From d1702c5e534c01e440f11436988d17d35af5222f Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Wed, 5 Aug 2026 09:31:05 +0100
Subject: [PATCH 01/13] feat: integrate public labels

Load versioned Public Labels V3 content while preserving compatibility visibility rules. Keep co-brand rendering and campaign metadata independent of manager-profile functionality.
---
 components/entities/vault/VaultBorrowItem.vue |   5 +
 components/entities/vault/VaultPoints.vue     |  15 +-
 .../entities/vault/VaultPointsModal.vue       |   9 +-
 .../vault/discovery/DiscoveryMarketCard.vue   |   2 +-
 composables/useEulerLabels.ts                 |  44 +-
 composables/useMarketGroups.ts                |   6 +-
 docs/architecture.md                          |   2 +-
 docs/vault-labels-and-verification.md         | 231 +-------
 entities/euler/labels.ts                      |  21 +
 entities/lend-discovery.ts                    |   2 +
 server/utils/v3-proxy.ts                      |  10 +
 tests/composables/useEulerLabels.test.ts      |  21 +
 .../public-labels-v20260804151305236.ts       | 185 +++++++
 tests/server/v3-proxy.test.ts                 |  15 +
 tests/utils/discovery-calculations.test.ts    |  19 +
 tests/utils/public-labels.test.ts             | 201 +++++++
 utils/discoveryCalculations.ts                |  20 +-
 utils/public-labels.ts                        | 521 ++++++++++++++++++
 18 files changed, 1101 insertions(+), 228 deletions(-)
 create mode 100644 tests/fixtures/public-labels-v20260804151305236.ts
 create mode 100644 tests/utils/public-labels.test.ts
 create mode 100644 utils/public-labels.ts

diff --git a/components/entities/vault/VaultBorrowItem.vue b/components/entities/vault/VaultBorrowItem.vue
index 3443020d5..11f337cde 100644
--- a/components/entities/vault/VaultBorrowItem.vue
+++ b/components/entities/vault/VaultBorrowItem.vue
@@ -367,6 +367,11 @@ const linkPath = computed(() => ({
             data-field="borrow-apy"
             :data-value="borrowApyWithRewards"
           >
+            <VaultPoints
+              class="mr-4"
+              :vault="pair.borrow"
+              campaign-type="borrow"
+            />
             <UiModalPreviewTrigger
               v-if="hasBorrowApyRewards"
               :component="VaultApyModal"
diff --git a/components/entities/vault/VaultPoints.vue b/components/entities/vault/VaultPoints.vue
index 0c7725849..34ad28689 100644
--- a/components/entities/vault/VaultPoints.vue
+++ b/components/entities/vault/VaultPoints.vue
@@ -1,12 +1,18 @@
 <script setup lang="ts">
 import type { EulerEarn, EVault, SecuritizeCollateralVault } from '@eulerxyz/euler-v2-sdk'
-import { getEulerLabelEntityLogo } from '~/entities/euler/labels'
+import { getEulerLabelEntityLogo, getEulerLabelPointLogo } from '~/entities/euler/labels'
 import { useModal } from '~/components/ui/composables/useModal'
 import { VaultPointsModal } from '#components'
 
-const { vault } = defineProps<{ vault: EVault | EulerEarn | SecuritizeCollateralVault }>()
+const { vault, campaignType = 'deposit' } = defineProps<{
+  vault: EVault | EulerEarn | SecuritizeCollateralVault
+  campaignType?: 'deposit' | 'borrow'
+}>()
 
-const points = useEulerPointsOfVault(vault.address)
+const allPoints = useEulerPointsOfVault(vault.address)
+const points = computed(() => allPoints.filter(point =>
+  point.type ? point.type === campaignType : campaignType === 'deposit',
+))
 const modal = useModal()
 
 const onLogoError = (event: Event, logoFileName: string) => {
@@ -27,6 +33,7 @@ const onPointClick = (
     props: {
       pointName: point.name,
       pointLogo: point.logo,
+      campaignType,
     },
   })
 }
@@ -42,7 +49,7 @@ const onPointClick = (
       :key="point.name"
       class="w-16 h-16 rounded-full cursor-pointer select-none"
       :class="{ '-ml-6': index > 0 }"
-      :src="`/entities/${point.logo}`"
+      :src="getEulerLabelPointLogo(point.logo)"
       alt="Points entity logo"
       referrerpolicy="no-referrer"
       draggable="false"
diff --git a/components/entities/vault/VaultPointsModal.vue b/components/entities/vault/VaultPointsModal.vue
index 6c2d25cd1..48a1080f0 100644
--- a/components/entities/vault/VaultPointsModal.vue
+++ b/components/entities/vault/VaultPointsModal.vue
@@ -1,10 +1,11 @@
 <script setup lang="ts">
-import { getEulerLabelEntityLogo } from '~/entities/euler/labels'
+import { getEulerLabelEntityLogo, getEulerLabelPointLogo } from '~/entities/euler/labels'
 
 defineEmits(['close'])
-const { pointName, pointLogo } = defineProps<{
+const { pointName, pointLogo, campaignType = 'deposit' } = defineProps<{
   pointName: string
   pointLogo: string
+  campaignType?: 'deposit' | 'borrow'
 }>()
 
 const onLogoError = (event: Event) => {
@@ -67,9 +68,9 @@ const formattedPointName = computed(() => convertMarkdownLinks(pointName))
     @close="$emit('close')"
   >
     <div class="flex items-center gap-12">
-      <span class="text-p2">Supply earns</span>
+      <span class="text-p2">{{ campaignType === 'borrow' ? 'Borrowing earns' : 'Supply earns' }}</span>
       <img
-        :src="`/entities/${pointLogo}`"
+        :src="getEulerLabelPointLogo(pointLogo)"
         alt="Point logo"
         referrerpolicy="no-referrer"
         class="w-20 h-20 rounded-full"
diff --git a/components/entities/vault/discovery/DiscoveryMarketCard.vue b/components/entities/vault/discovery/DiscoveryMarketCard.vue
index 4ee23dbd5..68e3f7bae 100644
--- a/components/entities/vault/discovery/DiscoveryMarketCard.vue
+++ b/components/entities/vault/discovery/DiscoveryMarketCard.vue
@@ -69,7 +69,7 @@ const getMaxRoeModalData = (result: BestMaxRoeResult) => ({
           class="icon--40 shrink-0"
           :class="{ 'opacity-20': isGovernanceLimited }"
           :src="marketEntities.logos"
-          :label="marketEntities.name"
+          :label="marketEntities.labels"
         />
         <div
           class="flex-grow min-w-0"
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index 743c5699a..4c02797d2 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -20,6 +20,12 @@ import { useEulerOracleAdapters } from '~/composables/useEulerOracleAdapters'
 import { erc4626AssetAbi } from '~/abis/erc4626'
 import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
+import {
+  fetchPublicLabelsData,
+  type MigratedEulerLabelsData,
+  type PublicLabelsQuery,
+  type PublicLabelsResponse,
+} from '~/utils/public-labels'
 
 const LABEL_QUERY_NAMES = [
   'queryEulerLabelsEntities',
@@ -29,7 +35,7 @@ const LABEL_QUERY_NAMES = [
   'queryEulerLabelsAssets',
 ] as const
 
-const createEmptyEulerLabelsData = (): EulerLabelsData => ({
+const createEmptyEulerLabelsData = (): MigratedEulerLabelsData => ({
   products: {},
   entities: {},
   points: {},
@@ -45,19 +51,20 @@ const createEmptyEulerLabelsData = (): EulerLabelsData => ({
   assetBlocks: {},
   assetRestrictions: {},
   assetPatternRules: [],
-} as unknown as EulerLabelsData)
+  rawGeoPolicies: [],
+} as unknown as MigratedEulerLabelsData)
 
-const labelsData = shallowRef<EulerLabelsData>(createEmptyEulerLabelsData())
+const labelsData = shallowRef<MigratedEulerLabelsData>(createEmptyEulerLabelsData())
 const labelsChainId = ref<number | null>(null)
 const labelsVersion = ref(0)
 const isLoading = ref(false)
 const isReady = ref(false)
-const pendingLabelsFetches = new Map<number, Promise<EulerLabelsData>>()
+const pendingLabelsFetches = new Map<number, Promise<MigratedEulerLabelsData>>()
 let labelsLoadGeneration = 0
 let wrapPairProbeGeneration = 0
 const wrapPairs = shallowReactive<Record<string, string>>({})
 
-const setLabelsData = (data: EulerLabelsData, chainId: number | null) => {
+const setLabelsData = (data: MigratedEulerLabelsData, chainId: number | null) => {
   labelsData.value = data
   labelsChainId.value = chainId
   labelsVersion.value += 1
@@ -65,6 +72,8 @@ const setLabelsData = (data: EulerLabelsData, chainId: number | null) => {
 
 export const getCurrentEulerLabelsData = (): EulerLabelsData => labelsData.value
 
+export const getCurrentMigratedEulerLabelsData = (): MigratedEulerLabelsData => labelsData.value
+
 export const getEulerLabelsVersion = (): number => labelsVersion.value
 
 export const getEulerLabelWrapPairs = (): Record<string, string> => wrapPairs
@@ -79,7 +88,8 @@ export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {})
     ...data,
     notExplorableEarnVaults: data.notExplorableEarnVaults ?? new Set(),
     assetPatternRules: data.assetPatternRules ?? [],
-  } as unknown as EulerLabelsData, null)
+    rawGeoPolicies: (data as Partial<MigratedEulerLabelsData>).rawGeoPolicies ?? [],
+  } as unknown as MigratedEulerLabelsData, null)
   isReady.value = true
   isLoading.value = false
 }
@@ -100,6 +110,7 @@ const entities = toReactive(computed(() => labelsData.value.entities as Record<s
 const points = toReactive(computed(() => labelsData.value.points as Record<string, EulerLabelPointReward[]>))
 const verifiedVaultAddresses = computed(() => labelsData.value.verifiedVaultAddresses)
 const earnVaults = computed(() => labelsData.value.earnVaults)
+const geoPolicies = computed(() => labelsData.value.rawGeoPolicies)
 
 const isCurrentLabelsLoad = (chainId: number, generation: number) => {
   const { getCurrentChainConfig } = useEulerAddresses()
@@ -110,13 +121,23 @@ const getLabelsFetch = (chainId: number, forceRefresh: boolean) => {
   const pendingFetch = pendingLabelsFetches.get(chainId)
   if (pendingFetch && !forceRefresh) return pendingFetch
 
