defineProps<{ reason: string }>()
         name="warning"
         class="!w-20 !h-20 flex-shrink-0"
       />
-      <!-- eslint-disable vue/no-v-html -- deprecationReason is validated server-side in server/api/internal/labels/[file].get.ts -->
+      <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
       <p
         v-if="reason"
         class="text-p3 text-warning-500 auto-link"
diff --git a/components/entities/vault/overview/VaultOverviewBlockGeneral.vue b/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
index b5f218530..32b74e95d 100644
--- a/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
+++ b/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
@@ -168,7 +168,7 @@ watchEffect(() => {
         </p>
       </div>
     </div>
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <p
       v-if="description"
       class="text-p2 text-content-secondary auto-link"
diff --git a/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue b/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
index 9d1434ce0..cdc0ce864 100644
--- a/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
+++ b/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
@@ -69,7 +69,7 @@ const feeDisplay = computed(() => {
         </p>
       </div>
     </div>
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <p
       v-if="earnDescription"
       class="text-p2 text-content-secondary auto-link"
diff --git a/composables/guards/useUnverifiedVaultGuard.ts b/composables/guards/useUnverifiedVaultGuard.ts
index 7863af001..d7ecc54b7 100644
--- a/composables/guards/useUnverifiedVaultGuard.ts
+++ b/composables/guards/useUnverifiedVaultGuard.ts
@@ -16,6 +16,7 @@ interface UnverifiedVaultGuardContext {
   account: Ref<string | undefined>
   chainId: Ref<number | undefined>
   operation: ComputedRef<string>
+  allowUnavailableLabels?: boolean
 }
 
 let unverifiedVaultGuardSequence = 0
@@ -59,12 +60,12 @@ export const useUnverifiedVaultGuard = (
       return !!entry && !!context.chainId.value && entry.vault.chainId === context.chainId.value
     })
   })
-  const isVerificationReady = computed(() => labelsReady.value && hasVaultMetadata.value)
+  const isVerificationReady = computed(() => (labelsReady.value || context.allowUnavailableLabels === true) && hasVaultMetadata.value)
   const isVerificationLoading = computed(() =>
-    (!labelsReady.value && !labelsError.value) || (!hasVaultMetadata.value && isResolvingVaults.value),
+    (!context.allowUnavailableLabels && !labelsReady.value && !labelsError.value) || (!hasVaultMetadata.value && isResolvingVaults.value),
   )
   const verificationError = computed(() => {
-    if (!labelsReady.value && labelsError.value) return labelsError.value
+    if (!context.allowUnavailableLabels && !labelsReady.value && labelsError.value) return labelsError.value
     if (!hasVaultMetadata.value && !isResolvingVaults.value) return 'Unable to load vault verification. Please retry.'
     return undefined
   })
@@ -74,6 +75,7 @@ export const useUnverifiedVaultGuard = (
   }
 
   const hasCanonicalVerification = (address: string): boolean => {
+    if (!labelsReady.value) return false
     const entry = get(address)
     if (!entry || !context.chainId.value || entry.vault.chainId !== context.chainId.value) return false
 
diff --git a/composables/useDeployConfig.ts b/composables/useDeployConfig.ts
index 06c299080..fe1f9d680 100644
--- a/composables/useDeployConfig.ts
+++ b/composables/useDeployConfig.ts
@@ -6,8 +6,6 @@ export const useDeployConfig = () => {
     const s = String(val)
     return s !== 'false' && s !== '0'
   }
-  const labelsBaseUrl = (rc.configLabelsBaseUrl || '').trim().replace(/\/+$/, '')
-
   return {
     // URLs (empty string = not configured, hide UI element)
     docsUrl: rc.configDocsUrl,
@@ -28,11 +26,6 @@ export const useDeployConfig = () => {
     logoUrl: envConfig.logoUrl,
     socialImageUrl: envConfig.socialImageUrl,
 
-    // Repos (labelsRepo/branch/baseUrl still needed for logo URL construction)
-    labelsRepo: rc.configLabelsRepo || 'euler-xyz/euler-labels',
-    labelsRepoBranch: rc.configLabelsRepoBranch || 'master',
-    labelsBaseUrl,
-
     // Feature flags: all enabled by default, set env var to 'false' to disable
     enableTosSignature: !!rc.configTosMdUrl,
     enableEntityBranding: isEnabled(rc.configEnableEntityBranding),
diff --git a/composables/useEulerConfig.ts b/composables/useEulerConfig.ts
index 4628b9bae..4be1449b4 100644
--- a/composables/useEulerConfig.ts
+++ b/composables/useEulerConfig.ts
@@ -5,21 +5,12 @@ import {
 
 export const useEulerConfig = () => {
   const envConfig = useEnvConfig()
-  const { labelsRepo, labelsRepoBranch, labelsBaseUrl: configLabelsBaseUrl } = useDeployConfig()
-
-  const resolvedLabelsBaseUrl = (
-    configLabelsBaseUrl
-    || `https://raw.githubusercontent.com/${labelsRepo}/refs/heads/${labelsRepoBranch}`
-  ).replace(/\/+$/, '')
 
   return {
     // APIs (from constants)
     DEFILLAMA_YIELDS_URL,
     MERKL_API_BASE_URL,
 
-    // Labels
-    EULER_LABELS_ENTITY_LOGO_URL: `${resolvedLabelsBaseUrl}/logo`,
-
     // Runtime app config APIs
     SWAP_API_URL: envConfig.swapApiUrl,
     PYTH_HERMES_URL: envConfig.pythHermesUrl,
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index fe71aae36..f7ee47771 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -12,7 +12,6 @@ import { toReactive, until } from '@vueuse/core'
 import { decodeFunctionResult, encodeFunctionData, type Hex, type PublicClient } from 'viem'
 import { computed, ref, shallowReactive, shallowRef, unref, type Ref } from 'vue'
 import { logWarn } from '~/utils/errorHandling'
-import { invalidateSdkQueries } from '~/utils/sdk-query-cache'
 import type { EulerLabelEntity, EulerLabelProduct, EulerLabelPointReward } from '~/entities/euler/labels'
 import { eulerLabelProductEmpty } from '~/entities/euler/labels'
 import { getEulerSdk } from '~/composables/useEulerSdk'
@@ -20,17 +19,15 @@ import { useEulerOracleAdapters } from '~/composables/useEulerOracleAdapters'
 import { erc4626AssetAbi } from '~/abis/erc4626'
 import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
-import { fetchEulerLabelsDataStrict } from '~/utils/euler-labels-fetch'
-
-const LABEL_QUERY_NAMES = [
-  'queryEulerLabelsEntities',
-  'queryEulerLabelsProducts',
-  'queryEulerLabelsPoints',
-  'queryEulerLabelsEarnVaults',
-  'queryEulerLabelsAssets',
-] as const
-
-const createEmptyEulerLabelsData = (): EulerLabelsData => ({
+import {
+  normalizeLabelsBundle,
+  getLabelVaultCandidates,
+  getLabelsVaultLoadKey,
+  type PublicEulerLabelsData,
+  type PublicLabelsBundle,
+} from '~/utils/public-labels'
+
+const createEmptyEulerLabelsData = (): PublicEulerLabelsData => ({
   products: {},
   entities: {},
   points: {},
@@ -46,21 +43,26 @@ const createEmptyEulerLabelsData = (): EulerLabelsData => ({
   assetBlocks: {},
   assetRestrictions: {},
   assetPatternRules: [],
-} as unknown as EulerLabelsData)
+  rawGeoPolicies: [],
+  geoContext: { policies: undefined, chainId: null, productByVault: {} },
+} as unknown as PublicEulerLabelsData)
 
-const labelsData = shallowRef<EulerLabelsData>(createEmptyEulerLabelsData())
+const labelsData = shallowRef<PublicEulerLabelsData>(createEmptyEulerLabelsData())
 const labelsChainId = ref<number | null>(null)
 const labelsVersion = ref(0)
 const isLoading = ref(false)
 const isReady = ref(false)
 const loadError = ref<string | undefined>()
+const LABELS_REFRESH_INTERVAL_MS = 5 * 60_000
+const LABELS_MAX_AGE_MS = 15 * 60_000
+let lastSuccessfulLoadAt = 0
 let hasSuccessfulSnapshot = false
-const pendingLabelsFetches = new Map<number, Promise<EulerLabelsData>>()
+const pendingLabelsFetches = new Map<number, Promise<PublicEulerLabelsData>>()
 let labelsLoadGeneration = 0
 let wrapPairProbeGeneration = 0
 const wrapPairs = shallowReactive<Record<string, string>>({})
 
-const setLabelsData = (data: EulerLabelsData, chainId: number | null) => {
+const setLabelsData = (data: PublicEulerLabelsData, chainId: number | null) => {
   labelsData.value = data
   labelsChainId.value = chainId
   labelsVersion.value += 1
@@ -68,21 +70,28 @@ const setLabelsData = (data: EulerLabelsData, chainId: number | null) => {
 
 export const getCurrentEulerLabelsData = (): EulerLabelsData => labelsData.value
 
+export const getEulerLabelsSourceData = () => labelsData.value
+
+export const getEulerGeoContext = () => labelsData.value.geoContext
+
 export const getEulerLabelsVersion = (): number => labelsVersion.value
 
 export const getEulerLabelWrapPairs = (): Record<string, string> => wrapPairs
 
-export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {}) => {
+export const __setEulerLabelsDataForTest = (data: Partial<PublicEulerLabelsData> = {}) => {
   labelsLoadGeneration += 1
   wrapPairProbeGeneration += 1
   pendingLabelsFetches.clear()
+  lastSuccessfulLoadAt = 0
   Object.keys(wrapPairs).forEach(key => Reflect.deleteProperty(wrapPairs, key))
   setLabelsData({
     ...createEmptyEulerLabelsData(),
     ...data,
+    geoContext: data.geoContext, // Explicit static fixtures use the compatibility evaluator.
     notExplorableEarnVaults: data.notExplorableEarnVaults ?? new Set(),
     assetPatternRules: data.assetPatternRules ?? [],
-  } as unknown as EulerLabelsData, null)
+    rawGeoPolicies: (data as Partial<PublicEulerLabelsData>).rawGeoPolicies ?? [],
+  } as unknown as PublicEulerLabelsData, null)
   isReady.value = true
   hasSuccessfulSnapshot = true
   loadError.value = undefined
@@ -105,6 +114,10 @@ const entities = toReactive(computed(() => labelsData.value.entities as Record<s
 const points = toReactive(computed(() => labelsData.value.points as Record<string, EulerLabelPointReward[]>))
 const verifiedVaultAddresses = computed(() => labelsData.value.verifiedVaultAddresses)
 const earnVaults = computed(() => labelsData.value.earnVaults)
+const vaultCandidates = computed(() => getLabelVaultCandidates(labelsData.value).vaults)
+const earnCandidates = computed(() => getLabelVaultCandidates(labelsData.value).earn)
+const visibility = computed(() => labelsData.value.visibility)
+const geoPolicies = computed(() => labelsData.value.rawGeoPolicies)
 
 const isCurrentLabelsLoad = (chainId: number, generation: number) => {
   const { getCurrentChainConfig } = useEulerAddresses()
@@ -116,12 +129,18 @@ const getLabelsFetch = (chainId: number, forceRefresh: boolean) => {
   if (pendingFetch && !forceRefresh) return pendingFetch
 
   const fetchPromise = (async () => {
-    if (forceRefresh) {
-      await invalidateSdkQueries([...LABEL_QUERY_NAMES])
+    try {
+      const bundle = await $fetch<PublicLabelsBundle>('/api/internal/public-labels', {
+        query: { chainId },
+        timeout: 35_000,
+        ...(forceRefresh && { headers: { 'cache-control': 'no-cache' } }),
+      })
+      return normalizeLabelsBundle(chainId, bundle)
+    }
+    catch (error) {
+      logWarn('labels/public-v3', error)
+      throw error
     }
-
-    const sdk = await getEulerSdk()
-    return fetchEulerLabelsDataStrict(sdk.eulerLabelsService, chainId)
   })()
 
   pendingLabelsFetches.set(chainId, fetchPromise)
@@ -133,13 +152,15 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
 
   const { getCurrentChainConfig } = useEulerAddresses()
   if (getCurrentChainConfig.value?.chainId !== chainId) return
-  if (!forceRefresh && labelsChainId.value === chainId && isReady.value) return
+  const hasCurrentSnapshot = labelsChainId.value === chainId && hasSuccessfulSnapshot
+  if (!forceRefresh && hasCurrentSnapshot && isReady.value
+    && Date.now() - lastSuccessfulLoadAt < LABELS_REFRESH_INTERVAL_MS) return
 
   const generation = ++labelsLoadGeneration
   const isCurrentLoad = () => isCurrentLabelsLoad(chainId, generation)
   if (!isCurrentLoad()) return
 
-  isReady.value = false
+  isReady.value = hasCurrentSnapshot && Date.now() - lastSuccessfulLoadAt < LABELS_MAX_AGE_MS
   isLoading.value = true
   loadError.value = undefined
   const probeGeneration = ++wrapPairProbeGeneration
@@ -150,13 +171,16 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
     setLabelsData(createEmptyEulerLabelsData(), chainId)
   }
 
-  const fetchPromise = getLabelsFetch(chainId, forceRefresh)
+  // A scheduled refresh requests current server data; concurrent ordinary
+  // callers still join the existing fetch instead of restarting it.
+  const fetchPromise = getLabelsFetch(chainId, forceRefresh || (hasCurrentSnapshot && !pendingLabelsFetches.has(chainId)))
 
   try {
     const data = await fetchPromise
     if (isCurrentLoad()) {
       setLabelsData(data, chainId)
       hasSuccessfulSnapshot = true
+      lastSuccessfulLoadAt = Date.now()
     }
     if (isCurrentLoad()) {
       void probeWrapPairs(chainId, generation, probeGeneration)
@@ -172,11 +196,27 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
     }
     if (isCurrentLoad()) {
       isLoading.value = false
-      isReady.value = hasSuccessfulSnapshot
+      isReady.value = hasSuccessfulSnapshot && Date.now() - lastSuccessfulLoadAt < LABELS_MAX_AGE_MS
     }
   }
 }
 
+const refreshLabelsIfStale = async () => {
+  if (hasSuccessfulSnapshot && Date.now() - lastSuccessfulLoadAt >= LABELS_MAX_AGE_MS) {
+    isReady.value = false
+  }
+  if (isLoading.value) return
+  const previous = labelsData.value
+  const previousChain = labelsChainId.value
+  const previousKey = getLabelsVaultLoadKey(previous)
+  await loadLabels()
+  if (isReady.value && previousChain === labelsChainId.value && previous !== labelsData.value
+    && previousKey !== getLabelsVaultLoadKey(labelsData.value)) {
+    // Open forms may hold unlisted vaults which discovery does not reload.
+    await useVaults().loadVaults({ preserveRegistry: true })
+  }
+}
+
 const retryLabels = async () => {
   if (isLoading.value) return
   await loadLabels(true)
@@ -267,6 +307,8 @@ export const useEulerLabels = () => {
     isReady,
     loadError,
     verifiedVaultAddresses,
+    vaultCandidates,
+    earnCandidates,
     products,
     entities,
     points,
@@ -274,7 +316,10 @@ export const useEulerLabels = () => {
     oracleAssessmentsStatus: oracleAdapters.oracleAssessmentsStatus,
     oracleAssessmentsAvailable: oracleAdapters.oracleAssessmentsAvailable,
     earnVaults,
+    geoPolicies,
+    visibility,
     loadLabels,
+    refreshLabelsIfStale,
     retryLabels,
     loadOracleAdapter: oracleAdapters.loadOracleAdapter,
     loadOracleAdapters: oracleAdapters.loadOracleAdapters,
diff --git a/composables/useEulerSdk.ts b/composables/useEulerSdk.ts
index 20dffb586..5fb1bd212 100644
--- a/composables/useEulerSdk.ts
+++ b/composables/useEulerSdk.ts
@@ -110,8 +110,7 @@ const buildV3ProxyApiPath = () => buildAppApiPath(INTERNAL_API_BASE)
 // one server-side TTL cache across browser tabs, (2) take the cold-TLS
 // hit once at proxy startup rather than on every user, and (3) keep
 // upstream URLs (and any auth) server-only. See
-// `server/api/internal/proxy/{merkl,fuul,incentra,subgraph}/[...path].ts` and
-// `server/api/internal/labels/[chainId]/[file].get.ts`.
+// `server/api/internal/proxy/{merkl,fuul,incentra,subgraph}/[...path].ts`.
 const buildMerklProxyApiPath = () => buildAppApiPath('/api/internal/proxy/merkl')
 const buildFuulProxyApiPath = (path = '') =>
   buildAppApiPath(`/api/internal/proxy/fuul${path ? `/${path.replace(/^\/+/, '')}` : ''}`)
@@ -124,7 +123,6 @@ const buildTurtleProxyApiPath = () => buildAppApiPath('/api/internal/proxy/turtl
 // the one actually serving queryAccountVaults.
 export const buildSubgraphProxyApiPath = (chainId: number) =>
   buildAppApiPath(`/api/internal/proxy/subgraph/${chainId}`)
-const buildLabelsProxyApiPath = () => buildAppApiPath('/api/internal/labels')
 const buildMorphoProxyApiPath = () => buildAppApiPath('/api/internal/proxy/morpho')
 const buildAaveProxyApiPath = () => buildAppApiPath('/api/internal/proxy/aave')
 
@@ -180,7 +178,6 @@ const buildSdkStaticConfig = (backend: SdkBackend) => {
   const { enableMerkl, enableIncentra, enableFuul, enableTurtle } = useDeployConfig()
   const swapApiUrl = cleanUrl(rc.swapApiUrl)
   const v3ApiUrl = buildV3ProxyApiPath()
-  const labelsProxyUrl = buildLabelsProxyApiPath()
   const subgraphUrls = buildSubgraphUrlMap()
   const { enableV3Backend, browserVaultSource, eulerInterfacesBranch } = useEnvConfig()
   // 'fast' resolves to whatever NUXT_PUBLIC_BROWSER_VAULT_SOURCE pins.
@@ -196,11 +193,6 @@ const buildSdkStaticConfig = (backend: SdkBackend) => {
     ...(v3ApiUrl ? { v3ApiUrl, tokenlistApiBaseUrl: v3ApiUrl, intrinsicApyV3ApiUrl: v3ApiUrl } : {}),
     eulerInterfacesBranch,
     deploymentsUrl: buildAppApiPath('/api/internal/euler-chains'),
-    // Labels always go through the local /api/internal/labels proxy. Server-side env
-    // (`NUXT_PUBLIC_CONFIG_LABELS_BASE_URL`/`*_REPO`) controls where the proxy
-    // fetches upstream, so callers see a single internal hostname. Same
-    // pattern as `tokenlistApiBaseUrl` above.
-    eulerLabelsBaseUrl: labelsProxyUrl,
     ...(swapApiUrl ? { swapApiUrl } : {}),
     ...(enableMerkl ? { rewardsMerklApiUrl: buildMerklProxyApiPath() } : { rewardsEnableMerkl: false }),
     // Incentra/Brevis: SDK takes the full URL for each endpoint, so map both
diff --git a/composables/useGeoBlock.ts b/composables/useGeoBlock.ts
index 035911a81..24ce650ce 100644
--- a/composables/useGeoBlock.ts
+++ b/composables/useGeoBlock.ts
@@ -11,7 +11,8 @@ import {
   patternRuleMatches,
   isWrapPair,
 } from '~/utils/eulerLabelsUtils'
-import { getEulerLabelsVersion } from '~/composables/useEulerLabels'
+import { matchesHostedGeo } from '~/utils/geo-policies'
+import { getEulerGeoContext, getEulerLabelsVersion } from '~/composables/useEulerLabels'
 import { useVaultRegistry } from '~/composables/useVaultRegistry'
 import { SANCTIONED_COUNTRIES, COUNTRY_GROUPS } from '~/entities/constants'
 
@@ -35,7 +36,11 @@ export const useGeoBlock = () => {
     }
   }
 
-  return { country, loadCountry }
+  const isPolicyAvailable = computed(() => {
+    const hosted = getEulerGeoContext()
+    return !hosted || hosted.policies !== undefined
+  })
+  return { country, loadCountry, isPolicyAvailable }
 }
 
 const isCountryInList = (codes: readonly string[]): boolean => {
@@ -133,6 +138,9 @@ export const isAssetBlockedByCountry = (asset: AssetLike): boolean => {
   // Sanctioned countries are always blocked
   if (isCountryInList(SANCTIONED_COUNTRIES)) return cacheSet(assetBlockCache, cacheKey, true)
 
+  const hosted = getEulerGeoContext()
+  if (hosted) return cacheSet(assetBlockCache, cacheKey, matchesHostedGeo(hosted, country.value, 'block', fields))
+
   if (fields.address) {
     const assetBlock = getAssetBlock(fields.address)
     if (assetBlock?.length && isCountryInList(expandBlockList(assetBlock))) {
@@ -162,11 +170,16 @@ export const isAssetRestrictedByCountry = (
   asset: AssetLike,
   opts?: { counterpart?: AssetLike },
 ): boolean => {
+  const hosted = getEulerGeoContext()
+  if (hosted && hosted.policies === undefined) return true
   const fields = toAssetFields(asset)
   if (!fields) return false
   if (country.value === undefined) return true // unresolved policy must fail closed
   if (country.value === null) return true // loaded, country unknown
 
+  // Global/chain rules cannot be exempted by a wrap or same-asset transfer.
+  if (hosted && matchesHostedGeo(hosted, country.value, 'restrict', fields, undefined, 'non-asset')) return true
+
   const cacheKey = makeAssetCacheKey(fields)
   const cached = assetRestrictedCache.get(cacheKey)
   const restricted = cached !== undefined ? cached : computeAssetRestricted(fields, cacheKey)
@@ -188,6 +201,9 @@ const computeAssetRestricted = (
   fields: { address?: string, symbol?: string, name?: string },
   cacheKey: string,
 ): boolean => {
+  const hosted = getEulerGeoContext()
+  if (hosted) return cacheSet(assetRestrictedCache, cacheKey, matchesHostedGeo(hosted, country.value!, 'restrict', fields, undefined, 'asset'))
+
   if (fields.address) {
     const assetRestricted = getAssetRestricted(fields.address)
     if (assetRestricted?.length && isCountryInList(expandBlockList(assetRestricted))) {
@@ -221,6 +237,14 @@ export const isVaultBlockedByCountry = (
   if (isCountryInList(SANCTIONED_COUNTRIES)) return true
   if (!vaultAddress) return false
 
+  const hosted = getEulerGeoContext()
+  if (hosted) {
+    if (hosted.policies === undefined) return false // No new exposure; exits are not hard blocked.
+    const asset = toAssetFields(opts?.asset ?? getVaultUnderlyingAsset(vaultAddress))
+    return matchesHostedGeo(hosted, country.value, 'block', asset, vaultAddress)
+      || !asset
+  }
+
   const productBlock = getVaultBlock(vaultAddress)
   if (productBlock?.length && isCountryInList(expandBlockList(productBlock))) return true
 
@@ -246,6 +270,18 @@ export const isVaultRestrictedByCountry = (
   if (country.value === null) return true // loaded, country unknown
   if (!vaultAddress) return false
 
+  const hosted = getEulerGeoContext()
+  if (hosted) {
+    if (hosted.policies === undefined) return true
+    const asset = toAssetFields(opts?.asset ?? getVaultUnderlyingAsset(vaultAddress))
+    if (matchesHostedGeo(hosted, country.value, 'restrict', asset, vaultAddress, 'non-asset')) return true
+    if (!asset) return true
+    if (!matchesHostedGeo(hosted, country.value, 'restrict', asset, vaultAddress, 'asset')) return false
+    const counterpart = toAssetFields(opts?.counterpart)
+    return !(asset.address && counterpart?.address
+      && (asset.address.toLowerCase() === counterpart.address.toLowerCase() || isWrapPair(asset.address, counterpart.address)))
+  }
+
   const vaultRestricted = getVaultRestricted(vaultAddress)
   if (vaultRestricted?.length && isCountryInList(expandBlockList(vaultRestricted))) return true
 
diff --git a/composables/useMarketGroups.ts b/composables/useMarketGroups.ts
index 123715cbf..6156d5e9f 100644
--- a/composables/useMarketGroups.ts
+++ b/composables/useMarketGroups.ts
@@ -1,4 +1,5 @@
 import { isEVault, type EVault } from '@eulerxyz/euler-v2-sdk'
+import { getEulerLabelProductBrandEntities } from '@eulerxyz/euler-v2-sdk/public-labels'
 import { getAddress, type Address } from 'viem'
 import { logWarn } from '~/utils/errorHandling'
 import type { EulerLabelEntity, EulerLabelProduct } from '~/entities/euler/labels'
@@ -74,6 +75,7 @@ export const buildProductGroups = (
   const groups: MarketGroup[] = []
 
   for (const [productKey, product] of Object.entries(products)) {
+    if (product.isStandalone) continue
     const memberVaults: AnyVault[] = []
     const allProductAddresses = [...product.vaults, ...(product.deprecatedVaults || [])]
     for (const vaultAddr of allProductAddresses) {
@@ -104,6 +106,7 @@ export const buildProductGroups = (
       source: 'product',
       curator,
       curatorKey,
+      brandEntities: getEulerLabelProductBrandEntities(product, entities),
       vaults: memberVaults,
       externalCollateral: [],
       unknownCollateral: [],
@@ -511,7 +514,7 @@ export const useMarketGroups = () => {
   /** Fetch a market group on demand for non-explorable products accessed via direct URL */
   const fetchMarketGroupOnDemand = async (productKey: string): Promise<MarketGroup | null> => {
     const product = products[productKey]
-    if (!product) return null
+    if (!product || product.isStandalone) return null
 
     const allAddresses = [...product.vaults, ...(product.deprecatedVaults || [])]
     if (allAddresses.length === 0) return null
@@ -575,6 +578,7 @@ export const useMarketGroups = () => {
       source: 'product',
       curator,
       curatorKey,
+      brandEntities: getEulerLabelProductBrandEntities(product, entities),
       vaults: memberVaults,
       externalCollateral: [],
       unknownCollateral: [],
diff --git a/composables/useOperationGuard.ts b/composables/useOperationGuard.ts
index e3b678174..c179d4492 100644
--- a/composables/useOperationGuard.ts
+++ b/composables/useOperationGuard.ts
@@ -6,9 +6,22 @@ import { useTosGuard } from '~/composables/guards/useTosGuard'
 import { useUnverifiedVaultGuard } from '~/composables/guards/useUnverifiedVaultGuard'
 import { clearOperationMeta, registerOperationBlocker, setOperationMeta, unregisterOperationBlocker } from '~/utils/operationGuardRegistry'
 import { clearSdkKeyringCredential, setSdkKeyringCredential } from '~/utils/sdk-keyring'
+import { useGeoBlock } from '~/composables/useGeoBlock'
 import { isVaultKeyring } from '~/utils/eulerLabelsUtils'
 
-export const useOperationGuard = (vaultAddresses: Ref<(string | undefined)[]> | (string | undefined)[]) => {
+let geoGuardSequence = 0
+
+export const useOperationGuard = (
+  vaultAddresses: Ref<(string | undefined)[]> | (string | undefined)[],
+  options: { acquiresExposure?: boolean } = {},
+) => {
+  const { isPolicyAvailable } = useGeoBlock()
+  const geoBlockerKey = `geo-policy:${++geoGuardSequence}`
+  watch(isPolicyAvailable, (available) => {
+    if (!available && options.acquiresExposure !== false) registerOperationBlocker(geoBlockerKey, 'Compliance data unavailable. Please retry.')
+    else unregisterOperationBlocker(geoBlockerKey)
+  }, { immediate: true })
+  onUnmounted(() => unregisterOperationBlocker(geoBlockerKey))
   const { address: userAddress } = useWagmi()
   const chainId = useChainId()
   const { chainId: appChainId } = useEulerAddresses()
@@ -28,6 +41,7 @@ export const useOperationGuard = (vaultAddresses: Ref<(string | undefined)[]> |
     account: userAddress,
     chainId: appChainId,
     operation,
+    allowUnavailableLabels: options.acquiresExposure === false,
   })
 
   // --- Keyring guard ---
diff --git a/composables/useTxBatch.ts b/composables/useTxBatch.ts
index e4183d40a..a20e87e4e 100644
--- a/composables/useTxBatch.ts
+++ b/composables/useTxBatch.ts
@@ -1,3 +1,4 @@
+import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
 import { computed, effectScope, ref, shallowRef, watch, type EffectScope, type Ref } from 'vue'
 import { formatUnits, getAddress, type Address, type Hash, type StateOverride } from 'viem'
 import { Account, fetchErc20SlotHints, getEulerLabelProductByVault, mergeStateOverrides } from '@eulerxyz/euler-v2-sdk'
@@ -665,7 +666,10 @@ export const fetchBaseAccountSnapshot = async (
   owner: Address,
 ): Promise<Account<IHasVaultAddress>> => {
   const fetched = await sdk.accountService.fetchAccount(chainId, owner, {
-    populateAll: true,
+    populateVaults: true,
+    populateMarketPrices: true,
+    populateUserRewards: true,
+    vaultFetchOptions: liteVaultFetchOptions,
   })
   return fetched.result as Account<IHasVaultAddress>
 }
@@ -1525,7 +1529,7 @@ export const stitchAccount = (
 ): Account<IHasVaultAddress> => {
   // Reward + intrinsic-APY metadata is populated directly on the simulated
   // vaults by simulateTransactionPlan (vaultFetchOptions), matching the base
-  // account's populateAll. The simulated account only contains the touched
+  // account's explicit population options. The simulated account only contains the touched
   // slice, so we merge positions first and then recompute USD fields that depend
   // on the full sub-account context.
   const mergedSubs: Record<string, StitchSubAccount> = {}
@@ -1771,7 +1775,7 @@ export const useTxBatch = () => {
           stateOverrideOptions: { slotHints: batchSlotHints },
           extraStateOverrides,
           // Populate the simulated vaults with reward campaigns + intrinsic
-          // (e.g. staking) APY, exactly as the base account is via populateAll —
+          // (e.g. staking) APY, exactly as the base account is via its fetch options —
           // so the simulated portfolio's net APY / ROE and per-position
           // supply/borrow costs include them, including for vaults entered for
           // the first time in the batch (which the base account can't supply).
diff --git a/composables/useVaultRegistry.ts b/composables/useVaultRegistry.ts
index 459c649a7..a8a9fcb5e 100644
--- a/composables/useVaultRegistry.ts
+++ b/composables/useVaultRegistry.ts
@@ -1,3 +1,6 @@
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
+import { getLabelVaultCandidates } from '~/utils/public-labels'
+import { getHostedEntityKeys, isVaultGovernorVerified, isEarnVaultOwnerVerified } from '~/utils/vault/governor-verification'
 import type { EulerEarn, SecuritizeCollateralVault, EVault, VaultEntity } from '@eulerxyz/euler-v2-sdk'
 import { fetchVaultCategory } from '~/utils/vault/categories'
 import { getAddress, type Address } from 'viem'
@@ -244,7 +247,7 @@ const getVerifiedEVaults = (includeNotExplorable = false): EVault[] => {
   return activeEntries()
     .filter(entry =>
       entry.type === 'evk'
-      && entry.verified === true
+      && isVerifiedVault(entry.vault.address)
       && (includeNotExplorable || !isVaultNotExplorable(entry.vault.address)),
     )
     .map(entry => entry.vault) as EVault[]
@@ -265,10 +268,28 @@ const isEarnVault = (address: string): boolean => getType(address) === 'earn'
 const isSecuritizeVault = (address: string): boolean => getType(address) === 'securitize'
 const isEVaultAddress = (address: string): boolean => getType(address) === 'evk'
 const isVerifiedVault = (address: string): boolean => {
-  const { verifiedVaultAddresses, earnVaults } = useEulerLabels()
+  const { verifiedVaultAddresses, earnVaults, visibility } = useEulerLabels()
   const normalized = normalizeAddress(address)
-  return get(normalized)?.verified === true
-    || isKnownEscrowAddress(normalized)
+  const labels = getEulerLabelsSourceData()
+  if (labels.source === 'v3-metadata') {
+    if (isEscrowVault(normalized)) return true
+    const entry = get(normalized)
+    const candidates = getLabelVaultCandidates(labels)
+    if (!entry || ![...candidates.vaults, ...candidates.earn].some(addr => normalizeAddress(addr) === normalized)) return false
+    const verificationLabels = {
+      getDeclaredEntityKeys: (addr: string) => getHostedEntityKeys(labels, addr),
+      hasEntityAddress: (key: string, addr: Address) => Object.keys(labels.entities[key]?.addresses ?? {})
+        .some(candidate => normalizeAddress(candidate) === normalizeAddress(addr)),
+    }
+    // Re-evaluate against current membership and entity addresses, never the cached positive flag.
+    return entry.type === 'earn'
+      ? isEarnVaultOwnerVerified(Object.assign({}, entry.vault as EulerEarn, { verified: true }), verificationLabels)
+      : isVaultGovernorVerified(Object.assign({}, entry.vault as EVault | SecuritizeCollateralVault, { verified: true }), verificationLabels)
+  }
+  // Registry metadata describes the fetch that created the entry. Current
+  // labels must be able to revoke that earlier positive verification.
+  return isEscrowVault(normalized)
+    || (visibility?.value === undefined && get(normalized)?.verified === true)
     || verifiedVaultAddresses.value.some(vault => normalizeAddress(vault) === normalized)
     || earnVaults.value.some(vault => normalizeAddress(vault) === normalized)
 }
diff --git a/composables/useVaults.ts b/composables/useVaults.ts
index bff62b6fd..cc2d9b76c 100644
--- a/composables/useVaults.ts
+++ b/composables/useVaults.ts
@@ -1,3 +1,5 @@
+import { getHostedEntityKeys } from '~/utils/vault/governor-verification'
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
 import type {
   EulerEarn as EulerEarnClass,
   DataIssue,
@@ -208,10 +210,10 @@ const borrowPairCache = new Map<string, AnyBorrowVaultPair>()
 
 const borrowList = computed((): AnyBorrowVaultPair[] => {
   const { getVerifiedEVaults, getVault: registryGetVault } = useVaultRegistry()
-  const { verifiedVaultAddresses } = useEulerLabels()
+  const { vaultCandidates } = useEulerLabels()
   const pairs: AnyBorrowVaultPair[] = []
   const vaultOrder = new Map(
-    verifiedVaultAddresses.value.map((address, index) => [address.toLowerCase(), index]),
+    vaultCandidates.value.map((address, index) => [address.toLowerCase(), index]),
   )
   const getVaultOrder = (address: string) => vaultOrder.get(address.toLowerCase()) ?? Number.MAX_SAFE_INTEGER
   const eVaults = [...getVerifiedEVaults(showAllLabelEntries.value)]
@@ -257,7 +259,7 @@ const borrowList = computed((): AnyBorrowVaultPair[] => {
   return pairs
 })
 
-const resetVaultsState = () => {
+const resetVaultsState = (options: { preserveRegistry?: boolean } = {}) => {
   const { clear } = useVaultRegistry()
 
   loadGeneration.value++
@@ -274,7 +276,7 @@ const resetVaultsState = () => {
   isEscrowUpdating.value = true
   isEscrowLoadedOnce.value = false
   loadedChainId.value = null
-  clear()
+  if (!options.preserveRegistry) clear()
   resetVaultCategoryCache()
 }
 
@@ -386,7 +388,7 @@ const updateEarnVaults = async (vaultAddresses: string[], generation?: number, s
     if (!isCurrentVaultLoad(gen, targetChainId)) return
     result.errors.forEach(issue => logWarn('useVaults/updateEarnVaults', issue))
 
-    const curatedAddresses = new Set(useEulerLabels().earnVaults.value.map(address => getAddress(address).toLowerCase()))
+    const curatedAddresses = new Set(useEulerLabels().earnCandidates.value.map(address => getAddress(address).toLowerCase()))
     registrySetMany((result.result.filter(Boolean) as EulerEarn[]).map(vault => ({
       address: vault.address,
       vault,
@@ -785,12 +787,12 @@ const hydrateFromServer = async (targetChainId: number, generation: number): Pro
   }
 }
 
-const loadVaults = async () => {
+const loadVaults = async (options: { preserveRegistry?: boolean } = {}) => {
   const { chainId } = useEulerAddresses()
-  const { verifiedVaultAddresses, earnVaults: earnVaultAddresses } = useEulerLabels()
+  const { vaultCandidates, earnCandidates: earnVaultAddresses } = useEulerLabels()
   const { setEscrowAddresses } = useVaultRegistry()
 
-  resetVaultsState()
+  resetVaultsState(options)
   const generation = loadGeneration.value
   const startChainId = chainId.value
 
@@ -807,8 +809,8 @@ const loadVaults = async () => {
 
   // Filter out non-explorable vaults before any on-chain work
   const explorableVaultAddresses = showAllLabelEntries.value
-    ? verifiedVaultAddresses.value
-    : verifiedVaultAddresses.value.filter(addr => !isVaultNotExplorable(addr))
+    ? vaultCandidates.value
+    : vaultCandidates.value.filter(addr => !isVaultNotExplorable(addr))
   const explorableEarnAddresses = showAllLabelEntries.value
     ? earnVaultAddresses.value
     : earnVaultAddresses.value.filter(addr => !isEarnVaultNotExplorable(addr))
@@ -938,7 +940,7 @@ const loadVaults = async () => {
   }
 }
 const getVault = async (address: string): Promise<EVault> => {
-  const { verifiedVaultAddresses } = useEulerLabels()
+  const { vaultCandidates } = useEulerLabels()
   const {
     getType,
     getVault: registryGetVault,
@@ -959,11 +961,11 @@ const getVault = async (address: string): Promise<EVault> => {
     return registryGetVault(normalizedAddress) as EVault
   }
 
-  // If still no type info and address is in verifiedVaultAddresses but not in registry,
+  // If still no type info and address is in vaultCandidates but not in registry,
   // do an async check to avoid infinite wait on securitize vaults
   if (
     !vaultType
-    && verifiedVaultAddresses.value.includes(normalizedAddress)
+    && vaultCandidates.value.includes(normalizedAddress)
     && !registryHas(normalizedAddress)
   ) {
     const isSecuritize = await isSecuritizeVault(normalizedAddress)
@@ -972,7 +974,7 @@ const getVault = async (address: string): Promise<EVault> => {
     }
   }
 