-  const fetchPromise = (async () => {
-    if (forceRefresh) {
-      await invalidateSdkQueries([...LABEL_QUERY_NAMES])
-    }
+  const request = async <T>(path: string, query: PublicLabelsQuery): Promise<PublicLabelsResponse<T>> =>
+    $fetch<PublicLabelsResponse<T>>(`/api/internal/v3${path}`, { query })
 
+  const fetchPromise = (async () => {
+    if (forceRefresh) await invalidateSdkQueries([...LABEL_QUERY_NAMES])
     const sdk = await getEulerSdk()
-    return sdk.eulerLabelsService.fetchEulerLabelsData(chainId)
+    const legacy = sdk.eulerLabelsService.fetchEulerLabelsData(chainId)
+    try {
+      return await fetchPublicLabelsData(request, chainId, undefined, legacy)
+    }
+    catch (error) {
+      logWarn('labels/public-v3', error)
+      return {
+        ...await legacy,
+        rawGeoPolicies: [],
+      } as MigratedEulerLabelsData
+    }
   })()
 
   pendingLabelsFetches.set(chainId, fetchPromise)
@@ -256,6 +277,7 @@ export const useEulerLabels = () => {
     points,
     oracleAdapters: oracleAdapters.oracleAdapters,
     earnVaults,
+    geoPolicies,
     loadLabels,
     loadOracleAdapter: oracleAdapters.loadOracleAdapter,
     loadOracleAdapters: oracleAdapters.loadOracleAdapters,
diff --git a/composables/useMarketGroups.ts b/composables/useMarketGroups.ts
index 2266408ff..12eaa461c 100644
--- a/composables/useMarketGroups.ts
+++ b/composables/useMarketGroups.ts
@@ -9,6 +9,7 @@ import { isVaultNotExplorable, isVaultRecentlyAdded, isVaultDeprecated, getProdu
 import { isLiveCollateralEdge } from '~/utils/vault/ltv'
 import { isVaultBorrowable } from '~/utils/vault/classification'
 import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
+import { getEulerLabelProductBrandEntities } from '~/utils/public-labels'
 
 // -- Helpers --
 
@@ -68,6 +69,7 @@ const buildProductGroups = (
   const groups: MarketGroup[] = []
 
   for (const [productKey, product] of Object.entries(products)) {
+    if (product.isStandalone) continue
     const memberVaults: AnyVault[] = []
     const allProductAddresses = [...product.vaults, ...(product.deprecatedVaults || [])]
     for (const vaultAddr of allProductAddresses) {
@@ -91,6 +93,7 @@ const buildProductGroups = (
       source: 'product',
       curator,
       curatorKey,
+      brandEntities: getEulerLabelProductBrandEntities(product, entities),
       vaults: memberVaults,
       externalCollateral: [],
       unknownCollateral: [],
@@ -498,7 +501,7 @@ export const useMarketGroups = () => {
   /** Fetch a market group on demand for non-explorable products accessed via direct URL */
   const fetchMarketGroupOnDemand = async (productKey: string): Promise<MarketGroup | null> => {
     const product = products[productKey]
-    if (!product) return null
+    if (!product || product.isStandalone) return null
 
     const allAddresses = [...product.vaults, ...(product.deprecatedVaults || [])]
     if (allAddresses.length === 0) return null
@@ -536,6 +539,7 @@ export const useMarketGroups = () => {
       source: 'product',
       curator,
       curatorKey,
+      brandEntities: getEulerLabelProductBrandEntities(product, entities),
       vaults: memberVaults,
       externalCollateral: [],
       unknownCollateral: [],
diff --git a/docs/architecture.md b/docs/architecture.md
index 298424c8e..bbc48c057 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -246,7 +246,7 @@ The Explore page (`pages/explore/index.vue`) provides a market discovery interfa
 
 The `useMarketGroups` composable (`composables/useMarketGroups.ts`) implements a hybrid grouping algorithm:
 
-1. **Product-label groups** — Vaults are first assigned to groups using `products` metadata from euler-labels. Each product defines a curator entity, name, and list of vault addresses.
+1. **Product-label groups** — Vaults are first assigned to groups using versioned Public Labels product metadata from V3. Each product defines its managing entity, optional display-only co-brands, name, and assigned vaults. Manager ownership and governance verification use only the managing entity.
 2. **Collateral graph augmentation** — For each group, external collateral vaults (referenced by member vaults but not in the group) are resolved and attached.
 3. **Orphan clustering** — Vaults not assigned to any product are clustered using a BFS connected-component algorithm over their collateral relationships. This produces "Ungrouped" markets.
 4. **Async TVL resolution** — Group metrics (TVL, available liquidity, borrowed) are resolved asynchronously using USD pricing.
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index a804cf7b7..9b01808d6 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -4,223 +4,47 @@ This document explains how euler-lite discovers, categorizes, verifies, and disp
 
 ## Overview
 
-Not all vaults on-chain are equal. Some are curated by the Euler UI listing process, while others may be unknown or even malicious. The labels system provides a trust layer that maps on-chain vault addresses to off-chain metadata (names, logos, descriptions, deprecation status) and determines whether a vault is **verified** or **unknown**.
+Not all vaults on-chain are equal. Public Labels maps chain-scoped vault addresses to published products, managing entities, display-only co-brands, campaigns, descriptions, tags, and deprecation metadata. Lite combines that published content with on-chain governor checks and its effective visibility data when deciding how a vault is presented.
 
 ## Label Data Sources
 
-Labels originate from the [euler-labels](https://github.com/euler-xyz/euler-labels) GitHub repository by default. The client never fetches label JSON files directly from GitHub/CDN — all label data is served through **server-side proxy endpoints** that add in-memory caching and stale-fallback. Entity logos are still resolved directly from the labels base URL via `<img>` tags (benefiting from browser HTTP caching). Each supported chain has a directory containing JSON files:
+`useEulerLabels` reads the immutable Public Labels dataset from V3 through the same-origin `/api/internal/v3` proxy. Normal application traffic uses `version=latest`; deterministic tests use the published version pinned in `utils/public-labels.ts`. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
 
-| File | Server endpoint | Empty shape |
-|------|-----------------|-------------|
-| `products.json` | `GET /api/internal/labels/products.json?chainId=X` | `{}` |
-| `entities.json` | `GET /api/internal/labels/entities.json?chainId=X` | `{}` |
-| `points.json` | `GET /api/internal/labels/points.json?chainId=X` | `[]` |
-| `earn-vaults.json` | `GET /api/internal/labels/earn-vaults.json?chainId=X` | `[]` |
+| Public data | V3 path |
+|---|---|
+| Vault inventory and labels | `GET /curation/vaults?version=...&chainId=...` |
+| Products | `GET /products?version=...&chainId=...` |
+| Entities | `GET /entities?version=...` |
+| Entity governance addresses | `GET /entities/{entityId}/addresses?chainId=...` |
+| Geo policy records | `GET /geo-policies?version=...` |
 
-All label files are optional — any chain may legitimately ship without a given file. When upstream reports the file absent (HTTP 404 or 403), the proxy returns the type-appropriate empty payload (`{}` for object-shaped files, `[]` for array-shaped files) with HTTP 200 and caches it for 5 minutes. Transient upstream failures (5xx, timeouts) serve stale cached data when available; they do not persist an empty shape into the cache. Non-404 upstream statuses are logged once per refresh so genuine outages stay visible.
+The vault inventory is a union of label and assessment records. Lite includes a row in label-derived listing or verification state when it has a product/entity assignment or published label content such as display metadata, deprecation, tags, or campaigns. Plain-address labels and assessment-only rows share the same empty content shape, so an empty row is retained only when the SDK compatibility snapshot classifies the same inventory address as a verified or Earn vault. Other assessment-only rows are ignored.
 