-  if (verifiedVaultAddresses.value.includes(normalizedAddress) && !isVaultNotExplorable(normalizedAddress)) {
+  if (vaultCandidates.value.includes(normalizedAddress) && !isVaultNotExplorable(normalizedAddress)) {
     await until(computed(() => Boolean(registryGetVault(normalizedAddress)))).toMatch(Boolean)
     return registryGetVault(normalizedAddress) as EVault
   }
@@ -994,7 +996,7 @@ const getVault = async (address: string): Promise<EVault> => {
 const getEarnVault = async (address: string): Promise<EulerEarn> => {
   const { getVault: registryGetVault, set: registrySet } = useVaultRegistry()
   const normalizedAddress = getAddress(address)
-  const { earnVaults } = useEulerLabels()
+  const { earnCandidates: earnVaults } = useEulerLabels()
   const targetChainId = resolveTargetChainId()
 
   const fetchAndStoreEarnVault = async () => {
@@ -1248,6 +1250,8 @@ export const useVaults = () => {
     const { entities } = useEulerLabels()
     return {
       getDeclaredEntityKeys: (vaultAddress) => {
+        const hostedKeys = getHostedEntityKeys(getEulerLabelsSourceData(), vaultAddress)
+        if (hostedKeys !== undefined) return hostedKeys
         const productKey = getProductKeyByVault(vaultAddress)
         if (!productKey) return undefined
         const product = getProductByVault(vaultAddress)
diff --git a/docs/architecture.md b/docs/architecture.md
index 0eb0edf87..c8fc6dcfe 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -182,8 +182,8 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 ├─────────────────────────────────────────────────────────────────┤
 │              Server-Side Proxy Layer (Nuxt server/)             │
 │  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐                │
-│  │ /api/internal│ │ /api/internal/pyth   │ │ /api/internal/labels │                │
-│  │ /token-list │ │ /updates    │ │ /rpc/[chain]│                │
+│  │ /api/internal│ │ /api/internal/pyth   │ │ /api/internal/public │                │
+│  │ /token-list │ │ /updates    │ │ -labels, /rpc/[chain]│       │
 │  └─────────────┘ └─────────────┘ └─────────────┘                │
 ├─────────────────────────────────────────────────────────────────┤
 │                    External Services                            │
@@ -195,14 +195,13 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 └─────────────────────────────────────────────────────────────────┘
 ```
 
-**Server-Side Proxy Layer**: External data sources (token lists, Pyth Hermes, labels, Data V3 oracle assessments, RPC) are proxied through Nuxt server endpoints rather than called directly from the browser. This provides caching, rate limiting, CORS avoidance, and keeps credentials server-side. Vault reads use the Euler SDK from the client layer. See [Development Guide - Server-Side Data Proxies](./development-guide.md#server-side-data-proxies) for the full endpoint reference.
+**Server-Side Proxy Layer**: External data sources (token lists, Pyth Hermes, Public Labels, Data V3 oracle assessments, RPC) are reached through Nuxt server endpoints rather than called directly from the browser. This provides caching, rate limiting, CORS avoidance, and keeps credentials server-side. Vault reads use the Euler SDK from the client layer. See [Development Guide - Server-Side Data Proxies](./development-guide.md#server-side-data-proxies) for the full endpoint reference.
 
 **Proxy cache strategy**:
 
 | Endpoint | TTL | Notes |
 |----------|-----|-------|
-| `/api/internal/labels/{file}` | 5 min | Query-shape labels endpoint (`?chainId=N`); used internally by Lite helpers. 404 → empty shape; stale-fallback on upstream error |
-| `/api/internal/labels/{chainId}/{file}` | 5 min | Path-shape labels endpoint matching the SDK's default `eulerLabelsBaseUrl` template; shares the underlying cache with the query-shape route |
+| `/api/internal/public-labels` | 5 min | One chain/version-scoped Public Labels V3 bundle; in-flight dedup and bounded stale fallback |
 | `/api/internal/token-list` | 5 min | Four sources merged via `Promise.allSettled` (Euler SDK, DefiLlama, Uniswap, Merkl); per-source cache with stale fallback |
 | `/api/internal/v3/oracles/adapter-assessments/{address}?chainId={chainId}` | request-scoped | Lazy per-address Data V3 assessment fetch through the exact SDK browser endpoint allowlist |
 | `/api/internal/euler-chains` | 5 min | Static chain-agnostic config from `euler-interfaces` repo. 7-day stale window so a running instance outlives upstream outages |
@@ -216,7 +215,7 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 
 Every cacheable proxy above uses the same pattern: TTL cache for fresh hits, stale-cache fallback on upstream failure, and in-flight request deduplication so concurrent cache-miss callers (e.g. warm-cache racing real traffic) collapse onto a single upstream fetch per cache key. The in-flight dedup pattern itself is a shared util — `createInFlightDedup` / `scheduleBackgroundRefresh` in `server/utils/in-flight.ts`. The per-host proxies (`/api/internal/proxy/{merkl,fuul,incentra,subgraph}`) share a common forwarder at `server/utils/external-proxy.ts`.
 
-`server/plugins/warm-cache.ts` pre-populates labels and token-list for every enabled chain, plus `/api/internal/euler-chains` and the runtime ABI manifests once globally, on a 5-min cycle. The vault snapshot runs on its own faster timer (1 min when V3 is configured, 5 min otherwise) so V3-backed refreshes stay tight without hammering upstream. Every warm task is a **direct function call** to a `refreshX()` that bypasses the handler's fresh-cache short-circuit and writes straight to the cache. This matters: if warm cycled via HTTP, the handler would short-circuit on the still-fresh entry from the previous cycle (age ≈ TTL − 2 s) and the entry would then expire with no refresh until the next cycle — leaving a stale window per cycle. With direct refresh calls, the cache is always rewritten while the previous entry is still serving live traffic, so user requests arriving during a refresh continue to read the fresh previous entry (no blocking on the in-flight refresh). Warming runs fire-and-forget so Nitro's listener is never delayed; caches are typically hot within ~5 s of boot, and users arriving before that just pay the usual cold-upstream latency for whichever endpoints they hit.
+`server/plugins/warm-cache.ts` pre-populates the Public Labels bundle, its temporary effective-policy overlay, and the token list for every enabled chain, plus Euler Chains and runtime ABI manifests once globally, on a 5-minute cycle. The vault snapshot runs on its own faster timer (1 minute when V3 is configured, 5 minutes otherwise). Warm calls refresh the shared utilities directly; concurrent requests deduplicate against the same in-flight work, and stale fallback is bounded by `createTtlCache`.
 
 For the full setup — per-host proxies, vault snapshot pipeline, two-pass client hydration, V3-conditional cadence, and the bigint wire codec — see [Server-Side Caching](./server-side-caching.md).
 
@@ -247,7 +246,7 @@ The Explore page (`pages/explore/index.vue`) provides a market discovery interfa
 
 The `useMarketGroups` composable (`composables/useMarketGroups.ts`) implements a hybrid grouping algorithm:
 
-1. **Product-label groups** — Vaults are first assigned to groups using `products` metadata from euler-labels. Each product defines a curator entity, name, and list of vault addresses.
+1. **Product-label groups** — Vaults are first assigned to groups using versioned Public Labels product metadata from V3. Each product defines its managing entity, optional display-only co-brands, name, and assigned vaults. Manager ownership and governance verification use only the managing entity.
 2. **Collateral graph augmentation** — For each group, external collateral vaults (referenced by member vaults but not in the group) are resolved and attached.
 3. **Orphan clustering** — Vaults not assigned to any product are clustered using a BFS connected-component algorithm over their collateral relationships. This produces "Ungrouped" markets.
 4. **Async TVL resolution** — Group metrics (TVL, available liquidity, borrowed) are resolved asynchronously using USD pricing.
diff --git a/docs/development-guide.md b/docs/development-guide.md
index 6eed4ed72..e4a2359a8 100644
--- a/docs/development-guide.md
+++ b/docs/development-guide.md
@@ -73,7 +73,7 @@ Configuration is split into three mechanisms:
 
 1. **`useEnvConfig()`** (`composables/useEnvConfig.ts`) — API URLs, Pyth, Reown, branding, and deployment announcements. Injected at runtime via `server/plugins/app-config.ts` into `window.__APP_CONFIG__`, with Nuxt public runtime config as a fallback when the injected config is unavailable. Browser V3 data services use the same-origin `/api/internal/v3` proxy. The proxy reads `V3_API_URL`, `EULER_SDK_V3_API_URL`, or `NUXT_PUBLIC_V3_API_URL` for the upstream URL and `EULER_SDK_V3_API_KEY` for the optional server-side API key.
 
-2. **Nuxt `runtimeConfig`** (`useDeployConfig()`) — social links, feature flags, label source URLs, and static deployment fallbacks. Set via `NUXT_PUBLIC_CONFIG_*` env vars. Includes `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` and `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL` for configuring upstream data sources. Both are fetched through server-side proxy endpoints with 5-minute caching — see [Server-Side Data Proxies](#server-side-data-proxies) below.
+2. **Nuxt `runtimeConfig`** (`useDeployConfig()`) — social links, feature flags, and static deployment fallbacks. Set via `NUXT_PUBLIC_CONFIG_*` env vars. The temporary visibility/geo compatibility policy is server-only and configured through `EFFECTIVE_POLICY_*`; display content comes from Public Labels V3. Explicit chain and ABI URLs configure their respective upstream sources.
 
 3. **Chain config** (`useChainConfig()`) — derived dynamically from `RPC_URL_<chainId>` env vars at server startup, injected via `window.__CHAIN_CONFIG__`.
 
@@ -91,8 +91,7 @@ External metadata (contract addresses, labels, and Data V3 oracle assessments) i
 |----------|----------------|-----------|------------------|
 | `GET /api/internal/euler-chains` | `EulerChains.json` from `EULER_SDK_EULER_INTERFACES_BRANCH` (`master`) | 5 min, 7-day stale window | `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL` (takes precedence over the branch vars) |
 | `GET /api/internal/abis/:contract` | `abis/{contract}.json` from euler-interfaces (allowlist: `AccountLens`, `VaultLens`, `UtilsLens`; SDK `setQueryABI` target) | 5 min, 7-day stale window | `NUXT_PUBLIC_CONFIG_EULER_ABIS_BASE_URL` (takes precedence over the branch vars) |
-| `GET /api/internal/labels/:file?chainId=X` | `{chainId}/{file}` from euler-labels (query-shape; used by Lite helpers). Reads through the shared TTL cache — a fresh entry short-circuits without upstream. | 5 min read-through | `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` |
-| `GET /api/internal/labels/:chainId/:file` | `{chainId}/{file}` from euler-labels (path-shape; SDK `eulerLabelsBaseUrl` template). Calls `refreshLabelFile()` directly — bypasses the fresh-cache check and joins any in-flight refresh for the same `scope:file`. Shared cache is write + stale-fallback only on this route. | 5 min shared cache (stale fallback; not read-through) | `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` |
+| `GET /api/internal/public-labels?chainId=X&version=latest` | Versioned Public Labels V3 content plus the temporary effective-policy overlay | 5 min server cache; 30 s browser/CDN | `V3_API_URL`, optional `EULER_SDK_V3_API_KEY`; `EFFECTIVE_POLICY_BASE_URL` for policy only |
 | `GET /api/internal/token-list?chainId=X` | Euler V3 + Uniswap + DefiLlama + Merkl reward-tokens | 5 min | `V3_API_URL`, `EULER_SDK_V3_API_URL`, `NUXT_PUBLIC_V3_API_URL`, `EULER_SDK_V3_API_KEY`, `NUXT_PUBLIC_CONFIG_UNISWAP_TOKEN_LIST_URL`, `NUXT_PUBLIC_CONFIG_DEFILLAMA_TOKEN_LIST_URL` |
 | `GET /api/internal/vaults?chainId=X` | Pre-computed chain vault snapshot built by the server-side SDK | 2 min (V3 configured) / 5 min (no V3) | `V3_API_URL`, `EULER_SDK_V3_API_URL`, `NUXT_PUBLIC_V3_API_URL` (presence selects cadence) |
 | `GET\|HEAD /api/internal/proxy/merkl/:path` | `api.merkl.xyz/v4` (`opportunities`, `users`, `campaigns` allowlist) | 60 s | — |
@@ -107,10 +106,10 @@ All listed endpoints use rate limiting. Local-TTL endpoints (everything in the t
 
 **Startup cache warming**: `server/plugins/warm-cache.ts` runs at Nitro startup. Two timers:
 
-- **Global cycle (5 min)**: `/api/internal/euler-chains` once, the runtime ABI manifests once, cross-chain `labels/all/assets.json` once, then per-chain `/api/internal/labels/*` and `/api/internal/token-list` for every enabled non-deprecated chain, serialized so cross-chain upstreams dedupe via the in-flight cache.
+- **Global cycle (5 min)**: Euler Chains and runtime ABIs once, the cross-chain effective asset policy once, then each enabled non-deprecated chain's Public Labels bundle, effective product/Earn/asset policy, and token list.
 - **Vaults cycle (1 min when V3 is configured, otherwise 5 min)**: `/api/internal/vaults` per chain, also serialized.
 
-Each warm task is a **direct function call** (`refreshX()`) that bypasses any handler fresh-cache short-circuit and forces an upstream fetch, so the entry is always overwritten before it can expire. Handlers that read through the cache (query-shape labels, vault snapshot, and similar) keep serving the still-fresh previous entry during that refresh. The path-shape labels handler does not: it calls `refreshLabelFile()` and joins the in-flight refresh instead. Warming runs in the background — Nitro's node-server preset doesn't await plugins before starting the HTTP listener, so users arriving in the first ~5 s of a freshly-booted instance's lifetime pay the usual cold-upstream latency for whichever endpoints they hit; everyone after that sees cached responses from read-through handlers.
+Each warm task is a **direct function call** (`refreshX()`) that forces an upstream fetch and replaces the cached value before expiry. Concurrent refreshes join the same in-flight operation; request paths continue to use the previous fresh value or the bounded stale fallback. Warming runs in the background — Nitro's node-server preset does not await plugins before starting the HTTP listener, so users arriving in the first few seconds of a freshly booted instance may pay the cold-upstream latency.
 
 For the full setup — per-host proxies, vault snapshot pipeline, two-pass client hydration, V3-conditional cadence, and the bigint wire codec — see [Server-Side Caching](./server-side-caching.md).
 
diff --git a/docs/geo-blocking.md b/docs/geo-blocking.md
index dd3f3fc82..9da6d04b3 100644
--- a/docs/geo-blocking.md
+++ b/docs/geo-blocking.md
@@ -7,7 +7,7 @@ This document explains how Euler Lite restricts vault access based on the user's
 Certain jurisdictions are prohibited from interacting with specific vaults (or all vaults) due to regulatory requirements. The geo-blocking system:
 
 1. Detects the user's country from an HTTP response header.
-2. Evaluates blocking rules at four levels: global sanctions, product-level blocks, per-vault overrides, and **asset-level blocks** keyed by the vault's underlying ERC-20.
+2. Evaluates blocking rules at four levels: global sanctions, V3 global/chain rules, product/vault rules, and **asset-level blocks** keyed by the vault's underlying ERC-20.
 3. Evaluates soft restriction rules that prevent users from acquiring more exposure to a restricted asset.
 4. Extends those rules to the arbitrary-asset selectors used by pay-with (repay), withdraw-to, borrow swap-in, and swap-deposit flows, so a user can't route around a vault block by picking the blocked underlying asset as a swap leg.
 5. Prevents blocked users from submitting transactions while still showing blocked vaults in the UI (dimmed, with a "Restricted" chip).
@@ -93,234 +93,32 @@ Request → cors.ts (strip client x-country-code, set response x-country-code fr
 
 When the gate blocks a request or flags VPN/proxy usage it logs the request path. VPN evidence is audit-only here — it does not fail the request, and it does not replace [address screening](./address-screening.md) at wallet connect. Because some `/api/*` routes embed a wallet address in the path (e.g. `/api/internal/proxy/merkl/users/0x.../rewards`), the path is first run through `safePathTemplate` (`server/utils/observability.ts`), which replaces address and numeric segments with `:address`/`:number` placeholders. This keeps wallet addresses (PII) out of the log sink while preserving the route shape for observability. Routing and matching still operate on the real path.
 
-## Blocking Rules
+## Hosted policy evaluation
 
-**File**: `composables/useGeoBlock.ts`
+The SDK paginates live `GET /v3/geo-policies` without a metadata version or chain filter and validates the complete collection. Lite embeds it with the published metadata snapshot. `utils/geo-policies.ts` evaluates `countriesResolved` directly; country groups such as EEA are expanded by V3, including Norway.
 
-The function `isVaultBlockedByCountry(vaultAddress)` evaluates three layers in order:
+Rules accumulate across global, chain, product, vault and asset scopes. A vault rule cannot remove a product restriction. Product matching uses the resolved vault's current `productId`, including vaults outside the discovery allowlist. Non-null chain/product/vault selectors constrain matching; asset address, symbol, name and regex selectors are alternatives. Address and asset text matching is case-insensitive. Standalone asset selectors apply global/chain/asset rules and cannot resolve product or vault scopes.
 
-### 1. Sanctioned Countries (Global Block)
+Regex expressions are compile-checked and limited to 512 characters by the SDK. Lite treats token metadata longer than 128 characters as a match without running its regex. Missing vault asset metadata remains fail-closed. Same-asset and known wrap-pair exemptions apply only to soft asset restrictions, never global/product/vault restrictions, hard blocks, or unavailable policy data.
 
-Defined in `entities/constants.ts` as `SANCTIONED_COUNTRIES`. Users from these countries are blocked from **all** vaults unconditionally:
+Sanctions remain in `SANCTIONED_COUNTRIES`, enforced independently at the server edge and in client helpers. The compatibility evaluator and `COUNTRY_GROUPS` remain available for static label data; hosted snapshots always use V3 rules. `LABELS_SOURCE=static` selects the authored-file engine.
 
-```text
-AF, CF, CU, KP, CD, ET, IR, IQ, LB, LY, ML, MM, NI, RU, SO, SS, SD, SY, VE, YE, ZW
-```
-
-This list is checked first. If the user's country matches, the function returns `true` immediately without checking product or vault-level blocks.
-
-### 2. Product-Level Blocks
-
-Each product in `products.json` (from the euler-labels repo) can have a `block` array of country codes or group aliases:
-
-```json
-{
-  "name": "Example Vault",
-  "vaults": ["0x1234..."],
-  "block": ["US", "EU"]
-}
-```
-
-All vaults listed under that product inherit the block list. The function `getVaultBlock(address)` in `useEulerLabels.ts` resolves this.
-
-### 3. Per-Vault Overrides
-
-A product can override blocking rules for individual vaults via `vaultOverrides`:
-
-```json
-{
-  "name": "Example Product",
-  "vaults": ["0xAAA...", "0xBBB..."],
-  "block": ["US"],
-  "vaultOverrides": {
-    "0xBBB...": {
-      "block": ["US", "EU", "CH"]
-    }
-  }
-}
-```
-
-When a vault has an override with a `block` field, the override **replaces** (not merges with) the product-level block list. In the example above, `0xAAA` is blocked for `US` only, while `0xBBB` is blocked for `US`, `EU`, and `CH`.
-
-### 4. Earn Vault Blocks
-
-Earn vaults have a separate blocking mechanism in `earn-vaults.json`. Entries can be a plain address string (no blocking) or an object with a `block` array:
-
-```json
-[
-  "0x1111...",
-  { "address": "0x2222...", "block": ["EU", "CH"] }
-]
-```
-
-These are stored in a dedicated `earnVaultBlocks` map (keyed by lowercase address) and checked by `getEarnVaultBlock(address)`.
-
-### 5. Asset-Level Blocks
-
-A vault's **underlying ERC-20 asset** can carry its own block rules in `assets.json` (from the euler-labels repo). When the user's country matches a rule for a vault's underlying asset, the vault is treated as blocked — in addition to any product-level or earn-level rules. This is the primary mechanism for compliance-driven blocks that apply to a token regardless of which vault wraps it.
-
-The same rules also drive the `SwapTokenSelector`, so users cannot route around a vault block by picking the blocked underlying as a pay-with, withdraw-to, borrow swap-in, or swap-deposit source.
-
-#### Address-based entries
-
-```json
-[
-  { "address": "0xf6b1117ec07684D3958caD8BEb1b302bfD21103f", "block": ["CA", "US"] },
-  { "address": "0xFeDC5f4a6c38211c1338aa411018DFAf26612c08", "restricted": ["EU", "EFTA"] }
-]
-```
-
-Stored in the `assetBlocks` and `assetRestrictions` maps (keyed by lowercase address), accessed via `getAssetBlock(address)` and `getAssetRestricted(address)`.
-
-#### Pattern-based entries
-
-External token lists (Uniswap, DefiLlama, Merkl) surface addresses the labels repo hasn't enumerated. When a given issuer publishes many tokens with a shared naming convention (e.g. Ondo's USDY, OUSG, OMPL), pattern rules match by symbol or name instead of address:
-
-```json
-[
-  { "symbols": ["USDY", "OUSG", "OMPL"], "block": ["CA", "US"] },
-  { "symbolRegex": "^(USDY|OUSG|OMPL)$", "restricted": ["EU"] },
-  { "names": ["Ondo Short-Term US Govt"], "block": ["CA", "US"] },
-  { "nameRegex": "^Ondo\\s", "block": ["CA", "US"] }
-]
-```
-
-- All string comparisons are **case-insensitive**. Regex fields are compiled with the `i` flag at load time.
-- An entry may combine multiple match fields (`symbols` + `nameRegex`, etc.); they are **OR-composed** — the entry matches if any populated match field matches.
-- Invalid regex strings are rejected at the proxy layer (compile check + 512-char cap) and dropped with a warning at load time.
-- Pattern entries compile into `assetPatternRules`, an ordered list iterated on each asset lookup. Exact-match symbols/names are kept in pre-lowercased `Set`s for O(1) membership; regexes stay as `RegExp` objects.
-
-#### Cross-chain rules: `all/assets.json`
-
-Per-chain `assets.json` files (e.g. `1/assets.json`, `8453/assets.json`) are the right home for address-based rules because addresses are chain-specific. Pattern rules usually apply identically across every chain (USDY is USDY wherever it's deployed), so the labels repo hosts them in a special cross-chain directory:
-
-```text
-euler-labels/
-├── 1/assets.json
-├── 8453/assets.json
-└── all/assets.json        ← cross-chain rules (usually patterns)
-```
-
-The `/api/internal/labels/assets.json?chainId=N` proxy transparently **unions** the per-chain file with `all/assets.json` before returning — the client sees a single merged list. If either file is absent upstream the proxy serves only the present side (empty-shape fallback on 404, matching every other label file). Both files accept both shapes; conventionally addresses live per-chain and patterns live in `all/`, but nothing enforces that split.
-
-The global file is warmed once on server boot in `warm-cache.ts` alongside the per-chain entries.
-
-#### Resolution via the vault registry
-
-`isVaultBlockedByCountry(address)` resolves the vault's underlying asset via `useVaultRegistry().getVault(address).asset` and calls `isAssetBlockedByCountry(asset)`, passing the full asset object (address + symbol + name) so pattern rules also fire. Before the registry is warm the lookup returns `undefined` and the asset-level branch is a no-op — product/earn-level rules still apply as before.
-
-## Restriction Rules (Soft Block)
-
-**File**: `composables/useGeoBlock.ts`
+## Availability and durable fallback
 
-The function `isVaultRestrictedByCountry(vaultAddress)` checks for soft restrictions:
+`server/utils/geo-policy-source.ts` refreshes the full live collection every five minutes, deduplicates concurrent reads, and writes an atomic, upstream-specific checkpoint containing `policies` and `fetchedAt`. A failed or malformed fetch retains last-known-good policies without an age limit and logs their age. A successful empty collection clears previous rules. Partial pagination never replaces the checkpoint.
 
-### Per-Vault Override Restrictions
+Set `GEO_POLICY_CACHE_DIR` to a mounted persistent directory to survive container replacement. The default `.data/geo-policies` survives process restarts on the same filesystem. Failed checkpoint writes are logged; current validated live rules remain in use, but that write is not durable. Log monitoring must alert on stale-policy age and checkpoint failures; this code does not provision production alerting.
 
-A product can specify `restricted` in vault overrides (vault-level only, no product-level fallback):
+A cold start with no valid policy snapshot fails the entire labels response. The client distinguishes unavailable policies from an authored empty collection. `useOperationGuard` registers “Compliance data unavailable. Please retry.” for acquisition forms, including direct wallet deposits. Repay and withdrawal forms opt out of this availability blocker. Simple withdrawals/redemptions and repayment without swaps can acknowledge unverified-vault risk when labels are unavailable, in both the form and final reviewed-execution policy. Missing/wrong-chain vault metadata still blocks; swaps, borrowing and mixed acquisition batches still require labels. Country, sanctions and operation-specific checks still apply. Soft restriction helpers also deny acquisition while policies are unavailable, including wrap exemptions.
 
-```json
-{
-  "name": "Example Product",
-  "vaults": ["0xAAA...", "0xBBB..."],
-  "vaultOverrides": {
-    "0xBBB...": {
-      "restricted": ["US", "EU"]
-    }
-  }
-}
-```
-
-### Earn Vault Restrictions
-
-Earn vault entries in `earn-vaults.json` can also have a `restricted` array:
-
-```json
-[
-  "0x1111...",
-  { "address": "0x2222...", "restricted": ["US"], "block": ["IR"] }
-]
-```
-
-A vault can have both `block` and `restricted`. The `block` check takes precedence — if a vault is blocked, the restricted check is not evaluated (blocked is stricter).
-
-### Asset-Level Restrictions
-
-`assets.json` entries (per-chain and `all/`) accept the same `restricted` field with the same semantics as vault-level restrictions. Both address entries and pattern entries support it:
-
-```json
-[
-  { "address": "0xFeDC...", "restricted": ["EU"] },
-  { "symbols": ["USDY"], "restricted": ["EU"] }
-]
-```
-
-Because asset-level rules propagate to `isVaultRestrictedByCountry(address)` via the vault's underlying, a soft-restriction on asset X automatically restricts every vault that uses X — including Earn and Securitize variants — and every swap flow that would acquire X.
-
-#### Soft-restrict semantics by flow context
-
-The picker / flow behavior is preserved by context:
-
-| Flow context | Hard-block | Soft-restrict |
-|---|---|---|
-| Swap target / receive-as / borrow-into / multiply (acquire) | Disabled | Disabled |
-| Swap source / pay-with / swap-deposit input (reduce) | Disabled | Allowed |
-
-## Country Groups
-
-**File**: `entities/constants.ts`
-
-Block and restriction lists can reference group aliases instead of individual country codes. The `expandBlockList()` function in `useGeoBlock.ts` resolves these before matching:
-
-| Alias | Expansion | Count |
-|-------|-----------|-------|
-| `EU` | All 27 EU member states (AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE) | 27 |
-| `EEA` | EU + IS, LI, NO | 30 |
-| `EFTA` | IS, LI, NO, CH | 4 |
-
-Group aliases can be mixed with individual codes: `["EU", "CH", "US"]` blocks all EU countries plus Switzerland and the US.
-
-## Helper Functions
+## Helper functions
 
-### `isVaultBlockedByCountry(address): boolean`
-
-The core hard-block check. Returns `true` if the vault is blocked for the detected country or its underlying asset cannot be resolved. Callers that already hold a chain-scoped vault can pass its asset through `opts.asset`.
-
-### `isAnyVaultBlockedByCountry(...addresses): boolean`
-
-Returns `true` if **any** of the provided vault addresses are blocked. Used on action pages that involve multiple vaults (e.g. a borrow position has both a collateral vault and a borrow vault).
-
-### `isVaultRestrictedByCountry(address): boolean`
-
-The soft-restriction check. Returns `true` if the vault has a `restricted` entry matching the user's country or its underlying asset cannot be resolved. Only checks vault-level overrides and earn vault restrictions (no product-level fallback).
-
-### `isAnyVaultRestrictedByCountry(...addresses): boolean`
-
-Returns `true` if **any** of the provided vault addresses are restricted. Used for multi-vault restriction checks (e.g. multiply requires checking both long and short vaults).
-
-### `isAssetBlockedByCountry(asset: AssetLike): boolean`
-
-Asset-level hard-block check. Accepts either a bare address string (backward compat) or an asset-like object `{ address?, symbol?, name? }` — `VaultAsset` satisfies the latter. The object form is required for pattern rules to fire; string-only callers skip the pattern path.
-
-Lookup order: sanctioned-country check → address-map lookup (via `getAssetBlock`) → iterate `assetPatternRules` and test each rule's `symbolsLower` / `symbolRegex` / `namesLower` / `nameRegex` against the lowercased asset symbol/name.
-
-### `isAssetRestrictedByCountry(asset: AssetLike): boolean`
-
-Asset-level soft-restriction check. Same signature and lookup order as the block variant, but consults `getAssetRestricted` and rule `restricted` lists.
-
-Both helpers are called from form-level sites (pay-with, withdraw-to, swap-deposit source, borrow swap-in) where the full asset object is in hand, and also from the `SwapTokenSelector` per visible row. The vault-level helpers (`isVaultBlockedByCountry` / `isVaultRestrictedByCountry`) use them internally by resolving `vault.asset` via the registry.
-
-### `getVaultTags(address, context?): { tags: string[], disabled: boolean }`
-
-Combines geo-blocking, soft-restriction, and deprecation status into a single result for UI consumption. Returns tags like `["Restricted"]`, `["Deprecated"]`, or `["Restricted", "Deprecated"]`.
-
-The `context` parameter controls when the "Restricted" chip appears for soft-restricted vaults:
-
-| Context | When Used | Shows Restricted Chip? |
-|---------|-----------|----------------------|
-| `'browse'` (default) | Browse pages, general display | Only for hard-blocked vaults |
-| `'swap-target'` | Vault selection modals for swap/borrow TO targets | Yes (prevents acquiring exposure) |
-| `'supply-source'` | Vault selection modals for supply FROM sources, multiply collateral | No (user is spending, not acquiring) |
+- `isVaultBlockedByCountry(address, { asset? })` combines sanctions and matching V3 block policies.
+- `isVaultRestrictedByCountry(address, { asset?, counterpart? })` evaluates soft restrictions.
+- `isAnyVaultBlockedByCountry` / `isAnyVaultRestrictedByCountry` combine decisions across vaults.
+- `isAssetBlockedByCountry` / `isAssetRestrictedByCountry` evaluate standalone asset choices.
+- `getVaultTags(address, context)` presents restrictions and deprecation. `swap-target` disables soft-restricted destinations; `supply-source` permits existing exposure to be used for repayment.
+- `useGeoBlock().isPolicyAvailable` distinguishes successful empty data from unavailable data.
 
 ## UI Enforcement
 
@@ -407,125 +205,10 @@ Uses `useSwapCollateralOptions` with `tagContext: 'supply-source'` so collateral
 
 Existing positions in blocked vaults show the "Restricted" chip. No chip for soft-restricted vaults (positions are already open).
 
-## Data Flow
+## Data flow and validation
 
-```text
-App Startup
-  │
-  ├─ loadCountry() ─► HEAD / ─► cors.ts sets x-country-code from the edge context
-  │                  ◄─────────── x-country-code: DE ──────────────────────────
-  │                  country ref: "DE" (5-min cache)
-  │                  undefined → null (fail-closed) on unknown/error (geo-capable edge, prod)
-  │                  undefined → "--" (non-null sentinel, fail-open) on unknown in dev or under the `none` preset
-  │
-  └─ loadLabels() ──► euler-labels data source (GitHub or S3/CDN) ─► products.json ─► product.block
-                                                                    product.vaultOverrides[addr].block
-                                                                    product.vaultOverrides[addr].restricted
-                                                 ► earn-vaults.json ─► earnVaultBlocks map
-                                                                       earnVaultRestrictions map
-                                                 ► assets.json ─────► union of {chainId}/assets.json
-                                                                       + all/assets.json
-                                                                     → assetBlocks / assetRestrictions maps
-                                                                       (address entries)
-                                                                     → assetPatternRules list
-                                                                       (compiled symbols/regex)
-                                                   (5-min cache)
-
-Server-Side (every API request):
-  geo-gate.ts reads the country from the edge context (EDGE_PROVIDER preset)
-  ├─ unknown/XX/T1 + geo-capable edge + prod → HTTP 451 (fail-closed)
-  ├─ unknown + dev, or `none` preset → allow
-  └─ known country → check SANCTIONED_COUNTRIES → block or allow
-
-Runtime Check: isVaultBlockedByCountry("0x1234...")
-  │
-  ├─ country === undefined (loading) → true (policy pending, fail-closed)
-  ├─ country === null (unknown, fail-closed) → true (blocked)
-  │
-  ├─ 1. SANCTIONED_COUNTRIES includes "DE"?  ─► yes → blocked
-  │
-  ├─ 2. getVaultBlock("0x1234...")
-  │     └─ product.vaultOverrides["0x1234..."]?.block ?? product.block
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → blocked
-  │
-  ├─ 3. getEarnVaultBlock("0x1234...")
-  │     └─ earnVaultBlocks[lowercase addr]
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → blocked
-  │
-  ├─ 4. Asset-level: resolve vault.asset via vault registry
-  │     ├─ unresolved asset → blocked
-  │     └─ isAssetBlockedByCountry({ address, symbol, name })
-  │           ├─ assetBlocks[asset.address.toLowerCase()] includes "DE"? ─► blocked
-  │           └─ iterate assetPatternRules (with block list):
-  │                 symbolsLower.has(symbol.toLowerCase()) ||
-  │                 symbolRegex.test(symbol.toLowerCase()) ||
-  │                 namesLower.has(name.toLowerCase())     ||
-  │                 nameRegex.test(name.toLowerCase())       ─► blocked
-  │
-  └─ 5. Not blocked → return false
-
-Runtime Check: isVaultRestrictedByCountry("0x1234...")
-  │
-  ├─ country === undefined (loading) → true (policy pending, fail-closed)
-  ├─ country === null (unknown, fail-closed) → true (restricted)
-  │
-  ├─ 1. getVaultRestricted("0x1234...")
-  │     └─ product.vaultOverrides["0x1234..."]?.restricted (no product fallback)
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → restricted
-  │
-  ├─ 2. getEarnVaultRestricted("0x1234...")
-  │     └─ earnVaultRestrictions[lowercase addr]
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → restricted
-  │
-  ├─ 3. Asset-level: resolve vault.asset via vault registry
-  │     ├─ unresolved asset → restricted
-  │     └─ isAssetRestrictedByCountry({ address, symbol, name })
-  │           ├─ assetRestrictions[asset.address.toLowerCase()] → restricted
-  │           └─ iterate assetPatternRules (with restricted list):
-  │                 symbol/name match as above ─► restricted
-  │
-  └─ 4. Not restricted → return false
-```
+V3 live policies → SDK pagination/validation → Lite disk checkpoint → atomic labels bundle → current vault assignments + country → Lite eligibility helpers and operation guards.
+
+The server bundle cache is five minutes; open tabs refresh labels after five minutes, checked once a minute and on focus. Policy updates do not depend on a metadata publication. The labels snapshot revision invalidates asset decision caches.
 
-## Configuration
-
-All blocking and restriction configuration lives outside the app codebase:
-
-| What | Where | Effect |
-|------|-------|--------|
-| Global sanctions list | `entities/constants.ts` — `SANCTIONED_COUNTRIES` | Blocks all vaults for listed countries |
-| Country group definitions | `entities/constants.ts` — `COUNTRY_GROUPS` | Defines EU, EEA, EFTA aliases |
-| Product-level blocks | `euler-labels` repo — `products.json` `block` field | Blocks all vaults in a product |
-| Per-vault block overrides | `euler-labels` repo — `products.json` `vaultOverrides[addr].block` | Overrides product block for one vault |
-| Per-vault restrictions | `euler-labels` repo — `products.json` `vaultOverrides[addr].restricted` | Soft-restricts one vault (no product fallback) |
-| Earn vault blocks | `euler-labels` repo — `earn-vaults.json` `block` field | Hard-blocks specific earn vaults |
-| Earn vault restrictions | `euler-labels` repo — `earn-vaults.json` `restricted` field | Soft-restricts specific earn vaults |
-| Asset-level blocks/restrictions (per-chain) | `euler-labels` repo — `{chainId}/assets.json` | Blocks/restricts any vault whose underlying is listed + the token in the swap picker |
-| Asset-level blocks/restrictions (cross-chain) | `euler-labels` repo — `all/assets.json` | Same as per-chain, usually pattern rules (`symbols`/`symbolRegex`/`names`/`nameRegex`) that apply on every chain |
-| Edge provider preset | `.env` — `EDGE_PROVIDER` | Selects the trusted-header mapping (geo, client IP, VPN evidence); required in production |
-| Dev country simulation | `.env` — `DEV_GEO_COUNTRY=GB` | Simulates a country when the edge provides none (dev, previews); production refuses to boot with it set |
-
-Changes to `products.json`, `earn-vaults.json`, `{chainId}/assets.json`, or `all/assets.json` in the euler-labels data source (GitHub repo or S3/CDN) take effect within 5 minutes (the label cache TTL) without any app deployment.
-
-## Key Files
-
-| File | Role |
-|------|------|
-| `services/country.ts` | Client-side country detection via HEAD request and `x-country-code` response header |
-| `server/middleware/cors.ts` | Strips client `x-country-code`, derives authoritative value from the edge context, emits as response header |
-| `server/utils/edge.ts` + `utils/edge-presets.ts` | Normalized edge context (`getEdgeContext`) and the per-provider trusted-header mapping (`EDGE_PROVIDER` presets) |
-| `server/middleware/geo-gate.ts` | Server-side sanctioned-country block; fail-closed on unknown country in prod |
-| `composables/useGeoBlock.ts` | Core blocking logic, `isVaultBlockedByCountry`, `isVaultRestrictedByCountry`, `isAssetBlockedByCountry`, `isAssetRestrictedByCountry`, `getVaultTags`; `AssetLike` type |
-| `composables/useEulerLabels.ts` | SDK-backed label loading and current label snapshot |
-| `utils/eulerLabelsUtils.ts` | Getter helpers `getVaultBlock`, `getEarnVaultBlock`, `getVaultRestricted`, `getEarnVaultRestricted`, `getAssetBlock`, `getAssetRestricted`, `getAssetPatternRules` |
-| `server/api/internal/labels/[file].get.ts` | Labels proxy. Unions `{chainId}/assets.json` with `all/assets.json`. Validates `symbolRegex` / `nameRegex` (compile check + 512-char cap). `refreshLabelFile(scope, file)` where `scope: number \| 'all'` |
-| `server/plugins/warm-cache.ts` | Warms `all/assets.json` once globally plus per-chain label files |
-| `entities/constants.ts` | `SANCTIONED_COUNTRIES`, `COUNTRY_GROUPS` (EU/EEA/EFTA) |
-| `entities/euler/labels.ts` | TypeScript types (`EulerLabelProduct`, `EulerLabelVaultOverride`, `EulerLabelAssetEntry` union with address + pattern fields) |
-| `components/entities/asset/SwapTokenSelector.vue` | Arbitrary-asset selector. Disables blocked/restricted rows (mode-aware) via `getAssetGeoState(asset, mode)` |
-| `components/entities/vault/VaultItem.vue` | Browse page "Restricted" chip (hard-block only) |
-| `components/entities/vault/VaultBorrowItem.vue` | Borrow browse page "Restricted" chip (hard-block + soft-restricted) |
-| `components/entities/vault/ChooseCollateralModal.vue` | Selection modal disabled state and warning chips |
-| `composables/useSwapCollateralOptions.ts` | Collateral selection with `tagContext` parameter |
-| `composables/useSwapDebtOptions.ts` | Debt selection with `'swap-target'` context |
-| `composables/useMultiplyCollateralOptions.ts` | Multiply collateral selection with `'supply-source'` context |
+Tests cover resolved Norway membership, cumulative scopes, product reassignment, chain isolation, case-insensitive asset patterns, input bounds, unavailable versus empty data, acquisition guards, disk restart recovery and malformed/partial fetches. Production canary deployment and alert wiring are separate operational work.
diff --git a/docs/keyring-hooks.md b/docs/keyring-hooks.md
index a28170bc8..8978d2025 100644
--- a/docs/keyring-hooks.md
+++ b/docs/keyring-hooks.md
@@ -10,13 +10,14 @@ Certain Euler vaults are configured with a **hook target** contract that interce
 
 ### Detection: Labels
 
-Keyring vaults are flagged via the labels system (`products.json`):
+Keyring vaults are flagged through Public Labels `tags` on the vault. Lite emits
+a product-level tag only when every assigned vault carries the same tag:
 
 ```jsonc
 {
-  "private-market": {
+  "product": {
     "name": "Private Market",
-    "tags": ["keyring"],       // All vaults in this product require keyring
+    "tags": ["keyring"],       // Derived only when every product vault has the tag
     "vaults": ["0x1234..."],
     "vaultOverrides": {
       "0x5678...": {
diff --git a/docs/public-api.md b/docs/public-api.md
index 5e71f8f23..f8818e291 100644
--- a/docs/public-api.md
+++ b/docs/public-api.md
@@ -16,12 +16,12 @@ A vault is **verified** through one of two paths:
 
 - **Escrow path**: the address appears in the on-chain set returned by `escrowedCollateralPerspective.verifiedArray()` for the chain. Escrow vaults are trusted unconditionally; no product, entity, or governor check applies.
 - **Label + authority path**:
-  - EVK / Securitize vaults must appear under a product's `vaults[]` or `deprecatedVaults[]` in `products.json`.
+  - EVK / Securitize vaults must be assigned to a Public Labels V3 product.
   - The product must declare at least one `entity` key.
   - The vault's `governorAdmin` must be in the `addresses` map of one of the product's declared entities. If the vault's oracle router has a non-zero governor, that governor must also match.
   - A product whose `entity` field is empty or omitted is treated as having no on-chain authority to claim the vault — every vault under such a product is unverified, regardless of its `governorAdmin`.
 
-Earn vaults listed only in `earn-vaults.json` are trusted on the strength of the Earn label entry. If an Earn vault also appears under a product, the current verifier applies an owner/entity match against that product; current labels do not use that shape.
+Standalone Earn vaults published in the V3 inventory are trusted on the strength of that label. If an Earn vault is assigned to a product, the verifier applies an owner/entity match against that product.
 
 For EVK / Securitize vaults, the same governor check applies to active and deprecated vaults — deprecation does not change the verification rule. The `notExplorable` flag does **not** change verification either: vaults hidden from Explore are still verified.
 
@@ -74,15 +74,15 @@ Addresses are validated via viem's `isAddress` (strict EIP-55 checks) and normal
 |--------|--------------------------------------------------------------------------|
 | `400`  | Missing/invalid `chainId`, `chainId` not supported by this deployment, >100 addresses, or a malformed address. |
 | `429`  | Rate limit exceeded for this client IP.                                  |
-| `502`  | All upstream sources (labels endpoint, chains config, RPC proxy) failed and no stale cache is available. |
+| `502`  | Public Labels V3, chains config, or RPC failed and no bounded stale cache is available. |
 
 ### Caching and propagation
 
 - **Response header**: `Cache-Control: public, max-age=30, stale-while-revalidate=30`. CDNs and browsers can cache for 30 s and serve stale for another 30 s while revalidating.
 - **Server-side cache**: per-chain in-memory verified set with a 5-minute TTL. A warm-cache process rebuilds every cache entry every 5 minutes on its own schedule (force-refresh, ignores fresh entries), so the cache is always continuously fresh in steady state.
 - **In-flight dedup**: concurrent cold requests for the same chain collapse onto a single upstream pass.
-- **Propagation**: on-chain governor changes and `products.json` / `entities.json` edits typically propagate within **~5 minutes**. The labels / vault snapshot and the verified-set cache are warmed on the same 5-minute cycle, so a label edit picked up by the labels cache flows into the next bridge rebuild within the same cycle.
-- **Stale fallback**: during prolonged upstream outages (labels endpoint, vault snapshot, or RPC failing), the bridge serves the last-known-good verified set for up to 10 minutes past TTL before returning a hard error.
+- **Propagation**: on-chain governor changes and `version=latest` Public Labels updates typically propagate within **~5 minutes**. Public Labels, the vault snapshot, and the verified-set cache are warmed on the same cycle.
+- **Stale fallback**: during upstream outages, the bridge serves only the last-known-good data within each cache's configured stale ceiling before returning a hard error.
 
 ### Rate limit
 
@@ -141,13 +141,13 @@ This endpoint answers "what is this vault?" — the trust verdict (`is-known`) i
 |-------------|----------|----------|-----------------------------------------------------------------------------|
 | `chainId`   | integer  | yes      | EVM chain ID (e.g. `1` for mainnet).                                        |
 | `addresses` | string   | no       | Comma-separated list of vault addresses. Max 100. Same casing rules as `/is-known`. Omit to return every known vault on the chain ("list mode"). |
-| `productId` | string   | no       | Product slug from `products.json` (e.g. `euler-prime`). When set, only entries whose `productId` equals this value are returned. Combines with `addresses`: an address that resolves but belongs to a different product returns `null`. `[a-zA-Z0-9_-]+`, max 100 chars. |
+| `productId` | string   | no       | Public Labels V3 product ID (e.g. `euler-prime`). When set, only entries whose `productId` equals this value are returned. Combines with `addresses`: an address that resolves but belongs to a different product returns `null`. `[a-zA-Z0-9_-]+`, max 100 chars. |
 
 ### Response
 
 Status `200`, JSON object keyed by EIP-55 checksum addresses.
 
-**Lookup mode** (`addresses` provided): one entry per input address. Unknown addresses (not in any labels file and not in the on-chain escrow perspective) resolve to `null`.
+**Lookup mode** (`addresses` provided): one entry per input address. Unknown addresses (not in Public Labels and not in the on-chain escrow perspective) resolve to `null`.
 
 **List mode** (`addresses` omitted): every known vault on the chain. No `null` values.
 
@@ -164,7 +164,7 @@ interface VaultMetadata {
   deprecationReason: string | null
   deprecated: boolean                        // true if listed under any product's deprecatedVaults or earn entry has deprecated: true
   governanceLimited: boolean                 // true when the owning product has the "governance limited" tag. False for vaults without a product.
-  productId: string | null                   // product slug from products.json that owns this vault; null for escrow and for vaults with no product entry
+  productId: string | null                   // Public Labels product ID; null for escrow and standalone vaults
   asset: {
     address: string                          // checksummed
     symbol: string
@@ -174,7 +174,7 @@ interface VaultMetadata {
   } | null
   entities: Array<{
     name: string
-    logo: string                             // full URL composed from the labels CDN config
+    logo: string                             // hosted URL from the Public Labels entity profile
     description: string | null
     url: string | null                       // entity website; only set when http(s) URL
   }>                                         // empty array when no entity matches (escrow, unverified, or no product); usually 0 or 1 entry, but can be N when a product declares multiple entities that all match the on-chain governor
@@ -183,18 +183,18 @@ interface VaultMetadata {
 
 ### Resolution rules
 
-Label-derived display fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`) are sourced from labels regardless of verification state — they are authoritative content set by the team that listed the vault. For product-owned EVK / Securitize vaults, per-vault `vaultOverrides` take precedence over product-level values. Earn vault metadata comes from the `earn-vaults.json` entry, with product fallback fields only if an Earn address is also present in `products.json`. The on-chain ERC-20 `name` is only a fallback when no label name is defined.
+Label-derived display fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`) are sourced from Public Labels V3 regardless of verification state. Vault fields take precedence over product fields. Standalone Earn metadata comes from its V3 inventory row. The on-chain ERC-20 `name` is only a fallback when no published label name is defined.
 
 `entities` identifies every declared product entity whose `addresses` contain the vault's `governorAdmin` (or `owner` for an Earn vault that also appears under a product). A product can declare multiple entity keys, and more than one of those can match — the array preserves the declared-key order. Resolution depends on the vault's verification state:
 
-- **Verified non-escrow vault** (governor match against at least one declared entity): `entities` contains every matching entity from `entities.json`, with `logo` composed as a full URL. Usually 1 entry, but can be N.
+- **Verified non-escrow vault** (governor match against at least one declared entity): `entities` contains every matching Public Labels entity profile, including its hosted `logo` URL. Usually 1 entry, but can be N.
 - **Unverified vault** (in labels but governor mismatch, or in a product that declares no entity): `entities` is `[]`. Other label fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`, `deprecated`) are still populated. `asset` and `type` are also populated.
-- **Earn vault without a product entry** (`earn-vaults.json` only): `entities` is `[]`.
+- **Standalone Earn vault**: `entities` is `[]`.
 - **Escrow vault** (`escrowedCollateralPerspective.verifiedArray()`): `name` is the constant `"Escrowed collateral"`; all label-derived fields and `productId` are `null`; `entities` is `[]`; `deprecated: false`; `asset` comes from the snapshot when the address is in the referenced subset, otherwise `null`.
 
 The `deprecated` boolean distinguishes deprecated-but-otherwise-fine vaults from genuinely unverified ones. For EVK / Securitize vaults, the same governor check applies to deprecated and active vaults — deprecation only sets the `deprecated` flag and (typically) populates `deprecationReason`.
 
-Earn vaults resolve with `description` / `portfolioNotice` / `deprecationReason` from the earn entry. Current labels do not place Earn vaults in `products.json`, so they resolve with `productId: null` and `entities: []`.
+Standalone Earn vaults resolve with `description`, `portfolioNotice`, and `deprecationReason` from the V3 inventory row and return `productId: null`, `entities: []`.
 
 #### `entities` is not equivalent to `is-known`
 
@@ -208,7 +208,7 @@ Use `/api/public/is-known` for the verification verdict. Use the non-`null` / `n
 |--------|--------------------------------------------------------------------------|
 | `400`  | Missing/invalid `chainId`, `chainId` not supported, >100 addresses, or a malformed address. |
 | `429`  | Rate limit exceeded for this client IP.                                  |
-| `502`  | Required upstream sources (`products.json`, `entities.json`, vault snapshot) failed and no stale cache is available. |
+| `502`  | Required Public Labels V3, effective-policy, or vault-snapshot data failed and no stale cache is available. |
 
 ### Caching and propagation
 
@@ -260,7 +260,7 @@ curl 'https://<host>/api/public/metadata?chainId=1&addresses=0xD8b27CF359b7D1571
     "entities": [
       {
         "name": "Euler DAO",
-        "logo": "https://raw.githubusercontent.com/euler-xyz/euler-labels/refs/heads/master/logo/euler.svg",
+        "logo": "https://token-images.euler.finance/labels/euler",
         "description": "Euler DAO is responsible for the governance of the Euler protocol.",
         "url": "https://euler.finance"
       }
@@ -284,4 +284,4 @@ curl 'https://<host>/api/public/metadata?chainId=1'
 - Metadata builder + cache: `server/utils/vault-metadata.ts`
 - Shared verification rule (also used by the client UI): `utils/vault/governor-verification.ts`
 - CORS bypass for the `/api/public/` prefix lives in `server/middleware/cors.ts`.
-- Escrow vaults are read via an `eth_call` to `escrowedCollateralPerspective.verifiedArray()`. The perspective address is looked up from `EulerChains.json` (served by `/api/internal/euler-chains`), and the RPC endpoint is taken from `RPC_URL_<chainId>`. Products and earn-vault label files are fetched via internal self-calls to `/api/internal/labels/<file>` to reuse the labels endpoint's own cache and validation. Entity logo URLs are composed from `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` (or the `REPO`/`REPO_BRANCH` fallback) so they match the URL the app itself renders.
+- Escrow vaults are read via an `eth_call` to `escrowedCollateralPerspective.verifiedArray()`. The perspective address is looked up from `EulerChains.json` (served by `/api/internal/euler-chains`), and the RPC endpoint is taken from `RPC_URL_<chainId>`. Public endpoints use the same cached `getPublicEulerLabelsData()` source as the browser and vault snapshot; there are no internal self-HTTP label calls. Entity logo URLs come directly from Public Labels profiles.
diff --git a/docs/sdk-integration.md b/docs/sdk-integration.md
index ab2961500..2a406010a 100644
--- a/docs/sdk-integration.md
+++ b/docs/sdk-integration.md
@@ -109,7 +109,6 @@ The server-side snapshot builder has its own independent `SERVER_VAULT_CACHE_SOU
 | `eulerInterfacesBranch` | `EULER_SDK_EULER_INTERFACES_BRANCH` (`master`) | Branch selection for the euler-interfaces manifests (browser ABI fetches themselves go through the proxy below) |
 | `deploymentsUrl` | `/api/internal/euler-chains` | Local proxy |
 | ABI fetches (`setQueryABI` in `configureAppProxies`) | `/api/internal/abis/{contract}` | Runtime ABI proxy (`AccountLens`/`VaultLens`/`UtilsLens` allowlist) |
-| `eulerLabelsBaseUrl` | `/api/internal/labels` | Path-shape labels endpoint (see [server-side caching](./server-side-caching.md)) |
 | `rewardsMerklApiUrl` | `/api/internal/proxy/merkl` | Merkl proxy |
 | `rewardsFuulApiUrl` | `/api/internal/proxy/fuul` | Fuul proxy |
 | `rewardsBrevisApiUrl` | `/api/internal/proxy/incentra/sdk/v1/eulerCampaigns` | Incentra/Brevis proxy |
diff --git a/docs/server-side-caching.md b/docs/server-side-caching.md
index 6025165e0..4ce212faa 100644
--- a/docs/server-side-caching.md
+++ b/docs/server-side-caching.md
@@ -1,6 +1,6 @@
 # Server-Side Caching
 
-Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, the labels repo, the Euler V3 backend, and the chain RPC. The layer accomplishes four things:
+Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, Public Labels V3, the optional static authoring source, and the chain RPC. The layer accomplishes four things:
 
 1. **Cross-tab sharing.** Every browser session against the same origin hits the same in-process cache.
 2. **Authentication / credentials stay server-side.** Browsers don't need V3 API keys, subgraph project IDs, or any provider tokens.
@@ -18,8 +18,9 @@ This document covers the per-host proxies, the vault snapshot pipeline, the warm
 | `server/api/internal/proxy/fuul/[...path].ts` | Proxies Fuul (`api.fuul.xyz/api/v1`) |
 | `server/api/internal/proxy/incentra/[...path].ts` | Proxies Incentra / Brevis (`incentra-prd.brevis.network`) |
 | `server/api/internal/proxy/subgraph/[chainId].post.ts` | Proxies the per-chain Goldsky subgraph |
-| `server/api/internal/labels/[file].get.ts` | Query-shape labels endpoint (`?chainId=X`) — used internally |
-| `server/api/internal/labels/[chainId]/[file].get.ts` | Path-shape labels endpoint — matches the SDK's default URL template |
+| `server/api/internal/public-labels.get.ts` | Chain/version-scoped aggregate Public Labels endpoint |
+| `server/utils/public-labels-source.ts` | Public Labels V3 pagination, 5-minute cache, in-flight dedup, and bounded stale fallback |
+| `server/utils/static-labels-source.ts` | Atomic static authoring snapshots, used only in static mode |
 | `server/api/internal/v3/[...path].ts` | Rate-limited V3 backend proxy for SDK browser endpoints (`/api/internal/v3/...` → `v3.euler.finance/v3/...`) |
 | `server/api/internal/vaults.get.ts` | Per-chain consolidated vault snapshot endpoint |
 | `server/utils/vaults-cache.ts` | `refreshChainVaults` + `vaultsCache` |
@@ -67,18 +68,11 @@ Each proxy carries a rate limiter (`createRateLimiter`) and returns 405 for disa
 - **Goldsky subgraph**: Each chain's URL is a per-deployment Goldsky deployment ID. Proxying keeps the project ID server-side and amortizes GraphQL responses across tabs.
 - **Merkl**: CORS, plus credential handling.
 
-### Labels
+### Public Labels
 
-Two endpoints, same `refreshLabelFile` engine:
+`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines published metadata with the live visibility and geo overlays. The result is cached for 5 minutes by chain and version; concurrent misses share one in-flight operation. Bundle stale fallback is bounded. Geo separately retains a validated, fetchedAt-stamped disk checkpoint with unbounded stale-on-error fallback; cold starts without geo cannot publish a bundle. Mount `GEO_POLICY_CACHE_DIR` for cross-container persistence.
 
-- **`/api/internal/labels/{file}?chainId=N`** (`[file].get.ts`) — query-shape, used by internal callers (`labels-helpers.ts`).
-- **`/api/internal/labels/{chainId}/{file}`** (`[chainId]/[file].get.ts`) — path-shape, matches the SDK's default `eulerLabelsBaseUrl` template (`${base}/{chainId}/{file}.json`). The SDK is pointed at `/api/internal/labels`, default templates land here.
-
-Both endpoints write to and fall back on the same in-memory TTL cache, but only the query-shape handler reads through it. It checks `cache.get()` first (and uses the `getOrRefresh` helper for the `assets.json` union), so a fresh entry short-circuits without touching upstream. The path-shape handler calls `refreshLabelFile` directly, and that function is the force-refresh primitive — it skips the fresh-entry check and only deduplicates while a fetch is in flight. Every path-shape request therefore reaches upstream unless it coincides with an in-flight fetch for the same key, so the warm-cache entry acts as a stale fallback on that route rather than as a read-through cache. Since the SDK's default template targets the path shape, that is the route most label traffic takes. Warm callers (`warm-cache.ts`, `vaults-cache.ts`) use `refreshLabelFile` intentionally — see [Warm-Cache Plugin](#warm-cache-plugin) for why. The path handler's file header documents the shared TTL cache / upstream-fetch pipeline and that this route force-refreshes rather than reading through.
-
-Missing label files (HTTP 403/404) return a cached empty payload. Transient failures serve stale labels when available or return HTTP 503; they never turn an unavailable verification list into a successful empty result.
-
-Upstream is resolved by `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` if set, else `NUXT_PUBLIC_CONFIG_LABELS_REPO` + `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH` → GitHub raw.
+`LABELS_SOURCE=v3` performs no label-file reads. `LABELS_SOURCE=static` reads the operator-owned authoring files on the same warm/refresh cycle and uses one atomic disk checkpoint for the entire collection. See [Static labels](./static-labels.md).
 