-Oracle adapter metadata is fetched from a separate repository ([oracle-checks](https://github.com/euler-xyz/oracle-checks)) by default, loaded lazily per adapter via `GET /api/internal/oracle-adapter?chainId=X&address=0x...`.
-
-**Custom sources**: The server resolves upstream URLs from environment variables. `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` overrides the GitHub URL for labels (when set, `NUXT_PUBLIC_CONFIG_LABELS_REPO` and `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH` are ignored). `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL` overrides the GitHub URL for oracle checks. The expected URL pattern is `{baseUrl}/{chainId}/{file}` for labels and `{baseUrl}/{chainId}/adapters/{address}.json` for oracle adapters.
-
-**Caching**: The server caches each label response for 5 minutes with in-flight request deduplication, so concurrent cache-miss callers collapse onto a single upstream fetch per `chainId:file`. On upstream failure, stale cached data is served. The client also maintains a 5-minute TTL to avoid unnecessary requests on chain switches. `server/plugins/warm-cache.ts` pre-populates the server caches at Nitro startup (fire-and-forget) and re-warms every 5 minutes.
-
-**Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
-
----
-
-## JSON File Schemas
-
-### products.json
-
-Structure: `Record<string, Product>` — keys are product identifiers (e.g. `"euler-flagship"`).
+Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-```jsonc
-{
-  "euler-flagship": {
-    // Required fields
-    "name": "Euler Flagship",                    // Display name shown in UI
-    "description": "The flagship Euler market.",  // Shown on vault overview pages
-    "portfolioNotice": "Strategy rebalancing in progress", // Operational notice on portfolio cards (optional)
-    "entity": ["euler-foundation"],              // Entity key(s) from entities.json (string or string[])
-    "url": "https://euler.finance",              // External link (shown on vault overview)
-    "vaults": [                                  // Active vault addresses
-      "0x1234...abcd",
-      "0x5678...ef01"
-    ],
-
-    // Optional fields
-    "deprecatedVaults": ["0xold1..."],           // Phased-out vault addresses (still verified, shown as deprecated)
-    "deprecationReason": "Migrated to v2",       // Why deprecated — shown in warning banner. Supports URLs.
-    "tags": ["keyring", "governance limited"],   // Product classification tags
-    "notExplorable": true,                       // If true, hides ALL product vaults from lend/borrow/explore pages
-    "block": ["US", "EU"],                       // Country codes/groups to hard-block (see geo-blocking.md)
-    "vaultOverrides": {                          // Per-vault customizations (see below)
-      "0x5678...ef01": {
-        "description": "Custom description for this vault",
-        "portfolioNotice": "Vault-specific operational notice",
-        "deprecationReason": "This specific vault is being phased out",
-        "block": ["US", "EU", "CH"],
-        "restricted": ["JP"],
-        "notExplorableLend": true,
-        "notExplorableBorrow": true,
-        "tags": ["recently added"]
-      }
-    }
-  }
-}
-```
-
-#### Product Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Display name in UI (discovery tables, vault overview, search) |
-| `description` | `string` | Yes | Product description shown on vault overview pages. Supports auto-linked URLs. |
-| `portfolioNotice` | `string` | No | Operational notice shown on portfolio position cards. Supports auto-linked URLs and **bold** formatting. |
-| `entity` | `string \| string[]` | Yes | Key(s) referencing entries in `entities.json`. Used for entity logo display, governor verification, and risk manager identification. |
-| `url` | `string` | Yes | External URL linked from entity logos on vault overview pages |
-| `vaults` | `string[]` | Yes | Active vault addresses (checksummed). These become "verified" vaults in the app. |
-| `deprecatedVaults` | `string[]` | No | Phased-out vault addresses. Still verified and viewable in portfolio, but hidden from discovery tables and shown with a deprecation warning. |
-| `deprecationReason` | `string` | No | Explanation for deprecation. Shown in a warning banner on vault overview. URLs are auto-linked. Also accepts legacy key `deprecateReason`. |
-| `tags` | `string[]` | No | Product classification tags. `keyring` marks all product vaults as requiring Keyring identity verification; `access control` marks vaults gated by an allowlist hook; `governance limited` shows "Limited risk management" and fades the risk manager entity display; `suppress high utilisation warning` hides the high-utilisation warning while leaving critical utilisation warnings visible; `cyclical note` shows cyclical-note badges, target-utilisation copy, and the cyclical IRM overview. |
-| `notExplorable` | `boolean` | No | If `true`, hides **all** vaults in this product from lend, borrow, and explore discovery pages. Takes precedence over per-vault `notExplorableLend`/`notExplorableBorrow`. Vaults remain accessible via direct URL. |
-| `block` | `string[]` | No | Country codes or group aliases (`EU`, `EEA`, `EFTA`) for hard geo-blocking. See [geo-blocking.md](./geo-blocking.md). |
-| `vaultOverrides` | `Record<string, VaultOverride>` | No | Per-vault customizations keyed by checksummed address. See next section. |
-
-Classification markers use `tags`. Product `isGovernanceLimited`, product `recentlyAddedVaults`, and earn-vault `recentlyAdded` are not supported by the current labels contract.
-
-#### Vault Override Fields
-
-Per-vault overrides allow customizing behavior for individual vaults within a product:
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `description` | `string` | Overrides the product `description` for this specific vault on the overview page |
-| `portfolioNotice` | `string` | Overrides the product `portfolioNotice` for this specific vault on portfolio cards |
-| `deprecationReason` | `string` | Overrides the product `deprecationReason` for this specific vault |
-| `block` | `string[]` | **Replaces** (not merges with) the product-level `block` list for this vault |
-| `restricted` | `string[]` | Soft geo-restriction for this vault only. No product-level fallback. See [geo-blocking.md](./geo-blocking.md). |
-| `notExplorableLend` | `boolean` | If `true`, hides this vault from the **lend** discovery page. Product-level `notExplorable` takes precedence. |
-| `notExplorableBorrow` | `boolean` | If `true`, hides this vault from the **borrow** discovery page — both as a borrow vault and as collateral. Product-level `notExplorable` takes precedence. |
-| `tags` | `string[]` | Vault classification tags. `keyring`, `access control`, `recently added`, `suppress high utilisation warning`, and `cyclical note` apply to this specific vault. See [keyring-hooks.md](./keyring-hooks.md). |
-
-**Precedence rules**:
-- `block`: vault override replaces product-level (not additive)
-- `restricted`: vault-level only (no product-level equivalent)
-- `notExplorable` (product) > `notExplorableLend` / `notExplorableBorrow` (vault override)
-- `description` / `portfolioNotice` / `deprecationReason`: vault override replaces product-level
+The current V3 assessment and geo-policy records are not final eligibility decisions. Lite does not use raw `/evk/vaults/{chainId}/{address}/assessment` or `/earn/vaults/{chainId}/{address}/assessment` responses to hide or verify vaults, and it does not resolve global/product/vault/asset geo precedence from raw policy rows. Until V3 publishes an effective derived contract, Lite preserves the effective `block`, `restricted`, and discovery-visibility values supplied by the SDK labels service. Raw geo policies are retained as informational data only.
 
----
-
-### entities.json
-
-Structure: `Record<string, Entity>` — keys are entity identifiers (e.g. `"euler-foundation"`).
-
-```jsonc
-{
-  "euler-foundation": {
-    "name": "Euler Foundation",                    // Organization name
-    "logo": "euler.svg",                           // Logo filename (served from euler-labels repo)
-    "description": "The Euler Foundation...",       // Organization description (not currently displayed)
-    "url": "https://euler.finance",                // Organization website (linked from vault overview)
-    "addresses": {                                 // Map of governance addresses to labels
-      "0xGovAddr...": "Governor",
-      "0xMultisig...": "Multisig"
-    },
-    "social": {                                    // Social media links (stored but not currently displayed)
-      "twitter": "https://twitter.com/eulerfinance",
-      "youtube": "",
-      "discord": "https://discord.gg/euler",
-      "telegram": "",
-      "github": "https://github.com/euler-xyz"
-    }
-  }
-}
-```
-
-#### Entity Fields Reference
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Organization name. Shown in Risk Manager section on vault overview and as filter labels on discovery pages. |
-| `logo` | `string` | Yes | Logo filename. Resolved to a URL from the euler-labels repo. Displayed as avatar on vault overview and discovery filters. |
-| `description` | `string` | Yes | Organization description. *Currently stored but not displayed in the UI.* |
-| `url` | `string` | Yes | Organization website. Linked from entity name/logo on vault overview pages. |
-| `addresses` | `Record<string, string>` | Yes | Map of checksummed governance addresses to labels. Used to match `vault.governorAdmin` for entity identification and governor verification. |
-| `social` | `object` | Yes | Social media links (twitter, youtube, discord, telegram, github). *Currently stored but not displayed in the UI.* |
-
-**Entity matching**: A vault's `governorAdmin` address is compared against all `addresses` keys in entities declared by the product's `entity` field. If matched, the entity is displayed as the vault's Risk Manager.
-
----
-
-### points.json
-
-**Optional** — if this file is missing, the app functions normally without points/campaign badges.
-
-Structure: `EulerLabelPoint[]` (array of point campaign objects).
-
-```jsonc
-[
-  {
-    "name": "Turtle Club",                        // Campaign name (supports markdown links)
-    "logo": "turtle-club.svg",                    // Campaign logo filename
-    "collateralVaults": [                         // Vault addresses eligible for this campaign
-      "0xVault1...",
-      "0xVault2..."
-    ]
-  }
-]
-```
+Oracle adapter metadata is fetched from a separate repository ([oracle-checks](https://github.com/euler-xyz/oracle-checks)) by default, loaded lazily per adapter via `GET /api/internal/oracle-adapter?chainId=X&address=0x...`.
 
-#### Points Fields Reference
+**Caching and fallback**: Public Labels requests share the client label load's chain-scoped in-flight deduplication and refresh lifecycle. The V3 proxy is request-scoped; V3 owns upstream caching. If a Public Labels read fails, the current load falls back to the SDK compatibility-label snapshot and logs the V3 failure.
 
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `name` | `string` | Yes | Campaign name. Displayed as badge on vault items. Supports markdown link syntax in modals. |
-| `logo` | `string` | Yes | Campaign logo filename. Served locally from `/entities/` path with CDN fallback. Displayed as rounded avatar badge. |
-| `collateralVaults` | `string[]` | No | Vault addresses eligible for points. Each vault gets a points badge in the UI. |
+**Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
 
 ---
 
-### earn-vaults.json
-
-Structure: `Array<string | EarnVaultEntry>` — each entry is either a plain address string or an object with metadata.
+## Published Content Contract
 
-```jsonc
-[
-  "0xSimpleEarnVault...",                         // Plain address — no special metadata
-  {
-    "address": "0xDetailedEarnVault...",          // Vault address (required)
-    "block": ["US", "EU"],                        // Hard geo-blocking (country codes/groups)
-    "restricted": ["JP"],                         // Soft geo-restriction
-    "tags": ["recently added"],                   // Sort to top in earn discovery table
-    "deprecated": true,                           // Mark as deprecated
-    "deprecationReason": "Migrated to new vault", // Deprecation explanation
-    "description": "Custom description",          // Vault description
-    "portfolioNotice": "Strategy rebalancing in progress"  // Operational notice on portfolio cards
-  }
-]
-```
+Products provide `entityId`, optional `coBrandEntityIds`, display name, description, URL, portfolio notice, and direct product deprecation metadata. Vault inventory rows provide vault type, product/entity assignment, display metadata, tags, campaigns, and direct vault deprecation metadata. Lite does not cascade product deprecation to a vault; cascading behavior belongs to the future effective derived contract.
 
-#### Earn Vault Entry Fields Reference
+Entity rows provide profile text, hosted logos, website/social links, and optional organization details. Lite separately fetches each relevant entity's chain-scoped governance addresses and checksums them before comparison with on-chain governor addresses.
 
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `address` | `string` | Yes | Checksummed vault address |
-| `block` | `string[]` | No | Country codes/groups for hard geo-blocking (same syntax as products.json `block`) |
-| `restricted` | `string[]` | No | Country codes/groups for soft geo-restriction |
-| `tags` | `string[]` | No | Earn-vault classification tags. `recently added` sorts the vault to the top in earn discovery. |
-| `deprecated` | `boolean` | No | If `true`, marks vault as deprecated (hidden from discovery, warning banner shown) |
-| `deprecationReason` | `string` | No | Explanation shown in deprecation warning banner |
-| `description` | `string` | No | Custom description displayed on earn vault items and overview pages |
-| `portfolioNotice` | `string` | No | Operational notice shown on portfolio position cards. Supports auto-linked URLs and **bold** formatting. |
+Vault campaigns have a `name`, hosted `logo`, and `type` of `deposit` or `borrow`. Deposit campaigns render beside supply APY and borrow campaigns render beside borrow APY. Campaign badges are informational and do not change reward APR calculations.
 
-Classification markers use a clean-cut tags schema. Earn-vault `recentlyAdded` is not supported by the current labels contract.
+Classification markers use vault `tags`. Current UI-recognized tags include `keyring`, `access control`, `governance limited`, `recently added`, `suppress high utilisation warning`, and `cyclical note`.
 
 ---
 
-### Oracle Adapter Files (oracle-checks repo)
+## Oracle Adapter Files (oracle-checks repo)
 
 Oracle adapter metadata is loaded lazily from the [oracle-checks](https://github.com/euler-xyz/oracle-checks) repository. Each adapter has its own file at `data/{chainId}/adapters/{checksummedAddress}.json`.
 
@@ -249,7 +73,7 @@ The full "is this vault verified?" verdict (used by the UI to render markets, an
 
 ### Ungoverned vaults
 
-Vaults with `governorAdmin = address(0)` are supported via an **artificial entity** convention: declare an `ungoverned` entity in `entities.json` whose `addresses` map contains the zero address, then list ungoverned vaults under a product that declares `entity: ["ungoverned"]`. The shared governor rule then matches the vault's zero `governorAdmin` against the artificial entity, no special-case code path needed. The UI shows the "Ungoverned" governance type chip independently of entity matching (driven by `governorAdmin === zeroAddress` directly).
+Vaults with `governorAdmin = address(0)` use the `ungoverned` entity whose governance-address set contains the zero address. A product managed by that entity follows the same governor matching rule as any other product. The UI shows the "Ungoverned" governance type chip independently from entity matching, based directly on `governorAdmin === zeroAddress`.
 
 This keeps the bridge endpoint verification aligned with the UI: label/entity matching proves the vault is governed by the declared entity, while the "Ungoverned" presentation signal comes directly from the on-chain `governorAdmin` value.
 
@@ -308,7 +132,7 @@ The client keeps an in-session categorization cache with this shape:
 
 For per-address lookups during direct navigation to a not-yet-cached vault, `fetchVaultCategory(address)` checks the SDK escrow verified array first, then asks `vaultMetaService.fetchVaultType` for the vault type.
 
-**Important: labels remain authoritative for which vaults are _shown_.** SDK categorization says "what category each vault is"; `products.json` / `earn-vaults.json` still say "which vaults to include in lists". The two are composed in `useVaults.loadVaults`: labels select the set, categorization picks the right lens per address.
+**Important: labels remain authoritative for which vaults are _shown_.** SDK categorization says "what category each vault is"; normalized Public Labels products and earn-vault entries say "which vaults to include in lists". The two are composed in `useVaults.loadVaults`: labels select the set, categorization picks the right lens per address.
 
 ## Discovery Page Filtering
 
@@ -356,7 +180,7 @@ The `getOrFetch()` method on the vault registry handles this flow. It first chec
 
 Entities are matched to vaults through two mechanisms:
 
-1. **Labels**: `product.entity` names the owning entity key(s), which are looked up in `entities.json`
+1. **Labels**: `product.entity` contains the Public Labels managing entity ID, which is looked up in the normalized entity map
 2. **Governor admin**: `vault.governorAdmin` is compared against entity `addresses` keys to identify the governing entity
 
 The governor admin must match an address in one of the product's declared entities for the vault to be considered "governor verified". If the product has the `governance limited` tag, the vault shows "Limited risk management" text and the entity display is faded to 20% opacity across all UI surfaces (list items, overview pages, explore cards).
@@ -379,13 +203,14 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 | File | Purpose |
 |------|---------|
 | `entities/euler/labels.ts` | TypeScript type definitions for all label types |
-| `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the current SDK label snapshot |
-| `composables/useEulerLabels.ts` | SDK-backed label loading and reactive composables |
+| `utils/public-labels.ts` | Public V3 pagination, normalization, and effective-visibility composition |
+| `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the normalized label snapshot |
+| `composables/useEulerLabels.ts` | Chain-scoped Public Labels and compatibility-visibility loading |
 | `composables/useVaultRegistry.ts` | Vault registry with type detection and unknown resolution |
 | `composables/useGeoBlock.ts` | Geo-blocking logic using label block/restricted fields |
 
 ## Programmatic verification lookup
 
-External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. The endpoint merges `products.json` (active and deprecated entries), `earn-vaults.json` (active and deprecated entries), and the on-chain `escrowedCollateralPerspective` into a single per-chain verified set, applies the same governor / router-governor / owner verification that the client UI uses (an EVK or Securitize vault must have `governorAdmin` — and a non-zero oracle-router governor, if present — match one of its product's declared entity addresses; an Earn vault listed under a product must have `owner` match), and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults — deprecation does not change the verification rule. Escrow vaults from the on-chain perspective and earn entries with no product entry are trusted unconditionally.
+External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. This server endpoint uses the compatibility-label snapshot plus the on-chain `escrowedCollateralPerspective`, applies governor / router-governor / owner verification, and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults. Escrow vaults from the on-chain perspective and earn entries with no product entry are trusted unconditionally.
 
 Consumers that need display metadata (resolved name, description, governing entity, asset) on top of the verification verdict can call [`GET /api/public/metadata`](./public-api.md#get-apipublicmetadata), which applies the same labels / override / verification rules the client UI uses and returns a uniform shape across EVK, Securitize, and Earn vaults.
diff --git a/entities/euler/labels.ts b/entities/euler/labels.ts
index c52312b4c..f00f58a54 100644
--- a/entities/euler/labels.ts
+++ b/entities/euler/labels.ts
@@ -1,8 +1,15 @@
 export type EulerLabelEntity = {
+  id?: string
   name: string
   logo: string
   description: string
   url: string
+  legalEntityName?: string
+  riskMethodology?: string
+  security?: string
+  termsOfService?: string
+  licenses?: string
+  disclaimers?: string
   addresses: Record<string, string>
   social: {
     twitter: string
@@ -10,6 +17,7 @@ export type EulerLabelEntity = {
     discord: string
     telegram: string
     github: string
+    [key: string]: string | undefined
   }
 }
 export type EulerLabelVaultOverride = {
@@ -25,16 +33,24 @@ export type EulerLabelVaultOverride = {
 }
 
 export type EulerLabelProduct = {
+  id?: string
+  chainId?: number
   name: string
   description: string
   portfolioNotice?: string
   entity: string[] | string
+  /** Display-only brand partners. These do not participate in manager verification. */
+  coBrandEntityIds?: string[]
+  isDeprecated?: boolean
+  /** Local compatibility wrapper for a labeled vault that has no product. */
+  isStandalone?: boolean
   url: string
   vaults: string[]
   deprecatedVaults?: string[]
   deprecationReason?: string
   notExplorable?: boolean
   block?: string[]
+  restricted?: string[]
   vaultOverrides?: Record<string, EulerLabelVaultOverride>
   // Freeform classification tags, e.g. 'keyring', 'access control', or
   // 'governance limited'. Replaces the former bespoke classification booleans.
@@ -84,6 +100,7 @@ export type EulerLabelPoint = {
 export type EulerLabelPointReward = {
   name: string
   logo: string
+  type?: 'deposit' | 'borrow'
 }
 
 export const eulerLabelEntityEmpty = {
@@ -112,8 +129,12 @@ export const eulerLabelProductEmpty = {
 } as EulerLabelProduct
 
 export const getEulerLabelEntityLogo = (fileName: string) => {
+  if (/^https?:\/\//i.test(fileName)) return fileName
   const { EULER_LABELS_ENTITY_LOGO_URL } = useEulerConfig()
   return `${EULER_LABELS_ENTITY_LOGO_URL}/${fileName}`
 }
 
+export const getEulerLabelPointLogo = (fileName: string) =>
+  /^https?:\/\//i.test(fileName) ? fileName : `/entities/${fileName}`
+
 export const getEntityLogoLocalPath = (fileName: string) => `/entities/${fileName}`
diff --git a/entities/lend-discovery.ts b/entities/lend-discovery.ts
index 4fa5d13dc..85b4491d0 100644
--- a/entities/lend-discovery.ts
+++ b/entities/lend-discovery.ts
@@ -14,6 +14,8 @@ export interface MarketGroup {
   curator?: EulerLabelEntity
   /** Curator entity key from labels */
   curatorKey?: string
+  /** Owner first, followed by display-only co-brand entities. */
+  brandEntities?: EulerLabelEntity[]
   /** Core member vaults */
   vaults: AnyVault[]
   /** Vaults referenced as collateral but not in this group */
diff --git a/server/utils/v3-proxy.ts b/server/utils/v3-proxy.ts
index 291753dd5..17e98ad4a 100644
--- a/server/utils/v3-proxy.ts
+++ b/server/utils/v3-proxy.ts
@@ -11,13 +11,18 @@ const FORWARDED_RESPONSE_HEADERS = [
 const GET_ONLY_PATHS = new Set([
   '/v3/apys/intrinsic',
   '/v3/apys/rewards',
+  '/v3/curation/vaults',
   '/v3/earn/vaults',
+  '/v3/entities',
   '/v3/evk/vaults',
   '/v3/evk/vaults/bad-debt',
   '/v3/evk/vaults/open-interest',
   '/v3/evk/vaults/open-interest/by-collateral',
+  '/v3/geo-policies',
+  '/v3/label-sets/public/versions',
   '/v3/liquidations',
   '/v3/prices',
+  '/v3/products',
   '/v3/rewards/breakdown',
   '/v3/tokens',
 ])
@@ -26,9 +31,14 @@ const GET_ONLY_PATH_PATTERNS = [
   /^\/v3\/accounts\/[^/]+\/positions$/,
   /^\/v3\/activity\/accounts\/0x[a-fA-F0-9]{40}\/events$/,
   /^\/v3\/activity\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/events$/,
+  /^\/v3\/curation\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/labels$/,
+  /^\/v3\/entities\/[A-Za-z0-9_-]{1,100}$/,
+  /^\/v3\/entities\/[A-Za-z0-9_-]{1,100}\/addresses$/,
+  /^\/v3\/(?:earn|evk)\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/assessment$/,
   /^\/v3\/earn\/vaults\/[^/]+\/[^/]+$/,
   /^\/v3\/earn\/vaults\/[^/]+\/[^/]+\/totals$/,
   /^\/v3\/evk\/vaults\/[^/]+\/[^/]+\/totals$/,
+  /^\/v3\/products\/[1-9][0-9]{0,15}\/[A-Za-z0-9_-]{1,100}$/,
 ]
 
 const POST_ONLY_PATHS = new Set([
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index 6794393f3..0a96adc80 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -30,6 +30,7 @@ const deferred = <T>(): Deferred<T> => {
 const mocks = vi.hoisted(() => ({
   evcBatchCall: vi.fn(),
   fetchEulerLabelsData: vi.fn(),
+  fetchPublicLabelsData: vi.fn(),
   getProvider: vi.fn(),
   invalidateSdkQueries: vi.fn(),
   vaults: [] as Array<{ asset: { address: string } }>,
@@ -46,6 +47,10 @@ vi.mock('~/composables/useEulerSdk', () => ({
   })),
 }))
 