 ### V3 proxy
 
@@ -185,7 +179,7 @@ Pipeline:
 
 ```text
 1. getServerSdk(chainId)          // lazy per-chain server SDK; reused across requests
-2. getLabels(chainId)             // verified addresses, earn vaults (read via refreshLabelFile)
+2. getPublicEulerLabelsData(chainId) // shared normalized Public Labels bundle
 3. sdk.eVaultService.fetchVerifiedVaultAddresses(chainId, [ESCROW])   // escrow set
 4. sdk.vaultMetaService.fetchVaultTypes(chainId, candidates)          // partition EVK vs Securitize vs Earn
 5. Promise.all([
@@ -317,12 +311,11 @@ The pipeline always succeeds eventually — the snapshot is the *fast path*, not
 ```text
 Global cycle (5 min)                   Vaults cycle (1 min if V3, else 5 min)
 ─────────────────────                  ──────────────────────────────────────
-- /api/internal/euler-chains                    - refreshChainVaults(chain) for each
-- /api/internal/abis/{contract} (×3)     enabled non-deprecated chain,
-- labels/all/assets.json                 sequential (lets cross-chain V3
-- per-chain:                             upstreams dedupe via in-flight)
-    labels/{file}.json (×5)
-    /api/internal/token-list
+- Euler Chains and runtime ABIs                         - refreshChainVaults(chain) for each
+- static source includes cross-chain assets     enabled non-deprecated chain
+- per-chain Public Labels bundle
+- per-chain labels snapshot
+- per-chain token list
 ```
 
 Vault snapshot has its own faster timer because V3-backed refreshes are cheap — one batched POST per chain hitting V3's own cache. Pulling a fresh snapshot every minute keeps it tight without hammering upstream. Without V3, the snapshot is built from heavier onchain lens multicalls, so it falls back to the global 5-min cadence.
@@ -331,9 +324,7 @@ When the two intervals are equal (V3 off), the timers naturally double-warm at e
 
 ### Why warm directly (not via HTTP)
 
-Every warm task is a **direct function call** (`refreshChainVaults(chainId)`, `refreshLabelFile(...)`, etc.) that bypasses the handler's fresh-cache short-circuit and writes straight to the cache. If we warm via HTTP, the handler short-circuits on the still-fresh previous entry (age ≈ TTL − 2 s) and the entry then expires without refresh until the next cycle — leaving a stale window per cycle. Direct calls ensure the entry is always rewritten *before* it expires.
-
-User requests arriving during a refresh continue to read the still-fresh previous entry via the handler's own `cache.get()` short-circuit, so there's no blocking on the in-flight refresh. This holds for handlers that actually short-circuit — the vault snapshot endpoint and the query-shape labels endpoint. The path-shape labels endpoint calls `refreshLabelFile` instead of reading through, so a concurrent request there joins the in-flight refresh rather than being served the previous entry (see [Labels](#labels)).
+Every warm task is a **direct function call** (`refreshChainVaults(chainId)`, `refreshPublicLabelsBundle(...)`, `refreshLabelFile(...)`, etc.) that replaces the cache before expiry. The Public Labels and policy refreshers deduplicate concurrent work, while normal reads use the previous fresh value and failures can fall back only within the configured stale ceiling.
 
 ### Boot behaviour
 
diff --git a/docs/static-labels.md b/docs/static-labels.md
new file mode 100644
index 000000000..105a9ddcd
--- /dev/null
+++ b/docs/static-labels.md
@@ -0,0 +1,41 @@
+# Static label authoring
+
+`LABELS_SOURCE=v3` is the default hosted mode. It reads published metadata, live visibility, governance addresses and geo policies from V3, without consulting any labels repository.
+
+Hosted deployments select metadata with `LABELS_V3_SET` (default `public`) and `LABELS_V3_VERSION` (default `latest`, or an immutable publication key such as `v20260911011146353` or `test-2026-06-30`). The SDK resolves `latest` within the selected set and applies that set/version to vault, product and entity metadata. Server caches separate upstream, set, chain and version. Unknown sets or unavailable publications fail rather than falling back to public. The internal endpoint's explicit `version` query still overrides the deployment default for diagnostics; the label set is server-configured. Draft selectors are not supported. Restart the service after changing these variables.
+
+These settings select published metadata, not an isolated staging system: visibility, geo policies, governance addresses and live platform fields continue to use the configured V3 backend. Static mode ignores the V3 label selectors.
+
+Forks select `LABELS_SOURCE=static` and set `STATIC_LABELS_BASE_URL` to their own HTTP(S) directory. The server and browser consume the same normalized snapshot as hosted mode. Authored membership determines discovery; hosted curation/visibility is never consulted. The SDK provides the shared file derivation function, while Lite owns atomic fetching, validation, caching and logo policy.
+
+## Directory contract
+
+For each enabled chain, the loader reads these JSON documents:
+
+| Path | Shape and fields |
+|---|---|
+| `{chainId}/products.json` | Object keyed by product slug. Each product includes `name`, `entity` (entity key or keys), `vaults`; optional `deprecatedVaults`, `deprecationReason`, `description`, `portfolioNotice`, `tags`, `notExplorable`, `block`, `restricted`, and address-keyed `vaultOverrides`. Overrides support text, tags, country rules and `notExplorableLend/Borrow`. |
+| `{chainId}/entities.json` | Object keyed by entity key. Profiles include `name`, `logo` filename, `description`, `url`, `addresses` (address-to-label map), and `social` URLs. These addresses drive governor/owner checks. |
+| `{chainId}/points.json` | Array of `{name, logo, collateralVaults}` campaigns. |
+| `{chainId}/earn-vaults.json` | Array of vault addresses or `{address, deprecated, deprecationReason, description, portfolioNotice, notExplorable, block, restricted, tags}` objects. |
+| `{chainId}/assets.json` | Array of address or symbol/name matchers: `address`, `symbols`, `names`, `symbolRegex`, `nameRegex`, plus `block` / `restricted`. |
+| `all/assets.json` | Global asset rules, combined with each chain's rules. |
+| `logo/{filename}` | Entity/product/points images on the same origin. |
+
+Collections may be omitted: HTTP 404 and HTTP 403 (the missing-key response from some S3/CDN hosts) resolve to `{}` for products/entities and `[]` for points/Earn/assets. Missing chain asset rules do not remove global asset rules, and vice versa. Explicit empty documents are also supported. Other HTTP errors, network failures and malformed content fail the refresh. File syntax retains the five-file authoring format; no generated normalized snapshot needs editing. [`tests/fixtures/static-labels.json`](../tests/fixtures/static-labels.json) is an executable example of the file contents.
+
+Only HTTP(S) profile links and simple image filenames are accepted. Remote hosted label images must use `https://token-images.euler.finance`; static images may additionally use the configured source origin. Paths/credentials and lookalike hosts cannot bypass the image allowlist. The browser repeats the image check before rendering.
+
+## Failure behavior
+
+All six file reads resolve together, with absent files represented by empty collections. A failed or malformed refresh retains the complete last-known-good snapshot, including its rules. A cold start fails if any read has an error other than the supported absent-file responses. An absent-file response applies the empty collection on that refresh; there is no per-file stale grace period for 403/404. A source returning 403/404 for every file produces an empty snapshot, so configure a publicly readable source URL. Checkpoints are source-and-chain-specific, content-hashed and timestamped. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for container replacements; the default `.data/geo-policies` only persists on the same filesystem. Stale fallback and failed checkpoint writes are logged for alerting.
+
+Authored geo retains static country-group expansion and override semantics. This differs deliberately from hosted V3's cumulative rules. The contract test covers discovery, entities/authority addresses, points, logos, per-side flags, asset patterns, Earn restrictions and restart recovery.
+
+## On-chain data
+
+Static labels do not require running a V3 backend. A fork may use Euler's hosted quantitative endpoints for supported factory vaults, subject to API availability and access policy. Alternatively, configure `ONCHAIN_SDK_CHAINS` and the existing V3 feature gate for direct on-chain SDK reads. That mode has reduced history/activity/rewards coverage; static labels do not create an indexer or add support for arbitrary chains.
+
+## Rollout boundary
+
+Before switching production, compare authored and V3 membership, explorability, display content, geo decisions and full verification across enabled chains. Resolve unexplained differences; preserve public API behavior and measure revocation latency. On-chain governor verification remains active in hosted mode during this bake. SDK release/dependency changes and production cutover are deployment work. Persistent volumes, dedicated geo alerts and a compliance canary are optional operational hardening; fresh containers may fetch their initial rules from the configured upstream, as in the existing deployment model.
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 6282e80cf..bcc385aa2 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -4,238 +4,51 @@ This document explains how euler-lite discovers, categorizes, verifies, and disp
 
 ## Overview
 
-Not all vaults on-chain are equal. Some are curated by the Euler UI listing process, while others may be unknown or even malicious. The labels system provides a trust layer that maps on-chain vault addresses to off-chain metadata (names, logos, descriptions, deprecation status) and determines whether a vault is **verified** or **unknown**.
+Not all vaults on-chain are equal. Public Labels maps chain-scoped vault addresses to published products, managing entities, display-only co-brands, campaigns, descriptions, tags, and deprecation metadata. Lite combines that published content with on-chain governor checks and its effective visibility data when deciding how a vault is presented.
 
 ## Label Data Sources
 
-Labels originate from the [euler-labels](https://github.com/euler-xyz/euler-labels) GitHub repository by default. The client never fetches label JSON files directly from GitHub/CDN — all label data is served through **server-side proxy endpoints** that add in-memory caching and stale-fallback. Entity logos are still resolved directly from the labels base URL via `<img>` tags (benefiting from browser HTTP caching). Each supported chain has a directory containing JSON files:
+`useEulerLabels` reads one chain-scoped bundle from `/api/internal/public-labels`. The server resolves `version=latest` once through the published-versions endpoint, pins resolved metadata pages and entity profiles to that publication. Geo policies, global entity addresses, platform tags and visibility remain live even for a concrete version. Tests use captured fixtures for those live overlays. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
 
-| File | Server endpoint | Empty shape |
-|------|-----------------|-------------|
-| `products.json` | `GET /api/internal/labels/products.json?chainId=X` | `{}` |
-| `entities.json` | `GET /api/internal/labels/entities.json?chainId=X` | `{}` |
-| `points.json` | `GET /api/internal/labels/points.json?chainId=X` | `[]` |
-| `earn-vaults.json` | `GET /api/internal/labels/earn-vaults.json?chainId=X` | `[]` |
+| Public data | V3 path |
+|---|---|
+| Vault inventory and labels | `GET /labels/vaults?view=resolved&version=...&chainId=...` |
+| Products | `GET /labels/products?view=resolved&version=...&chainId=...` |
+| Entities | `GET /labels/entities?version=...` |
+| Entity governance addresses | `GET /labels/entities/{entityId}/addresses` |
+| Geo policy records | `GET /geo-policies` |
 
-All label files are optional — any chain may legitimately ship without a given file. When upstream reports the file absent (HTTP 404 or 403), the proxy returns the type-appropriate empty payload (`{}` for object-shaped files, `[]` for array-shaped files) with HTTP 200 and caches it for 5 minutes. Transient upstream failures (5xx, timeouts, invalid responses) serve stale cached data when available and return HTTP 503 otherwise. They do not return or cache a successful empty shape. Non-404 upstream statuses are reported through `reportStatus`, which logs on *transitions* rather than once per refresh: the first observation of a given status warns, an unchanged status stays silent on later refreshes, and a return to `ok` logs a recovery. A persistent outage therefore surfaces once and then goes quiet until it changes.
+The adapter also reads `/evk/vaults` and `/earn/vaults` with explicit `visibility=visible,warning,hidden,pending_review`. Trusted label membership requires a visible or warning verdict and a managing entity. Hidden and pending metadata remain available without granting trusted membership. Per-side V3 explorability flags control hosted listing. On-chain governor checks still determine the stronger verification badge.
 
-Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
-
-**Custom sources**: The server resolves upstream URLs from environment variables. `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` overrides the GitHub URL for labels (when set, `NUXT_PUBLIC_CONFIG_LABELS_REPO` and `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH` are ignored). Oracle assessments use the configured V3 API URL and optional server-side V3 API key.
-
-**Server caching**: The server keeps one 5-minute TTL cache keyed by `chainId:file`, plus an in-flight map so concurrent callers collapse onto a single upstream fetch per key. On upstream failure, stale cached data is served. `server/plugins/warm-cache.ts` pre-populates the cache at Nitro startup (fire-and-forget) and re-warms every 5 minutes.
-
-Two handlers front that one cache, and **they do not read from it the same way**:
+Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-| Handler | Used by | Cache behavior |
-|---|---|---|
-| `/api/internal/labels/{file}?chainId=N` (query-shape) | server-side callers via `labels-helpers.ts` | Reads through. A fresh entry short-circuits and no upstream fetch happens. |
-| `/api/internal/labels/{chainId}/{file}` (path-shape) | the SDK — `eulerLabelsBaseUrl` is `/api/internal/labels`, so its default template lands here | Calls `refreshLabelFile` directly, which **bypasses the fresh-entry check**. Every request fetches upstream unless one is already in flight for the same key. |
+Lite evaluates live V3 geo policies using `countriesResolved` and cumulative global/chain/product/vault/asset rules. The server embeds a validated geo collection with each snapshot and retains a disk checkpoint for stale-on-error recovery. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for redeploy durability. Hosted snapshots have no GitHub-label dependency. `LABELS_SOURCE=static` supplies the same snapshot from operator-owned files; see [Static labels](./static-labels.md). Production bake/canary remain rollout work. See [Geo-Blocking](./geo-blocking.md).
 
-So the 5-minute TTL is not what bounds upstream traffic on the SDK's path. On that route the cache is used for writes and stale fallback, and the in-flight map is the only thing collapsing duplicate work. Warm callers (`server/plugins/warm-cache.ts` and the vault snapshot builder) call `refreshLabelFile` for the same reason — each cycle rewrites the entry instead of cache-hitting a nearly-expired value. The path handler's file header states this directly, so the two shapes' behavior is documented where it is implemented. See [server-side caching](./server-side-caching.md) for the endpoint-level view.
-
-**Client loading and chain changes**: `useEulerLabels().loadLabels()` loads a snapshot for the current chain. A ready snapshot is reused only while that chain remains selected. On a chain change, the composable publishes an empty snapshot while the new labels load, deduplicates concurrent fetches per `chainId`, and uses a monotonic load generation to prevent a late response from a previous chain or superseded refresh from overwriting current data. ERC-4626 wrap-pair probes use the same chain and generation checks.
+Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
 
-The browsing SDK applies a separate 5-minute stale window to its five label queries, so revisiting a chain may reuse SDK-cached data without an upstream request. This cache does not bypass the composable's current-chain publication guard. Call `loadLabels(true)` when an explicit refresh is required; it starts a new composable-level fetch (it does not join `pendingLabelsFetches`) and invalidates all five SDK label queries before calling the SDK. At the transport layer that invalidation does not cancel an already-running `fetchQuery` for the same key — TanStack joins the pending promise — so a force refresh can still receive the older in-flight SDK result. The monotonic load generation still decides which response may publish.
+**Caching and fallback**: The server bundle has a 5-minute chain/version cache, concurrent cold loads share one in-flight fetch, and failures can return a bounded stale bundle. The browser deduplicates chain-scoped loads and rejects superseded responses. Visible tabs check freshness every minute and on focus/visibility changes, requesting a fresh server bundle after five minutes. Same-chain refreshes retain display data; verification becomes unavailable after fifteen minutes without a successful response. Requests time out after 35 seconds. Current hosted membership overrides cached positive registry flags, so refreshed revocations also update verification guards and verified EVault lists. Escrow perspective trust remains independent. An initial failure leaves labels unavailable with a retry action. Retry requests a fresh bundle and reloads vault discovery after labels recover.
 
-Verification requires successful entity, product, and Earn label requests before the SDK normalizes the snapshot. Optional point-reward failures do not block verification. An initial failure leaves labels unavailable with a retry action; a failed same-chain refresh retains the last successful snapshot. The retry invalidates SDK label queries and reloads vault discovery after labels recover.
+**Inventory gaps**: The SDK reads direct V3 visibility for labelled vaults absent from the EVK/Earn inventories, with at most eight requests in flight. This covers Securitize labels without inventing a verdict. Effective lend/borrow listing decisions are preserved, so a visible collateral wrapper may remain hidden from lend discovery. Direct-verdict failures fail the aggregate refresh and use the same bounded stale-snapshot behavior described above. Hosted governor/owner verification still applies separately.
 
 **Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
 
 ---
 
-## JSON File Schemas
+## Published Content Contract
 
-### products.json
+Products provide `entityId`, optional `coBrandEntityIds`, display name, description, URL, portfolio notice, and direct product deprecation metadata. Vault inventory rows provide vault type, product/entity assignment, display metadata, tags, campaigns, and resolved vault deprecation metadata. V3 resolves the display cascade; Lite preserves empty resolved overrides instead of re-inheriting product notices.
 
-Structure: `Record<string, Product>` — keys are product identifiers (e.g. `"euler-flagship"`).
+Entity rows provide profile text, hosted logos, website/social links, and optional organization details. Lite separately fetches each relevant entity's global governance addresses and checksums them before comparison with on-chain governor addresses.
 
-```jsonc
-{
-  "euler-flagship": {
-    // Required fields
-    "name": "Euler Flagship",                    // Display name shown in UI
-    "description": "The flagship Euler market.",  // Shown on vault overview pages
-    "portfolioNotice": "Strategy rebalancing in progress", // Operational notice on portfolio cards (optional)
-    "entity": ["euler-foundation"],              // Entity key(s) from entities.json (string or string[])
-    "url": "https://euler.finance",              // External link (shown on vault overview)
-    "vaults": [                                  // Active vault addresses
-      "0x1234...abcd",
-      "0x5678...ef01"
-    ],
-
-    // Optional fields
-    "deprecatedVaults": ["0xold1..."],           // Phased-out vault addresses (still verified, shown as deprecated)
-    "deprecationReason": "Migrated to v2",       // Why deprecated — shown in warning banner. Supports URLs.
-    "tags": ["keyring", "governance limited"],   // Product classification tags
-    "notExplorable": true,                       // If true, hides ALL product vaults from lend/borrow/explore pages
-    "block": ["US", "EU"],                       // Country codes/groups to hard-block (see geo-blocking.md)
-    "vaultOverrides": {                          // Per-vault customizations (see below)
-      "0x5678...ef01": {
-        "description": "Custom description for this vault",
-        "portfolioNotice": "Vault-specific operational notice",
-        "deprecationReason": "This specific vault is being phased out",
-        "block": ["US", "EU", "CH"],
-        "restricted": ["JP"],
-        "notExplorableLend": true,
-        "notExplorableBorrow": true,
-        "tags": ["recently added"]
-      }
-    }
-  }
-}
-```
-
-#### Product Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Display name in UI (discovery tables, vault overview, search) |
-| `description` | `string` | Yes | Product description shown on vault overview pages. Supports auto-linked URLs. |
-| `portfolioNotice` | `string` | No | Operational notice shown on portfolio position cards. Supports auto-linked URLs and **bold** formatting. |
-| `entity` | `string \| string[]` | Yes | Key(s) referencing entries in `entities.json`. Used for entity logo display, governor verification, and risk manager identification. |
-| `url` | `string` | Yes | External URL linked from entity logos on vault overview pages |
-| `vaults` | `string[]` | Yes | Active vault addresses (checksummed). These become "verified" vaults in the app. |
-| `deprecatedVaults` | `string[]` | No | Phased-out vault addresses. Still verified and viewable in portfolio, but hidden from discovery tables and shown with a deprecation warning. |
-| `deprecationReason` | `string` | No | Explanation for deprecation. Shown in a warning banner on vault overview. URLs are auto-linked. Also accepts legacy key `deprecateReason`. |
-| `tags` | `string[]` | No | Product classification tags. `keyring` marks all product vaults as requiring Keyring identity verification; `access control` marks vaults gated by an allowlist hook; `governance limited` shows "Limited risk management" and fades the risk manager entity display; `suppress high utilisation warning` hides the high-utilisation warning while leaving critical utilisation warnings visible; `cyclical note` shows cyclical-note badges, target-utilisation copy, and the cyclical IRM overview. |
-| `notExplorable` | `boolean` | No | If `true`, hides **all** vaults in this product from lend, borrow, and explore discovery pages. Takes precedence over per-vault `notExplorableLend`/`notExplorableBorrow`. Vaults remain accessible via direct URL. |
-| `block` | `string[]` | No | Country codes or group aliases (`EU`, `EEA`, `EFTA`) for hard geo-blocking. See [geo-blocking.md](./geo-blocking.md). |
-| `vaultOverrides` | `Record<string, VaultOverride>` | No | Per-vault customizations keyed by checksummed address. See next section. |
-
-Classification markers use `tags`. Product `isGovernanceLimited`, product `recentlyAddedVaults`, and earn-vault `recentlyAdded` are not supported by the current labels contract.
-
-#### Vault Override Fields
-
-Per-vault overrides allow customizing behavior for individual vaults within a product:
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `description` | `string` | Overrides the product `description` for this specific vault on the overview page |
-| `portfolioNotice` | `string` | Overrides the product `portfolioNotice` for this specific vault on portfolio cards |
-| `deprecationReason` | `string` | Overrides the product `deprecationReason` for this specific vault |
-| `block` | `string[]` | **Replaces** (not merges with) the product-level `block` list for this vault |
-| `restricted` | `string[]` | Soft geo-restriction for this vault only. No product-level fallback. See [geo-blocking.md](./geo-blocking.md). |
-| `notExplorableLend` | `boolean` | If `true`, hides this vault from the **lend** discovery page. Product-level `notExplorable` takes precedence. |
-| `notExplorableBorrow` | `boolean` | If `true`, hides this vault from the **borrow** discovery page — both as a borrow vault and as collateral. Product-level `notExplorable` takes precedence. |
-| `tags` | `string[]` | Vault classification tags. `keyring`, `access control`, `recently added`, `suppress high utilisation warning`, and `cyclical note` apply to this specific vault. See [keyring-hooks.md](./keyring-hooks.md). |
-
-**Precedence rules**:
-- `block`: vault override replaces product-level (not additive)
-- `restricted`: vault-level only (no product-level equivalent)
-- `notExplorable` (product) > `notExplorableLend` / `notExplorableBorrow` (vault override)
-- `description` / `portfolioNotice` / `deprecationReason`: vault override replaces product-level
-
----
+Vault campaigns have a `name`, hosted `logo`, and `type` of `deposit` or `borrow`. Deposit campaigns render beside supply APY and borrow campaigns render beside borrow APY. Campaign badges are informational and do not change reward APR calculations.
 
-### entities.json
+Classification markers use vault `tags`. Current UI-recognized tags include `keyring`, `access control`, `governance limited`, `recently added`, `suppress high utilisation warning`, and `cyclical note`.
 
-Structure: `Record<string, Entity>` — keys are entity identifiers (e.g. `"euler-foundation"`).
-
-```jsonc
-{
-  "euler-foundation": {
-    "name": "Euler Foundation",                    // Organization name
-    "logo": "euler.svg",                           // Logo filename (served from euler-labels repo)
-    "description": "The Euler Foundation...",       // Organization description (not currently displayed)
-    "url": "https://euler.finance",                // Organization website (linked from vault overview)
-    "addresses": {                                 // Map of governance addresses to labels
-      "0xGovAddr...": "Governor",
-      "0xMultisig...": "Multisig"
-    },
-    "social": {                                    // Social media links (stored but not currently displayed)
-      "twitter": "https://twitter.com/eulerfinance",
-      "youtube": "",
-      "discord": "https://discord.gg/euler",
-      "telegram": "",
-      "github": "https://github.com/euler-xyz"
-    }
-  }
-}
-```
-
-#### Entity Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Organization name. Shown in Risk Manager section on vault overview and as filter labels on discovery pages. |
-| `logo` | `string` | Yes | Logo filename. Resolved to a URL from the euler-labels repo. Displayed as avatar on vault overview and discovery filters. |
-| `description` | `string` | Yes | Organization description. *Currently stored but not displayed in the UI.* |
-| `url` | `string` | Yes | Organization website. Linked from entity name/logo on vault overview pages. |
-| `addresses` | `Record<string, string>` | Yes | Map of checksummed governance addresses to labels. Used to match `vault.governorAdmin` for entity identification and governor verification. |
-| `social` | `object` | Yes | Social media links (twitter, youtube, discord, telegram, github). *Currently stored but not displayed in the UI.* |
-
-**Entity matching**: A vault's `governorAdmin` address is compared against all `addresses` keys in entities declared by the product's `entity` field. If matched, the entity is displayed as the vault's Risk Manager.
+Vault tags stay scoped to their vault override. A product-level tag is emitted only when every assigned vault carries that tag, so one vault's classification cannot leak to sibling vaults.
 
 ---
 
-### points.json
-
-**Optional** — if this file is missing, the app functions normally without points/campaign badges.
-
-Structure: `EulerLabelPoint[]` (array of point campaign objects).
-
-```jsonc
-[
-  {
-    "name": "Turtle Club",                        // Campaign name (supports markdown links)
-    "logo": "turtle-club.svg",                    // Campaign logo filename
-    "collateralVaults": [                         // Vault addresses eligible for this campaign
-      "0xVault1...",
-      "0xVault2..."
-    ]
-  }
-]
-```
-
-#### Points Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Campaign name. Displayed as badge on vault items. Supports markdown link syntax in modals. |
-| `logo` | `string` | Yes | Campaign logo filename. Served locally from `/entities/` path with CDN fallback. Displayed as rounded avatar badge. |
-| `collateralVaults` | `string[]` | No | Vault addresses eligible for points. Each vault gets a points badge in the UI. |
-
----
-
-### earn-vaults.json
-
-Structure: `Array<string | EarnVaultEntry>` — each entry is either a plain address string or an object with metadata.
-
-```jsonc
-[
-  "0xSimpleEarnVault...",                         // Plain address — no special metadata
-  {
-    "address": "0xDetailedEarnVault...",          // Vault address (required)
-    "block": ["US", "EU"],                        // Hard geo-blocking (country codes/groups)
-    "restricted": ["JP"],                         // Soft geo-restriction
-    "tags": ["recently added"],                   // Sort to top in earn discovery table
-    "deprecated": true,                           // Mark as deprecated
-    "deprecationReason": "Migrated to new vault", // Deprecation explanation
-    "description": "Custom description",          // Vault description
-    "portfolioNotice": "Strategy rebalancing in progress"  // Operational notice on portfolio cards
-  }
-]
-```
-
-#### Earn Vault Entry Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `address` | `string` | Yes | Checksummed vault address |
-| `block` | `string[]` | No | Country codes/groups for hard geo-blocking (same syntax as products.json `block`) |
-| `restricted` | `string[]` | No | Country codes/groups for soft geo-restriction |
-| `tags` | `string[]` | No | Earn-vault classification tags. `recently added` sorts the vault to the top in earn discovery. |
-| `deprecated` | `boolean` | No | If `true`, marks vault as deprecated (hidden from discovery, warning banner shown) |
-| `deprecationReason` | `string` | No | Explanation shown in deprecation warning banner |
-| `description` | `string` | No | Custom description displayed on earn vault items and overview pages |
-| `portfolioNotice` | `string` | No | Operational notice shown on portfolio position cards. Supports auto-linked URLs and **bold** formatting. |
-
-Classification markers use a clean-cut tags schema. Earn-vault `recentlyAdded` is not supported by the current labels contract.
-
----
-
-### Oracle Adapter Assessments (Data V3)
+## Oracle Adapter Assessments (Data V3)
 
 How Lite joins these assessments to decoded routes, when it loads the active-route catalogue vs a per-address fallback, and the label/Route/quote rules are in [Oracle Adapter Display](./oracle-adapter-display.md).
 
@@ -305,7 +118,7 @@ Only a **defined** `governorAdmin` means governance actually resolved. Until the
 
 ### Ungoverned vaults
 
-Vaults with `governorAdmin = address(0)` are supported via an **artificial entity** convention: declare an `ungoverned` entity in `entities.json` whose `addresses` map contains the zero address, then list ungoverned vaults under a product that declares `entity: ["ungoverned"]`. The shared governor rule then matches the vault's zero `governorAdmin` against the artificial entity, no special-case code path needed. The UI shows the "Ungoverned" governance type chip independently of entity matching (driven by `governorAdmin === zeroAddress` directly).
+Vaults with `governorAdmin = address(0)` use the `ungoverned` entity whose governance-address set contains the zero address. A product managed by that entity follows the same governor matching rule as any other product. The UI shows the "Ungoverned" governance type chip independently from entity matching, based directly on `governorAdmin === zeroAddress`.
 
 This keeps the bridge endpoint verification aligned with the UI: label/entity matching proves the vault is governed by the declared entity, while the "Ungoverned" presentation signal comes directly from the on-chain `governorAdmin` value.
 
@@ -314,7 +127,7 @@ This keeps the bridge endpoint verification aligned with the UI: label/entity ma
 | Vault Source | Verification Method |
 |-------------|---------------------|
 | **EVaults** | Address appears in `verifiedVaultAddresses` from labels |
-| **Earn vaults** | Verified if in `earnVaults` from labels (`earn-vaults.json`) |
+| **Earn vaults** | Verified if present in the normalized Public Labels `earnVaults` set |
 | **Escrow vaults** | Loaded from `escrowedCollateralPerspective` on-chain (always verified) |
 | **Securitize vaults** | Address appears in `verifiedVaultAddresses` from labels |
 | **Unknown vaults** | Resolved via subgraph; verified only if in labels |
@@ -363,7 +176,7 @@ The client keeps an in-session categorization cache with this shape:
 
 For per-address lookups during direct navigation to a not-yet-cached vault, `fetchVaultCategory(address)` checks the SDK escrow verified array first, then asks `vaultMetaService.fetchVaultType` for the vault type.
 
-**Important: labels remain authoritative for which vaults are _shown_.** SDK categorization says "what category each vault is"; `products.json` / `earn-vaults.json` still say "which vaults to include in lists". The two are composed in `useVaults.loadVaults`: labels select the set, categorization picks the right lens per address.
+**Important: labels remain authoritative for which vaults are _shown_.** SDK categorization says "what category each vault is"; normalized Public Labels products and earn-vault entries say "which vaults to include in lists". The two are composed in `useVaults.loadVaults`: labels select the set, categorization picks the right lens per address.
 
 ## Discovery Page Filtering
 
@@ -413,7 +226,7 @@ The `getOrFetch()` method on the vault registry handles this flow. It first chec
 
 Entities are matched to vaults through two mechanisms:
 
-1. **Labels**: `product.entity` names the owning entity key(s), which are looked up in `entities.json`
+1. **Labels**: `product.entity` contains the Public Labels managing entity ID, which is looked up in the normalized entity map
 2. **Governor admin**: `vault.governorAdmin` is compared against entity `addresses` keys to identify the governing entity
 
 The governor admin must match an address in one of the product's declared entities for the vault to be considered "governor verified". If the product has the `governance limited` tag, the vault shows "Limited risk management" text and the entity display is faded to 20% opacity across all UI surfaces (list items, overview pages, explore cards).
@@ -436,13 +249,31 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 | File | Purpose |
 |------|---------|
 | `entities/euler/labels.ts` | TypeScript type definitions for all label types |
-| `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the current SDK label snapshot |
-| `composables/useEulerLabels.ts` | SDK-backed label loading and reactive composables |
+| `utils/public-labels.ts` | Public V3 pagination, normalization, and effective-visibility composition |
+| `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the normalized label snapshot |
+| `server/utils/public-labels-source.ts` | Shared V3 aggregate cache used by browser, public APIs, and vault snapshots |
+| `server/utils/static-labels-source.ts` | Atomic authoring-file source and durable checkpoint for forks |
+| `composables/useEulerLabels.ts` | Chain-scoped aggregate loading and normalized label publication |
 | `composables/useVaultRegistry.ts` | Vault registry with type detection and unknown resolution |
-| `composables/useGeoBlock.ts` | Geo-blocking logic using label block/restricted fields |
+| `composables/useGeoBlock.ts` | V3 country evaluation and independent sanctions gate |
 
 ## Programmatic verification lookup
 
-External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. The endpoint merges `products.json` (active and deprecated entries), `earn-vaults.json` (active and deprecated entries), and the on-chain `escrowedCollateralPerspective` into a single per-chain verified set, applies the same governor / router-governor / owner verification that the client UI uses (an EVK or Securitize vault must have `governorAdmin` — and a non-zero oracle-router governor, if present — match one of its product's declared entity addresses; an Earn vault listed under a product must have `owner` match), and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults — deprecation does not change the verification rule. Escrow vaults from the on-chain perspective and earn entries with no product entry are trusted unconditionally.
+External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. This server endpoint uses the same normalized Public Labels bundle as the UI plus the on-chain `escrowedCollateralPerspective`, applies governor / router-governor / owner verification, and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults. Escrow vaults from the on-chain perspective and standalone Earn entries are trusted unconditionally.
 
 Consumers that need display metadata (resolved name, description, governing entity, asset) on top of the verification verdict can call [`GET /api/public/metadata`](./public-api.md#get-apipublicmetadata), which applies the same labels / override / verification rules the client UI uses and returns a uniform shape across EVK, Securitize, and Earn vaults.
+
+
+Hosted full verification resolves the managing entity from the V3 vault row, including standalone Earn vaults. Missing manager data yields an empty authority set, so a visible/warning inventory entry alone cannot grant an owner-verification badge. Both client and public APIs apply this rule. Static Earn labels preserve their authored membership semantics. Hosted on-chain governor/owner checks remain in place until the verification bake justifies delegation to V3.
+
+## Archived chains: V3 metadata with on-chain verification
+
+Enabled `DEPRECATED_CHAINS` select the SDK's `PublicLabelsV3MetadataAdapter`. Each must also be in `ONCHAIN_SDK_CHAINS`; a missing entry is a configuration error. Chains without a configured RPC are ignored, and other enabled chains keep V3 assessments even if they use on-chain SDK reads. No separate labels chain variable is required. The archived-chain configuration is `DEPRECATED_CHAINS=146,239,60808,80094`; restart after configuration changes. Swellchain is not selected unless enabled and added to the deprecated/on-chain lists.
+
+The SDK shares metadata fetching and display mapping between its adapters. Metadata-only bundles carry `source: 'v3-metadata'` and contain no visibility verdicts. They use the same label set/publication selection, live entity addresses and live geo policies as the assessed path. Candidate addresses are separate from verified membership.
+
+Lite selects the adapter once in its shared server labels loader. The browser, vault snapshots and public APIs use that selection. The metadata-only path applies the existing governor/router/owner checks against the vault's explicit managing entity; an absent manager cannot inherit static Earn trust. Registry verification uses current candidates and entity addresses rather than a cached positive flag. Independent escrow-perspective verification remains applicable.
+
+Metadata-only discovery follows published product `notExplorable` and per-vault `notExplorableLend` / `notExplorableBorrow` flags and normal market filters. Explore product cards are label/market driven; governance checks separately control verified vault lists and verification badges. Deprecation alone does not hide a vault; Earn uses its lend-side flag and product hiding. Published deprecation and display information remains available to direct pages and existing positions. V3 assessment-based platform listing controls are not synthesized for these chains. Errors on normally assessed chains never switch them to metadata-only handling. Static fork mode remains independent.
+
+Live labels refreshes reload vault data when membership or discovery eligibility changes; text-only updates use the reactive labels store. This brings newly eligible vaults into the registry without requiring a page reload. Same-chain label refreshes retain already loaded vaults, including unlisted vaults used by open forms; current hosted membership still controls verification. Ordinary loads and chain changes clear the registry. Batch-review account reads request quantitative data explicitly and do not invoke the SDK's default file-based labels service through `populateAll`.
diff --git a/entities/euler/labels.ts b/entities/euler/labels.ts
index c52312b4c..6229e6ed9 100644
--- a/entities/euler/labels.ts
+++ b/entities/euler/labels.ts
@@ -1,89 +1,25 @@
-export type EulerLabelEntity = {
-  name: string
-  logo: string
-  description: string
-  url: string
-  addresses: Record<string, string>
-  social: {
-    twitter: string
-    youtube: string
-    discord: string
-    telegram: string
-    github: string
-  }
-}
-export type EulerLabelVaultOverride = {
-  name?: string
-  description?: string
-  portfolioNotice?: string
-  deprecationReason?: string
-  block?: string[]
-  restricted?: string[]
-  notExplorableLend?: boolean
-  notExplorableBorrow?: boolean
-  tags?: string[]
-}
-
-export type EulerLabelProduct = {
-  name: string
-  description: string
-  portfolioNotice?: string
-  entity: string[] | string
-  url: string
-  vaults: string[]
-  deprecatedVaults?: string[]
-  deprecationReason?: string
-  notExplorable?: boolean
-  block?: string[]
-  vaultOverrides?: Record<string, EulerLabelVaultOverride>
-  // Freeform classification tags, e.g. 'keyring', 'access control', or
-  // 'governance limited'. Replaces the former bespoke classification booleans.
-  tags?: string[]
-}
-
-export type EulerLabelEarnVaultEntry = {
-  address: string
-  block?: string[]
-  restricted?: string[]
-  tags?: string[]
-  deprecated?: boolean
-  deprecationReason?: string
-  description?: string