+vi.mock('~/utils/public-labels', () => ({
+  fetchPublicLabelsData: mocks.fetchPublicLabelsData,
+}))
+
 vi.mock('~/composables/useEulerOracleAdapters', () => ({
   useEulerOracleAdapters: () => ({
     oracleAdapters: {},
@@ -99,6 +104,9 @@ describe('useEulerLabels chain-scoped loading', () => {
     currentChainId.value = 1
     mocks.evcBatchCall.mockReset().mockResolvedValue([])
     mocks.fetchEulerLabelsData.mockReset()
+    mocks.fetchPublicLabelsData.mockReset().mockImplementation(
+      (_request: unknown, _chainId: number, _version: unknown, legacy: Promise<EulerLabelsData>) => legacy,
+    )
     mocks.getProvider.mockReset().mockReturnValue({})
     mocks.invalidateSdkQueries.mockReset().mockResolvedValue(undefined)
     mocks.vaults.length = 0
@@ -219,6 +227,19 @@ describe('useEulerLabels chain-scoped loading', () => {
     expect(labels.isReady.value).toBe(true)
   })
 
+  it('falls back to the compatibility snapshot when Public Labels V3 fails', async () => {
+    const fallback = labelsFor('compatibility-fallback')
+    mocks.fetchEulerLabelsData.mockResolvedValue(fallback)
+    mocks.fetchPublicLabelsData.mockRejectedValue(new Error('V3 unavailable'))
+
+    const labels = useEulerLabels()
+    await labels.loadLabels()
+
+    expect(currentProductKeys()).toEqual(['compatibility-fallback'])
+    expect(labels.geoPolicies.value).toEqual([])
+    expect(labels.isReady.value).toBe(true)
+  })
+
   it('does not publish wrap pairs from a probe invalidated by a chain change', async () => {
     const wrapper = '0x0000000000000000000000000000000000000011'
     const underlying = '0x0000000000000000000000000000000000000022'
diff --git a/tests/fixtures/public-labels-v20260804151305236.ts b/tests/fixtures/public-labels-v20260804151305236.ts
new file mode 100644
index 000000000..57904d7ba
--- /dev/null
+++ b/tests/fixtures/public-labels-v20260804151305236.ts
@@ -0,0 +1,185 @@
+import type { PublicLabelsSource } from '~/utils/public-labels'
+
+export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
+
+export const KPK = 'kpk'
+export const SECURITIZE = 'securitize'
+export const KPK_VAULT = '0x2Ff596321782FE034102f55af5ad707A4Ce0d6a7'
+export const NEUTRAL_ESCROW = '0x00000000000000000000000000000000000000E5'
+export const ASSESSMENT_ONLY_EVK = '0x00000000000000000000000000000000000000A1'
+export const ASSESSMENT_ONLY_EARN = '0x00000000000000000000000000000000000000A2'
+export const VERIFICATION_ONLY_EVK = '0x00000000000000000000000000000000000000B1'
+export const VERIFICATION_ONLY_EARN = '0x00000000000000000000000000000000000000B2'
+export const KPK_GOVERNOR = '0x1572063377a9a4f8065BD7bA0D7fa135cd13051F'
+
+export const publicLabelsFixture: PublicLabelsSource = {
+  products: [{
+    id: 'kpk-securitize',
+    chainId: 1,
+    entityId: KPK,
+    coBrandEntityIds: [SECURITIZE],
+    name: 'KPK x Securitize RWA Markets',
+    logo: null,
+    description: 'Curated by KPK and co-branded with Securitize.',
+    url: 'https://kpk.io/vaults',
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    governanceMode: 'unknown',
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  vaults: [{
+    chainId: 1,
+    address: KPK_VAULT,
+    vaultType: 'evk',
+    productId: 'kpk-securitize',
+    entityId: KPK,
+    name: 'KPK VBILL/USDC Lend',
+    description: 'USDC lending vault for the KPK VBILL market.',
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: ['recently added', 'suppress high utilisation warning'],
+    campaigns: [{
+      name: 'KPK RWA points',
+      logo: 'https://token-images.euler.finance/labels/kpk',
+      type: 'deposit',
+    }],
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: ASSESSMENT_ONLY_EVK,
+    vaultType: 'evk',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-07-31T14:48:35.257Z',
+  }, {
+    chainId: 1,
+    address: ASSESSMENT_ONLY_EARN,
+    vaultType: 'earn',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-07-31T14:48:35.257Z',
+  }, {
+    chainId: 1,
+    address: VERIFICATION_ONLY_EVK,
+    vaultType: 'evk',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: VERIFICATION_ONLY_EARN,
+    vaultType: 'earn',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    chainId: 1,
+    address: NEUTRAL_ESCROW,
+    vaultType: 'escrow',
+    productId: null,
+    entityId: null,
+    name: null,
+    description: null,
+    portfolioNotice: null,
+    isDeprecated: false,
+    deprecationReason: null,
+    tags: [],
+    campaigns: null,
+    createdAt: '2026-07-31T14:48:35.257Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  entities: [{
+    id: KPK,
+    name: 'KPK',
+    logo: 'https://token-images.euler.finance/labels/kpk',
+    description: 'KPK is a third-party curator.',
+    url: 'https://kpk.io/',
+    socialTwitter: 'https://x.com/kpk_io',
+    socialYoutube: null,
+    socialDiscord: null,
+    socialTelegram: null,
+    socialGithub: 'https://github.com/karpatkey',
+    socialDefillama: null,
+    legalEntityName: null,
+    riskMethodology: null,
+    security: null,
+    termsOfService: null,
+    licenses: null,
+    disclaimers: null,
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }, {
+    id: SECURITIZE,
+    name: 'Securitize',
+    logo: 'https://token-images.euler.finance/labels/securitize',
+    description: 'Securitize is a tokenisation platform.',
+    url: 'https://securitize.io/',
+    socialTwitter: 'https://x.com/Securitize',
+    socialYoutube: null,
+    socialDiscord: null,
+    socialTelegram: null,
+    socialGithub: null,
+    socialDefillama: null,
+    legalEntityName: null,
+    riskMethodology: null,
+    security: null,
+    termsOfService: null,
+    licenses: null,
+    disclaimers: null,
+    createdAt: '2026-08-04T13:25:58.430Z',
+    updatedAt: '2026-08-04T13:25:58.430Z',
+  }],
+  entityAddresses: [{
+    entityId: KPK,
+    chainId: 1,
+    address: KPK_GOVERNOR,
+    label: 'KPK Euler RWA Curation Safe',
+  }],
+  geoPolicies: [{
+    id: 'raw-kpk-policy',
+    chainId: 1,
+    productId: 'kpk-securitize',
+    vaultAddress: null,
+    assetAddress: null,
+    countries: ['DE'],
+    policyType: 'block',
+    reason: 'Raw fixture policy',
+    createdAt: '2026-08-04T13:25:58.430Z',
+  }],
+}
diff --git a/tests/server/v3-proxy.test.ts b/tests/server/v3-proxy.test.ts
index f0f6f6d88..5caa010ec 100644
--- a/tests/server/v3-proxy.test.ts
+++ b/tests/server/v3-proxy.test.ts
@@ -36,15 +36,26 @@ describe('v3 proxy utilities', () => {
     expect(isV3ProxyPathAllowed(`/v3/activity/vaults/1/${VAULT}/events`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/apys/intrinsic')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/apys/rewards')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/curation/vaults')).toBe(true)
+    expect(isV3ProxyPathAllowed(`/v3/curation/vaults/1/${VAULT}/labels`)).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}`)).toBe(true)
+    expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}/assessment`)).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}/totals`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/bad-debt')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/batch')).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/evk/vaults/1/${VAULT}/totals`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/open-interest')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/open-interest/by-collateral')).toBe(true)
+    expect(isV3ProxyPathAllowed(`/v3/evk/vaults/1/${VAULT}/assessment`)).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/entities')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/entities/kpk')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/entities/kpk/addresses')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/geo-policies')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/label-sets/public/versions')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/liquidations')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/prices')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/products')).toBe(true)
+    expect(isV3ProxyPathAllowed('/v3/products/1/kpk-securitize')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/resolve/vaults')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/rewards/breakdown')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/tokens')).toBe(true)
@@ -55,9 +66,13 @@ describe('v3 proxy utilities', () => {
     expect(isV3ProxyPathAllowed('/v3/accounting')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/bad-debt/history')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults-admin')).toBe(false)
+    expect(isV3ProxyPathAllowed(`/v3/curation/vaults/1/${VAULT}/labels/admin`)).toBe(false)
+    expect(isV3ProxyPathAllowed('/v3/entities/kpk/addresses/admin')).toBe(false)
+    expect(isV3ProxyPathAllowed('/v3/entities/bad.dot')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/apys/unknown')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/liquidations/admin')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/liquidations-extra')).toBe(false)
+    expect(isV3ProxyPathAllowed('/v3/products/1/bad.dot')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/resolve')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/activity/accounts/not-an-address/events')).toBe(false)
     expect(isV3ProxyPathAllowed(`/v3/activity/accounts/${ACCOUNT}/events/admin`)).toBe(false)
diff --git a/tests/utils/discovery-calculations.test.ts b/tests/utils/discovery-calculations.test.ts
index c5f039cd2..c3a2f56a7 100644
--- a/tests/utils/discovery-calculations.test.ts
+++ b/tests/utils/discovery-calculations.test.ts
@@ -465,6 +465,25 @@ describe('getMarketEntities', () => {
     expect(getMarketEntities(market)).toEqual({
       name: 'KPK & Securitize',
       logos: ['/entities/kpk.svg', '/entities/securitize.png'],
+      labels: ['KPK', 'Securitize'],
+    })
+  })
+
+  it('shows co-brand logos while keeping the product owner as the manager label', () => {
+    const market = {
+      ...makeMarket([makeVault('0xBorrow', [])]),
+      source: 'product',
+      curator: { name: 'KPK', logo: 'kpk.svg' },
+      brandEntities: [
+        { name: 'KPK', logo: 'kpk.svg' },
+        { name: 'Securitize', logo: 'securitize.png' },
+      ],
+    } as MarketGroup
+
+    expect(getMarketEntities(market)).toEqual({
+      name: 'KPK',
+      logos: ['/entities/kpk.svg', '/entities/securitize.png'],
+      labels: ['KPK', 'Securitize'],
     })
   })
 })
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
new file mode 100644
index 000000000..48b5dcd58
--- /dev/null
+++ b/tests/utils/public-labels.test.ts
@@ -0,0 +1,201 @@
+import type { EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
+import { getAddress } from 'viem'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  fetchAllPublicLabelPages,
+  fetchPublicLabelsData,
+  getEulerLabelProductBrandEntities,
+  getEulerLabelProductBrandEntityKeys,
+  normalizePublicLabelsData,
+  PUBLIC_LABELS_PAGE_SIZE,
+  type PublicLabelsRequest,
+  type PublicProductLabel,
+} from '~/utils/public-labels'
+import {
+  ASSESSMENT_ONLY_EARN,
+  ASSESSMENT_ONLY_EVK,
+  KPK,
+  KPK_GOVERNOR,
+  KPK_VAULT,
+  NEUTRAL_ESCROW,
+  PUBLIC_LABELS_FIXTURE_VERSION,
+  VERIFICATION_ONLY_EARN,
+  VERIFICATION_ONLY_EVK,
+  publicLabelsFixture,
+} from '~/tests/fixtures/public-labels-v20260804151305236'
+
+describe('Public Labels pagination', () => {
+  it('follows meta.total with limit/offset using the pinned fixture version', async () => {
+    const rows = Array.from({ length: 167 }, (_, index) => ({ id: `product-${index}` }))
+    const request = vi.fn(async (_path: string, query: Record<string, string | number | undefined>) => {
+      const offset = Number(query.offset)
+      return {
+        data: rows.slice(offset, offset + PUBLIC_LABELS_PAGE_SIZE),
+        meta: {
+          total: rows.length,
+          offset,
+          limit: PUBLIC_LABELS_PAGE_SIZE,
+          timestamp: '2026-08-04T15:13:05.236Z',
+        },
+      }
+    })
+
+    const result = await fetchAllPublicLabelPages<Pick<PublicProductLabel, 'id'>>(
+      request as PublicLabelsRequest,
+      '/products',
+      { version: PUBLIC_LABELS_FIXTURE_VERSION },
+    )
+
+    expect(result).toHaveLength(167)
+    expect(request.mock.calls.map(([, query]) => query)).toEqual([
+      { version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
+      { version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 100 },
+    ])
+  })
+
+  it('fails closed when pagination stops before meta.total', async () => {
+    const request = vi.fn(async () => ({
+      data: [],
+      meta: { total: 1, timestamp: '2026-08-04T15:13:05.236Z' },
+    })) as PublicLabelsRequest
+
+    await expect(fetchAllPublicLabelPages(request, '/products', {
+      version: PUBLIC_LABELS_FIXTURE_VERSION,
+    })).rejects.toThrow('pagination stalled')
+  })
+
+  it('pins entity governance-address reads to the selected dataset version', async () => {
+    const rowsByPath: Record<string, unknown[]> = {
+      '/curation/vaults': publicLabelsFixture.vaults,
+      '/products': publicLabelsFixture.products,
+      '/entities': publicLabelsFixture.entities,
+      '/geo-policies': publicLabelsFixture.geoPolicies,
+      '/entities/kpk/addresses': publicLabelsFixture.entityAddresses,
+      '/entities/securitize/addresses': [],
+    }
+    const request = vi.fn(async (path: string) => ({
+      data: rowsByPath[path] ?? [],
+      meta: {
+        total: (rowsByPath[path] ?? []).length,
+        timestamp: '2026-08-04T15:13:05.236Z',
+      },
+    })) as PublicLabelsRequest
+
+    await fetchPublicLabelsData(request, 1, PUBLIC_LABELS_FIXTURE_VERSION)
+
+    const addressCalls = vi.mocked(request).mock.calls.filter(([path]) => path.endsWith('/addresses'))
+    expect(addressCalls).toHaveLength(2)
+    expect(addressCalls.map(([, query]) => query)).toEqual([
+      { chainId: 1, version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
+      { chainId: 1, version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
+    ])
+  })
+})
+
+describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
+  it('keeps KPK as owner, exposes Securitize as a co-brand, and maps hosted profiles', () => {
+    const legacy = {
+      products: {
+        'kpk-securitize': {
+          name: 'Legacy KPK market',
+          description: '',
+          entity: KPK,
+          url: '',
+          vaults: [getAddress(KPK_VAULT)],
+          block: ['US'],
+          vaultOverrides: {
+            [getAddress(KPK_VAULT)]: { restricted: ['CA'] },
+          },
+        },
+      },
+      assetBlocks: { '0xasset': ['GB'] },
+      assetRestrictions: {},
+      assetPatternRules: [],
+      earnVaultBlocks: {},
+      earnVaultRestrictions: {},
+      earnVaultEntries: {},
+      notExplorableEarnVaults: new Set<string>(),
+    } as unknown as EulerLabelsData
+
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+    const product = result.products['kpk-securitize']
+
+    expect(product.entity).toBe(KPK)
+    expect(product.coBrandEntityIds).toEqual(['securitize'])
+    expect(getEulerLabelProductBrandEntityKeys(product)).toEqual([KPK, 'securitize'])
+    expect(getEulerLabelProductBrandEntities(product, result.entities).map(entity => entity.id)).toEqual([
+      KPK,
+      'securitize',
+    ])
+    expect(product.vaults).toEqual([getAddress(KPK_VAULT)])
+    expect(result.entities.kpk.logo).toBe('https://token-images.euler.finance/labels/kpk')
+    expect(result.entities.kpk.addresses).toEqual({
+      [getAddress(KPK_GOVERNOR)]: 'KPK Euler RWA Curation Safe',
+    })
+    expect(result.points[getAddress(KPK_VAULT)]).toEqual([{
+      name: 'KPK RWA points',
+      logo: 'https://token-images.euler.finance/labels/kpk',
+      type: 'deposit',
+    }])
+  })
+
+  it('keeps neutral escrows unattributed and raw geo policies non-effective', () => {
+    const legacy = {
+      products: {
+        'kpk-securitize': {
+          name: 'Legacy KPK market',
+          description: '',
+          entity: KPK,
+          url: '',
+          vaults: [getAddress(KPK_VAULT)],
+          block: ['US'],
+          vaultOverrides: {
+            [getAddress(KPK_VAULT)]: { restricted: ['CA'] },
+          },
+        },
+      },
+      assetBlocks: {},
+      assetRestrictions: {},
+      assetPatternRules: [],
+      earnVaultBlocks: {},
+      earnVaultRestrictions: {},
+      earnVaultEntries: {},
+      notExplorableEarnVaults: new Set<string>(),
+    } as unknown as EulerLabelsData
+
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+    const product = result.products['kpk-securitize']
+
+    expect(result.verifiedVaultAddresses).not.toContain(getAddress(NEUTRAL_ESCROW))
+    expect(result.verifiedVaultAddresses).not.toContain(getAddress(ASSESSMENT_ONLY_EVK))
+    expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
+    expect(Object.keys(result.products)).not.toContain(`__vault_${NEUTRAL_ESCROW.toLowerCase()}`)
+    expect(Object.keys(result.products)).not.toContain(`__vault_${ASSESSMENT_ONLY_EVK.toLowerCase()}`)
+    expect(product.block).toEqual(['US'])
+    expect(product.vaultOverrides?.[getAddress(KPK_VAULT)]?.restricted).toEqual(['CA'])
+    expect(product.block).not.toContain('DE')
+    expect(result.rawGeoPolicies).toEqual(publicLabelsFixture.geoPolicies)
+  })
+
+  it('retains compatibility-confirmed plain labels without trusting assessment-only rows', () => {
+    const legacy = {
+      products: {},
+      verifiedVaultAddresses: [getAddress(VERIFICATION_ONLY_EVK)],
+      earnVaults: [getAddress(VERIFICATION_ONLY_EARN)],
+      assetBlocks: {},
+      assetRestrictions: {},
+      assetPatternRules: [],
+      earnVaultBlocks: {},
+      earnVaultRestrictions: {},
+      earnVaultEntries: {},
+      notExplorableEarnVaults: new Set<string>(),
+    } as unknown as EulerLabelsData
+
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+
+    expect(result.verifiedVaultAddresses).toContain(getAddress(VERIFICATION_ONLY_EVK))
+    expect(result.verifiedVaultAddresses).not.toContain(getAddress(ASSESSMENT_ONLY_EVK))
+    expect(result.earnVaults).toContain(getAddress(VERIFICATION_ONLY_EARN))
+    expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
+  })
+})
diff --git a/utils/discoveryCalculations.ts b/utils/discoveryCalculations.ts
index 4a45566d1..6551fef9d 100644
--- a/utils/discoveryCalculations.ts
+++ b/utils/discoveryCalculations.ts
@@ -150,7 +150,17 @@ export const getDeprecatedVaultCount = (market: MarketGroup): number => {
 export const getUnknownCollateralCount = (market: MarketGroup): number =>
   market.unknownCollateral.length
 