-  portfolioNotice?: string
-  notExplorable?: boolean
-}
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
+import { resolveLabelLogo } from '~/utils/label-logo'
+import type {
+  EulerLabelAssetEntry as SdkEulerLabelAssetEntry,
+  EulerLabelEarnVaultEntry as SdkEulerLabelEarnVaultEntry,
+  EulerLabelEntity as SdkEulerLabelEntity,
+  EulerLabelPoint as SdkEulerLabelPoint,
+  EulerLabelProduct as SdkEulerLabelProduct,
+  EulerLabelVaultOverride as SdkEulerLabelVaultOverride,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
 
-/**
- * Asset-level geo-blocking entry. At least one match field
- * (`address` | `symbols` | `symbolRegex` | `names` | `nameRegex`) must be
- * set. When multiple match fields are set they are OR-composed: the entry
- * matches an asset if ANY populated match field matches.
- *
- * All string comparisons (`symbols`, `names`) are case-insensitive. Regex
- * fields are compiled with the `i` flag at load time. Invalid regexes are
- * dropped with a warning.
- *
- * `block` (hard) and `restricted` (soft) follow the same semantics as
- * vault-level rules; countries accept the `EU` / `EEA` / `EFTA` aliases.
- */
-export type EulerLabelAssetEntry = {
-  address?: string
-  symbols?: string[]
-  symbolRegex?: string
-  names?: string[]
-  nameRegex?: string
-  block?: string[]
-  restricted?: string[]
-}
-export type EulerLabelPoint = {
-  name: string
-  logo: string
-  collateralVaults?: string[]
-}
+export type EulerLabelEntity = SdkEulerLabelEntity
+export type EulerLabelVaultOverride = SdkEulerLabelVaultOverride
+export type EulerLabelEarnVaultEntry = SdkEulerLabelEarnVaultEntry
+export type EulerLabelAssetEntry = SdkEulerLabelAssetEntry
+export type EulerLabelPoint = SdkEulerLabelPoint
+export type EulerLabelPointReward = SdkEulerLabelPoint
 
-export type EulerLabelPointReward = {
-  name: string
-  logo: string
+// Lite's existing UI assumes every rendered product has a managing entity.
+// Public Labels normalization guarantees that shape for product records.
+export type EulerLabelProduct = Omit<SdkEulerLabelProduct, 'entity'> & {
+  entity: string[] | string
 }
 
 export const eulerLabelEntityEmpty = {
@@ -100,6 +36,7 @@ export const eulerLabelEntityEmpty = {
     github: '',
   },
 } as EulerLabelEntity
+
 export const eulerLabelProductEmpty = {
   name: '',
   description: '',
@@ -111,9 +48,10 @@ export const eulerLabelProductEmpty = {
   vaultOverrides: {},
 } as EulerLabelProduct
 
-export const getEulerLabelEntityLogo = (fileName: string) => {
-  const { EULER_LABELS_ENTITY_LOGO_URL } = useEulerConfig()
-  return `${EULER_LABELS_ENTITY_LOGO_URL}/${fileName}`
-}
+export const getEulerLabelEntityLogo = (fileName: string) =>
+  resolveLabelLogo(fileName, getEulerLabelsSourceData().logoBaseUrl)
+
+export const getEulerLabelPointLogo = getEulerLabelEntityLogo
 
-export const getEntityLogoLocalPath = (fileName: string) => `/entities/${fileName}`
+export const getEntityLogoLocalPath = (fileName: string) =>
+  /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i.test(fileName) ? `/entities/${fileName}` : ''
diff --git a/entities/lend-discovery.ts b/entities/lend-discovery.ts
index 4fa5d13dc..85b4491d0 100644
--- a/entities/lend-discovery.ts
+++ b/entities/lend-discovery.ts
@@ -14,6 +14,8 @@ export interface MarketGroup {
   curator?: EulerLabelEntity
   /** Curator entity key from labels */
   curatorKey?: string
+  /** Owner first, followed by display-only co-brand entities. */
+  brandEntities?: EulerLabelEntity[]
   /** Core member vaults */
   vaults: AnyVault[]
   /** Vaults referenced as collateral but not in this group */
diff --git a/features/reviewed-execution/policy/app-policy.ts b/features/reviewed-execution/policy/app-policy.ts
index 61609b68f..3d8b1d98e 100644
--- a/features/reviewed-execution/policy/app-policy.ts
+++ b/features/reviewed-execution/policy/app-policy.ts
@@ -32,6 +32,8 @@ export const resolveAppPolicy = async (
   now = Date.now(),
   intents?: readonly OperationIntent[],
 ): Promise<Readonly<ReviewedPolicy>> => {
+  const exitsWithoutAcquisition = new Set(['withdraw', 'redeem', 'repay-from-wallet', 'repay-from-deposit', 'cleanup', 'reward-claim', 'reul-unlock'])
+  const onlyExits = Boolean(intents?.length && intents.every(intent => exitsWithoutAcquisition.has(intent.planner.name)))
   const expiresAt = now + 5 * 60_000
   const { get, getOrFetch, getVault, isVerifiedVault } = useVaultRegistry()
   const { getTokenByAddress } = useTokenList()
@@ -71,7 +73,7 @@ export const resolveAppPolicy = async (
       exactVaults.push({ address, vault: entry.vault as EVault | EulerEarn | SecuritizeCollateralVault, type: entry.type })
     }
 
-    if (requirements.vaults.length && !useEulerLabels().isReady.value) {
+    if (requirements.vaults.length && !useEulerLabels().isReady.value && !onlyExits) {
       throw new Error('Vault verification is unavailable')
     }
 
@@ -100,6 +102,7 @@ export const resolveAppPolicy = async (
   }
 
   const canonicallyVerified = (entry: NonNullable<typeof exactVaults>[number]) => {
+    if (!useEulerLabels().isReady.value) return false
     const { isVaultGovernorVerified, isSecuritizeGovernorVerified, isEarnVaultOwnerVerified } = useVaults()
     if (entry.type === 'earn') return isEarnVaultOwnerVerified(entry.vault as EulerEarn)
     if (entry.type === 'securitize') return isSecuritizeGovernorVerified(entry.vault as SecuritizeCollateralVault)
@@ -147,13 +150,13 @@ export const resolveAppPolicy = async (
       const address = addressOfSubject(requirement.subject)
       if (!address) throw new Error('Vault/contract policy subject is malformed')
       const vault = getVault(address)
-      if ((vault || vaultLabelSubjects.has(address)) && !useEulerLabels().isReady.value) {
+      if ((vault || vaultLabelSubjects.has(address)) && !useEulerLabels().isReady.value && !onlyExits) {
         throw new Error('Vault verification is unavailable')
       }
       if (vault) {
         if (!vault.asset?.address || !vault.type) throw new Error(`Vault metadata is incomplete for ${address}`)
-        if (!labelsVersion) throw new Error('Euler labels policy metadata is unavailable')
-        version = `vault:${vault.type}:${vault.asset.address}:${labelsVersion}`
+        if (!labelsVersion && !onlyExits) throw new Error('Euler labels policy metadata is unavailable')
+        version = `vault:${vault.type}:${vault.asset.address}:${useEulerLabels().isReady.value ? labelsVersion : 'unavailable-exit'}`
       }
       else version = `effect-target:${address}`
     }
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 395075041..035154adc 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -143,9 +143,6 @@ export default defineNuxtConfig({
       // Absolute URL to an image used for social share previews (og:image /
       // twitter:image). Empty default so forks don't inherit our branding.
       configSocialImageUrl: '',
-      configLabelsRepo: 'euler-xyz/euler-labels',
-      configLabelsRepoBranch: 'master',
-      configLabelsBaseUrl: '',
       configEulerChainsUrl: '',
       // Feature flags: enabled by default. Set to 'false' to disable.
       configEnableEntityBranding: '',
@@ -303,7 +300,7 @@ export default defineNuxtConfig({
           'Cloudflare-CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
         },
       },
-      '/api/internal/labels/**': {
+      '/api/internal/public-labels': {
         headers: {
           'CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
           'Cloudflare-CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
diff --git a/pages/borrow/index.vue b/pages/borrow/index.vue
index 78d86bf26..be15ec6b3 100644
--- a/pages/borrow/index.vue
+++ b/pages/borrow/index.vue
@@ -425,7 +425,7 @@ const marketOptions = computed(() => {
     counted.add(dedupKey)
     const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
     const entityObj = entityName ? entities[entityName] : null
-    return [{ key: market.name, label: market.name, tvl, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
+    return [{ key: market.name, label: market.name, tvl, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
   }))
 })
 
@@ -438,7 +438,7 @@ const riskManagerOptions = computed(() => {
       const dedupKey = `${entity.name}:${pair.borrow.address}`
       const tvl = counted.has(dedupKey) ? 0 : pairTvl
       counted.add(dedupKey)
-      return { key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined }
+      return { key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined }
     })
   }))
 })
diff --git a/pages/earn/[vault]/[subAccount]/withdraw.vue b/pages/earn/[vault]/[subAccount]/withdraw.vue
index 1a6db55f2..f9e37c27d 100644
--- a/pages/earn/[vault]/[subAccount]/withdraw.vue
+++ b/pages/earn/[vault]/[subAccount]/withdraw.vue
@@ -28,7 +28,7 @@ const { isConnected, isSpyMode, effectiveAddress } = useEffectiveAddress()
 const { runSimulation, simulationError, clearSimulationError } = useTransactionPlanSimulation()
 const { viewer, visibleTotal } = useApyVisibility()
 const vaultAddress = route.params.vault as string
-useOperationGuard([vaultAddress])
+useOperationGuard([vaultAddress], { acquiresExposure: false })
 const product = useEulerProductOfVault(vaultAddress)
 const subAccountIndex = Number(route.params.subAccount)
 const subAccount = computed(() => {
diff --git a/pages/earn/index.vue b/pages/earn/index.vue
index 3b03cdc99..c040342aa 100644
--- a/pages/earn/index.vue
+++ b/pages/earn/index.vue
@@ -164,7 +164,7 @@ const curatorOptions = computed(() => {
   return buildTvlSortedOptions(list.value.flatMap((vault) => {
     const tvl = vaultTotalSupplyUsd.value.get(vault.address) ?? 0
     return getEntitiesByEarnVault(vault).map(entity => ({
-      key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
+      key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
     }))
   }))
 })
diff --git a/pages/explore/index.vue b/pages/explore/index.vue
index 561fc7345..8019fa894 100644
--- a/pages/explore/index.vue
+++ b/pages/explore/index.vue
@@ -111,7 +111,7 @@ const marketOptions = computed(() => {
       seenInGroup.add(market.name)
       const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
       const entityObj = entityName ? entities[entityName] : null
-      entries.push({ key: market.name, label: market.name, tvl: group.metrics.totalTVL, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined })
+      entries.push({ key: market.name, label: market.name, tvl: group.metrics.totalTVL, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined })
     }
   }
   return buildTvlSortedOptions(entries)
@@ -141,7 +141,7 @@ const riskManagerOptions = computed(() => {
   for (const group of marketGroups.value) {
     if (group.source !== 'product') continue
     for (const entity of getUniqueEntitiesByVaults(group.vaults)) {
-      entries.push({ key: entity.name, label: entity.name, tvl: group.metrics.totalTVL, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined })
+      entries.push({ key: entity.name, label: entity.name, tvl: group.metrics.totalTVL, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined })
     }
   }
   return buildTvlSortedOptions(entries)
diff --git a/pages/lend/[vault]/[subAccount]/withdraw.vue b/pages/lend/[vault]/[subAccount]/withdraw.vue
index 428206466..b7b0e340e 100644
--- a/pages/lend/[vault]/[subAccount]/withdraw.vue
+++ b/pages/lend/[vault]/[subAccount]/withdraw.vue
@@ -57,7 +57,7 @@ const {
 const { settings } = useUserSettings()
 const enableIntrinsicApy = computed(() => settings.value.enableIntrinsicApy)
 const vaultAddress = route.params.vault as string
-useOperationGuard([vaultAddress])
+useOperationGuard([vaultAddress], { acquiresExposure: false })
 const subAccountIndex = Number(route.params.subAccount)
 const subAccount = computed(() => {
   const addr = effectiveAddress.value
diff --git a/pages/lend/index.vue b/pages/lend/index.vue
index b55fc40e6..b8a25c746 100644
--- a/pages/lend/index.vue
+++ b/pages/lend/index.vue
@@ -196,7 +196,7 @@ const marketOptions = computed(() => {
     if (!market.name) return []
     const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
     const entityObj = entityName ? entities[entityName] : null
-    return [{ key: market.name, label: market.name, tvl: vaultUsdValues.value.get(vault.address) ?? 0, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
+    return [{ key: market.name, label: market.name, tvl: vaultUsdValues.value.get(vault.address) ?? 0, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
   }))
 })
 
@@ -216,7 +216,7 @@ const riskManagerOptions = computed(() => {
   return buildTvlSortedOptions(borrowableVaults.value.flatMap((vault) => {
     const tvl = vaultUsdValues.value.get(vault.address) ?? 0
     return getEntitiesByVault(vault).map(entity => ({
-      key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
+      key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
     }))
   }))
 })
diff --git a/pages/position/[number]/repay.vue b/pages/position/[number]/repay.vue
index e465c48a2..6507e4706 100644
--- a/pages/position/[number]/repay.vue
+++ b/pages/position/[number]/repay.vue
@@ -68,7 +68,7 @@ const collateralVault = computed<EVault | SecuritizeCollateralVault | undefined>
 const positionCollateralVaults = computed(() =>
   resolvePositionRoeCollateralVaults(position.value, collateralVault.value),
 )
-useOperationGuard(computed(() => [borrowVault.value?.address].filter(Boolean)))
+useOperationGuard(computed(() => [borrowVault.value?.address].filter(Boolean)), { acquiresExposure: false })
 const assets = computed<VaultAsset[]>(() => [collateralVault.value?.asset, borrowVault.value?.asset].filter((asset): asset is VaultAsset => !!asset))
 const assetsLabel = usePositionPairLabel(position)
 const isEligibleForLiquidation = computed(() => position.value?.liquidatable ?? false)
diff --git a/pages/position/[number]/withdraw.vue b/pages/position/[number]/withdraw.vue
index 009d33f4c..3620c6bc9 100644
--- a/pages/position/[number]/withdraw.vue
+++ b/pages/position/[number]/withdraw.vue
@@ -180,7 +180,7 @@ const form = useCollateralForm({
   },
   usePreparedPipeline: true,
 })
-useOperationGuard(computed(() => [form.collateralVault.value?.address, form.borrowVault.value?.address].filter(Boolean)))
+useOperationGuard(computed(() => [form.collateralVault.value?.address, form.borrowVault.value?.address].filter(Boolean)), { acquiresExposure: false })
 const withdrawableCollateralAssets = computed(() => cashLimitedCollateralAssets())
 
 // True when the requested amount covers the entire collateral balance. The Max
diff --git a/scripts/execution-record.mjs b/scripts/execution-record.mjs
index b7e65ece7..8d76d5577 100644
--- a/scripts/execution-record.mjs
+++ b/scripts/execution-record.mjs
@@ -1483,7 +1483,7 @@ function shouldCaptureUrl(rawUrl) {
       || pathName.startsWith('/api/internal/pyth')
       || pathName.startsWith('/api/internal/rpc')
       || pathName.startsWith('/api/internal/euler-chains')
-      || pathName.startsWith('/api/internal/labels')
+      || pathName.startsWith('/api/internal/public-labels')
       || pathName.startsWith('/api/internal/vaults')
       || pathName.startsWith('/api/internal/token-list')
       || url.hostname.includes('swap')
diff --git a/scripts/install-preview-sdk.sh b/scripts/install-preview-sdk.sh
index c4a5e2afa..c16c8a5ec 100644
--- a/scripts/install-preview-sdk.sh
+++ b/scripts/install-preview-sdk.sh
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 
+APP_DIR="${EULER_LITE_APP_DIR:-$(pwd)}"
+export APP_DIR
+
 if [ -z "${EULER_SDK_BRANCH:-}" ]; then
   echo "EULER_SDK_BRANCH is not set; using @eulerxyz/euler-v2-sdk from package-lock.json."
   npm ls @eulerxyz/euler-v2-sdk --depth=0
@@ -14,7 +17,7 @@ case "$EULER_SDK_BRANCH" in
     ;;
 esac
 
-APP_SDK_VERSION="$(node -p "const p=require('/usr/src/app/package.json'); const spec=(p.dependencies||{})['@eulerxyz/euler-v2-sdk'] || (p.devDependencies||{})['@eulerxyz/euler-v2-sdk'] || ''; spec.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] || ''")"
+APP_SDK_VERSION="$(node -p "const p=require(process.env.APP_DIR + '/package.json'); const spec=(p.dependencies||{})['@eulerxyz/euler-v2-sdk'] || (p.devDependencies||{})['@eulerxyz/euler-v2-sdk'] || ''; spec.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] || ''")"
 
 SDK_REPO="https://github.com/euler-xyz/euler-sdks.git"
 SDK_DIR="/tmp/euler-sdks"
@@ -38,7 +41,7 @@ if [ -n "$APP_SDK_VERSION" ]; then
     SDK_RELEASE_COMMIT="$(git rev-parse "refs/tags/${SDK_RELEASE_TAG}^{}")"
     if git merge-base --is-ancestor HEAD "$SDK_RELEASE_COMMIT"; then
       echo "SDK branch ${EULER_SDK_BRANCH} is already included in ${SDK_RELEASE_TAG}; using @eulerxyz/euler-v2-sdk from package-lock.json."
-      cd /usr/src/app
+      cd "$APP_DIR"
       npm ls @eulerxyz/euler-v2-sdk --depth=0
       exit 0
     fi
@@ -65,7 +68,11 @@ fi
 
 case "$SDK_PNPM_PACKAGE" in
   pnpm@*|pnpm)
-    npm install --global "$SDK_PNPM_PACKAGE"
+    if command -v pnpm >/dev/null 2>&1 && pnpm --version >/dev/null 2>&1; then
+      echo "Using existing pnpm $(pnpm --version)."
+    else
+      npm install --global "$SDK_PNPM_PACKAGE"
+    fi
     ;;
   *)
     echo "Unsupported SDK pnpm package: ${SDK_PNPM_PACKAGE}" >&2
@@ -84,7 +91,7 @@ const fs = require('node:fs')
 
 const packageJsonPath = 'packages/euler-v2-sdk/package.json'
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
-const appPackageJson = JSON.parse(fs.readFileSync('/usr/src/app/package.json', 'utf8'))
+const appPackageJson = JSON.parse(fs.readFileSync(`${process.env.APP_DIR}/package.json`, 'utf8'))
 const appSdkSpec = appPackageJson.dependencies?.['@eulerxyz/euler-v2-sdk']
   || appPackageJson.devDependencies?.['@eulerxyz/euler-v2-sdk']
   || ''
@@ -105,22 +112,31 @@ NODE
 mkdir -p "$SDK_PACK_DIR"
 npm pack --ignore-scripts ./packages/euler-v2-sdk --pack-destination "$SDK_PACK_DIR"
 
-cd /usr/src/app
+cd "$APP_DIR"
 npm install --no-save --ignore-scripts "$SDK_PACK_DIR"/*.tgz
 if ! npm ls @eulerxyz/euler-v2-sdk --depth=0; then
   echo "npm ls reported a version mismatch for the preview SDK tarball; validating runtime exports instead."
 fi
 
 node --input-type=module - <<'NODE'
-import { buildEulerSDK, PositionMigrationService } from '@eulerxyz/euler-v2-sdk'
+import {
+  buildEulerSDK,
+  PositionMigrationService,
+} from '@eulerxyz/euler-v2-sdk'
+import {
+  normalizePublicLabelsData,
+  PublicLabelsV3Adapter,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
 
 const missing = []
 if (typeof buildEulerSDK !== 'function') missing.push('buildEulerSDK')
 if (typeof PositionMigrationService !== 'function') missing.push('PositionMigrationService')
+if (typeof PublicLabelsV3Adapter !== 'function') missing.push('PublicLabelsV3Adapter')
+if (typeof normalizePublicLabelsData !== 'function') missing.push('normalizePublicLabelsData')
 
 if (missing.length > 0) {
   throw new Error(`Preview SDK is missing expected exports: ${missing.join(', ')}`)
 }
 
-console.log('Preview @eulerxyz/euler-v2-sdk migration exports are available.')
+console.log('Preview @eulerxyz/euler-v2-sdk branch exports are available.')
 NODE
diff --git a/server/api/internal/labels/[chainId]/[file].get.ts b/server/api/internal/labels/[chainId]/[file].get.ts
deleted file mode 100644
index 35a4c47c4..000000000
--- a/server/api/internal/labels/[chainId]/[file].get.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * Path-shape labels endpoint that mirrors the SDK's default URL template
- *
- *   `${eulerLabelsBaseUrl}/${chainId}/${file}.json`
- *
- * Point the SDK at `eulerLabelsBaseUrl: '/api/internal/labels'` and its built-in
- * fetcher hits this endpoint instead of `raw.githubusercontent.com`.
- *
- * `chainId` is either an integer or the literal string `all` (for the
- * cross-chain `all/assets.json` file the SDK's
- * `getEulerLabelsGlobalAssetsUrl` calls). Anything else 400s.
- *
- * Calls `refreshLabelFile` from the sibling query-shape endpoint, so both
- * paths share one in-memory TTL cache and one upstream-fetch pipeline.
- * Unlike the query-shape handler, this route does not short-circuit on a
- * fresh cache entry: every request force-refreshes (joining any in-flight
- * fetch for the same `scope:file`), and the shared cache is used for writes
- * and stale fallback only.
- */
-import { createError, getRouterParam, setResponseHeader } from 'h3'
-import { createRateLimiter } from '~/server/utils/rate-limit'
-import {
-  LABEL_FILES,
-  refreshLabelFile,
-  type LabelFile,
-  type LabelScope,
-} from '~/server/api/internal/labels/[file].get'
-
-const rateLimiter = createRateLimiter({
-  max: 1000,
-  windowMs: 60_000,
-  label: 'labels-by-path',
-})
-
-const isLabelFile = (file: string): file is LabelFile =>
-  (LABEL_FILES as readonly string[]).includes(file)
-
-const parseScope = (raw: string | undefined): LabelScope | undefined => {
-  if (!raw) return undefined
-  if (raw === 'all') return 'all'
-  const n = Number(raw)
-  if (Number.isInteger(n) && n > 0) return n
-  return undefined
-}
-
-export default defineEventHandler(async (event) => {
-  rateLimiter.consume(event)
-
-  const file = getRouterParam(event, 'file')
-  if (!file || !isLabelFile(file)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid label file' })
-  }
-
-  const scope = parseScope(getRouterParam(event, 'chainId'))
-  if (scope === undefined) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId (use an integer or "all")' })
-  }
-
-  // Pure pass-through: no chain/global union here. The SDK calls the
-  // global file via a separate `getEulerLabelsGlobalAssetsUrl()` and
-  // composes the result itself.
-  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
-  return await refreshLabelFile(scope, file)
-})
diff --git a/server/api/internal/labels/[file].get.ts b/server/api/internal/labels/[file].get.ts
deleted file mode 100644
index 5d221ff6a..000000000
--- a/server/api/internal/labels/[file].get.ts
+++ /dev/null
@@ -1,231 +0,0 @@
-import { createError, getQuery, getRouterParam, setResponseHeader } from 'h3'
-import { createRateLimiter } from '~/server/utils/rate-limit'
-import { createTtlCache } from '~/server/utils/cache'
-import { fetchWithTimeout } from '~/server/utils/fetchWithTimeout'
-import { createInFlightDedup } from '~/server/utils/in-flight'
-import { resolveLabelsFileUrl } from '~/server/utils/labels-base-url'
-import { reportStatus } from '~/server/utils/log'
-
-const CACHE_TTL_MS = 300_000
-
-/** The set of label files this proxy serves. Also consumed by warm-cache. */
-export const LABEL_FILES = ['products.json', 'entities.json', 'earn-vaults.json', 'points.json', 'assets.json'] as const
-
-export type LabelFile = typeof LABEL_FILES[number]
-
-/** Scope for a label fetch: a chain ID for per-chain files, or 'all' for cross-chain rules. */
-export type LabelScope = number | 'all'
-
-// Missing files resolve to a type-appropriate empty payload. Transient failures
-// require a usable cached response or return an error so verification can retry.
-const EMPTY_SHAPES: Record<LabelFile, unknown> = {
-  'products.json': {},
-  'entities.json': {},
-  'earn-vaults.json': [],
-  'points.json': [],
-  'assets.json': [],
-}
-
-const rateLimiter = createRateLimiter({
-  max: 1000,
-  windowMs: 60_000,
-  label: 'labels',
-})
-
-const cache = createTtlCache<unknown>({ ttlMs: CACHE_TTL_MS })
-const inFlight = createInFlightDedup<string, unknown>()
-
-/** Fields whose values are rendered as HTML via autoLink() — check for markdown link injection. */
-const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
-/** Fields whose values are bound directly to :href in Vue templates. */
-const URL_KEYS = new Set(['url'])
-/** Fields whose values must be compilable as regular expressions (assets.json pattern rules). */
-const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
-/** Cap regex length as a basic ReDoS sanity guard — labels are curated, not user-submitted. */
-const MAX_REGEX_LEN = 512
-/**
- * Fields whose values are concatenated into image URLs (`${CDN}/${logo}`
- * and `/entities/${logo}`). Must be a bare filename — no slashes, no `..`,
- * no scheme — so a curator slip can't point the browser off-origin or
- * traverse outside the intended asset directory.
- */
-const LOGO_FILENAME_KEYS = new Set(['logo'])
-const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
-/**
- * Defensive size caps. Labels are trusted but version-controlled; these
- * are there to prevent a mistake (or a compromise of the labels repo)
- * from ballooning a single proxy response into a client-side DoS.
- */
-const MAX_STRING_LEN = 16_384
-const MAX_ARRAY_LEN = 10_000
-
-/**
- * Detects the markdown-link href-injection pattern: [text](https://..."....)
- * A double-quote inside the URL portion closes the href attribute, allowing
- * additional HTML attributes (e.g. style=) to be injected via HTML parser
- * error-recovery. Bare double-quotes in the link text are harmless.
- */
-const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
-
-function isSafeHttpUrl(value: string): boolean {
-  if (!value) return true
-  try {
-    const { protocol } = new URL(value)
-    return protocol === 'http:' || protocol === 'https:'
-  }
-  catch {
-    return false
-  }
-}
-
-export function validateNode(node: unknown, path: string): void {
-  if (Array.isArray(node)) {
-    if (node.length > MAX_ARRAY_LEN) {
-      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
-    }
-    node.forEach((item, i) => validateNode(item, `${path}[${i}]`))
-    return
-  }
-  if (node !== null && typeof node === 'object') {
-    for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
-      if (typeof value === 'string') {
-        if (value.length > MAX_STRING_LEN) {
-          throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
-        }
-        if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
-          throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
-        }
-        if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
-          throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
-        }
-        if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
-          throw new Error(`Injection pattern detected in ${path}.${key}`)
-        }
-        if (REGEX_KEYS.has(key)) {
-          if (value.length > MAX_REGEX_LEN) {
-            throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
-          }
-          try {
-            new RegExp(value)
-          }
-          catch {
-            throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
-          }
-        }
-      }
-      else if (value !== null && typeof value === 'object') {
-        validateNode(value, `${path}.${key}`)
-      }
-    }
-  }
-}
-
-function getUpstreamUrl(scope: LabelScope, file: string): string {
-  return resolveLabelsFileUrl(scope, file)
-}
-
-/**
- * Forces an upstream fetch, bypassing the fresh-cache check. Used by the
- * warm-cache plugin so every cycle actually refreshes the entry instead
- * of cache-hitting a still-fresh value and letting it expire before the
- * next cycle. Collapses concurrent refresh calls per `scope:file` via
- * the in-flight map.
- *
- * `persist=true` writes the empty shape into the cache so subsequent
- * requests skip upstream entirely. Reserved for the absent-file cases
- * (404 and 403 — see below), where the file is legitimately not published
- * for this scope. For other failures (transient 5xx, network errors,
- * JSON parse, validation), serve stale data if available or return HTTP 503.
- * A transient failure must not become a successful empty verification list.
- */
-export function refreshLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const key = `${scope}:${file}`
-
-  const fallback = (persist: boolean): unknown => {
-    const stale = cache.getStale(key)
-    if (stale) return stale
-    const empty = EMPTY_SHAPES[file]
-    if (!persist) throw createError({ statusCode: 503, statusMessage: 'Vault labels are temporarily unavailable' })
-    cache.set(key, empty)
-    return empty
-  }
-
-  return inFlight.run(key, async (): Promise<unknown> => {
-    const statusKey = `${file}:${scope}`
-    try {
-      const resp = await fetchWithTimeout(getUpstreamUrl(scope, file))
-      if (!resp.ok) {
-        // 404 and 403 are both expected signals for "file not published
-        // at this scope". The labels CDN (S3+CloudFront origin without
-        // ListBucket grant) returns 403 AccessDenied for missing keys
-        // rather than 404, so we treat them identically: persist the
-        // empty fallback and stay quiet on subsequent warm cycles.
-        // Other non-2xx statuses (5xx etc.) are reported as transitions
-        // so the first occurrence surfaces but repeats do not.
-        if (resp.status === 404 || resp.status === 403) {
-          reportStatus('labels', statusKey, `absent-${resp.status}`)
-          return fallback(true)
-        }
-        throw new Error(`${file} upstream returned ${resp.status} for scope ${scope}`)
-      }
-
-      const data: unknown = await resp.json()
-      validateNode(data, file)
-      cache.set(key, data)
-      reportStatus('labels', statusKey, 'ok')
-      return data
-    }
-    catch (err) {
-      reportStatus('labels', statusKey, 'fetch-error',
-        `Failed to fetch ${file} for scope ${scope}: ${err instanceof Error ? err.message : err}`)
-      return fallback(false)
-    }
-  })
-}
-
-// Read-through helper: cache hit → return synchronously; otherwise refresh.
-// Used by the handler's assets.json union so each source can be served from
-// its own cache entry without triggering two upstream fetches on a warm cache.
-async function getOrRefresh(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const hit = cache.get(`${scope}:${file}`)
-  if (hit !== undefined) return hit
-  return refreshLabelFile(scope, file)
-}
-
-export default defineEventHandler(async (event) => {
-  rateLimiter.consume(event)
-
-  const file = getRouterParam(event, 'file')
-  if (!file || !Object.hasOwn(EMPTY_SHAPES, file)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid file' })
-  }
-
-  const query = getQuery(event)
-  const chainId = Number(query.chainId)
-  if (!Number.isInteger(chainId) || chainId <= 0) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId' })
-  }
-
-  // Labels are curated external metadata — CDN can short-circuit polls
-  // between warm cycles.
-  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
-
-  // assets.json is unioned with the cross-chain `all/assets.json` so global
-  // pattern rules (e.g. by issuer symbol) apply to every chain without the
-  // client knowing about the separate source.
-  if (file === 'assets.json') {
-    const [chainData, globalData] = await Promise.all([
-      getOrRefresh(chainId, 'assets.json'),
-      getOrRefresh('all', 'assets.json'),
-    ])
-    const chainArr = Array.isArray(chainData) ? chainData : []
-    const globalArr = Array.isArray(globalData) ? globalData : []
-    return [...chainArr, ...globalArr]
-  }
-
-  const key = `${chainId}:${file}`
-  const cached = cache.get(key)
-  if (cached) return cached
-
-  return refreshLabelFile(chainId, file as LabelFile)
-})
diff --git a/server/api/internal/public-labels.get.ts b/server/api/internal/public-labels.get.ts
new file mode 100644
index 000000000..cfc3eef47
--- /dev/null
+++ b/server/api/internal/public-labels.get.ts
@@ -0,0 +1,35 @@
+import { createError, getHeader, getQuery, setResponseHeader } from 'h3'
+import { createRateLimiter } from '~/server/utils/rate-limit'
+import {
+  getPublicLabelsBundle,
+  refreshPublicLabelsBundle,
+} from '~/server/utils/public-labels-source'
+import { isV3LabelsVersionSelector } from '~/server/utils/labels-base-url'
+
+const rateLimiter = createRateLimiter({
+  max: 1000,
+  windowMs: 60_000,
+  label: 'public-labels',
+})
+
+export default defineEventHandler(async (event) => {
+  rateLimiter.consume(event)
+  const query = getQuery(event)
+  const chainId = Number(query.chainId)
+  if (!Number.isInteger(chainId) || chainId <= 0) {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId' })
+  }
+
+  const version = typeof query.version === 'string' && query.version.length > 0
+    ? query.version
+    : undefined
+  if (version !== undefined && !isV3LabelsVersionSelector(version)) {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid labels version' })
+  }
+
+  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
+  const forceRefresh = getHeader(event, 'cache-control')?.toLowerCase().includes('no-cache') === true
+  return forceRefresh
+    ? refreshPublicLabelsBundle(chainId, version)
+    : getPublicLabelsBundle(chainId, version)
+})
diff --git a/server/plugins/warm-cache.ts b/server/plugins/warm-cache.ts
index de1525fca..5c41881f4 100644
--- a/server/plugins/warm-cache.ts
+++ b/server/plugins/warm-cache.ts
@@ -1,6 +1,6 @@
 /**
  * Pre-populates the in-memory TTL caches for every proxy that serves
- * static/low-churn data (labels, token-list, euler-chains) and for the
+ * static/low-churn data (Public Labels, token-list, Euler Chains) and for the
  * per-chain vault snapshot served at /api/internal/vaults.
  *
  * Nitro's node-server preset calls `server.listen()` synchronously right
@@ -14,9 +14,9 @@
  *
  * Two timers, each with its own cadence:
  *
- *   • Global cycle (5 min): /api/internal/euler-chains once, runtime ABIs
- *     once, cross-chain `all/assets.json` once, then per-chain labels +
- *     token-list, serialized across chains.
+ *   • Global cycle (5 min): Euler Chains and runtime ABIs once, then each
+ *     chain's labels bundle and token list, serialized across chains. Hosted
+ *     bundles share the live geo-policy cache.
  *   • Vaults cycle (1 min when V3 is configured, otherwise 5 min):
  *     /api/internal/vaults per chain, serialized.
  *
@@ -35,11 +35,11 @@
  * Merkl's /tokens/reward payload is fetched transitively by /api/internal/token-list
  * (one of its sources).
  */
-import { LABEL_FILES, refreshLabelFile } from '../api/internal/labels/[file].get'
 import { refreshEulerChains } from '../api/internal/euler-chains.get'
 import { ABI_CONTRACTS, refreshAbi } from '../api/internal/abis/[contract].get'
 import { refreshTokenList } from '../api/internal/token-list.get'
 import { refreshChainVaults } from '../utils/vaults-cache'
+import { refreshPublicLabelsBundle } from '../utils/public-labels-source'
 import {
   readDisableServerVaultCache,
   readV3ApiUrl,
@@ -107,19 +107,8 @@ const warmAbis = (): Promise<unknown>[] =>
     reportWarm(`abis/${contract}`, refreshAbi(contract)),
   )
 
-// Cross-chain pattern rules for asset geo-blocking live at `all/assets.json`
-// upstream. The /api/internal/labels/assets.json handler unions this with the
-// per-chain file; warm it once so the first chain-scoped request doesn't
-// pay the cold-upstream cost.
-const warmGlobalAssets = () =>
-  reportWarm('labels/assets.json scope=all', refreshLabelFile('all', 'assets.json'))
-
-// --- Per-chain warms (parallel across chains and within a chain) ---
-
-const warmLabels = (chainId: number): Promise<unknown>[] =>
-  LABEL_FILES.map(file =>
-    reportWarm(`labels/${file} chain=${chainId}`, refreshLabelFile(chainId, file)),
-  )
+const warmPublicLabels = (chainId: number) =>
+  reportWarm(`public-labels chain=${chainId}`, refreshPublicLabelsBundle(chainId))
 
 const warmTokenList = (chainId: number) =>
   reportWarm(`token-list chain=${chainId}`, refreshTokenList(chainId))
@@ -130,10 +119,10 @@ const warmTokenList = (chainId: number) =>
 const warmVaults = (chainId: number) =>
   reportWarm(`vaults chain=${chainId}`, refreshChainVaults(chainId))
 
-// Labels + token-list — refresh at the global 5-min interval. Vaults run
-// on their own faster timer (see `warmVaultsForChains` below).
+// Labels and token-list refresh at the global
+// 5-min interval. Vaults run on their own faster timer.
 const warmChainTasks = (chainId: number): Promise<unknown>[] => [
-  ...warmLabels(chainId),
+  warmPublicLabels(chainId),
   warmTokenList(chainId),
 ]
 
@@ -170,7 +159,6 @@ export default defineNitroPlugin(() => {
       await Promise.allSettled([
         warmEulerChains(),
         ...warmAbis(),
-        warmGlobalAssets(),
         warmChainsSequentially(),
       ])
     }
diff --git a/server/utils/geo-policy-source.ts b/server/utils/geo-policy-source.ts
new file mode 100644
index 000000000..40462cbcd
--- /dev/null
+++ b/server/utils/geo-policy-source.ts
@@ -0,0 +1,60 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fetchPublicGeoPolicies, validatePublicGeoPolicies, type PublicGeoPolicy, type PublicLabelsRequest } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { logger } from './logger'
+import { withWallClock } from './fetchWithTimeout'
+
+interface GeoSnapshot { fetchedAt: number, policies: PublicGeoPolicy[] }
+
+/** A source-specific disk checkpoint survives process restarts; mount the directory for redeploys. */
+export const createGeoPolicySource = (source: string, directory: string) => {
+  const file = join(directory, `${createHash('sha256').update(source).digest('hex')}.json`)
+  let lastGood: GeoSnapshot | undefined
+  let pending: Promise<GeoSnapshot> | undefined
+  let diskLoaded = false
+
+  const refresh = async (request: PublicLabelsRequest): Promise<GeoSnapshot> => {
+    if (!diskLoaded) {
+      diskLoaded = true
+      try {
+        const saved = JSON.parse(await readFile(file, 'utf8')) as GeoSnapshot
+        if (!Number.isFinite(saved.fetchedAt) || saved.fetchedAt <= 0 || saved.fetchedAt > Date.now()) throw new Error('Invalid geo checkpoint timestamp')
+        lastGood = { fetchedAt: saved.fetchedAt, policies: validatePublicGeoPolicies(saved.policies) }
+      }
+      catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') logger.warn({ ctx: 'geo-policy-source', err }, 'geo checkpoint unavailable')
+      }
+    }
+    try {
+      const policies = await withWallClock(() => fetchPublicGeoPolicies(request), 10_000, 'geo-policies')
+      const snapshot = { policies, fetchedAt: Date.now() }
+      // A failed checkpoint write must not cause use of older, less restrictive live rules.
+      lastGood = snapshot
+      try {
+        await mkdir(directory, { recursive: true })
+        const temporary = `${file}.${randomUUID()}.tmp`
+        await writeFile(temporary, JSON.stringify(snapshot), { mode: 0o600 })
+        await rename(temporary, file)
+      }
+      catch (err) {
+        logger.warn({ ctx: 'geo-policy-source', err }, 'geo checkpoint write failed; restart persistence unavailable')
+      }
+      return snapshot
+    }
+    catch (err) {
+      if (!lastGood) throw err
+      logger.warn({ ctx: 'geo-policy-source', ageMs: Date.now() - lastGood.fetchedAt, fetchedAt: lastGood.fetchedAt, err }, 'using last-known-good geo policies')
+      return lastGood
+    }
+  }
+  return (request: PublicLabelsRequest): Promise<GeoSnapshot> => {
+    if (pending) return pending
+    // Freshness is bounded; stale use is permitted only after a failed refresh.
+    if (lastGood && Date.now() - lastGood.fetchedAt < 300_000) return Promise.resolve(lastGood)
+    pending = refresh(request).finally(() => {
+      pending = undefined
+    })
+    return pending
+  }
+}
diff --git a/server/utils/labels-base-url.ts b/server/utils/labels-base-url.ts
index 4caef38ac..89b4429ae 100644
--- a/server/utils/labels-base-url.ts
+++ b/server/utils/labels-base-url.ts
@@ -1,11 +1,41 @@
+import { getEnabledChainIds } from '~/utils/chain-env'
+import { parseChainIds } from '~/utils/parseChainIds'
+
+export const readLabelsSource = (): 'v3' | 'static' => {
+  const source = process.env.LABELS_SOURCE?.trim() || 'v3'
+  if (source !== 'v3' && source !== 'static') throw new Error('LABELS_SOURCE must be v3 or static')
+  return source
+}
+
 export function resolveLabelsBaseUrl(): string {
-  const explicit = (process.env.NUXT_PUBLIC_CONFIG_LABELS_BASE_URL || '').trim().replace(/\/+$/, '')
-  if (explicit) return explicit
-  const repo = process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO || 'euler-xyz/euler-labels'
-  const branch = process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH || 'master'
-  return `https://raw.githubusercontent.com/${repo}/refs/heads/${branch}`
+  const value = process.env.STATIC_LABELS_BASE_URL?.trim().replace(/\/+$/, '')
+  if (!value) throw new Error('STATIC_LABELS_BASE_URL is required for static labels')
+  const url = new URL(value)
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error('STATIC_LABELS_BASE_URL must be an HTTP(S) directory URL without credentials, query or fragment')
+  }
+  return value
+}
+
+export const isV3LabelsVersionSelector = (value: string): boolean =>
+  /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(value) && !['draft', 'current', 'production'].includes(value)
+
+export const readV3LabelsSelection = () => {
+  const labelSet = process.env.LABELS_V3_SET?.trim() || 'public'
+  const version = process.env.LABELS_V3_VERSION?.trim() || 'latest'
+  if (!/^[A-Za-z0-9_-]{1,100}$/.test(labelSet)) throw new Error('LABELS_V3_SET must be a label set ID (letters, numbers, underscore or hyphen; max 100 characters)')
+  if (!isV3LabelsVersionSelector(version)) throw new Error('LABELS_V3_VERSION must be latest or a published version key (max 100 letters, numbers, dots, underscores or hyphens)')
+  return { labelSet, version }
 }
 
-export function resolveLabelsFileUrl(scope: number | 'all', file: string): string {
-  return `${resolveLabelsBaseUrl()}/${scope}/${file}`
+/** Deprecated enabled chains retain metadata with on-chain verification. */
+export const readLabelsOnchainVerificationChains = (): number[] => {
+  const enabled = new Set(getEnabledChainIds())
+  const deprecated = [...new Set(parseChainIds(process.env.DEPRECATED_CHAINS, enabled))]
+  const onchain = new Set(parseChainIds(process.env.ONCHAIN_SDK_CHAINS))
+  const missing = deprecated.filter(id => !onchain.has(id))
+  if (missing.length) {
+    throw new Error(`Deprecated labels chains must be in ONCHAIN_SDK_CHAINS: ${missing.join(',')}`)
+  }
+  return deprecated
 }
diff --git a/server/utils/labels-helpers.ts b/server/utils/labels-helpers.ts
index 4ba01cfd8..c989a6123 100644
--- a/server/utils/labels-helpers.ts
+++ b/server/utils/labels-helpers.ts
@@ -1,5 +1,4 @@
 import { getAddress, type Address } from 'viem'
-import { getInternalFetchHeaders } from './internal-headers'
 
 export interface EntityEntry {
   addresses?: unknown
@@ -39,13 +38,3 @@ export function buildEntityAddressSets(
   }
   return map
 }
-
-export async function fetchLabels<T>(
-  chainId: number,
-  file: 'products.json' | 'entities.json' | 'earn-vaults.json',
-): Promise<T> {
-  return await $fetch<T>(`/api/internal/labels/${file}`, {
-    query: { chainId },
-    headers: getInternalFetchHeaders(),
-  }) as unknown as T
-}
diff --git a/server/utils/labels-view.ts b/server/utils/labels-view.ts
index 40043826c..98d1a929f 100644
--- a/server/utils/labels-view.ts
+++ b/server/utils/labels-view.ts
@@ -1,7 +1,8 @@