-export const getMarketEntities = (market: MarketGroup): { name: string, logos: string[] } => {
+export const getMarketEntities = (market: MarketGroup): { name: string, logos: string[], labels: string[] } => {
+  if (market.source === 'product' && market.brandEntities?.length) {
+    return {
+      // Co-brands contribute visual identity only; the visible manager name
+      // and manager-profile ownership remain attached to the product curator.
+      name: market.curator?.name ?? market.brandEntities[0].name,
+      logos: market.brandEntities.map(entity => getEulerLabelEntityLogo(entity.logo)),
+      labels: market.brandEntities.map(entity => entity.name),
+    }
+  }
+
   const seen = new Set<string>()
   const all: EulerLabelEntity[] = []
   for (const v of market.vaults) {
@@ -160,13 +170,17 @@ export const getMarketEntities = (market: MarketGroup): { name: string, logos: s
       all.push(entity)
     }
   }
-  if (all.length === 0) return { name: '', logos: [] }
+  if (all.length === 0) return { name: '', logos: [], labels: [] }
   const name = all.length === 1
     ? all[0].name
     : all.length === 2
       ? `${all[0].name} & ${all[1].name}`
       : `${all[0].name} & others`
-  return { name, logos: all.map(e => getEulerLabelEntityLogo(e.logo)) }
+  return {
+    name,
+    logos: all.map(e => getEulerLabelEntityLogo(e.logo)),
+    labels: all.map(entity => entity.name),
+  }
 }
 
 const hasBorrowableLTV = (vault: EVault): boolean =>
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
new file mode 100644
index 000000000..28d29ce6e
--- /dev/null
+++ b/utils/public-labels.ts
@@ -0,0 +1,521 @@
+import type { EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
+import { getAddress } from 'viem'
+import type {
+  EulerLabelEarnVaultEntry,
+  EulerLabelEntity,
+  EulerLabelPointReward,
+  EulerLabelProduct,
+  EulerLabelVaultOverride,
+} from '~/entities/euler/labels'
+
+export const PUBLIC_LABELS_RUNTIME_VERSION = 'latest'
+export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
+export const PUBLIC_LABELS_PAGE_SIZE = 100
+
+const MAX_PUBLIC_LABEL_RECORDS = 10_000
+const ENTITY_ADDRESS_CONCURRENCY = 8
+
+export interface PublicLabelsMeta {
+  total?: number
+  limit?: number
+  offset?: number
+  timestamp: string
+}
+
+export interface PublicLabelsResponse<T> {
+  data: T
+  meta: PublicLabelsMeta
+}
+
+export interface PublicVaultCampaign {
+  name: string
+  logo: string | null
+  type: 'deposit' | 'borrow'
+}
+
+export interface PublicVaultLabel {
+  chainId: number
+  address: string
+  vaultType: 'evk' | 'earn' | 'securitize' | 'escrow'
+  productId: string | null
+  entityId: string | null
+  name: string | null
+  description: string | null
+  portfolioNotice: string | null
+  isDeprecated: boolean
+  deprecationReason: string | null
+  tags: string[]
+  campaigns: PublicVaultCampaign[] | null
+  createdAt: string
+  updatedAt: string
+}
+
+export interface PublicProductLabel {
+  id: string
+  chainId: number
+  entityId: string
+  coBrandEntityIds?: string[] | null
+  name: string
+  logo?: string | null
+  description: string | null
+  url: string | null
+  portfolioNotice: string | null
+  isDeprecated: boolean
+  deprecationReason: string | null
+  governanceMode: string
+  createdAt: string
+  updatedAt: string
+}
+
+export interface PublicEntityLabel {
+  id: string
+  name: string
+  logo: string | null
+  description: string | null
+  url: string | null
+  socialTwitter: string | null
+  socialYoutube: string | null
+  socialDiscord: string | null
+  socialTelegram: string | null
+  socialGithub: string | null
+  socialDefillama: string | null
+  legalEntityName: string | null
+  riskMethodology: string | null
+  security: string | null
+  termsOfService: string | null
+  licenses: string | null
+  disclaimers: string | null
+  createdAt: string
+  updatedAt: string
+}
+
+export interface PublicEntityAddress {
+  entityId: string
+  chainId: number
+  address: string
+  label: string | null
+}
+
+export interface PublicGeoPolicy {
+  id: string
+  chainId: number | null
+  productId: string | null
+  vaultAddress: string | null
+  assetAddress: string | null
+  assetSymbols?: string[] | null
+  assetSymbolRegex?: string | null
+  assetNames?: string[] | null
+  assetNameRegex?: string | null
+  countries: string[]
+  policyType: 'block' | 'restrict'
+  reason: string | null
+  createdAt: string
+}
+
+export interface PublicLabelsSource {
+  vaults: PublicVaultLabel[]
+  products: PublicProductLabel[]
+  entities: PublicEntityLabel[]
+  entityAddresses: PublicEntityAddress[]
+  geoPolicies: PublicGeoPolicy[]
+}
+
+export type PublicLabelsQuery = Record<string, string | number | undefined>
+export type PublicLabelsRequest = <T>(
+  path: string,
+  query: PublicLabelsQuery,
+) => Promise<PublicLabelsResponse<T>>
+
+export type MigratedEulerLabelsData = Omit<EulerLabelsData, 'products' | 'entities'> & {
+  products: Record<string, EulerLabelProduct>
+  entities: Record<string, EulerLabelEntity>
+  /** Versioned policy records are informational until effective precedence is specified. */
+  rawGeoPolicies: PublicGeoPolicy[]
+}
+
+export const getEulerLabelProductBrandEntityKeys = (product: EulerLabelProduct): string[] => {
+  const ownerKeys = Array.isArray(product.entity) ? product.entity : [product.entity]
+  return [...new Set([...ownerKeys.filter(Boolean), ...(product.coBrandEntityIds ?? [])])]
+}
+
+export const getEulerLabelProductBrandEntities = (
+  product: EulerLabelProduct,
+  entities: Record<string, EulerLabelEntity>,
+): EulerLabelEntity[] => getEulerLabelProductBrandEntityKeys(product)
+  .map(key => entities[key])
+  .filter((entity): entity is EulerLabelEntity => Boolean(entity))
+
+const isNonNegativeInteger = (value: unknown): value is number =>
+  typeof value === 'number' && Number.isInteger(value) && value >= 0
+
+const assertListResponse = <T>(
+  response: PublicLabelsResponse<T[]>,
+  path: string,
+): { items: T[], total: number } => {
+  if (!response || !Array.isArray(response.data)) {
+    throw new Error(`Invalid Public Labels response for ${path}`)
+  }
+  const total = response.meta?.total
+  if (!isNonNegativeInteger(total) || total > MAX_PUBLIC_LABEL_RECORDS) {
+    throw new Error(`Invalid Public Labels total for ${path}`)
+  }
+  return { items: response.data, total }
+}
+
+export const fetchAllPublicLabelPages = async <T>(
+  request: PublicLabelsRequest,
+  path: string,
+  query: PublicLabelsQuery,
+): Promise<T[]> => {
+  const result: T[] = []
+  let offset = 0
+
+  while (true) {
+    const response = await request<T[]>(path, {
+      ...query,
+      limit: PUBLIC_LABELS_PAGE_SIZE,
+      offset,
+    })
+    const { items, total } = assertListResponse(response, path)
+    result.push(...items)
+
+    if (result.length >= total) return result.slice(0, total)
+    if (items.length === 0) {
+      throw new Error(`Public Labels pagination stalled for ${path}`)
+    }
+    offset += items.length
+  }
+}
+
+const mapWithConcurrency = async <T, R>(
+  values: T[],
+  concurrency: number,
+  mapper: (value: T) => Promise<R>,
+): Promise<R[]> => {
+  const result = new Array<R>(values.length)
+  let nextIndex = 0
+
+  const worker = async () => {
+    while (nextIndex < values.length) {
+      const index = nextIndex++
+      result[index] = await mapper(values[index])
+    }
+  }
+
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, values.length) }, () => worker()),
+  )
+  return result
+}
+
+const isSafeEntityId = (value: string): boolean => /^[A-Za-z0-9_-]{1,100}$/.test(value)
+
+export const fetchPublicLabelsData = async (
+  request: PublicLabelsRequest,
+  chainId: number,
+  version = PUBLIC_LABELS_RUNTIME_VERSION,
+  legacy?: EulerLabelsData | Promise<EulerLabelsData>,
+): Promise<MigratedEulerLabelsData> => {
+  const [vaults, products, entities, geoPolicies, resolvedLegacy] = await Promise.all([
+    fetchAllPublicLabelPages<PublicVaultLabel>(request, '/curation/vaults', { version, chainId }),
+    fetchAllPublicLabelPages<PublicProductLabel>(request, '/products', { version, chainId }),
+    fetchAllPublicLabelPages<PublicEntityLabel>(request, '/entities', { version }),
+    fetchAllPublicLabelPages<PublicGeoPolicy>(request, '/geo-policies', { version }),
+    Promise.resolve(legacy),
+  ])
+
+  const entityIds = [...new Set([
+    ...products.flatMap(product => [product.entityId, ...(product.coBrandEntityIds ?? [])]),
+    ...vaults.flatMap(vault => vault.entityId ? [vault.entityId] : []),
+  ])].filter(isSafeEntityId)
+
+  const entityAddressPages = await mapWithConcurrency(
+    entityIds,
+    ENTITY_ADDRESS_CONCURRENCY,
+    entityId => fetchAllPublicLabelPages<PublicEntityAddress>(
+      request,
+      `/entities/${entityId}/addresses`,
+      { chainId, version },
+    ),
+  )
+
+  return normalizePublicLabelsData(chainId, {
+    vaults,
+    products,
+    entities,
+    entityAddresses: entityAddressPages.flat(),
+    geoPolicies,
+  }, resolvedLegacy)
+}
+
+const uniqueStrings = (values: Iterable<string>): string[] => [...new Set(values)]
+
+const present = <T>(value: T | null | undefined): T | undefined =>
+  value === null || value === undefined ? undefined : value
+
+const makeVaultOverride = (vault: PublicVaultLabel): EulerLabelVaultOverride => ({
+  ...present(vault.name) !== undefined && { name: vault.name! },
+  ...present(vault.description) !== undefined && { description: vault.description! },
+  ...present(vault.portfolioNotice) !== undefined && { portfolioNotice: vault.portfolioNotice! },
+  ...present(vault.deprecationReason) !== undefined && { deprecationReason: vault.deprecationReason! },
+  ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
+})
+
+const buildEntity = (
+  entity: PublicEntityLabel,
+  addresses: PublicEntityAddress[],
+): EulerLabelEntity => ({
+  id: entity.id,
+  name: entity.name,
+  logo: entity.logo ?? '',
+  description: entity.description ?? '',
+  url: entity.url ?? '',
+  ...present(entity.legalEntityName) !== undefined && { legalEntityName: entity.legalEntityName! },
+  ...present(entity.riskMethodology) !== undefined && { riskMethodology: entity.riskMethodology! },
+  ...present(entity.security) !== undefined && { security: entity.security! },
+  ...present(entity.termsOfService) !== undefined && { termsOfService: entity.termsOfService! },
+  ...present(entity.licenses) !== undefined && { licenses: entity.licenses! },
+  ...present(entity.disclaimers) !== undefined && { disclaimers: entity.disclaimers! },
+  addresses: Object.fromEntries(addresses.map(entry => [getAddress(entry.address), entry.label ?? ''])),
+  social: {
+    twitter: entity.socialTwitter ?? '',
+    youtube: entity.socialYoutube ?? '',
+    discord: entity.socialDiscord ?? '',
+    telegram: entity.socialTelegram ?? '',
+    github: entity.socialGithub ?? '',
+    defillama: entity.socialDefillama ?? '',
+  },
+})
+
+const productTags = (vaults: PublicVaultLabel[]): string[] | undefined => {
+  const tags = uniqueStrings(vaults.flatMap(vault => vault.tags))
+  return tags.length > 0 ? tags : undefined
+}
+
+const buildProduct = (
+  product: PublicProductLabel,
+  vaults: PublicVaultLabel[],
+): EulerLabelProduct => {
+  const active: string[] = []
+  const deprecated: string[] = []
+  const vaultOverrides: Record<string, EulerLabelVaultOverride> = {}
+
+  for (const vault of vaults) {
+    const address = getAddress(vault.address)
+    if (vault.isDeprecated) deprecated.push(address)