+import { getLabelVaultCandidates, type PublicEulerLabelsData } from '~/utils/public-labels'
 /**
  * Per-chain "labels view" shared by /api/public/is-known and
  * /api/public/metadata. It keeps Lite's public API/cache policy in the app,
- * but sources normalized labels and vault entities through the SDK.
+ * and reads normalized label content from the shared Public Labels V3 source.
  */
 import {
   StandardEVaultPerspectives,
@@ -23,7 +24,8 @@ import { logger } from './logger'
 import { summarizeSdkIssue } from './observability'
 import { getServerSdk } from './sdk-server'
 import { isSdkErrorDiagnostic } from './sdk-diagnostics'
-import type { VerificationLabels } from '~/utils/vault/governor-verification'
+import { getPublicEulerLabelsData } from './public-labels-source'
+import { getHostedEntityKeys, type VerificationLabels } from '~/utils/vault/governor-verification'
 import { resolveEulerRouterGovernors } from '~/utils/vault/euler-router-governance'
 import { governableGovernorAbi } from '~/abis/oracle'
 
@@ -65,7 +67,7 @@ interface TokenListEntry {
 }
 
 export interface ProductDescriptor {
-  slug: string
+  slug: string | null
   name: string
   description: string | null
   portfolioNotice: string | null
@@ -78,6 +80,7 @@ export interface ProductDescriptor {
 
 export interface LabelsView {
   chainId: number
+  logoBaseUrl?: string
   snapshot: ChainVaultsSnapshot
   productByVault: Map<Address, ProductDescriptor>
   deprecatedSet: Set<Address>
@@ -159,7 +162,7 @@ export function buildProductDescriptors(products: Record<string, ProductEntryFul
       }
     }
     const desc: ProductDescriptor = {
-      slug,
+      slug: product.isStandalone ? null : slug,
       name: strOrEmpty(product.name),
       description: strOrNull(product.description),
       portfolioNotice: strOrNull(product.portfolioNotice),
@@ -228,21 +231,21 @@ function withVaultMetadata<T extends object>(
 async function buildSnapshot(
   chainId: number,
   sdk: EulerSDK,
-  labels: EulerLabelsData,
+  labels: PublicEulerLabelsData,
 ): Promise<{ snapshot: ChainVaultsSnapshot, escrowAddresses: Set<Address> }> {
   const escrowAddresses = new Set<Address>(
     uniqueAddresses(await sdk.eVaultService.fetchVerifiedVaultAddresses(chainId, [StandardEVaultPerspectives.ESCROW])),
   )
   const candidates = uniqueAddresses([
-    ...labels.verifiedVaultAddresses,
-    ...labels.earnVaults,
+    ...getLabelVaultCandidates(labels).vaults,
+    ...getLabelVaultCandidates(labels).earn,
   ])
 
   const types = candidates.length > 0
     ? await sdk.vaultMetaService.fetchVaultTypes(chainId, candidates)
     : {}
 
-  const earnSet = new Set(uniqueAddresses(labels.earnVaults).map(addr => addr.toLowerCase()))
+  const earnSet = new Set(uniqueAddresses(getLabelVaultCandidates(labels).earn).map(addr => addr.toLowerCase()))
   const evkAddresses: Address[] = []
   const securitizeAddresses: Address[] = []
   const earnAddresses: Address[] = []
@@ -343,7 +346,7 @@ async function buildSnapshot(
 async function assembleLabelsView(chainId: number): Promise<LabelsView> {
   const sdk = await getSdk(chainId)
   const [labels, tokens] = await Promise.allSettled([
-    sdk.eulerLabelsService.fetchEulerLabelsData(chainId),
+    getPublicEulerLabelsData(chainId),
     fetchTokenList(chainId),
   ])
 
@@ -368,6 +371,8 @@ async function assembleLabelsView(chainId: number): Promise<LabelsView> {
 
   const verificationLabels: VerificationLabels = {
     getDeclaredEntityKeys: (addr) => {
+      const hostedKeys = getHostedEntityKeys(labels.value, addr)
+      if (hostedKeys !== undefined) return hostedKeys
       const checksum = tryChecksum(addr)
       if (!checksum) return undefined
       return productByVault.get(checksum)?.entityKeys
@@ -377,6 +382,7 @@ async function assembleLabelsView(chainId: number): Promise<LabelsView> {
 
   return {
     chainId,
+    logoBaseUrl: labels.value.logoBaseUrl,
     snapshot,
     productByVault,
     deprecatedSet,
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
new file mode 100644
index 000000000..1c86bf5b7
--- /dev/null
+++ b/server/utils/public-labels-source.ts
@@ -0,0 +1,122 @@
+import { createGeoPolicySource } from './geo-policy-source'
+import { createTtlCache } from './cache'
+import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
+import { createInFlightDedup } from './in-flight'
+import { readLabelsSource, readV3LabelsSelection, readLabelsOnchainVerificationChains } from './labels-base-url'
+import { getStaticLabelsBundle } from './static-labels-source'
+import { logger } from './logger'
+import { PublicLabelsV3Adapter, PublicLabelsV3MetadataAdapter } from '@eulerxyz/euler-v2-sdk/public-labels'
+import {
+  normalizeLabelsBundle,
+  type PublicEulerLabelsData,
+  type PublicLabelsBundle,
+  type HostedLabelsBundle,
+  type PublicLabelsQuery,
+  type PublicLabelsRequest,
+  type PublicLabelsResponse,
+} from '~/utils/public-labels'
+import { readResolvedV3ApiUrl, readV3ApiKey } from '~/utils/api-url-env'
+
+const CACHE_TTL_MS = 300_000
+const REFRESH_BUDGET_MS = 30_000
+
+const cache = createTtlCache<HostedLabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
+const inFlight = createInFlightDedup<string, HostedLabelsBundle>()
+
+const geoSources = new Map<string, ReturnType<typeof createGeoPolicySource>>()
+const getGeoSource = () => {
+  const source = readResolvedV3ApiUrl()
+  let loader = geoSources.get(source)
+  if (!loader) {
+    loader = createGeoPolicySource(source, process.env.GEO_POLICY_CACHE_DIR || '.data/geo-policies')
+    geoSources.set(source, loader)
+  }
+  return loader
+}
+
+const cacheKey = (chainId: number, labelSet: string, version: string): string =>
+  JSON.stringify([readResolvedV3ApiUrl(), labelSet, chainId, version, readLabelsOnchainVerificationChains().includes(chainId)])
+
+const buildRequest = (): PublicLabelsRequest => async <T>(
+  path: string,
+  query: PublicLabelsQuery,
+): Promise<PublicLabelsResponse<T>> => {
+  const base = new URL(readResolvedV3ApiUrl())
+  const basePath = base.pathname.replace(/\/+$/, '')
+  base.pathname = `${basePath.endsWith('/v3') ? basePath : `${basePath}/v3`}${path}`
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== undefined) base.searchParams.set(key, String(value))
+  }
+
+  const headers = new Headers({ accept: 'application/json' })
+  const apiKey = readV3ApiKey().trim()
+  if (apiKey) headers.set('X-API-Key', apiKey)
+
+  const response = await fetchWithTimeout(base.toString(), undefined, { headers })
+  if (!response.ok) {
+    throw new Error(`Public Labels V3 returned ${response.status} for ${path}`)
+  }
+  return await response.json() as PublicLabelsResponse<T>
+}
+
+export function refreshPublicLabelsBundle(
+  chainId: number,
+  version?: string,
+): Promise<PublicLabelsBundle> {
+  if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId, true)
+  const selection = readV3LabelsSelection()
+  const selectedVersion = version ?? selection.version
+  const key = cacheKey(chainId, selection.labelSet, selectedVersion)
+  return inFlight.run(key, async () => {
+    try {
+      const bundle = await withWallClock(
+        async () => {
+          const request = buildRequest()
+          const Adapter = readLabelsOnchainVerificationChains().includes(chainId) ? PublicLabelsV3MetadataAdapter : PublicLabelsV3Adapter
+          const adapter = new Adapter({
+            endpoint: readResolvedV3ApiUrl(),
+            labelSet: selection.labelSet,
+            version: selectedVersion,
+            request,
+          })
+          const geo = await getGeoSource()(request)
+          const snapshot = await adapter.fetchPublicLabelsSnapshot(chainId, selectedVersion, geo.policies)
+          normalizeLabelsBundle(chainId, snapshot)
+          return {
+            ...snapshot,
+            geoFetchedAt: geo.fetchedAt,
+          }
+        },
+        REFRESH_BUDGET_MS,
+        `public-labels chain=${chainId}`,
+      )
+      cache.set(key, bundle)
+      return bundle
+    }
+    catch (err) {
+      logger.warn({ ctx: 'public-labels-source', chainId, version, err }, 'refresh failed')
+      const stale = cache.getStale(key)
+      if (stale) return stale
+      throw err
+    }
+  })
+}
+
+export function getPublicLabelsBundle(
+  chainId: number,
+  version?: string,
+): Promise<PublicLabelsBundle> {
+  if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId)
+  const selection = readV3LabelsSelection()
+  const selectedVersion = version ?? selection.version
+  const hit = cache.get(cacheKey(chainId, selection.labelSet, selectedVersion))
+  return hit ? Promise.resolve(hit) : refreshPublicLabelsBundle(chainId, selectedVersion)
+}
+
+export async function getPublicEulerLabelsData(
+  chainId: number,
+  version?: string,
+): Promise<PublicEulerLabelsData> {
+  const bundle = await getPublicLabelsBundle(chainId, version)
+  return normalizeLabelsBundle(chainId, bundle)
+}
diff --git a/server/utils/sdk-server.ts b/server/utils/sdk-server.ts
index 91b3d743a..f4ae9daa7 100644
--- a/server/utils/sdk-server.ts
+++ b/server/utils/sdk-server.ts
@@ -33,7 +33,6 @@ import {
 } from '~/utils/api-url-env'
 import { parseChainIds } from '~/utils/parseChainIds'
 import { resolveRpcUrl } from './rpc'
-import { resolveLabelsBaseUrl } from './labels-base-url'
 
 const sdkByChain = new Map<number, Promise<EulerSDK>>()
 
@@ -81,7 +80,6 @@ const buildServerSdkConfig = (chainId: number): EulerSDKConfig => {
   return {
     rpcUrls: { [chainId]: rpcUrl },
     v3ApiUrl,
-    eulerLabelsBaseUrl: resolveLabelsBaseUrl(),
     tokenlistApiBaseUrl: v3ApiUrl,
     ...(v3ApiKey ? { v3ApiKey } : {}),
     ...adapterConfigForSource(source),
diff --git a/server/utils/static-labels-source.ts b/server/utils/static-labels-source.ts
new file mode 100644
index 000000000..1cb14e7a6
--- /dev/null
+++ b/server/utils/static-labels-source.ts
@@ -0,0 +1,91 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { EulerLabelsFileData } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
+import { resolveLabelsBaseUrl } from './labels-base-url'
+import { validateNode, validateStaticGeo } from './static-labels-validation'
+import { logger } from './logger'
+import { normalizeLabelsBundle, type StaticLabelsBundle } from '~/utils/public-labels'
+
+const cache = new Map<string, StaticLabelsBundle>()
+const pending = new Map<string, Promise<StaticLabelsBundle>>()
+
+const validate = (bundle: StaticLabelsBundle, chainId: number): StaticLabelsBundle => {
+  const files = bundle.files
+  if (!files || !Number.isFinite(bundle.fetchedAt) || bundle.fetchedAt <= 0) throw new Error('Invalid static labels checkpoint')
+  for (const key of ['products', 'entities'] as const) {
+    if (!files[key] || typeof files[key] !== 'object' || Array.isArray(files[key])) throw new Error(`Invalid static ${key}`)
+  }
+  for (const key of ['points', 'earnVaults', 'assets'] as const) {
+    if (!Array.isArray(files[key])) throw new Error(`Invalid static ${key}`)
+  }
+  validateNode(files, 'static-labels')
+  validateStaticGeo(files)
+  for (const rule of files.assets) {
+    if (!rule || typeof rule !== 'object' || !(rule.address || rule.symbols?.length || rule.names?.length || rule.symbolRegex || rule.nameRegex)) throw new Error('Static asset rule requires a matcher')
+  }
+  normalizeLabelsBundle(chainId, bundle)
+  return bundle
+}
+
+/** Missing documents use empty collections; failed refreshes retain the entire last-known-good snapshot. */
+export const getStaticLabelsBundle = (chainId: number, force = false): Promise<StaticLabelsBundle> => {
+  const base = resolveLabelsBaseUrl()
+  const key = `${base}:${chainId}`
+  const existing = pending.get(key)
+  if (existing) return existing
+  const hit = cache.get(key)
+  if (!force && hit && Date.now() - hit.fetchedAt < 300_000) return Promise.resolve(hit)
+  const directory = process.env.GEO_POLICY_CACHE_DIR || '.data/geo-policies'
+  const file = join(directory, `static-${createHash('sha256').update(key).digest('hex')}.json`)
+  const task = (async () => {
+    let lastGood = hit
+    if (!lastGood) {
+      try {
+        const saved = JSON.parse(await readFile(file, 'utf8')) as StaticLabelsBundle
+        if (saved.source !== 'static' || saved.logoBaseUrl !== base) throw new Error('Static labels checkpoint source mismatch')
+        lastGood = validate(saved, chainId)
+      }
+      catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') logger.warn({ ctx: 'static-labels', chainId, err }, 'checkpoint unavailable')
+      }
+    }
+    try {
+      const bundle = await withWallClock(async () => {
+        const read = async (scope: number | 'all', name: string) => {
+          const response = await fetchWithTimeout(`${base}/${scope}/${name}.json`)
+          // Match the labels file contract, including S3/CDN missing-key 403 responses.
+          if (response.status === 404 || response.status === 403) return name === 'products' || name === 'entities' ? {} : []
+          if (!response.ok) throw new Error(`Static labels ${scope}/${name}: HTTP ${response.status}`)
+          return response.json()
+        }
+        const [products, entities, points, earnVaults, chainAssets, globalAssets] = await Promise.all([
+          read(chainId, 'products'), read(chainId, 'entities'), read(chainId, 'points'),
+          read(chainId, 'earn-vaults'), read(chainId, 'assets'), read('all', 'assets'),
+        ])
+        if (!Array.isArray(chainAssets) || !Array.isArray(globalAssets)) throw new Error('Static asset rules must be arrays')
+        const files = { products, entities, points, earnVaults, assets: [...chainAssets, ...globalAssets] } as EulerLabelsFileData
+        const version = createHash('sha256').update(JSON.stringify(files)).digest('hex')
+        return validate({ source: 'static', version, files, logoBaseUrl: base, fetchedAt: Date.now() }, chainId)
+      }, 30_000, `static-labels chain=${chainId}`)
+      cache.set(key, bundle)
+      try {
+        await mkdir(directory, { recursive: true })
+        const temporary = `${file}.${randomUUID()}.tmp`
+        await writeFile(temporary, JSON.stringify(bundle), { mode: 0o600 })
+        await rename(temporary, file)
+      }
+      catch (err) { logger.warn({ ctx: 'static-labels', chainId, err }, 'checkpoint write failed') }
+      return bundle
+    }
+    catch (err) {
+      if (!lastGood) throw err
+      cache.set(key, lastGood)
+      logger.warn({ ctx: 'static-labels', chainId, ageMs: Date.now() - lastGood.fetchedAt, err }, 'using last-known-good static labels')
+      return lastGood
+    }
+  })().finally(() => { pending.delete(key) })
+  pending.set(key, task)
+  return task
+}
diff --git a/server/utils/static-labels-validation.ts b/server/utils/static-labels-validation.ts
new file mode 100644
index 000000000..e83bac65f
--- /dev/null
+++ b/server/utils/static-labels-validation.ts
@@ -0,0 +1,87 @@
+import { isAddress } from 'viem'
+
+const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
+const URL_KEYS = new Set(['url'])
+const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
+const MAX_REGEX_LEN = 512
+const LOGO_FILENAME_KEYS = new Set(['logo'])
+const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
+const MAX_STRING_LEN = 16_384
+const MAX_ARRAY_LEN = 10_000
+const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
+
+const isSafeHttpUrl = (value: string): boolean => {
+  if (!value) return true
+  try {
+    const { protocol } = new URL(value)
+    return protocol === 'http:' || protocol === 'https:'
+  }
+  catch {
+    return false
+  }
+}
+
+export function validateNode(node: unknown, path: string): void {
+  if (Array.isArray(node)) {
+    if (node.length > MAX_ARRAY_LEN) {
+      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
+    }
+    node.forEach((item, index) => validateNode(item, `${path}[${index}]`))
+    return
+  }
+  if (node === null || typeof node !== 'object') return
+
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (typeof value === 'string') {
+      if (value.length > MAX_STRING_LEN) {
+        throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
+      }
+      if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
+        throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
+      }
+      if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
+        throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
+      }
+      if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
+        throw new Error(`Injection pattern detected in ${path}.${key}`)
+      }
+      if (REGEX_KEYS.has(key)) {
+        if (value.length > MAX_REGEX_LEN) {
+          throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
+        }
+        try {
+          new RegExp(value)
+        }
+        catch {
+          throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
+        }
+      }
+    }
+    else if (value !== null && typeof value === 'object') {
+      validateNode(value, `${path}.${key}`)
+    }
+  }
+}
+
+/** Invalid geo fields cannot be silently discarded by permissive SDK normalization. */
+export function validateStaticGeo(node: unknown): void {
+  if (!node || typeof node !== 'object') return
+  if (Array.isArray(node)) {
+    for (const item of node) validateStaticGeo(item)
+    return
+  }
+  const row = node as Record<string, unknown>
+  for (const key of ['block', 'restricted']) {
+    if (row[key] !== undefined && (!Array.isArray(row[key]) || !(row[key] as unknown[]).every(code => typeof code === 'string' && /^[A-Z]{2,4}$/.test(code)))) {
+      throw new Error(`Invalid static geo ${key}`)
+    }
+  }
+  for (const key of ['symbolRegex', 'nameRegex']) {
+    if (row[key] !== undefined && typeof row[key] !== 'string') throw new Error(`Invalid static ${key}`)
+  }
+  for (const key of ['symbols', 'names']) {
+    if (row[key] !== undefined && (!Array.isArray(row[key]) || !(row[key] as unknown[]).every(item => typeof item === 'string'))) throw new Error(`Invalid static ${key}`)
+  }
+  if (row.address !== undefined && (typeof row.address !== 'string' || !isAddress(row.address))) throw new Error('Invalid static address')
+  for (const child of Object.values(row)) validateStaticGeo(child)
+}
diff --git a/server/utils/vault-metadata.ts b/server/utils/vault-metadata.ts
index 94635da49..851a4ebc2 100644
--- a/server/utils/vault-metadata.ts
+++ b/server/utils/vault-metadata.ts
@@ -1,7 +1,7 @@
+import { resolveLabelLogo } from '~/utils/label-logo'
 import type { Address } from 'viem'
 import { createTtlCache } from './cache'
 import { tryChecksum } from './labels-helpers'
-import { resolveLabelsBaseUrl } from './labels-base-url'
 import {
   buildLabelsView,
   type EntityEntryFull,
@@ -48,11 +48,11 @@ export interface VaultMetadata {
   description: string | null
   portfolioNotice: string | null
   deprecationReason: string | null
-  /** True if the vault is listed under any product's `deprecatedVaults` (or earn-vaults `deprecated: true`). */
+  /** True when Public Labels marks the vault deprecated. */
   deprecated: boolean
   /** True when the owning product has the `governance limited` tag. False for vaults without a product. */
   governanceLimited: boolean
-  /** The owning product slug from products.json (e.g. "euler-prime"), or null for vaults outside any product (escrow, earn-only entries, governor mismatch with no product). */
+  /** The Public Labels product ID, or null for vaults outside a product. */
   productId: string | null
   asset: AssetInfo | null
   /** All declared product entities whose `addresses` contain the vault's on-chain governor (or owner, for Earn). Empty when no entity matches, the vault is escrow, or the vault is unverified. Multiple entries can occur when a product declares multiple entities and more than one matches. */
@@ -77,10 +77,6 @@ function strOrEmpty(value: unknown): string {
   return typeof value === 'string' ? value : ''
 }
 
-function entityLogoUrl(fileName: string): string {
-  return `${resolveLabelsBaseUrl()}/logo/${fileName}`
-}
-
 function buildAsset(asset: VaultAsset | undefined, tokenLogos: Map<string, string>): AssetInfo | null {
   if (!asset) return null
   const addr = tryChecksum(asset.address)
@@ -94,7 +90,7 @@ function buildAsset(asset: VaultAsset | undefined, tokenLogos: Map<string, strin
   }
 }
 
-function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntryFull>): EntityInfo | null {
+function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntryFull>, logoBaseUrl?: string): EntityInfo | null {
   const entity = entities[entityKey]
   if (!entity) return null
   const name = strOrEmpty(entity.name)
@@ -103,7 +99,7 @@ function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntry
   const url = strOrNull(entity.url)
   return {
     name,
-    logo: logoFile ? entityLogoUrl(logoFile) : '',
+    logo: logoFile ? resolveLabelLogo(logoFile, logoBaseUrl) : '',
     description: strOrNull(entity.description),
     url: url && /^https?:\/\//i.test(url) ? url : null,
   }
@@ -140,14 +136,15 @@ function buildEvkMetadata(
   // the vault. On-chain ERC-20 name is only a fallback when labels carry
   // no name. Verification (governor match) only gates `entities` resolution
   // below, which is the security-sensitive "who manages this vault" claim.
-  const labelName = strOrNull(override?.name) ?? (product?.name || null)
-  const description = strOrNull(override?.description) ?? product?.description ?? null
-  const portfolioNotice = strOrNull(override?.portfolioNotice) ?? product?.portfolioNotice ?? null
-  const deprecationReason = strOrNull(override?.deprecationReason) ?? product?.deprecationReason ?? null
+  // Resolved empty strings clear inherited product content.
+  const labelName = strOrNull(override?.name ?? product?.name)
+  const description = strOrNull(override?.description ?? product?.description)
+  const portfolioNotice = strOrNull(override?.portfolioNotice ?? product?.portfolioNotice)
+  const deprecationReason = strOrNull(override?.deprecationReason ?? product?.deprecationReason)
 
   const entityKeys = verified ? resolveGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
-    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw))
+    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw, ctx.view.logoBaseUrl))
     .filter((e): e is EntityInfo => e !== null)
 
   return {
@@ -177,14 +174,15 @@ function buildEarnMetadata(vault: EulerEarn, ctx: BuildContext): VaultMetadata |
 
   // Same rationale as buildEvkMetadata: label fields are authoritative
   // content. `verified` only gates `entities` resolution.
-  const labelName = product?.name || null
-  const description = strOrNull(earnEntry?.description) ?? product?.description ?? null
-  const portfolioNotice = strOrNull(earnEntry?.portfolioNotice) ?? product?.portfolioNotice ?? null
-  const deprecationReason = strOrNull(earnEntry?.deprecationReason) ?? product?.deprecationReason ?? null
+  const override = product?.vaultOverrides[addr]
+  const labelName = strOrNull(override?.name ?? product?.name)
+  const description = strOrNull(override?.description ?? earnEntry?.description ?? product?.description)
+  const portfolioNotice = strOrNull(override?.portfolioNotice ?? earnEntry?.portfolioNotice ?? product?.portfolioNotice)
+  const deprecationReason = strOrNull(override?.deprecationReason ?? earnEntry?.deprecationReason ?? product?.deprecationReason)
 
   const entityKeys = verified ? resolveEarnGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
-    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw))
+    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw, ctx.view.logoBaseUrl))
     .filter((e): e is EntityInfo => e !== null)
 
   return {
diff --git a/server/utils/vaults-cache.ts b/server/utils/vaults-cache.ts
index 192ecd2a8..f19101d0b 100644
--- a/server/utils/vaults-cache.ts
+++ b/server/utils/vaults-cache.ts
@@ -1,3 +1,4 @@
+import { getLabelVaultCandidates } from '~/utils/public-labels'
 /**
  * Per-chain vault snapshot cache.
  *
@@ -35,11 +36,7 @@ import { reportStatus } from './log'
 import { summarizeSdkIssue } from './observability'
 import { getServerSdk } from './sdk-server'
 import { isSdkErrorDiagnostic } from './sdk-diagnostics'
-import {
-  LABEL_FILES,
-  refreshLabelFile,
-  type LabelFile,
-} from '~/server/api/internal/labels/[file].get'
+import { getPublicEulerLabelsData } from './public-labels-source'
 import { encodeBigints } from '~/utils/snapshot-codec'
 import { readV3ApiUrl } from '~/utils/api-url-env'
 import {
@@ -95,39 +92,6 @@ const uniqueAddresses = (addresses: Iterable<string>): Address[] => {
   return [...result.values()]
 }
 
-interface LabelProduct { vaults?: string[], deprecatedVaults?: string[] }
-interface EarnVaultEntry { address?: string }
-
-const fetchLabel = async <T>(scope: number | 'all', file: LabelFile, fallback: T): Promise<T> => {
-  try {
-    return (await refreshLabelFile(scope, file)) as T
-  }
-  catch (err) {
-    logger.warn({ ctx: 'vaults-cache', scope, file, err }, 'failed to fetch label')
-    return fallback
-  }
-}
-
-const getLabels = async (chainId: number) => {
-  const [products, earn] = await Promise.all([
-    fetchLabel<Record<string, LabelProduct>>(chainId, 'products.json', {}),
-    fetchLabel<Array<string | EarnVaultEntry>>(chainId, 'earn-vaults.json', []),
-  ])
-  const verified = new Set<string>()
-  for (const product of Object.values(products)) {
-    product.vaults?.forEach(addr => verified.add(addr))
-    product.deprecatedVaults?.forEach(addr => verified.add(addr))
-  }
-  const earnVaults: string[] = earn.flatMap((entry) => {
-    if (typeof entry === 'string') return [entry]
-    return typeof entry?.address === 'string' ? [entry.address] : []
-  })
-  return {
-    verifiedVaultAddresses: uniqueAddresses(verified),
-    earnVaults: uniqueAddresses(earnVaults),
-  }
-}
-
 const partitionVerified = async (
   sdk: EulerSDK,
   chainId: number,
@@ -222,13 +186,13 @@ const fetchEVaultsForSnapshot = async (
 export const refreshChainVaults = (chainId: number): Promise<SerialisedSnapshot> =>
   inFlight.run(chainId, async () => {
     const sdk = await getServerSdk(chainId)
-    const labels = await getLabels(chainId)
+    const labels = await getPublicEulerLabelsData(chainId)
     const escrowAddrs = await fetchEscrowAddrs(sdk, chainId)
     const { evkAddrs, securitizeAddrs, earnAddrs } = await partitionVerified(
       sdk,
       chainId,
-      labels.verifiedVaultAddresses,
-      labels.earnVaults,
+      uniqueAddresses(getLabelVaultCandidates(labels).vaults),
+      uniqueAddresses(getLabelVaultCandidates(labels).earn),
     )
 
     // populateCollaterals / populateStrategyVaults DISABLED — deferred to
@@ -301,7 +265,3 @@ export const refreshChainVaults = (chainId: number): Promise<SerialisedSnapshot>
     reportStatus('vaults-cache', `chain=${chainId}`, 'ok')
     return payload
   })
-
-// silence unused: LABEL_FILES is re-exported by callers via the labels
-// endpoint module, importing here keeps the file dependency edge explicit.
-void LABEL_FILES
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index a505c9392..f4ec513a7 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -9,6 +9,7 @@ import {
   getEulerLabelWrapPairs,
   useEulerLabels,
 } from '~/composables/useEulerLabels'
+import type { PublicLabelsBundle } from '~/utils/public-labels'
 
 type Deferred<T> = {
   promise: Promise<T>
@@ -29,25 +30,24 @@ const deferred = <T>(): Deferred<T> => {
 
 const mocks = vi.hoisted(() => ({
   evcBatchCall: vi.fn(),
-  fetchEulerLabelsData: vi.fn(),
+  fetchPublicLabelsBundle: vi.fn(),
+  normalizePublicLabelsData: vi.fn(),
   getProvider: vi.fn(),
-  invalidateSdkQueries: vi.fn(),
+  loadVaults: vi.fn(),
   vaults: [] as Array<{ asset: { address: string } }>,
 }))
 
 vi.mock('~/composables/useEulerSdk', () => ({
   getEulerSdk: vi.fn(async () => ({
-    eulerLabelsService: {
-      fetchEulerLabelsData: mocks.fetchEulerLabelsData,
-    },
     providerService: {
       getProvider: mocks.getProvider,
     },
   })),
 }))
 
-vi.mock('~/utils/euler-labels-fetch', () => ({
-  fetchEulerLabelsDataStrict: (_service: unknown, chainId: number) => mocks.fetchEulerLabelsData(chainId),
+vi.mock('~/utils/public-labels', async importOriginal => ({
+  ...await importOriginal<typeof import('~/utils/public-labels')>(),
+  normalizeLabelsBundle: (_chainId: number, bundle: { publicLabels: unknown }) => mocks.normalizePublicLabelsData(_chainId, bundle.publicLabels),
 }))
 
 vi.mock('~/composables/useEulerOracleAdapters', () => ({
@@ -76,10 +76,6 @@ vi.mock('~/utils/multicall', () => ({
   evcBatchCall: mocks.evcBatchCall,
 }))
 
-vi.mock('~/utils/sdk-query-cache', () => ({
-  invalidateSdkQueries: mocks.invalidateSdkQueries,
-}))
-
 const currentChainId = ref(1)
 const getCurrentChainConfig = computed(() => ({
   chainId: currentChainId.value,
@@ -96,16 +92,27 @@ const labelsFor = (marker: string) => ({
   },
 }) as unknown as EulerLabelsData
 
+const bundleFor = (labels: EulerLabelsData): PublicLabelsBundle => ({
+  version: 'v20260804151305236',
+  publicLabels: labels,
+  effectivePolicy: { products: {}, earnVaults: [], assets: [] },
+}) as unknown as PublicLabelsBundle
+
 const currentProductKeys = () => Object.keys(getCurrentEulerLabelsData().products)
 
 describe('useEulerLabels chain-scoped loading', () => {
   beforeEach(() => {
     currentChainId.value = 1
     mocks.evcBatchCall.mockReset().mockResolvedValue([])
-    mocks.fetchEulerLabelsData.mockReset()
+    mocks.fetchPublicLabelsBundle.mockReset()
+    mocks.normalizePublicLabelsData.mockReset().mockImplementation(
+      (_chainId: number, labels: EulerLabelsData) => labels,
+    )
+    mocks.loadVaults.mockReset().mockResolvedValue(undefined)
+    vi.stubGlobal('useVaults', () => ({ loadVaults: mocks.loadVaults }))
     mocks.getProvider.mockReset().mockReturnValue({})
-    mocks.invalidateSdkQueries.mockReset().mockResolvedValue(undefined)
     mocks.vaults.length = 0
+    vi.stubGlobal('$fetch', mocks.fetchPublicLabelsBundle)
     vi.stubGlobal('useEulerAddresses', () => ({
       getCurrentChainConfig,
       loadEulerConfig: vi.fn(),
@@ -117,34 +124,107 @@ describe('useEulerLabels chain-scoped loading', () => {
     vi.unstubAllGlobals()
   })
 
+  it('loads newly eligible vaults after a live refresh but leaves unchanged data alone', async () => {
+    vi.useFakeTimers()
+    try {
+      const address = '0x0000000000000000000000000000000000000001'
+      const base = { ...getCurrentEulerLabelsData(), products: {}, verifiedVaultAddresses: [] }
+      const added = { ...base, verifiedVaultAddresses: [address] }
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(base))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(added))
+      await vi.advanceTimersByTimeAsync(5 * 60_000)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.loadVaults).toHaveBeenCalledTimes(1)
+      expect(mocks.loadVaults).toHaveBeenCalledWith({ preserveRegistry: true })
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(structuredClone(added)))
+      await vi.advanceTimersByTimeAsync(5 * 60_000)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.loadVaults).toHaveBeenCalledTimes(1)
+      expect(mocks.loadVaults).toHaveBeenCalledWith({ preserveRegistry: true })
+    }
+    finally { vi.useRealTimers() }
+  })
+
   it('keeps a failed initial load unavailable and retries the same chain', async () => {
-    mocks.fetchEulerLabelsData.mockRejectedValueOnce(new Error('temporary outage'))
+    mocks.fetchPublicLabelsBundle.mockRejectedValueOnce(new Error('temporary outage'))
     const labels = useEulerLabels()
     await labels.loadLabels()
     expect(labels.isReady.value).toBe(false)
     expect(labels.loadError.value).toContain('Unable to load')
-    mocks.fetchEulerLabelsData.mockResolvedValueOnce(labelsFor('recovered'))
+    mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('recovered')))
     await labels.loadLabels()
-    expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+    expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
     expect(labels.isReady.value).toBe(true)
     expect(labels.loadError.value).toBeUndefined()
     expect(currentProductKeys()).toEqual(['recovered'])
   })
 
   it('retains a successful same-chain snapshot when a refresh fails', async () => {
-    mocks.fetchEulerLabelsData.mockResolvedValueOnce(labelsFor('cached'))
+    mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('cached')))
     const labels = useEulerLabels()
     await labels.loadLabels()
-    mocks.fetchEulerLabelsData.mockRejectedValueOnce(new Error('temporary outage'))
+    mocks.fetchPublicLabelsBundle.mockRejectedValueOnce(new Error('temporary outage'))
     await labels.loadLabels(true)
     expect(labels.isReady.value).toBe(true)
     expect(currentProductKeys()).toEqual(['cached'])
   })
 
+  it('refreshes an aged successful snapshot and joins overlapping poll events', async () => {
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    try {
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('visible')))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      clock.mockReturnValue(1_000_000 + 299_999)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1)
+
+      const refreshed = deferred<PublicLabelsBundle>()
+      mocks.fetchPublicLabelsBundle.mockReturnValueOnce(refreshed.promise)
+      clock.mockReturnValue(1_000_000 + 300_000)
+      const pending = labels.refreshLabelsIfStale()
+      await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
+      expect(labels.isReady.value).toBe(true)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenLastCalledWith('/api/internal/public-labels', expect.objectContaining({ headers: { 'cache-control': 'no-cache' } }))
+      refreshed.resolve(bundleFor(labelsFor('revoked')))
+      await pending
+      expect(currentProductKeys()).toEqual(['revoked'])
+    }
+    finally { clock.mockRestore() }
+  })
+
+  it('expires verification after refresh failures while retaining display data', async () => {
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    try {
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('cached')))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      mocks.fetchPublicLabelsBundle.mockRejectedValue(new Error('outage'))
+      clock.mockReturnValue(1_000_000 + 300_000)
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(true)
+      clock.mockReturnValue(1_000_000 + 900_000)
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(false)
+      expect(labels.loadError.value).toContain('Unable to load')
+      expect(currentProductKeys()).toEqual(['cached'])
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('recovered')))
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(true)
+      expect(currentProductKeys()).toEqual(['recovered'])
+    }
+    finally { clock.mockRestore() }
+  })
+
   it('starts a separate fetch for a new chain and ignores the stale response', async () => {
-    const chainOne = deferred<EulerLabelsData>()
-    const chainTwo = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
+    const chainOne = deferred<PublicLabelsBundle>()
+    const chainTwo = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
       if (chainId === 1) return chainOne.promise
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
@@ -152,35 +232,36 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     const labels = useEulerLabels()
     const firstLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     currentChainId.value = 2
     const secondLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     expect(labels.isLoading.value).toBe(true)
     expect(labels.isReady.value).toBe(false)
 
-    chainTwo.resolve(labelsFor('chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('chain-two')))
     await secondLoad
 
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
 
-    chainOne.resolve(labelsFor('stale-chain-one'))
+    chainOne.resolve(bundleFor(labelsFor('stale-chain-one')))
     await firstLoad
 
-    expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+    expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
   })
 
   it('reuses only the chain fetch while the latest wrapper controls publication', async () => {
-    const chainOne = deferred<EulerLabelsData>()
-    const chainTwo = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
+    const chainOne = deferred<PublicLabelsBundle>()
+    const chainTwo = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
       if (chainId === 1) return chainOne.promise
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
@@ -189,26 +270,26 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     const labels = useEulerLabels()
     const firstChainOneLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     currentChainId.value = 2
     const chainTwoLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     currentChainId.value = 1
     const latestChainOneLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
-    chainOne.resolve(labelsFor('latest-chain-one'))
+    chainOne.resolve(bundleFor(labelsFor('latest-chain-one')))
     await Promise.all([firstChainOneLoad, latestChainOneLoad])
 
-    expect(mocks.fetchEulerLabelsData.mock.calls.filter(([chainId]) => chainId === 1)).toHaveLength(1)
+    expect(mocks.fetchPublicLabelsBundle.mock.calls.filter(([, options]) => options.query.chainId === 1)).toHaveLength(1)
     expect(currentProductKeys()).toEqual(['latest-chain-one'])
     expect(getEulerLabelsVersion()).toBe(initialVersion + 4)
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
 
-    chainTwo.resolve(labelsFor('stale-chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('stale-chain-two')))
     await chainTwoLoad
 
     expect(currentProductKeys()).toEqual(['latest-chain-one'])
@@ -216,30 +297,29 @@ describe('useEulerLabels chain-scoped loading', () => {
   })
 
   it('keeps a force-refresh replacement available when the older fetch settles first', async () => {
-    const original = deferred<EulerLabelsData>()
-    const refreshed = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData
+    const original = deferred<PublicLabelsBundle>()
+    const refreshed = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle
       .mockReturnValueOnce(original.promise)
       .mockReturnValueOnce(refreshed.promise)
 
     const labels = useEulerLabels()
     const originalLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     const refreshLoad = labels.loadLabels(true)
     await vi.waitFor(() => {
-      expect(mocks.invalidateSdkQueries).toHaveBeenCalledTimes(1)
-      expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
     })
 
-    original.resolve(labelsFor('original'))
+    original.resolve(bundleFor(labelsFor('original')))
     await originalLoad
 
     const joinedRefreshLoad = labels.loadLabels()
     await Promise.resolve()
-    expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+    expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
 
-    refreshed.resolve(labelsFor('refreshed'))
+    refreshed.resolve(bundleFor(labelsFor('refreshed')))
     await Promise.all([refreshLoad, joinedRefreshLoad])
 
     expect(currentProductKeys()).toEqual(['refreshed'])
@@ -247,15 +327,28 @@ describe('useEulerLabels chain-scoped loading', () => {
     expect(labels.isReady.value).toBe(true)
   })
 
+  it('does not publish a second labels source when the aggregate endpoint fails', async () => {
+    mocks.fetchPublicLabelsBundle.mockRejectedValue(new Error('V3 unavailable'))
+
+    const labels = useEulerLabels()
+    await labels.loadLabels()
+
+    expect(currentProductKeys()).toEqual([])
+    expect(labels.geoPolicies.value).toEqual([])
+    expect(labels.isReady.value).toBe(false)
+    expect(labels.loadError.value).toContain('Unable to load')
+  })
+
   it('does not publish wrap pairs from a probe invalidated by a chain change', async () => {
     const wrapper = '0x0000000000000000000000000000000000000011'
     const underlying = '0x0000000000000000000000000000000000000022'
     const staleProbe = deferred<Array<{ success: boolean, result: string }>>()
-    const chainTwo = deferred<EulerLabelsData>()
+    const chainTwo = deferred<PublicLabelsBundle>()
     mocks.vaults.push({ asset: { address: wrapper } })
     mocks.evcBatchCall.mockReturnValueOnce(staleProbe.promise)
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
-      if (chainId === 1) return Promise.resolve(labelsFor('chain-one'))
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
+      if (chainId === 1) return Promise.resolve(bundleFor(labelsFor('chain-one')))
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
     })
@@ -267,7 +360,7 @@ describe('useEulerLabels chain-scoped loading', () => {
     currentChainId.value = 2
     mocks.vaults.length = 0
     const chainTwoLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     staleProbe.resolve([{
       success: true,
@@ -278,7 +371,7 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     expect(getEulerLabelWrapPairs()).toEqual({})
 
-    chainTwo.resolve(labelsFor('chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('chain-two')))
     await chainTwoLoad
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(getEulerLabelWrapPairs()).toEqual({})
diff --git a/tests/composables/useEulerSdk.test.ts b/tests/composables/useEulerSdk.test.ts
index da40a9296..271c399ff 100644
--- a/tests/composables/useEulerSdk.test.ts
+++ b/tests/composables/useEulerSdk.test.ts
@@ -14,7 +14,6 @@ type BuildEulerSDKOptions = {
     v3ApiUrl?: string
     tokenlistApiBaseUrl?: string
     deploymentsUrl?: string
-    eulerLabelsBaseUrl?: string
     rewardsMerklApiUrl?: string
     rewardsBrevisApiUrl?: string
     rewardsBrevisProofsApiUrl?: string
@@ -151,7 +150,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: 'https://example.test/EulerChains.json',
-        configLabelsBaseUrl: 'https://labels.example.test/',
       },
     }))
 
@@ -167,7 +165,6 @@ describe('useEulerSdk', () => {
       v3ApiUrl: '/api/internal',
       tokenlistApiBaseUrl: '/api/internal',
       deploymentsUrl: '/api/internal/euler-chains',
-      eulerLabelsBaseUrl: '/api/internal/labels',
     })
     expect(options.rpcUrls).toBeUndefined()
     expect(options.deploymentServiceConfig).toBeUndefined()
@@ -182,7 +179,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
       },
     }))
 
@@ -199,7 +195,6 @@ describe('useEulerSdk', () => {
       intrinsicApyV3ApiUrl: '/api/internal',
       eulerInterfacesBranch: 'account-lens-update',
       deploymentsUrl: '/api/internal/euler-chains',
-      eulerLabelsBaseUrl: '/api/internal/labels',
       rewardsMerklApiUrl: '/api/internal/proxy/merkl',
       rewardsBrevisApiUrl: '/api/internal/proxy/incentra/sdk/v1/eulerCampaigns',
       rewardsBrevisProofsApiUrl: '/api/internal/proxy/incentra/v1/getMerkleProofsBatch',
@@ -258,7 +253,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
       },
     }))
 
@@ -291,7 +285,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
       },
     }))
 
@@ -317,7 +310,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
       },
     }))
 
diff --git a/tests/composables/useGeoBlock-v3.test.ts b/tests/composables/useGeoBlock-v3.test.ts
new file mode 100644
index 000000000..e0cc91cd7
--- /dev/null
+++ b/tests/composables/useGeoBlock-v3.test.ts
@@ -0,0 +1,60 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PublicGeoPolicy } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { __setEulerLabelsDataForTest } from '~/composables/useEulerLabels'
+import { isAssetBlockedByCountry, isAssetRestrictedByCountry, isVaultBlockedByCountry, isVaultRestrictedByCountry, useGeoBlock } from '~/composables/useGeoBlock'
+
+vi.mock('~/composables/useVaultRegistry', () => ({ useVaultRegistry: () => ({ getVault: () => undefined }) }))
+const vault = '0x1111111111111111111111111111111111111111'
+const asset = { address: '0x2222222222222222222222222222222222222222', name: 'Ondo token', symbol: 'TEST' }
+const rule = (overrides: Partial<PublicGeoPolicy> = {}): PublicGeoPolicy => ({ id: 'rule', chainId: null, productId: null, vaultAddress: null, assetAddress: null, policyType: 'block', countries: ['EEA'], countriesResolved: ['NO', 'DE'], reason: null, createdAt: '', ...overrides })
+const set = (policies: PublicGeoPolicy[] | undefined, productId = 'current', chainId = 1) => __setEulerLabelsDataForTest({ geoContext: { policies, chainId, productByVault: { [vault]: productId } } })
+
+describe('V3 geo enforcement', () => {
+  beforeEach(() => {
+    set([])
+    useGeoBlock().country.value = 'NO'
+  })
+  it('uses countriesResolved, including Norway, without expanding aliases in Lite', () => {
+    set([rule()])
+    expect(isAssetBlockedByCountry(asset)).toBe(true)
+    useGeoBlock().country.value = 'FR'
+    expect(isAssetBlockedByCountry(asset)).toBe(false)
+  })
+  it('ORs global, product, vault and asset rules without narrowing overrides', () => {
+    for (const specific of [{}, { chainId: 1, productId: 'current' }, { chainId: 1, vaultAddress: vault }, { chainId: 1, assetAddress: asset.address }]) {
+      set([rule(specific), rule({ chainId: 1, vaultAddress: vault, countriesResolved: ['US'] })])
+      expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    }
+  })
+  it('uses current assignments and excludes other chains and scoped rules from standalone assets', () => {
+    set([rule({ chainId: 1, productId: 'old' }), rule({ chainId: 8453, vaultAddress: vault })])
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+    set([rule({ chainId: 1, productId: 'current' })])
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    expect(isAssetBlockedByCountry(asset)).toBe(false)
+    set([rule({ chainId: 1, productId: 'current' })], 'new')
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+  })
+  it('distinguishes unavailable from authored empty, preserving exits and sanctions', () => {
+    set(undefined)
+    expect(useGeoBlock().isPolicyAvailable.value).toBe(false)
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(true)
+    expect(isAssetRestrictedByCountry(asset, { counterpart: asset })).toBe(true)
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+    set([])
+    expect(useGeoBlock().isPolicyAvailable.value).toBe(true)
+    expect(isVaultRestrictedByCountry(vault, { asset })).toBe(false)
+    useGeoBlock().country.value = 'KP'
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    useGeoBlock().country.value = null
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+  })
+  it('preserves bounded pattern matching and limits same-asset exemptions to asset restrictions', () => {
+    set([rule({ policyType: 'restrict', assetNameRegex: '^ondo' })])
+    expect(isAssetRestrictedByCountry(asset)).toBe(true)
+    expect(isAssetRestrictedByCountry({ name: 'x'.repeat(129) })).toBe(true)
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(false)
+    set([rule({ policyType: 'restrict', chainId: 1, productId: 'current' })])
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(true)
+  })
+})
diff --git a/tests/composables/useOperationGuard.test.ts b/tests/composables/useOperationGuard.test.ts
index e12895e29..80c6fbf3b 100644
--- a/tests/composables/useOperationGuard.test.ts
+++ b/tests/composables/useOperationGuard.test.ts
@@ -5,7 +5,12 @@ import { mainnet, monad } from 'viem/chains'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { useOperationGuard } from '~/composables/useOperationGuard'
 
-vi.mock('~/composables/useEulerLabels', () => ({ getEulerLabelsVersion: () => 1 }))
+import type { HostedGeoContext } from '~/utils/geo-policies'
+import { operationBlockerEntries } from '~/utils/operationGuardRegistry'
+
+const hostedGeo = ref<HostedGeoContext | undefined>()
+
+vi.mock('~/composables/useEulerLabels', () => ({ getEulerLabelsVersion: () => 1, getEulerGeoContext: () => hostedGeo.value }))
 vi.mock('~/composables/guards/useTosGuard', () => ({ useTosGuard: () => ({}) }))
 vi.mock('~/utils/eulerLabelsUtils', () => ({ isVaultKeyring: () => false }))
 vi.mock('~/composables/useKeyring', () => ({
@@ -22,7 +27,8 @@ vi.mock('~/composables/useKeyring', () => ({
 describe('operation verification chain', () => {
   afterEach(() => vi.unstubAllGlobals())
 
-  it('verifies a Monad Earn vault while disconnected Wagmi still defaults to Ethereum', async () => {
+  it.each([true, false])('guards missing geo only for acquisition=%s while using the app verification chain', async (acquiresExposure) => {
+    hostedGeo.value = { chainId: 143, policies: undefined, productByVault: {} }
     const vault = { address: '0x00000000000000000000000000000000000000a1', chainId: 143 }
     const verifyOwner = vi.fn(() => true)
     vi.stubGlobal('useWagmi', () => ({ address: ref(undefined) }))
@@ -58,7 +64,7 @@ describe('operation verification chain', () => {
     let state: ReturnType<typeof useOperationGuard> | undefined
     const app = renderer.createApp({
       setup() {
-        state = useOperationGuard([vault.address])
+        state = useOperationGuard([vault.address], { acquiresExposure })
         return () => h('span')
       },
     })
@@ -66,6 +72,10 @@ describe('operation verification chain', () => {
     app.mount({ type: 'root' })
     try {
       await nextTick()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(acquiresExposure)
+      hostedGeo.value = { chainId: 143, policies: [], productByVault: {} }
+      await nextTick()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(false)
       expect(config.state.chainId).toBe(1)
       expect(verifyOwner).toHaveBeenCalledWith(vault)
       expect(state?.unverifiedVaultGuard.isAcknowledgmentRequired).toBe(false)
@@ -76,6 +86,7 @@ describe('operation verification chain', () => {
     }
     finally {
       app.unmount()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(false)
     }
   })
 })
diff --git a/tests/composables/useTxBatch.test.ts b/tests/composables/useTxBatch.test.ts
index afe50616d..87610cd70 100644
--- a/tests/composables/useTxBatch.test.ts
+++ b/tests/composables/useTxBatch.test.ts
@@ -1,3 +1,4 @@
+import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
 import { Account, Portfolio, type EVCBatchItem, type IAccountPosition, type IHasVaultAddress, type IAccountLiquidity, type TransactionPlan } from '@eulerxyz/euler-v2-sdk'
@@ -712,7 +713,7 @@ describe('stitchAccount', () => {
 })
 
 describe('fetchBaseAccountSnapshot', () => {
-  it('uses the same full population path as the normal portfolio read', async () => {
+  it('populates review data explicitly without invoking SDK legacy labels', async () => {
     const expected = accountWithPosition(subAccount, subAccount, 1n)
     const fetchAccount = vi.fn(async () => ({ result: expected, errors: [] }))
     const sdk = {
@@ -722,7 +723,7 @@ describe('fetchBaseAccountSnapshot', () => {
     const result = await fetchBaseAccountSnapshot(sdk, 1, owner)
 
     expect(result).toBe(expected)
-    expect(fetchAccount).toHaveBeenCalledWith(1, owner, { populateAll: true })
+    expect(fetchAccount).toHaveBeenCalledWith(1, owner, { populateVaults: true, populateMarketPrices: true, populateUserRewards: true, vaultFetchOptions: liteVaultFetchOptions })
   })
 })
 
@@ -981,7 +982,10 @@ describe('useTxBatch execution errors', () => {
     })
 
     expect(sdk.accountService.fetchAccount).toHaveBeenCalledWith(1, owner, {
-      populateAll: true,
+      populateVaults: true,
+      populateMarketPrices: true,
+      populateUserRewards: true,
+      vaultFetchOptions: liteVaultFetchOptions,
     })
     expect(executionMocks.compilePreview).toHaveBeenCalledWith(expect.any(Array), expect.not.objectContaining({ chainId: 8453 }))
   })
@@ -1003,7 +1007,10 @@ describe('useTxBatch execution errors', () => {
     })
 
     expect(sdk.accountService.fetchAccount).toHaveBeenCalledWith(1, owner, {
-      populateAll: true,
+      populateVaults: true,
+      populateMarketPrices: true,
+      populateUserRewards: true,
+      vaultFetchOptions: liteVaultFetchOptions,
     })
     expect(executionMocks.compilePreview).toHaveBeenCalledWith(expect.any(Array), expect.objectContaining({ owner }))
   })
diff --git a/tests/composables/useUnverifiedVaultGuard.test.ts b/tests/composables/useUnverifiedVaultGuard.test.ts
index 5a53bb3bf..b3650f219 100644
--- a/tests/composables/useUnverifiedVaultGuard.test.ts
+++ b/tests/composables/useUnverifiedVaultGuard.test.ts
@@ -17,7 +17,7 @@ vi.mock('~/composables/useEulerLabels', () => ({
   getEulerLabelsVersion: () => 1,
 }))
 
-const mountGuard = (options?: { chainId?: Ref<number | undefined>, account?: Ref<string | undefined>, operation?: Ref<string> }) => {
+const mountGuard = (options?: { allowUnavailableLabels?: boolean, chainId?: Ref<number | undefined>, account?: Ref<string | undefined>, operation?: Ref<string> }) => {
   let state: UnverifiedVaultGuardState | undefined
   const chainId = options?.chainId ?? ref<number | undefined>(1)
   const account = options?.account ?? ref<string | undefined>(ACCOUNT)
@@ -39,6 +39,7 @@ const mountGuard = (options?: { chainId?: Ref<number | undefined>, account?: Ref
     setup() {
       useUnverifiedVaultGuard(computed(() => [VAULT]), {
         chainId,
+        allowUnavailableLabels: options?.allowUnavailableLabels,
         account,
         operation: computed(() => operation.value),
       })
@@ -133,6 +134,23 @@ describe('useUnverifiedVaultGuard canonical context', () => {
     mounted.app.unmount()
   })
 
+  it('allows a simple exit to acknowledge unavailable labels without granting verification', async () => {
+    entries.set(VAULT.toLowerCase(), { type: 'evk', vault: { chainId: 1, address: VAULT } })
+    labelsReady.value = false
+    labelsError.value = 'Unavailable'
+    verifyEVault.mockReturnValue(true)
+    const mounted = mountGuard({ allowUnavailableLabels: true })
+    await nextTick()
+    expect(mounted.state.verificationError).toBeUndefined()
+    expect(mounted.state.isVerificationLoading).toBe(false)
+    expect(mounted.state.isAcknowledgmentRequired).toBe(true)
+    expect(verifyEVault).not.toHaveBeenCalled()
+    mounted.state.acknowledgeRisk()
+    await nextTick()
+    expect(operationBlockerEntries.value).toEqual([])
+    mounted.app.unmount()
+  })
+
   it('removes the acknowledgement requirement when canonical verification recovers', async () => {
     entries.set(VAULT.toLowerCase(), { type: 'evk', vault: { chainId: 1, address: VAULT } })
     verifyEVault.mockReturnValue(false)
diff --git a/tests/composables/useVaultRegistry.test.ts b/tests/composables/useVaultRegistry.test.ts
index 83405fe4b..27e73d254 100644
--- a/tests/composables/useVaultRegistry.test.ts
+++ b/tests/composables/useVaultRegistry.test.ts
@@ -1,3 +1,4 @@
+import { __setEulerLabelsDataForTest, useEulerLabels, getEulerLabelsSourceData } from '~/composables/useEulerLabels'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
 import { getAddress } from 'viem'
@@ -28,6 +29,8 @@ const vault = (asset: string) => ({
 describe('useVaultRegistry chain-scoped identity', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    __setEulerLabelsDataForTest()
+    vi.stubGlobal('useEulerLabels', useEulerLabels)
     vi.stubGlobal('useEulerAddresses', () => ({ chainId }))
     chainId.value = undefined
     useVaultRegistry().clear()
@@ -122,3 +125,50 @@ describe('useVaultRegistry chain-scoped identity', () => {
     expect(fetchVaultCategoryMock).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('metadata-only verification uses current governance and membership', () => {
+  beforeEach(() => {
+    vi.stubGlobal('useEulerAddresses', () => ({ chainId }))
+    vi.stubGlobal('useEulerLabels', useEulerLabels)
+    chainId.value = 146
+    useVaultRegistry().clear()
+    __setEulerLabelsDataForTest({ source: 'v3-metadata', candidateVaultAddresses: [VAULT],
+      managingEntityByVault: { [VAULT.toLowerCase()]: 'manager' },
+      entities: { manager: { name: 'Manager', addresses: { [ASSET_ONE]: 'Governor' } } } as never })
+  })
+  it('rejects mismatches and revokes cached positives when addresses or membership change', () => {
+    const registry = useVaultRegistry()
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_TWO } as never, 'evk', { verified: true })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE } as never, 'evk', { verified: true })
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    const labels = getEulerLabelsSourceData()
+    __setEulerLabelsDataForTest({ ...labels, entities: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    __setEulerLabelsDataForTest({ ...labels, candidateVaultAddresses: [] })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    __setEulerLabelsDataForTest({ ...labels, managingEntityByVault: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+  })
+  it('requires router governance and keeps independent escrow verification', () => {
+    const registry = useVaultRegistry()
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE, oracle: { name: 'EulerRouter' } } as never, 'evk')
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE, oracle: { name: 'EulerRouter' }, eulerRouterGovernor: ASSET_ONE } as never, 'evk')
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    __setEulerLabelsDataForTest({ source: 'v3-metadata' })
+    registry.set(VAULT, vault(ASSET_ONE) as never, 'evk', { vaultCategory: 'escrow' })
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+  })
+  it('checks Earn owners and rejects an absent manager', () => {
+    const registry = useVaultRegistry()
+    const labels = getEulerLabelsSourceData()
+    __setEulerLabelsDataForTest({ ...labels, candidateVaultAddresses: [], candidateEarnVaultAddresses: [VAULT] })
+    registry.set(VAULT, { ...vault(ASSET_ONE), governance: { owner: ASSET_TWO } } as never, 'earn')
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governance: { owner: ASSET_ONE } } as never, 'earn')
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    __setEulerLabelsDataForTest({ ...getEulerLabelsSourceData(), managingEntityByVault: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+  })
+})
diff --git a/tests/composables/useVaults.test.ts b/tests/composables/useVaults.test.ts
index db3ca826e..4f1586fe4 100644
--- a/tests/composables/useVaults.test.ts
+++ b/tests/composables/useVaults.test.ts
@@ -2,6 +2,7 @@ import { EVault as SdkEVault, type EVault, type EulerEarn, type IEVault } from '
 import { getAddress, type Address } from 'viem'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
+import type { PublicEulerLabelsData } from '~/utils/public-labels'
 import { __setEulerLabelsDataForTest, useEulerLabels } from '~/composables/useEulerLabels'
 import { useVaultRegistry } from '~/composables/useVaultRegistry'
 import { useVaults } from '~/composables/useVaults'
@@ -200,6 +201,28 @@ describe('useVaults EVault verification metadata', () => {
     ])
   })
 
+  it('retains an open unlisted vault during a same-chain labels reload', async () => {
+    await useVaults().updateEVaults([DYNAMIC_EVAULT], undefined, true)
+    const registry = useVaultRegistry()
+    const dynamic = registry.get(DYNAMIC_EVAULT)?.vault
+    await useVaults().updateEVaults([DEPRECATED_EVAULT], undefined, true, {
+      verifiedAddresses: new Set([getAddress(DEPRECATED_EVAULT).toLowerCase()]),
+    })
+    __setEulerLabelsDataForTest({
+      source: 'v3', visibility: {}, verifiedVaultAddresses: [getAddress(LABELED_EVAULT)],
+    })
+
+    await useVaults().loadVaults({ preserveRegistry: true })
+
+    expect(registry.get(DYNAMIC_EVAULT)?.vault).toBe(dynamic)
+    expect(registry.isVerifiedVault(DYNAMIC_EVAULT)).toBe(false)
+    expect(registry.get(LABELED_EVAULT)).toBeDefined()
+    expect(registry.isVerifiedVault(DEPRECATED_EVAULT)).toBe(false)
+
+    await useVaults().loadVaults()
+    expect(registry.get(DYNAMIC_EVAULT)).toBeUndefined()
+  })
+
   it('chunks EVault fetches for configured chunk chains', async () => {
     const addresses = Array.from(
       { length: 7 },
@@ -259,6 +282,29 @@ describe('useVaults EVault verification metadata', () => {
     expect(vaults.isEarnVaultOwnerVerified(registry.get(BASE_EARN_VAULT)!.vault as EulerEarn)).toBe(true)
   })
 
+  it('revokes cached EVault and Earn verification when the hosted snapshot removes them', () => {
+    const registry = useVaultRegistry()
+    const snapshot = {
+      verifiedVaultAddresses: [getAddress(LABELED_EVAULT)],
+      earnVaults: [getAddress(BASE_EARN_VAULT)],
+      visibility: {},
+    } as Partial<PublicEulerLabelsData>
+    __setEulerLabelsDataForTest(snapshot)
+    registry.set(LABELED_EVAULT, makeVault(LABELED_EVAULT), 'evk', { verified: true })
+    registry.set(BASE_EARN_VAULT, makeEarnVault(BASE_EARN_VAULT), 'earn', { verified: true })
+    registry.setEscrowAddresses([ESCROW_EVAULT])
+    expect(registry.isVerifiedVault(LABELED_EVAULT)).toBe(true)
+    expect(registry.isVerifiedVault(BASE_EARN_VAULT)).toBe(true)
+
+    __setEulerLabelsDataForTest({ visibility: {} } as Partial<PublicEulerLabelsData>)
+    expect(registry.isVerifiedVault(LABELED_EVAULT)).toBe(false)
+    expect(registry.isVerifiedVault(BASE_EARN_VAULT)).toBe(false)
+    expect(registry.getVerifiedEVaults(true)).toEqual([])
+    expect(registry.isVerifiedVault(ESCROW_EVAULT)).toBe(true)
+    expect(registry.getVault(LABELED_EVAULT)).toBeDefined()
+    expect(registry.getVault(BASE_EARN_VAULT)).toBeDefined()
+  })
+
   it('clears stale Earn verification when a vault is removed from curation', async () => {
     const registry = useVaultRegistry()
     registry.set(BASE_EARN_VAULT, makeEarnVault(BASE_EARN_VAULT), 'earn', { verified: true })
diff --git a/tests/fixtures/public-labels-v20260804151305236.ts b/tests/fixtures/public-labels-v20260804151305236.ts
new file mode 100644
index 000000000..5566dba29
--- /dev/null
+++ b/tests/fixtures/public-labels-v20260804151305236.ts
@@ -0,0 +1,186 @@
+import type { PublicLabelsSource } from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
+
+export const KPK = 'kpk'
+export const SECURITIZE = 'securitize'
+export const KPK_VAULT = '0x2Ff596321782FE034102f55af5ad707A4Ce0d6a7'
+export const NEUTRAL_ESCROW = '0x00000000000000000000000000000000000000E5'
+export const ASSESSMENT_ONLY_EVK = '0x00000000000000000000000000000000000000A1'
+export const ASSESSMENT_ONLY_EARN = '0x00000000000000000000000000000000000000A2'
+export const VERIFICATION_ONLY_EVK = '0x00000000000000000000000000000000000000B1'
+export const VERIFICATION_ONLY_EARN = '0x00000000000000000000000000000000000000B2'
+export const KPK_GOVERNOR = '0x1572063377a9a4f8065BD7bA0D7fa135cd13051F'
+
+export const publicLabelsFixture: PublicLabelsSource = {
+  visibility: Object.fromEntries([KPK_VAULT, VERIFICATION_ONLY_EVK, VERIFICATION_ONLY_EARN].map(address => [address.toLowerCase(), { status: 'visible' as const, explorableLend: true, explorableBorrow: true, decidedBy: 'verified', reason: null }])),
+  products: [{
+    id: 'kpk-securitize',
+    chainId: 1,
+    entityId: KPK,
+    coBrandEntityIds: [SECURITIZE],
+    name: 'KPK x Securitize RWA Markets',
+    logo: null,
+    description: 'Curated by KPK and co-branded with Securitize.',
+    url: 'https://kpk.io/vaults',
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    governanceMode: 'unknown',
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  vaults: [{
+    chainId: 1,
+    address: KPK_VAULT,
+    vaultType: 'evk',
+    productId: 'kpk-securitize',
+    entityId: KPK,
+    name: 'KPK VBILL/USDC Lend',
+    description: 'USDC lending vault for the KPK VBILL market.',
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: ['recently added', 'suppress high utilisation warning'],
+    campaigns: [{
+      name: 'KPK RWA points',
+      logo: 'https://token-images.euler.finance/labels/kpk',
+      type: 'deposit',
+    }],
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: ASSESSMENT_ONLY_EVK,
+    vaultType: 'evk',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-07-31T14:48:35.257Z',
+  }, {
+    chainId: 1,
+    address: ASSESSMENT_ONLY_EARN,
+    vaultType: 'earn',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-07-31T14:48:35.257Z',
+  }, {
+    chainId: 1,
+    address: VERIFICATION_ONLY_EVK,
+    vaultType: 'evk',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: VERIFICATION_ONLY_EARN,
+    vaultType: 'earn',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: NEUTRAL_ESCROW,
+    vaultType: 'escrow',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    deprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  entities: [{
+    id: KPK,
+    name: 'KPK',
+    logo: 'https://token-images.euler.finance/labels/kpk',
+    description: 'KPK is a third-party curator.',
+    url: 'https://kpk.io/',
+    socialTwitter: 'https://x.com/kpk_io',
+    socialYoutube: null,
+    socialDiscord: null,
+    socialTelegram: null,
+    socialGithub: 'https://github.com/karpatkey',
+    socialDefillama: null,
+    legalEntityName: null,
+    riskMethodology: null,
+    security: null,
+    termsOfService: null,
+    licenses: null,
+    disclaimers: null,
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    id: SECURITIZE,
+    name: 'Securitize',
+    logo: 'https://token-images.euler.finance/labels/securitize',
+    description: 'Securitize is a tokenisation platform.',
+    url: 'https://securitize.io/',
+    socialTwitter: 'https://x.com/Securitize',
+    socialYoutube: null,
+    socialDiscord: null,
+    socialTelegram: null,
+    socialGithub: null,
+    socialDefillama: null,
+    legalEntityName: null,
+    riskMethodology: null,
+    security: null,
+    termsOfService: null,
+    licenses: null,
+    disclaimers: null,
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  entityAddresses: [{
+    entityId: KPK,
+    address: KPK_GOVERNOR,
+    label: 'KPK Euler RWA Curation Safe',
+  }],
+  geoPolicies: [{
+    id: 'raw-kpk-policy',
+    chainId: 1,
+    productId: 'kpk-securitize',
+    vaultAddress: null,
+    assetAddress: null,
+    countries: ['DE'],
+    countriesResolved: ['DE'],
+    policyType: 'block',
+    reason: 'Raw fixture policy',
+    createdAt: '2026-08-04T13:25:58.430Z',
+  }],
+}
diff --git a/tests/fixtures/static-labels.json b/tests/fixtures/static-labels.json
new file mode 100644
index 000000000..30e666e82
--- /dev/null
+++ b/tests/fixtures/static-labels.json
@@ -0,0 +1,60 @@
+{
+  "products": {
+    "fork": {
+      "name": "Fork product",
+      "entity": "curator",
+      "vaults": [
+        "0x1111111111111111111111111111111111111111"
+      ],
+      "deprecatedVaults": [],
+      "block": [
+        "US"
+      ],
+      "vaultOverrides": {
+        "0x1111111111111111111111111111111111111111": {
+          "restricted": [
+            "CA"
+          ],
+          "notExplorableBorrow": true
+        }
+      }
+    }
+  },
+  "entities": {
+    "curator": {
+      "name": "Fork curator",
+      "logo": "curator.svg",
+      "description": "",
+      "url": "https://fork.test",
+      "addresses": {
+        "0x3333333333333333333333333333333333333333": "Owner"
+      },
+      "social": {}
+    }
+  },
+  "points": [
+    {
+      "name": "Fork points",
+      "logo": "points.svg",
+      "collateralVaults": [
+        "0x1111111111111111111111111111111111111111"
+      ]
+    }
+  ],
+  "earnVaults": [
+    {
+      "address": "0x2222222222222222222222222222222222222222",
+      "restricted": [
+        "GB"
+      ]
+    }
+  ],
+  "assets": [
+    {
+      "address": "0x4444444444444444444444444444444444444444",
+      "block": [
+        "US"
+      ]
+    }
+  ]
+}
diff --git a/tests/reviewed-execution/app-policy-vault-context.test.ts b/tests/reviewed-execution/app-policy-vault-context.test.ts
index 5ca8a1271..6ebc6334c 100644
--- a/tests/reviewed-execution/app-policy-vault-context.test.ts
+++ b/tests/reviewed-execution/app-policy-vault-context.test.ts
@@ -94,6 +94,16 @@ describe('final two-vault swap policy', () => {
       .rejects.toThrow('Vault verification is unavailable')
   })
 
+  it('allows an acknowledged simple withdrawal during a labels outage, but not a mixed swap batch', async () => {
+    geo.labelsReady.value = false
+    const intent = createOperationIntent({ kind: 'withdraw', planner: 'withdraw', args: { vaultAddress: TEST_VAULT, owner: TEST_ACCOUNT, assets: 1n }, chainId: 1, account: TEST_ACCOUNT, subAccounts: [TEST_ACCOUNT], source: 'test', operation: 'lend-withdraw', createdAt: 1, intentId: 'exit' })
+    const requestSet = makeReviewedExecution().requestSet
+    await expect(resolveAppPolicy(requestSet, 100, [intent])).rejects.toThrow('acknowledgement')
+    recordUnverifiedVaultAcknowledgement({ chainId: 1, account: TEST_ACCOUNT, operation: 'lend-withdraw', vaults: [TEST_VAULT] })
+    await expect(resolveAppPolicy(requestSet, 100, [intent])).resolves.toBeDefined()
+    await expect(resolveAppPolicy(requestSet, 100, [intent, swapIntent()])).rejects.toThrow('Vault verification is unavailable')
+  })
+
   it.each([
     ['omitted', true],
     ['empty', true],
diff --git a/tests/server/geo-policy-source.test.ts b/tests/server/geo-policy-source.test.ts
new file mode 100644
index 000000000..83c158bfd
--- /dev/null
+++ b/tests/server/geo-policy-source.test.ts
@@ -0,0 +1,45 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PublicGeoPolicy, PublicLabelsRequest } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { createGeoPolicySource } from '~/server/utils/geo-policy-source'
+
+vi.mock('~/server/utils/logger', () => ({ logger: { warn: vi.fn() } }))
+const policy: PublicGeoPolicy = { id: 'global', chainId: null, productId: null, vaultAddress: null, assetAddress: null, countries: ['US'], countriesResolved: ['US'], policyType: 'block', reason: null, createdAt: '' }
+const requestFor = (policies: PublicGeoPolicy[]) => vi.fn(async () => ({ data: policies, meta: { total: policies.length } })) as unknown as PublicLabelsRequest
+
+describe('durable geo source', () => {
+  let directory: string
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'geo-test-'))
+  })
+  afterEach(async () => {
+    vi.useRealTimers()
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  it('retains policies across restarts and unbounded outages; successful empty clears them', async () => {
+    const first = await createGeoPolicySource('v3', directory)(requestFor([policy]))
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(Date.now() + 365 * 86400_000)
+    const restarted = createGeoPolicySource('v3', directory)
+    const offline = vi.fn().mockRejectedValue(new Error('offline')) as PublicLabelsRequest
+    expect(await restarted(offline)).toEqual(first)
+    expect(await restarted(requestFor([]))).toEqual({ fetchedAt: Date.now(), policies: [] })
+  })
+
+  it('isolates upstream identities and rejects unavailable cold starts', async () => {
+    await createGeoPolicySource('v3-a', directory)(requestFor([policy]))
+    const offline = vi.fn().mockRejectedValue(new Error('offline')) as PublicLabelsRequest
+    await expect(createGeoPolicySource('v3-b', directory)(offline)).rejects.toThrow('offline')
+  })
+
+  it('never replaces the checkpoint with malformed or partially fetched policies', async () => {
+    const first = await createGeoPolicySource('v3', directory)(requestFor([policy]))
+    const invalid = requestFor([{ ...policy, countriesResolved: undefined } as unknown as PublicGeoPolicy])
+    expect(await createGeoPolicySource('v3', directory)(invalid)).toEqual(first)
+    const partial = vi.fn().mockResolvedValueOnce({ data: [policy], meta: { total: 2 } }).mockRejectedValueOnce(new Error('page two failed')) as PublicLabelsRequest
+    expect(await createGeoPolicySource('v3', directory)(partial)).toEqual(first)
+  })
+})
diff --git a/tests/server/labels-base-url.test.ts b/tests/server/labels-base-url.test.ts
new file mode 100644
index 000000000..0a5b13e53
--- /dev/null
+++ b/tests/server/labels-base-url.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { readLabelsOnchainVerificationChains, readLabelsSource, resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
+
+describe('label source configuration', () => {
+  afterEach(() => vi.unstubAllEnvs())
+  it('defaults to V3 regardless of obsolete GitHub settings', () => {
+    vi.stubEnv('LABELS_SOURCE', '')
+    vi.stubEnv('EFFECTIVE_POLICY_REPO', 'euler-xyz/euler-labels')
+    expect(readLabelsSource()).toBe('v3')
+  })
+  it('requires an explicit static URL and rejects invalid source selection', () => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', '')
+    expect(resolveLabelsBaseUrl).toThrow('required')
+    vi.stubEnv('LABELS_SOURCE', 'typo')
+    expect(readLabelsSource).toThrow('v3 or static')
+  })
+  it('accepts operator-owned directories without a repository dependency', () => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', 'https://fork.example/labels/')
+    expect(resolveLabelsBaseUrl()).toBe('https://fork.example/labels')
+  })
+  it.each(['file:///tmp/labels', 'https://user:password@example.test', 'https://example.test?token=x'])('rejects unsafe base %s', (base) => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', base)
+    expect(resolveLabelsBaseUrl).toThrow()
+  })
+})
+
+describe('deprecated-chain labels verification selection', () => {
+  afterEach(() => vi.unstubAllEnvs())
+  it('selects enabled deprecated chains without changing active on-chain chains', () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('RPC_URL_1', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '1,146')
+    vi.stubEnv('DEPRECATED_CHAINS', '146,146')
+    expect(readLabelsOnchainVerificationChains()).toEqual([146])
+    vi.stubEnv('DEPRECATED_CHAINS', '')
+    expect(readLabelsOnchainVerificationChains()).toEqual([])
+  })
+  it('ignores deprecated chains without an enabled RPC', () => {
+    vi.stubEnv('RPC_URL_1923', '')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '')
+    vi.stubEnv('DEPRECATED_CHAINS', '1923')
+    expect(readLabelsOnchainVerificationChains()).toEqual([])
+  })
+  it('rejects an enabled deprecated chain without on-chain SDK reads', () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '1')
+    vi.stubEnv('DEPRECATED_CHAINS', '146')
+    expect(() => readLabelsOnchainVerificationChains()).toThrow('ONCHAIN_SDK_CHAINS: 146')
+  })
+})
diff --git a/tests/server/labels-fetch-failure.test.ts b/tests/server/labels-fetch-failure.test.ts
deleted file mode 100644
index 13137898e..000000000
--- a/tests/server/labels-fetch-failure.test.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { fetchWithTimeout } from '~/server/utils/fetchWithTimeout'
-import { refreshLabelFile } from '~/server/api/internal/labels/[file].get'
-
-vi.mock('~/server/utils/fetchWithTimeout', () => ({ fetchWithTimeout: vi.fn() }))
-
-describe('label proxy failure handling', () => {
-  it('returns an error for a transient failure without a usable cache', async () => {
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(new Response('', { status: 503 }))
-    await expect(refreshLabelFile(9001, 'earn-vaults.json')).rejects.toMatchObject({ statusCode: 503 })
-  })
-
-  it('serves cached labels during an upstream outage', async () => {
-    const data = ['0x00000000000000000000000000000000000000A1']
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(Response.json(data))
-    expect(await refreshLabelFile(9002, 'earn-vaults.json')).toEqual(data)
-    vi.mocked(fetchWithTimeout).mockRejectedValueOnce(new Error('network error'))
-    expect(await refreshLabelFile(9002, 'earn-vaults.json')).toEqual(data)
-  })
-
-  it('keeps genuinely absent files valid and empty', async () => {
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(new Response('', { status: 404 }))
-    expect(await refreshLabelFile(9003, 'earn-vaults.json')).toEqual([])
-  })
-})
diff --git a/tests/server/labels-validate-node.test.ts b/tests/server/labels-validate-node.test.ts
index cf45ca0e6..7d2650006 100644
--- a/tests/server/labels-validate-node.test.ts
+++ b/tests/server/labels-validate-node.test.ts
@@ -9,10 +9,10 @@
  *
  * If an assertion here starts failing, do not relax it before reviewing the
  * threat model in `docs/geo-blocking.md` and the PR that introduced the
- * corresponding defense (see git blame on server/api/internal/labels/[file].get.ts).
+ * corresponding defense (see git history for server/utils/labels-source.ts).
  */
 import { describe, it, expect } from 'vitest'
-import { validateNode } from '~/server/api/internal/labels/[file].get'
+import { validateNode } from '~/server/utils/static-labels-validation'
 
 describe('validateNode — size caps', () => {
   it('rejects strings longer than 16 KiB (client-side DoS guard)', () => {
diff --git a/tests/server/metadata-labels-verification.test.ts b/tests/server/metadata-labels-verification.test.ts
new file mode 100644
index 000000000..f0268f2e4
--- /dev/null
+++ b/tests/server/metadata-labels-verification.test.ts
@@ -0,0 +1,38 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getAddress } from 'viem'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+import { publicLabelsFixture, KPK_VAULT } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+const mocks = vi.hoisted(() => ({ labels: vi.fn(), vaults: vi.fn(), types: vi.fn() }))
+vi.mock('~/server/utils/public-labels-source', () => ({ getPublicEulerLabelsData: mocks.labels }))
+vi.mock('~/server/utils/sdk-server', () => ({ getServerSdk: async () => ({
+  eVaultService: { fetchVerifiedVaultAddresses: async () => [], fetchVaults: mocks.vaults },
+  eulerEarnService: { fetchVaults: async () => ({ result: [], errors: [] }) },
+  securitizeVaultService: { fetchVaults: async () => ({ result: [], errors: [] }) },
+  vaultMetaService: { fetchVaultTypes: mocks.types },
+}) }))
+
+describe('public API metadata-only governance verification', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.stubGlobal('$fetch', vi.fn(async () => ({ tokens: [] })))
+    mocks.types.mockResolvedValue({})
+    mocks.labels.mockResolvedValue(normalizeLabelsBundle(1, {
+      source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: publicLabelsFixture,
+    }))
+  })
+  it('fetches candidates with empty verified membership, then rejects mismatches and refreshed claim removal', async () => {
+    const labels = await mocks.labels()
+    const governor = Object.keys(labels.entities.kpk.addresses)[0]
+    mocks.vaults.mockResolvedValue({ result: [{ address: getAddress(KPK_VAULT), governorAdmin: governor, collaterals: [] }], errors: [] })
+    const { refreshVerifiedAddressSet } = await import('~/server/utils/verified-vaults')
+    expect(labels.verifiedVaultAddresses).toEqual([])
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(true)
+    expect(mocks.vaults.mock.calls[0][1]).toContain(getAddress(KPK_VAULT))
+    mocks.labels.mockResolvedValue({ ...labels, managingEntityByVault: {} })
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(false)
+    mocks.labels.mockResolvedValue(labels)
+    mocks.vaults.mockResolvedValue({ result: [{ address: getAddress(KPK_VAULT), governorAdmin: '0x0000000000000000000000000000000000000001', collaterals: [] }], errors: [] })
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(false)
+  })
+})
diff --git a/tests/server/public-labels-endpoint.test.ts b/tests/server/public-labels-endpoint.test.ts
new file mode 100644
index 000000000..609bf7b7f
--- /dev/null
+++ b/tests/server/public-labels-endpoint.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  query: {} as Record<string, string>,
+  cacheControl: undefined as string | undefined,
+  getPublicLabelsBundle: vi.fn(),
+  refreshPublicLabelsBundle: vi.fn(),
+  consume: vi.fn(),
+  setResponseHeader: vi.fn(),
+}))
+
+vi.mock('h3', () => ({
+  createError: (args: { statusCode: number, statusMessage: string }) => Object.assign(
+    new Error(args.statusMessage),
+    args,
+  ),
+  getHeader: () => mocks.cacheControl,
+  getQuery: () => mocks.query,
+  setResponseHeader: mocks.setResponseHeader,
+}))
+
+vi.mock('~/server/utils/rate-limit', () => ({
+  createRateLimiter: () => ({ consume: mocks.consume }),
+}))
+
+vi.mock('~/server/utils/public-labels-source', () => ({
+  getPublicLabelsBundle: mocks.getPublicLabelsBundle,
+  refreshPublicLabelsBundle: mocks.refreshPublicLabelsBundle,
+}))
+
+const loadHandler = async () => {
+  vi.stubGlobal('defineEventHandler', (handler: unknown) => handler)
+  const route = await import('~/server/api/internal/public-labels.get')
+  return route.default as (event: unknown) => Promise<unknown>
+}
+
+describe('public labels aggregate endpoint', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+    mocks.query = { chainId: '1' }
+    mocks.cacheControl = undefined
+    mocks.getPublicLabelsBundle.mockReset().mockResolvedValue({ source: 'cache' })
+    mocks.refreshPublicLabelsBundle.mockReset().mockResolvedValue({ source: 'refresh' })
+    mocks.consume.mockReset()
+    mocks.setResponseHeader.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('leaves an omitted version to the server deployment default', async () => {
+    const handler = await loadHandler()
+
+    await expect(handler({})).resolves.toEqual({ source: 'cache' })
+    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, undefined)
+    expect(mocks.refreshPublicLabelsBundle).not.toHaveBeenCalled()
+  })
+
+  it('forces the selected deterministic version on no-cache requests', async () => {
+    mocks.query = { chainId: '1', version: 'v20260804151305236' }
+    mocks.cacheControl = 'no-cache'
+    const handler = await loadHandler()
+
+    await expect(handler({})).resolves.toEqual({ source: 'refresh' })
+    expect(mocks.refreshPublicLabelsBundle).toHaveBeenCalledWith(1, 'v20260804151305236')
+  })
+
+  it('passes a named published version through to the selected server source', async () => {
+    mocks.query = { chainId: '1', version: 'test-2026-06-30' }
+    const handler = await loadHandler()
+    await handler({})
+    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, 'test-2026-06-30')
+  })
+
+  it('rejects unsupported version shapes before fetching', async () => {
+    mocks.query = { chainId: '1', version: 'draft' }
+    const handler = await loadHandler()
+
+    await expect(handler({})).rejects.toMatchObject({ statusCode: 400 })
+    expect(mocks.getPublicLabelsBundle).not.toHaveBeenCalled()
+    expect(mocks.refreshPublicLabelsBundle).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
new file mode 100644
index 000000000..c5121d888
--- /dev/null
+++ b/tests/server/public-labels-source.test.ts
@@ -0,0 +1,235 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { getAddress } from 'viem'
+import { KPK_VAULT, publicLabelsFixture } from '~/tests/fixtures/public-labels-v20260804151305236'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  fetchWithTimeout: vi.fn(),
+  warn: vi.fn(),
+}))
+
+vi.mock('~/server/utils/fetchWithTimeout', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('~/server/utils/fetchWithTimeout')>()
+  return {
+    ...actual,
+    fetchWithTimeout: mocks.fetchWithTimeout,
+  }
+})
+
+vi.mock('~/server/utils/logger', () => ({
+  logger: { warn: mocks.warn },
+}))
+
+const emptyListResponse = () => new Response(JSON.stringify({
+  data: [],
+  meta: { total: 0, timestamp: '2026-08-04T15:13:05.236Z' },
+}), {
+  status: 200,
+  headers: { 'content-type': 'application/json' },
+})
+
+const versionsResponse = () => new Response(JSON.stringify({
+  data: [{
+    versionKey: 'v20260804151305236',
+    status: 'published',
+    aliases: ['latest'],
+    isLatest: true,
+  }],
+  meta: { timestamp: '2026-08-04T15:13:05.236Z' },
+}), {
+  status: 200,
+  headers: { 'content-type': 'application/json' },
+})
+
+describe('public labels server source', () => {
+  let directory: string
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'geo-bundle-test-'))
+    vi.stubEnv('GEO_POLICY_CACHE_DIR', directory)
+    vi.resetModules()
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
+    vi.stubEnv('LABELS_SOURCE', 'v3')
+    vi.stubEnv('DEPRECATED_CHAINS', '')
+    vi.stubEnv('LABELS_V3_SET', '')
+    vi.stubEnv('LABELS_V3_VERSION', '')
+    vi.stubEnv('V3_API_URL', 'https://v3.example.test')
+    mocks.fetchWithTimeout.mockReset().mockImplementation(async (url: string) =>
+      new URL(url).pathname.endsWith('/versions')
+        ? versionsResponse()
+        : emptyListResponse(),
+    )
+    mocks.warn.mockReset()
+  })
+
+  afterEach(async () => {
+    await rm(directory, { recursive: true, force: true })
+    vi.useRealTimers()
+    vi.unstubAllEnvs()
+  })
+
+  it('selects metadata-only for deprecated chains, isolates its cache and never falls back after assessment failure', async () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '146')
+    vi.stubEnv('DEPRECATED_CHAINS', '146')
+    mocks.fetchWithTimeout.mockImplementation(async (input: string) => {
+      const path = new URL(input).pathname
+      if (path.startsWith('/v3/evk/') || path.startsWith('/v3/earn/')) return new Response('CHAIN_NOT_SUPPORTED', { status: 404 })
+      return path.endsWith('/versions') ? versionsResponse() : emptyListResponse()
+    })
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const bundle = await getPublicLabelsBundle(146)
+    expect(bundle.source).toBe('v3-metadata')
+    expect(bundle).not.toHaveProperty('publicLabels.visibility')
+    expect(mocks.fetchWithTimeout.mock.calls.some(([url]) => /\/(evk|earn)\//.test(new URL(url).pathname))).toBe(false)
+    vi.stubEnv('DEPRECATED_CHAINS', '')
+    await expect(getPublicLabelsBundle(146)).rejects.toThrow('404')
+  })
+
+  it('deduplicates concurrent loads and serves the aggregate from cache', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+
+    const [first, concurrent] = await Promise.all([
+      getPublicLabelsBundle(1),
+      getPublicLabelsBundle(1),
+    ])
+    const cached = await getPublicLabelsBundle(1)
+
+    expect(concurrent).toBe(first)
+    expect(cached).toBe(first)
+    expect(first.version).toBe('v20260804151305236')
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(7)
+    expect(mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url).pathname)).toEqual([
+      '/v3/geo-policies',
+      '/v3/labels/sets/public/versions',
+      '/v3/labels/vaults',
+      '/v3/labels/products',
+      '/v3/labels/entities',
+      '/v3/evk/vaults',
+      '/v3/earn/vaults',
+    ])
+    expect(mocks.fetchWithTimeout.mock.calls.slice(2, 5).every(([url]) =>
+      new URL(url).searchParams.get('version') === 'v20260804151305236',
+    )).toBe(true)
+  })
+
+  it('loads missing inventory verdicts through the SDK and retains them on refresh failure', async () => {
+    const address = KPK_VAULT.toLowerCase()
+    let failVisibility = false
+    const json = (data: unknown, total?: number) => new Response(JSON.stringify({ data, meta: { total, timestamp: '2026-09-14T12:00:00Z' } }))
+    mocks.fetchWithTimeout.mockImplementation(async (input: string) => {
+      const url = new URL(input)
+      const path = url.pathname
+      if (path.endsWith('/versions')) return versionsResponse()
+      if (path === '/v3/labels/vaults') return json([{ ...publicLabelsFixture.vaults[0], vaultType: 'securitize' }], 1)
+      if (path === '/v3/labels/products') return json(publicLabelsFixture.products, publicLabelsFixture.products.length)
+      if (path === '/v3/labels/entities') return json(publicLabelsFixture.entities, publicLabelsFixture.entities.length)
+      if (path.startsWith('/v3/labels/entities/')) {
+        const entityId = path.split('/')[4]
+        if (path.endsWith('/addresses')) {
+          const addresses = publicLabelsFixture.entityAddresses.filter(row => row.entityId === entityId)
+          return json(addresses, addresses.length)
+        }
+        return json(publicLabelsFixture.entities.find(row => row.id === entityId))
+      }
+      if (path === `/v3/evk/vaults/1/${address}/visibility`) {
+        expect(url.search).toBe('')
+        if (failVisibility) return new Response('unavailable', { status: 503 })
+        return json({ chainId: 1, vaultAddress: address, status: 'visible', checks: {
+          decidedBy: 'verified', notExplorableLend: false,
+          listing: { lend: { hidden: true }, borrow: { hidden: false } },
+        } })
+      }
+      return emptyListResponse()
+    })
+    const { getPublicLabelsBundle, getPublicEulerLabelsData, refreshPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+    const data = await getPublicEulerLabelsData(1)
+    expect(data.verifiedVaultAddresses).toContain(getAddress(KPK_VAULT))
+    expect(data.managingEntityByVault?.[address]).toBe('kpk')
+    expect(data.visibility?.[address]).toMatchObject({ status: 'visible', explorableLend: false, explorableBorrow: true })
+    failVisibility = true
+    await expect(refreshPublicLabelsBundle(1)).resolves.toBe(first)
+    vi.resetModules()
+    const cold = await import('~/server/utils/public-labels-source')
+    await expect(cold.getPublicLabelsBundle(1)).rejects.toThrow('503')
+  })
+
+  it('uses deterministic fixture versions directly without resolving latest', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+
+    const bundle = await getPublicLabelsBundle(1, 'v20260804151305236')
+
+    expect(bundle.version).toBe('v20260804151305236')
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(6)
+    expect(mocks.fetchWithTimeout.mock.calls.every(([url]) =>
+      !new URL(url).pathname.endsWith('/labels/sets/public/versions'),
+    )).toBe(true)
+  })
+
+  it('uses configured set and version for server reads without resolving latest', async () => {
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    vi.stubEnv('LABELS_V3_VERSION', 'v20260804151305236')
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const bundle = await getPublicLabelsBundle(1)
+    expect(bundle).toMatchObject({ labelSet: 'test-instance', version: 'v20260804151305236' })
+    const urls = mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url))
+    expect(urls.some(url => url.pathname.endsWith('/versions'))).toBe(false)
+    expect(urls.filter(url => url.pathname.startsWith('/v3/labels/')).every(url =>
+      url.searchParams.get('labelSet') === 'test-instance' && url.searchParams.get('version') === 'v20260804151305236',
+    )).toBe(true)
+    expect(urls.filter(url => !url.pathname.startsWith('/v3/labels/')).every(url => !url.searchParams.has('labelSet'))).toBe(true)
+  })
+
+  it('separates cached and stale snapshots by set, version and upstream', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    const other = await getPublicLabelsBundle(1)
+    expect(other).not.toBe(first)
+    expect(other).toMatchObject({ labelSet: 'test-instance' })
+    expect(mocks.fetchWithTimeout.mock.calls.some(([url]) => new URL(url).pathname === '/v3/labels/sets/test-instance/versions')).toBe(true)
+    vi.stubEnv('LABELS_V3_VERSION', 'v20260911011146353')
+    const pinned = await getPublicLabelsBundle(1)
+    expect(pinned).not.toBe(other)
+    expect(pinned.version).toBe('v20260911011146353')
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('unavailable'))
+    vi.stubEnv('LABELS_V3_SET', 'unavailable-set')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('unavailable')
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    vi.stubEnv('V3_API_URL', 'https://another-v3.test')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('unavailable')
+  })
+
+  it.each([
+    ['LABELS_V3_SET', '../public'],
+    ['LABELS_V3_VERSION', 'draft'],
+  ])('rejects invalid %s before making requests', async (key, value) => {
+    vi.stubEnv(key, value)
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    expect(() => getPublicLabelsBundle(1)).toThrow(key)
+    expect(mocks.fetchWithTimeout).not.toHaveBeenCalled()
+  })
+
+  it('serves a bounded stale bundle when a refresh fails', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+
+    vi.advanceTimersByTime(300_001)
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('V3 unavailable'))
+
+    await expect(getPublicLabelsBundle(1)).resolves.toBe(first)
+    expect(mocks.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ ctx: 'public-labels-source', chainId: 1 }),
+      'refresh failed',
+    )
+  })
+
+  it('does not publish a snapshot when geo is unavailable on a cold start', async () => {
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('geo unavailable'))
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('geo unavailable')
+  })
+})
diff --git a/tests/server/sdk-server.test.ts b/tests/server/sdk-server.test.ts
index 9b82dae0d..983ab2660 100644
--- a/tests/server/sdk-server.test.ts
+++ b/tests/server/sdk-server.test.ts
@@ -3,7 +3,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   buildEulerSDK: vi.fn(),
   resolveRpcUrl: vi.fn(),
-  resolveLabelsBaseUrl: vi.fn(),
 }))
 
 vi.mock('@eulerxyz/euler-v2-sdk', () => ({
@@ -14,19 +13,13 @@ vi.mock('~/server/utils/rpc', () => ({
   resolveRpcUrl: mocks.resolveRpcUrl,
 }))
 
-vi.mock('~/server/utils/labels-base-url', () => ({
-  resolveLabelsBaseUrl: mocks.resolveLabelsBaseUrl,
-}))
-
 describe('getServerSdk', () => {
   beforeEach(() => {
     vi.resetModules()
     mocks.buildEulerSDK.mockReset()
     mocks.resolveRpcUrl.mockReset()
-    mocks.resolveLabelsBaseUrl.mockReset()
     mocks.buildEulerSDK.mockImplementation(async options => ({ options }))
     mocks.resolveRpcUrl.mockReturnValue('https://rpc.example')
-    mocks.resolveLabelsBaseUrl.mockReturnValue('https://labels.example')
     process.env.V3_API_URL = 'https://v3.example'
     process.env.SERVER_VAULT_CACHE_SOURCE = 'fallback'
     // Routing is driven by ONCHAIN_SDK_CHAINS only; DEPRECATED_CHAINS is a
diff --git a/tests/server/static-labels-source.test.ts b/tests/server/static-labels-source.test.ts
new file mode 100644
index 000000000..c8491bc06
--- /dev/null
+++ b/tests/server/static-labels-source.test.ts
@@ -0,0 +1,110 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
+import files from '~/tests/fixtures/static-labels.json'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+
+const fetchMock = vi.hoisted(() => vi.fn())
+vi.mock('~/server/utils/fetchWithTimeout', async original => ({ ...await original<typeof import('~/server/utils/fetchWithTimeout')>(), fetchWithTimeout: fetchMock }))
+vi.mock('~/server/utils/logger', () => ({ logger: { warn: vi.fn() } }))
+
+describe('static authoring source', () => {
+  let directory: string
+  beforeEach(async () => {
+    vi.resetModules()
+    directory = await mkdtemp(join(tmpdir(), 'static-labels-'))
+    vi.stubEnv('GEO_POLICY_CACHE_DIR', directory)
+    vi.stubEnv('STATIC_LABELS_BASE_URL', 'https://fork.test/labels')
+    vi.stubEnv('LABELS_SOURCE', 'static')
+    vi.stubEnv('LABELS_V3_SET', '../ignored-in-static-mode')
+    vi.stubEnv('LABELS_V3_VERSION', 'draft')
+    fetchMock.mockReset().mockImplementation(async (url: string) => {
+      const filename = url.split('/').pop()
+      const key = filename === 'earn-vaults.json' ? 'earnVaults' : filename?.replace('.json', '')
+      return Response.json(url.includes('/all/') ? [{ nameRegex: '^ond[o]', restricted: ['EEA'] }] : files[key as keyof typeof files])
+    })
+  })
+  afterEach(async () => {
+    vi.unstubAllEnvs()
+    await rm(directory, { recursive: true, force: true })
+  })
+  it('feeds authored membership, governance, points, logos, explorability and geo into the same snapshot without V3', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const raw = await getPublicLabelsBundle(1)
+    const data = normalizeLabelsBundle(1, raw)
+    expect(fetchMock).toHaveBeenCalledTimes(6)
+    expect(fetchMock.mock.calls.every(([url]) => url.startsWith('https://fork.test/labels/'))).toBe(true)
+    expect(data.visibility).toBeUndefined()
+    expect(data.geoContext).toBeUndefined()
+    expect(data.verifiedVaultAddresses).toEqual(['0x' + '1'.repeat(40)])
+    expect(data.earnVaults).toEqual(['0x' + '2'.repeat(40)])
+    expect(data.products.fork).toMatchObject({ entity: 'curator', block: ['US'], vaultOverrides: { ['0x' + '1'.repeat(40)]: { restricted: ['CA'], notExplorableBorrow: true } } })
+    expect(data.entities.curator.addresses).toEqual({ ['0x' + '3'.repeat(40)]: 'Owner' })
+    expect(data.entities.curator.logo).toBe('https://fork.test/labels/logo/curator.svg')
+    expect(data.points['0x' + '1'.repeat(40)]?.[0]).toMatchObject({ name: 'Fork points', logo: 'https://fork.test/labels/logo/points.svg' })
+    expect(data.assetBlocks).toEqual({ ['0x' + '4'.repeat(40)]: ['US'] })
+    expect(data.assetPatternRules[0]?.nameRegex?.test('ondo')).toBe(true)
+    expect(data.earnVaultRestrictions).toEqual({ ['0x' + '2'.repeat(40)]: ['GB'] })
+  })
+  it.each([403, 404])('accepts omitted files with HTTP %s while preserving global asset rules', async (status) => {
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => url.endsWith('/1/assets.json') || url.endsWith('/1/earn-vaults.json')
+      ? new Response(null, { status })
+      : defaultFetch(url))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const raw = await getStaticLabelsBundle(1)
+    const data = normalizeLabelsBundle(1, raw)
+    expect(raw.files.assets).toEqual([{ nameRegex: '^ond[o]', restricted: ['EEA'] }])
+    expect(data.verifiedVaultAddresses).toEqual(['0x' + '1'.repeat(40)])
+    expect(data.earnVaults).toEqual([])
+    expect(data.assetPatternRules[0]?.nameRegex?.test('ondo')).toBe(true)
+    expect(data.products.fork.block).toEqual(['US'])
+  })
+  it('preserves chain asset rules when the global file is omitted', async () => {
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => url.endsWith('/all/assets.json')
+      ? new Response(null, { status: 404 })
+      : defaultFetch(url))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const raw = await getStaticLabelsBundle(1)
+    expect(raw.files.assets).toEqual(files.assets)
+    expect(normalizeLabelsBundle(1, raw).assetBlocks).toEqual({ ['0x' + '4'.repeat(40)]: ['US'] })
+  })
+  it.each([403, 404])('uses the correct empty shapes when all files return HTTP %s', async (status) => {
+    fetchMock.mockImplementation(async () => new Response(null, { status }))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const raw = await getStaticLabelsBundle(1)
+    expect(raw.files).toEqual({ products: {}, entities: {}, points: [], earnVaults: [], assets: [] })
+    expect(normalizeLabelsBundle(1, raw).verifiedVaultAddresses).toEqual([])
+  })
+  it.each([401, 429, 500, 503])('fails cold on HTTP %s instead of treating it as an omitted file', async (status) => {
+    fetchMock.mockImplementation(async () => new Response(null, { status }))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    await expect(getStaticLabelsBundle(1)).rejects.toThrow(`HTTP ${status}`)
+  })
+  it.each(['network', 'json', 'server'])('retains the whole snapshot when one asset file has a %s failure', async (failure) => {
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const first = await getStaticLabelsBundle(1)
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => {
+      if (!url.endsWith('/all/assets.json')) return defaultFetch(url)
+      if (failure === 'network') throw new Error('offline')
+      return failure === 'json' ? new Response('{') : new Response(null, { status: 503 })
+    })
+    expect(await getStaticLabelsBundle(1, true)).toEqual(first)
+  })
+  it('rejects malformed geo fields instead of silently dropping restrictions', async () => {
+    fetchMock.mockImplementation(async (url: string) => Response.json(url.endsWith('/assets.json') ? [{ nameRegex: 42, block: ['US'] }] : url.endsWith('/products.json') || url.endsWith('/entities.json') ? {} : []))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    await expect(getStaticLabelsBundle(1)).rejects.toThrow('Invalid static nameRegex')
+  })
+  it('retains the entire checkpoint after restart when any file fails', async () => {
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const first = await getStaticLabelsBundle(1)
+    vi.resetModules()
+    fetchMock.mockRejectedValue(new Error('offline'))
+    const restarted = await import('~/server/utils/static-labels-source')
+    expect(await restarted.getStaticLabelsBundle(1)).toEqual(first)
+  })
+})
diff --git a/tests/server/vault-metadata-content.test.ts b/tests/server/vault-metadata-content.test.ts
new file mode 100644
index 000000000..a6b08ef41
--- /dev/null
+++ b/tests/server/vault-metadata-content.test.ts
@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getAddress } from 'viem'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+import { buildProductDescriptors } from '~/server/utils/labels-view'
+import { publicLabelsFixture, KPK_VAULT } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+const mocks = vi.hoisted(() => ({ view: vi.fn() }))
+vi.mock('~/server/utils/labels-view', async original => ({
+  ...await original<typeof import('~/server/utils/labels-view')>(),
+  buildLabelsView: mocks.view,
+}))
+vi.mock('~/server/utils/verified-vaults', () => ({ refreshVerifiedAddressSet: async () => new Set() }))
+
+const address = getAddress(KPK_VAULT)
+
+async function metadata(vaultType: 'evk' | 'earn', standalone = false, cleared = true) {
+  const source = structuredClone(publicLabelsFixture)
+  source.products[0].description = 'Product description'
+  source.products[0].portfolioNotice = 'Product notice'
+  source.products[0].deprecationReason = 'Product reason'
+  source.vaults = [{ ...source.vaults[0], vaultType,
+    productId: standalone ? null : source.products[0].id,
+    name: 'Vault-specific name',
+    description: cleared ? null : 'Vault description',
+    portfolioNotice: cleared ? null : 'Vault notice',
+    deprecationReason: cleared ? null : 'Vault reason',
+  }]
+  const labels = normalizeLabelsBundle(1, {
+    source: 'v3-metadata', labelSet: 'public', version: 'test', publicLabels: source,
+  })
+  const vault = { address, shares: { name: 'On-chain name' } }
+  mocks.view.mockResolvedValue({
+    ...buildProductDescriptors(labels.products),
+    snapshot: { evkVaults: vaultType === 'evk' ? [vault] : [], earnVaults: vaultType === 'earn' ? [vault] : [], securitizeVaults: [], escrowVaults: [] },
+    deprecatedEarnSet: new Set(), escrowAddresses: new Set(),
+    earnByAddr: new Map(Object.values(labels.earnVaultEntries).map(entry => [getAddress(entry.address), entry])),
+    tokenLogos: new Map(), entitiesRaw: {},
+  })
+  const { refreshChainVaultMetadata } = await import('~/server/utils/vault-metadata')
+  return (await refreshChainVaultMetadata(1)).get(address)
+}
+
+describe('public metadata resolved V3 content', () => {
+  beforeEach(() => vi.resetModules())
+
+  it.each(['evk', 'earn'] as const)('preserves cleared %s fields and the vault-specific name', async (type) => {
+    expect(await metadata(type)).toMatchObject({
+      name: 'Vault-specific name', description: null, portfolioNotice: null, deprecationReason: null,
+      productId: 'kpk-securitize',
+    })
+  })
+
+  it('keeps nonempty resolved vault text', async () => {
+    expect(await metadata('evk', false, false)).toMatchObject({
+      description: 'Vault description', portfolioNotice: 'Vault notice', deprecationReason: 'Vault reason',
+    })
+  })
+
+  it('does not expose synthetic display groups as V3 product IDs', async () => {
+    expect(await metadata('evk', true)).toMatchObject({ name: 'Vault-specific name', productId: null })
+  })
+})
diff --git a/tests/server/vaults-cache.test.ts b/tests/server/vaults-cache.test.ts
index 311e5465b..518210e6f 100644
--- a/tests/server/vaults-cache.test.ts
+++ b/tests/server/vaults-cache.test.ts
@@ -17,15 +17,14 @@ const mocks = vi.hoisted(() => ({
   fetchVaults: vi.fn(),
   fetchVerifiedVaultAddresses: vi.fn(),
   fetchVaultTypes: vi.fn(),
-  refreshLabelFile: vi.fn(),
+  getPublicEulerLabelsData: vi.fn(),
   warn: vi.fn(),
   error: vi.fn(),
   readContract: vi.fn(),
 }))
 
-vi.mock('~/server/api/internal/labels/[file].get', () => ({
-  LABEL_FILES: [],
-  refreshLabelFile: mocks.refreshLabelFile,
+vi.mock('~/server/utils/public-labels-source', () => ({
+  getPublicEulerLabelsData: mocks.getPublicEulerLabelsData,
 }))
 
 vi.mock('~/server/utils/sdk-server', () => ({
@@ -62,7 +61,7 @@ describe('vaults cache', () => {
     mocks.fetchVaults.mockReset()
     mocks.fetchVerifiedVaultAddresses.mockReset()
     mocks.fetchVaultTypes.mockReset()
-    mocks.refreshLabelFile.mockReset()
+    mocks.getPublicEulerLabelsData.mockReset()
     mocks.warn.mockReset()
     mocks.error.mockReset()
     mocks.readContract.mockReset()
@@ -70,15 +69,9 @@ describe('vaults cache', () => {
 
     mocks.fetchVerifiedVaultAddresses.mockResolvedValue([])
     mocks.fetchVaultTypes.mockResolvedValue({})
-    mocks.refreshLabelFile.mockImplementation(async (_scope, file) => {
-      if (file === 'products.json') {
-        return {
-          test: {
-            vaults: [...VAULTS],
-          },
-        }
-      }
-      return []
+    mocks.getPublicEulerLabelsData.mockResolvedValue({
+      verifiedVaultAddresses: [...VAULTS],
+      earnVaults: [],
     })
   })
 
diff --git a/tests/utils/discovery-calculations.test.ts b/tests/utils/discovery-calculations.test.ts
index c5f039cd2..8eabf65b8 100644
--- a/tests/utils/discovery-calculations.test.ts
+++ b/tests/utils/discovery-calculations.test.ts
@@ -21,13 +21,13 @@ import { VaultRewardInfo } from '@eulerxyz/euler-v2-sdk'
 import { INTEREST_RATE_MODEL_TYPE } from '~/entities/constants'
 
 vi.mock('~/entities/euler/labels', () => ({
-  getEulerLabelEntityLogo: (logo: string) => `/entities/${logo}`,
+  getEulerLabelEntityLogo: (logo: string) => logo,
 }))
 
 vi.mock('~/utils/eulerLabelsUtils', () => ({
   getEntitiesByVault: (vault: { address?: string }) => {
-    if (vault.address === '0xBorrow') return [{ name: 'KPK', logo: 'kpk.svg' }]
-    if (vault.address === '0xSecuritize') return [{ name: 'Securitize', logo: 'securitize.png' }]
+    if (vault.address === '0xBorrow') return [{ name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' }]
+    if (vault.address === '0xSecuritize') return [{ name: 'Securitize', logo: 'https://token-images.euler.finance/labels/securitize' }]
     return []
   },
   isVaultCyclicalNote: () => false,
@@ -464,7 +464,32 @@ describe('getMarketEntities', () => {
 
     expect(getMarketEntities(market)).toEqual({
       name: 'KPK & Securitize',
-      logos: ['/entities/kpk.svg', '/entities/securitize.png'],
+      logos: [
+        'https://token-images.euler.finance/labels/kpk',
+        'https://token-images.euler.finance/labels/securitize',
+      ],
+      labels: ['KPK', 'Securitize'],
+    })
+  })
+
+  it('shows co-brand logos while keeping the product owner as the manager label', () => {
+    const market = {
+      ...makeMarket([makeVault('0xBorrow', [])]),
+      source: 'product',
+      curator: { name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' },
+      brandEntities: [
+        { name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' },
+        { name: 'Securitize', logo: 'https://token-images.euler.finance/labels/securitize' },
+      ],
+    } as MarketGroup
+
+    expect(getMarketEntities(market)).toEqual({
+      name: 'KPK',
+      logos: [
+        'https://token-images.euler.finance/labels/kpk',
+        'https://token-images.euler.finance/labels/securitize',
+      ],
+      labels: ['KPK', 'Securitize'],
     })
   })
 })
diff --git a/tests/utils/label-logo.test.ts b/tests/utils/label-logo.test.ts
new file mode 100644
index 000000000..48fe7e655
--- /dev/null
+++ b/tests/utils/label-logo.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { resolveLabelLogo } from '~/utils/label-logo'
+
+describe('label image hosts', () => {
+  it('allows the dedicated HTTPS host', () => {
+    expect(resolveLabelLogo('https://token-images.euler.finance/labels/kpk')).toBe('https://token-images.euler.finance/labels/kpk')
+  })
+  it.each(['https://token-images.euler.finance.evil.test/x', 'https://evil.test/logo.svg', 'http://token-images.euler.finance/x', 'https://user@token-images.euler.finance/x', '//evil.test/x', 'data:image/svg+xml,x'])('rejects %s', (url) => {
+    expect(resolveLabelLogo(url)).toBe('')
+  })
+  it('allows static filenames and URLs only on the configured source origin', () => {
+    expect(resolveLabelLogo('fork.svg', 'https://fork.test/labels')).toBe('https://fork.test/labels/logo/fork.svg')
+    expect(resolveLabelLogo('https://fork.test/labels/logo/fork.svg', 'https://fork.test/labels')).toBe('https://fork.test/labels/logo/fork.svg')
+    expect(resolveLabelLogo('../secret', 'https://fork.test/labels')).toBe('')
+    expect(resolveLabelLogo('https://elsewhere.test/x', 'https://fork.test/labels')).toBe('')
+  })
+})
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
new file mode 100644
index 000000000..390c9cb9a
--- /dev/null
+++ b/tests/utils/public-labels.test.ts
@@ -0,0 +1,73 @@
+import { getAddress } from 'viem'
+import { describe, expect, it } from 'vitest'
+import { getEulerLabelProductBrandEntityKeys } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { normalizeLabelsBundle, getLabelVaultCandidates, getLabelsVaultLoadKey, normalizePublicLabelsData } from '~/utils/public-labels'
+import { ASSESSMENT_ONLY_EARN, ASSESSMENT_ONLY_EVK, KPK_VAULT, NEUTRAL_ESCROW, VERIFICATION_ONLY_EVK, VERIFICATION_ONLY_EARN, publicLabelsFixture } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+describe('V3-only label normalization', () => {
+  it('preserves managing entities, co-branding, campaigns and current geo assignments', () => {
+    const data = normalizePublicLabelsData(1, publicLabelsFixture)
+    expect(getEulerLabelProductBrandEntityKeys(data.products['kpk-securitize'])).toEqual(['kpk', 'securitize'])
+    expect(data.entities.kpk.logo).toBe('https://token-images.euler.finance/labels/kpk')
+    expect(data.points[getAddress(KPK_VAULT)]?.[0]?.name).toBe('KPK RWA points')
+    expect(data.geoContext?.productByVault[KPK_VAULT.toLowerCase()]).toBe('kpk-securitize')
+    expect(data.geoContext?.policies).toEqual(publicLabelsFixture.geoPolicies)
+  })
+  it('never uses old file membership to trust empty or unclaimed inventory', () => {
+    const data = normalizePublicLabelsData(1, publicLabelsFixture)
+    for (const address of [ASSESSMENT_ONLY_EVK, NEUTRAL_ESCROW, VERIFICATION_ONLY_EVK]) expect(data.verifiedVaultAddresses).not.toContain(getAddress(address))
+    for (const address of [ASSESSMENT_ONLY_EARN, VERIFICATION_ONLY_EARN]) expect(data.earnVaults).not.toContain(getAddress(address))
+  })
+  it.each(['hidden', 'pending_review'] as const)('enforces %s and per-side flags', (status) => {
+    const visibility = Object.fromEntries(Object.keys(publicLabelsFixture.visibility).map(address => [address, { status, explorableLend: false, explorableBorrow: false, decidedBy: 'unclaimed', reason: null }]))
+    const data = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility })
+    expect(data.verifiedVaultAddresses).toEqual([])
+    expect(data.earnVaults).toEqual([])
+    expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]?.notExplorableLend).toBe(true)
+    expect(data.notExplorableEarnVaults.has(VERIFICATION_ONLY_EARN.toLowerCase())).toBe(true)
+  })
+  it('does not infer one side from the other', () => {
+    const visibility = { ...publicLabelsFixture.visibility, [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false, explorableBorrow: true } }
+    const data = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility })
+    expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: true, notExplorableBorrow: false })
+  })
+})
+
+it('maps metadata-only labels for display without granting verification, preserving label listing flags', () => {
+  const data = normalizeLabelsBundle(1, { source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: publicLabelsFixture })
+  expect(data.source).toBe('v3-metadata')
+  expect(data.visibility).toBeUndefined()
+  expect(data.verifiedVaultAddresses).toEqual([])
+  expect(data.earnVaults).toEqual([])
+  expect(getLabelVaultCandidates(data).vaults).toContain(getAddress(KPK_VAULT))
+  expect(data.products['kpk-securitize'].notExplorable).toBe(false)
+  expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: false, notExplorableBorrow: false })
+  expect(data.geoContext?.policies).toEqual(publicLabelsFixture.geoPolicies)
+})
+
+it('detects eligibility changes without reloading for metadata-only text edits', () => {
+  const first = normalizePublicLabelsData(1, publicLabelsFixture)
+  const hidden = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility: {
+    ...publicLabelsFixture.visibility,
+    [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false, explorableBorrow: false },
+  } })
+  expect(getLabelsVaultLoadKey(first)).not.toBe(getLabelsVaultLoadKey(hidden))
+  const renamed = { ...first, products: { ...first.products, 'kpk-securitize': { ...first.products['kpk-securitize'], name: 'New name' } } }
+  expect(getLabelsVaultLoadKey(first)).toBe(getLabelsVaultLoadKey(renamed))
+})
+
+it('honours product and per-side hiding on deprecated metadata-only vaults', () => {
+  const source = structuredClone(publicLabelsFixture)
+  source.vaults[0].deprecated = true
+  source.vaults[0].notExplorableLend = true
+  source.vaults[0].notExplorableBorrow = false
+  const normalize = () => normalizeLabelsBundle(1, { source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: source })
+  const listed = normalize()
+  expect(listed.products['kpk-securitize'].notExplorable).toBe(false)
+  expect(listed.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: true, notExplorableBorrow: false })
+  source.products[0].notExplorable = true
+  const hidden = normalize()
+  expect(hidden.products['kpk-securitize'].notExplorable).toBe(true)
+  expect(getLabelsVaultLoadKey(hidden)).not.toBe(getLabelsVaultLoadKey(listed))
+  expect(hidden.verifiedVaultAddresses).toEqual([])
+})
diff --git a/tests/utils/vault/governor-verification.test.ts b/tests/utils/vault/governor-verification.test.ts
index 9d37435ec..9158099b9 100644
--- a/tests/utils/vault/governor-verification.test.ts
+++ b/tests/utils/vault/governor-verification.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect } from 'vitest'
 import { encodeAbiParameters, getAddress, type Address, zeroAddress } from 'viem'
 import {
   isVaultGovernorVerified,
+  getHostedEntityKeys,
   isEarnVaultOwnerVerified,
   resolveGoverningEntityKeys,
   resolveEarnGoverningEntityKeys,
@@ -239,7 +240,7 @@ describe('isEarnVaultOwnerVerified', () => {
     expect(isEarnVaultOwnerVerified(earn, labels)).toBe(false)
   })
 
-  it('trusts earn vaults without a product entry (earn-vaults.json sole anchor)', () => {
+  it('trusts a published earn vault without a product assignment', () => {
     const earn = makeEarn({ owner: GOV_A })
     const labels = buildLabels({ declaredKeys: {} })
     expect(isEarnVaultOwnerVerified(earn, labels)).toBe(true)
@@ -436,3 +437,17 @@ describe('hasResolvedGovernorAdmin', () => {
     expect(hasResolvedGovernorAdmin({ governorAdmin: GOV_A })).toBe(false)
   })
 })
+
+describe('hosted standalone Earn authority', () => {
+  it('requires the V3 manager and a matching on-chain owner even without a product', () => {
+    const vault = { address: VAULT_ADDR, verified: true, governance: { owner: GOV_A } } as EarnVault
+    const make = (entity?: string): VerificationLabels => ({
+      getDeclaredEntityKeys: address => getHostedEntityKeys({ source: 'v3', managingEntityByVault: entity ? { [VAULT_ADDR.toLowerCase()]: entity } : {} }, address),
+      hasEntityAddress: (key, address) => key === 'manager' && address === GOV_A,
+    })
+    expect(isEarnVaultOwnerVerified(vault, make())).toBe(false)
+    expect(isEarnVaultOwnerVerified(vault, make('co-brand'))).toBe(false)
+    expect(isEarnVaultOwnerVerified(vault, make('manager'))).toBe(true)
+    expect(isEarnVaultOwnerVerified({ ...vault, governance: { ...vault.governance, owner: GOV_B } } as EarnVault, make('manager'))).toBe(false)
+  })
+})
diff --git a/utils/discoveryCalculations.ts b/utils/discoveryCalculations.ts
index 4a45566d1..6551fef9d 100644
--- a/utils/discoveryCalculations.ts
+++ b/utils/discoveryCalculations.ts
@@ -150,7 +150,17 @@ export const getDeprecatedVaultCount = (market: MarketGroup): number => {
 export const getUnknownCollateralCount = (market: MarketGroup): number =>
   market.unknownCollateral.length
 
-export const getMarketEntities = (market: MarketGroup): { name: string, logos: string[] } => {
+export const getMarketEntities = (market: MarketGroup): { name: string, logos: string[], labels: string[] } => {
+  if (market.source === 'product' && market.brandEntities?.length) {
+    return {
+      // Co-brands contribute visual identity only; the visible manager name
+      // and manager-profile ownership remain attached to the product curator.
+      name: market.curator?.name ?? market.brandEntities[0].name,
+      logos: market.brandEntities.map(entity => getEulerLabelEntityLogo(entity.logo)),
+      labels: market.brandEntities.map(entity => entity.name),
+    }
+  }
+
   const seen = new Set<string>()
   const all: EulerLabelEntity[] = []
   for (const v of market.vaults) {
@@ -160,13 +170,17 @@ export const getMarketEntities = (market: MarketGroup): { name: string, logos: s
       all.push(entity)
     }
   }
-  if (all.length === 0) return { name: '', logos: [] }
+  if (all.length === 0) return { name: '', logos: [], labels: [] }
   const name = all.length === 1
     ? all[0].name
     : all.length === 2
       ? `${all[0].name} & ${all[1].name}`
       : `${all[0].name} & others`
-  return { name, logos: all.map(e => getEulerLabelEntityLogo(e.logo)) }
+  return {
+    name,
+    logos: all.map(e => getEulerLabelEntityLogo(e.logo)),
+    labels: all.map(entity => entity.name),
+  }
 }
 
 const hasBorrowableLTV = (vault: EVault): boolean =>
diff --git a/utils/geo-policies.ts b/utils/geo-policies.ts
new file mode 100644
index 000000000..5a64280f1
--- /dev/null
+++ b/utils/geo-policies.ts
@@ -0,0 +1,55 @@
+import type { PublicGeoPolicy } from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export interface HostedGeoContext {
+  chainId: number | null
+  /** Undefined means unavailable; [] is an authored empty collection. */
+  policies: PublicGeoPolicy[] | undefined
+  productByVault: Record<string, string | null>
+}
+
+type Asset = { address?: string, symbol?: string, name?: string }
+const patterns = new Map<string, RegExp>()
+const patternMatches = (pattern: string | null | undefined, input: string | undefined): boolean => {
+  if (!pattern || !input) return false
+  // Preserve the conservative legacy guard without evaluating unbounded token metadata.
+  if (input.length > 128) return true
+  let compiled = patterns.get(pattern)
+  if (!compiled) {
+    compiled = new RegExp(pattern, 'i')
+    if (patterns.size >= 1000) patterns.clear()
+    patterns.set(pattern, compiled)
+  }
+  return compiled.test(input)
+}
+
+export const isAssetGeoPolicy = (policy: PublicGeoPolicy): boolean =>
+  policy.assetAddress !== null || policy.assetSymbols != null || policy.assetNames != null
+  || policy.assetSymbolRegex != null || policy.assetNameRegex != null
+
+/** All matching rules accumulate. Selectors within the asset matcher are alternatives. */
+export const matchesHostedGeo = (
+  context: HostedGeoContext,
+  country: string,
+  type: PublicGeoPolicy['policyType'],
+  asset: Asset | undefined,
+  vaultAddress?: string,
+  scope: 'all' | 'asset' | 'non-asset' = 'all',
+): boolean => (context.policies ?? []).some((policy) => {
+  if (policy.policyType !== type || !policy.countriesResolved.includes(country.toUpperCase())) return false
+  if (policy.chainId !== null && policy.chainId !== context.chainId) return false
+  const vault = vaultAddress?.toLowerCase()
+  if (policy.vaultAddress && policy.vaultAddress.toLowerCase() !== vault) return false
+  if (policy.productId && (!vault || context.productByVault[vault] !== policy.productId)) return false
+  const assetRule = isAssetGeoPolicy(policy)
+  if (scope === 'asset' && !assetRule) return false
+  if (scope === 'non-asset' && assetRule) return false
+  if (!assetRule) return true
+  if (!asset) return false
+  return Boolean(
+    (policy.assetAddress && policy.assetAddress.toLowerCase() === asset.address?.toLowerCase())
+    || policy.assetSymbols?.some(value => value.toLowerCase() === asset.symbol?.toLowerCase())
+    || policy.assetNames?.some(value => value.toLowerCase() === asset.name?.toLowerCase())
+    || patternMatches(policy.assetSymbolRegex, asset.symbol)
+    || patternMatches(policy.assetNameRegex, asset.name),
+  )
+})
diff --git a/utils/label-logo.ts b/utils/label-logo.ts
new file mode 100644
index 000000000..b3f830ef3
--- /dev/null
+++ b/utils/label-logo.ts
@@ -0,0 +1,14 @@
+/** Hosted labels use the dedicated image host. Static sources may serve their own images. */
+export const resolveLabelLogo = (value: string | undefined, staticBaseUrl?: string): string => {
+  if (!value) return ''
+  try {
+    const base = staticBaseUrl ? new URL(`${staticBaseUrl.replace(/\/+$/, '')}/logo/`) : undefined
+    if (!/^https?:\/\//i.test(value) && (!base || !/^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i.test(value))) return ''
+    const url = new URL(value, base)
+    if (url.username || url.password) return ''
+    const hosted = url.protocol === 'https:' && url.hostname === 'token-images.euler.finance' && (!url.port || url.port === '443')
+    const authored = base && url.origin === base.origin && ['http:', 'https:'].includes(url.protocol)
+    return hosted || authored ? url.href : ''
+  }
+  catch { return '' }
+}
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
new file mode 100644
index 000000000..a59f9b19a
--- /dev/null
+++ b/utils/public-labels.ts
@@ -0,0 +1,123 @@
+import { isEulerLabelVaultNotExplorableLend, isEulerLabelVaultNotExplorableBorrow, isEulerLabelEarnVaultNotExplorable } from '@eulerxyz/euler-v2-sdk'
+import {
+  normalizeEulerLabelsFileData,
+  normalizePublicLabelsMetadata,
+  type PublicLabelsMetadataSnapshot,
+  type EulerLabelsFileData,
+  normalizePublicLabelsData as normalizeSdkPublicLabelsData,
+  type PublicEulerLabelsData as SdkPublicEulerLabelsData,
+  type PublicLabelsSource,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+import type { HostedGeoContext } from '~/utils/geo-policies'
+import { resolveLabelLogo } from '~/utils/label-logo'
+
+export {
+  PUBLIC_LABELS_RUNTIME_VERSION,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export type {
+  PublicEntityAddress,
+  PublicEntityLabel,
+  PublicGeoPolicy,
+  PublicLabelsMeta,
+  PublicLabelsQuery,
+  PublicLabelsRequest,
+  PublicLabelsResponse,
+  PublicLabelsSource,
+  PublicProductLabel,
+  PublicVaultCampaign,
+  PublicVaultLabel,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export type PublicEulerLabelsData = Omit<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>
+  & Partial<Pick<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>>
+  & { geoContext?: HostedGeoContext, source?: 'v3' | 'v3-metadata' | 'static', logoBaseUrl?: string, candidateVaultAddresses?: string[], candidateEarnVaultAddresses?: string[] }
+
+export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
+
+export interface V3LabelsBundle {
+  source?: 'v3'
+  labelSet?: string
+  version: string
+  publicLabels: PublicLabelsSource
+  geoFetchedAt?: number
+}
+
+export interface StaticLabelsBundle {
+  source: 'static'
+  version: string
+  files: EulerLabelsFileData
+  logoBaseUrl: string
+  fetchedAt: number
+}
+
+export type V3MetadataLabelsBundle = PublicLabelsMetadataSnapshot & { geoFetchedAt?: number }
+export type HostedLabelsBundle = V3LabelsBundle | V3MetadataLabelsBundle
+export type PublicLabelsBundle = HostedLabelsBundle | StaticLabelsBundle
+
+/** V3 owns hosted membership, published content and per-side visibility. */
+export const normalizePublicLabelsData = (chainId: number, source: PublicLabelsSource): PublicEulerLabelsData => {
+  const data = normalizeSdkPublicLabelsData(chainId, source)
+  for (const product of Object.values(data.products)) {
+    for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
+      const verdict = source.visibility[address.toLowerCase()]
+      const override = product.vaultOverrides?.[address]
+      if (!override) continue
+      override.notExplorableLend = verdict?.explorableLend !== true
+      override.notExplorableBorrow = verdict?.explorableBorrow !== true
+    }
+  }
+  for (const [address, entry] of Object.entries(data.earnVaultEntries)) {
+    entry.notExplorable = source.visibility[address]?.explorableLend !== true
+    if (entry.notExplorable) data.notExplorableEarnVaults.add(address)
+  }
+  return {
+    ...data,
+    source: 'v3',
+    geoContext: {
+      chainId,
+      policies: data.rawGeoPolicies,
+      productByVault: Object.fromEntries(source.vaults.filter(vault => vault.chainId === chainId)
+        .map(vault => [vault.address.toLowerCase(), vault.productId])),
+    },
+  }
+}
+
+export const normalizeLabelsBundle = (chainId: number, bundle: PublicLabelsBundle): PublicEulerLabelsData => {
+  if (bundle.source === 'v3-metadata') {
+    const data = normalizePublicLabelsMetadata(chainId, bundle.publicLabels)
+    return { ...data, source: 'v3-metadata', geoContext: {
+      chainId, policies: data.rawGeoPolicies,
+      productByVault: Object.fromEntries(bundle.publicLabels.vaults
+        .filter(vault => vault.chainId === chainId)
+        .map(vault => [vault.address.toLowerCase(), vault.productId])),
+    } }
+  }
+  if (bundle.source !== 'static') return normalizePublicLabelsData(chainId, bundle.publicLabels)
+  const data = normalizeEulerLabelsFileData(structuredClone(bundle.files))
+  // Static authoring uses filenames; resolve them only against the operator's source.
+  const logo = (value: string | undefined) => resolveLabelLogo(value, bundle.logoBaseUrl)
+  for (const entity of Object.values(data.entities)) entity.logo = logo(entity.logo)
+  for (const product of Object.values(data.products)) if (product.logo) product.logo = logo(product.logo)
+  for (const points of Object.values(data.points)) for (const point of points) point.logo = logo(point.logo)
+  return { ...data, source: 'static', logoBaseUrl: bundle.logoBaseUrl, rawGeoPolicies: [] }
+}
+
+/** Fetch candidates are not a governance verdict. */
+export const getLabelVaultCandidates = (labels: Pick<PublicEulerLabelsData,
+  'source' | 'candidateVaultAddresses' | 'candidateEarnVaultAddresses' | 'verifiedVaultAddresses' | 'earnVaults'>) => ({
+  vaults: labels.source === 'v3-metadata' ? labels.candidateVaultAddresses ?? [] : labels.verifiedVaultAddresses,
+  earn: labels.source === 'v3-metadata' ? labels.candidateEarnVaultAddresses ?? [] : labels.earnVaults,
+})
+
+/** Reload vault data only when labels change membership or discovery eligibility. */
+export const getLabelsVaultLoadKey = (labels: PublicEulerLabelsData): string => {
+  const candidates = getLabelVaultCandidates(labels)
+  return JSON.stringify([
+    labels.source,
+    (candidates.vaults ?? []).map(address => [address.toLowerCase(),
+      isEulerLabelVaultNotExplorableLend(labels, address),
+      isEulerLabelVaultNotExplorableBorrow(labels, address)]).sort(),
+    (candidates.earn ?? []).map(address => [address.toLowerCase(), isEulerLabelEarnVaultNotExplorable(labels, address)]).sort(),
+  ])
+}
diff --git a/utils/vault/governor-verification.ts b/utils/vault/governor-verification.ts
index ecf1ecc4e..4a3c5ec40 100644
--- a/utils/vault/governor-verification.ts
+++ b/utils/vault/governor-verification.ts
@@ -1,3 +1,4 @@
+import type { PublicEulerLabelsData } from '~/utils/public-labels'
 import { getAddress, zeroAddress, type Address } from 'viem'
 import { isEVault, type EulerEarn, type EVault, type OracleDetailedInfo } from '@eulerxyz/euler-v2-sdk'
 import { getEulerRouterGovernor } from '~/entities/oracle'
@@ -57,6 +58,13 @@ export interface VerificationLabels {
   hasEntityAddress: (entityKey: string, address: Address) => boolean
 }
 
+/** Hosted labels must explicitly declare a manager; absence cannot use static Earn trust. */
+export const getHostedEntityKeys = (labels: Pick<PublicEulerLabelsData, 'source' | 'managingEntityByVault'>, address: string): string[] | undefined => {
+  if (labels.source !== 'v3' && labels.source !== 'v3-metadata') return undefined
+  const entity = labels.managingEntityByVault?.[address.toLowerCase()]
+  return entity ? [entity] : []
+}
+
 const findDeclaredEntityFor = (
   address: Address,
   declaredKeys: string[],
@@ -118,9 +126,9 @@ export const isEarnVaultOwnerVerified = (
   if (!earnVault.verified) return false
 
   const declaredKeys = labels.getDeclaredEntityKeys(earnVault.address)
-  // Earn vaults outside any product are trusted on the strength of being in
-  // earn-vaults.json alone — earn curation lives in that file, not in
-  // products.json. Differs from EVK behaviour.
+  // A published Earn vault can be trusted without a product assignment.
+  // This differs from EVK governance verification, which requires a product
+  // with a declared managing entity.
   if (declaredKeys === undefined) return true
   // But if the earn vault IS in a product whose entity is empty/undefined,
   // the product has no on-chain authority to claim it — treat as unverified.