+    else active.push(address)
+    vaultOverrides[address] = makeVaultOverride(vault)
+  }
+
+  const tags = productTags(vaults)
+  return {
+    id: product.id,
+    chainId: product.chainId,
+    name: product.name,
+    description: product.description ?? '',
+    ...(product.portfolioNotice && { portfolioNotice: product.portfolioNotice }),
+    entity: product.entityId,
+    coBrandEntityIds: [...(product.coBrandEntityIds ?? [])],
+    url: product.url ?? '',
+    ...(product.logo && { logo: product.logo }),
+    vaults: active,
+    deprecatedVaults: deprecated,
+    ...(product.deprecationReason && { deprecationReason: product.deprecationReason }),
+    ...(product.isDeprecated && { isDeprecated: true }),
+    ...(tags && { tags }),
+    vaultOverrides,
+  }
+}
+
+const standaloneProductKey = (address: string): string => `__vault_${address.toLowerCase()}`
+
+/**
+ * The inventory is a union of label and assessment records. A row with only
+ * identity/type/timestamps is assessment-only and must not affect listing or
+ * verification state.
+ */
+export const hasPublishedVaultLabelContent = (vault: PublicVaultLabel): boolean => Boolean(
+  vault.productId
+  || vault.entityId
+  || vault.name
+  || vault.description
+  || vault.portfolioNotice
+  || vault.isDeprecated
+  || vault.deprecationReason
+  || vault.tags.length
+  || vault.campaigns?.length,
+)
+
+const buildStandaloneProduct = (vault: PublicVaultLabel): EulerLabelProduct => {
+  const address = getAddress(vault.address)
+  return {
+    id: standaloneProductKey(address),
+    chainId: vault.chainId,
+    isStandalone: true,
+    name: vault.name ?? '',
+    description: vault.description ?? '',
+    ...(vault.portfolioNotice && { portfolioNotice: vault.portfolioNotice }),
+    entity: vault.entityId ?? '',
+    coBrandEntityIds: [],
+    url: '',
+    vaults: vault.isDeprecated ? [] : [address],
+    deprecatedVaults: vault.isDeprecated ? [address] : [],
+    ...(vault.deprecationReason && { deprecationReason: vault.deprecationReason }),
+    ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
+    vaultOverrides: { [address]: makeVaultOverride(vault) },
+  }
+}
+
+export const normalizePublicLabelsData = (
+  chainId: number,
+  source: PublicLabelsSource,
+  legacy?: EulerLabelsData,
+): MigratedEulerLabelsData => {
+  const inventoryRows = source.vaults.filter(vault => vault.chainId === chainId)
+  const chainVaults = inventoryRows.filter(hasPublishedVaultLabelContent)
+  const compatibilityVerified = new Set(
+    (legacy?.verifiedVaultAddresses ?? []).map(address => address.toLowerCase()),
+  )
+  const compatibilityEarn = new Set(
+    (legacy?.earnVaults ?? []).map(address => address.toLowerCase()),
+  )
+  // Plain-address labels and assessment-only rows have the same empty content
+  // shape in the inventory. Retain an empty row only when the compatibility
+  // snapshot already classifies that exact published inventory address.
+  const compatibilityEarnRows = inventoryRows.filter(vault =>
+    !hasPublishedVaultLabelContent(vault)
+    && vault.vaultType === 'earn'
+    && compatibilityEarn.has(vault.address.toLowerCase()),
+  )
+  const compatibilityVerifiedRows = inventoryRows.filter(vault =>
+    !hasPublishedVaultLabelContent(vault)
+    && vault.vaultType !== 'earn'
+    && vault.vaultType !== 'escrow'
+    && compatibilityVerified.has(vault.address.toLowerCase()),
+  )
+  const productRows = source.products.filter(product => product.chainId === chainId)
+  const vaultsByProduct = new Map<string, PublicVaultLabel[]>()
+  for (const vault of chainVaults) {
+    if (!vault.productId) continue
+    const rows = vaultsByProduct.get(vault.productId) ?? []
+    rows.push(vault)
+    vaultsByProduct.set(vault.productId, rows)
+  }
+
+  const products: Record<string, EulerLabelProduct> = {}
+  for (const product of productRows) {
+    products[product.id] = buildProduct(product, vaultsByProduct.get(product.id) ?? [])
+  }
+
+  for (const vault of chainVaults) {
+    if (vault.productId) {
+      if (!products[vault.productId]) {
+        throw new Error(`Public Labels vault references missing product ${vault.productId}`)
+      }
+      continue
+    }
+    if (vault.vaultType !== 'earn' && vault.vaultType !== 'escrow') {
+      products[standaloneProductKey(vault.address)] = buildStandaloneProduct(vault)
+    }
+  }
+
+  const addressesByEntity = new Map<string, PublicEntityAddress[]>()
+  for (const address of source.entityAddresses) {
+    if (address.chainId !== chainId) continue
+    const rows = addressesByEntity.get(address.entityId) ?? []
+    rows.push(address)
+    addressesByEntity.set(address.entityId, rows)
+  }
+  const entities = Object.fromEntries(source.entities.map(entity => [
+    entity.id,
+    buildEntity(entity, addressesByEntity.get(entity.id) ?? []),
+  ])) as Record<string, EulerLabelEntity>
+
+  const verifiedVaultAddresses: string[] = compatibilityVerifiedRows.map(vault => getAddress(vault.address))
+  const earnVaults: string[] = []
+  const earnVaultEntries: Record<string, EulerLabelEarnVaultEntry> = {}
+  const earnVaultBlocks: Record<string, string[]> = { ...(legacy?.earnVaultBlocks ?? {}) }
+  const earnVaultRestrictions: Record<string, string[]> = { ...(legacy?.earnVaultRestrictions ?? {}) }
+  const deprecatedEarnVaults: Record<string, string> = {}
+  const earnVaultDescriptions: Record<string, string> = {}
+  const earnVaultNotices: Record<string, string> = {}
+  const notExplorableEarnVaults = new Set<string>(legacy?.notExplorableEarnVaults ?? [])
+  const points: Record<string, EulerLabelPointReward[]> = {}
+  for (const vault of [...chainVaults, ...compatibilityEarnRows]) {
+    const address = getAddress(vault.address)
+    const lower = address.toLowerCase()
+    if (vault.vaultType === 'earn') {
+      earnVaults.push(address)
+      earnVaultEntries[lower] = {
+        address,
+        ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
+        ...(vault.isDeprecated && { deprecated: true }),
+        ...(vault.deprecationReason && { deprecationReason: vault.deprecationReason }),
+        ...(vault.description && { description: vault.description }),
+        ...(vault.portfolioNotice && { portfolioNotice: vault.portfolioNotice }),
+      }
+      if (vault.isDeprecated) deprecatedEarnVaults[lower] = vault.deprecationReason ?? ''
+      if (vault.description) earnVaultDescriptions[lower] = vault.description
+      if (vault.portfolioNotice) earnVaultNotices[lower] = vault.portfolioNotice
+    }
+    else if (vault.vaultType !== 'escrow') {
+      verifiedVaultAddresses.push(address)
+    }
+
+    if (vault.campaigns?.length) {
+      points[address] = vault.campaigns.map(campaign => ({
+        name: campaign.name,
+        logo: campaign.logo ?? '',
+        type: campaign.type,
+      }))
+    }
+  }
+
+  // Preserve the currently effective geo/visibility data. Raw V3 geo policies
+  // are intentionally not composed here: global/product/vault/asset precedence
+  // and the final eligibility contract are not specified yet.
+  for (const [productKey, product] of Object.entries(products)) {
+    const legacyProduct = legacy?.products?.[productKey] as EulerLabelProduct | undefined
+    if (!legacyProduct) continue
+    product.block = legacyProduct.block
+    product.restricted = legacyProduct.restricted
+    product.notExplorable = legacyProduct.notExplorable
+    for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
+      const target = product.vaultOverrides?.[address]
+      const previous = legacyProduct.vaultOverrides?.[address]
+      if (!target || !previous) continue
+      target.block = previous.block
+      target.restricted = previous.restricted
+      target.notExplorableLend = previous.notExplorableLend
+      target.notExplorableBorrow = previous.notExplorableBorrow
+    }
+  }
+  for (const [address, entry] of Object.entries(earnVaultEntries)) {
+    const previous = legacy?.earnVaultEntries?.[address]
+    if (!previous) continue
+    entry.block = previous.block
+    entry.restricted = previous.restricted
+    entry.notExplorable = previous.notExplorable
+  }
+
+  return {
+    products,
+    entities,
+    points,
+    verifiedVaultAddresses: uniqueStrings(verifiedVaultAddresses),
+    earnVaults: uniqueStrings(earnVaults),
+    earnVaultEntries,
+    earnVaultBlocks,
+    earnVaultRestrictions,
+    deprecatedEarnVaults,
+    earnVaultDescriptions,
+    earnVaultNotices,
+    notExplorableEarnVaults,
+    assetBlocks: { ...(legacy?.assetBlocks ?? {}) },
+    assetRestrictions: { ...(legacy?.assetRestrictions ?? {}) },
+    assetPatternRules: [...(legacy?.assetPatternRules ?? [])],
+    rawGeoPolicies: source.geoPolicies.filter(policy =>
+      policy.chainId === null || policy.chainId === chainId,
+    ),
+  } as MigratedEulerLabelsData
+}

From 512b74ab88e3f364b8759bd4d7ce2c8f6ff66404 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Wed, 5 Aug 2026 10:46:35 +0100
Subject: [PATCH 02/13] fix: unify public labels data flow

Route all display labels through one version-pinned V3 aggregate and remove the legacy browser and SDK label endpoints. Keep unresolved effective visibility policy server-side with bounded caching and deployment-compatible configuration.
---
 .env.example                                  |  13 +-
 README.md                                     |  27 +-
 .../entities/portfolio/PortfolioNotice.vue    |   2 +-
 components/entities/vault/VaultPoints.vue     |  21 +-
 .../entities/vault/VaultPointsModal.vue       |  22 +-
 .../overview/SecuritizeVaultOverview.vue      |   2 +-
 .../vault/overview/VaultDeprecationBanner.vue |   2 +-
 .../overview/VaultOverviewBlockGeneral.vue    |   2 +-
 .../earn/VaultOverviewEarnBlockGeneral.vue    |   2 +-
 composables/useDeployConfig.ts                |   7 -
 composables/useEulerConfig.ts                 |   9 -
 composables/useEulerLabels.ts                 |  31 +--
 composables/useEulerSdk.ts                    |  10 +-
 docs/architecture.md                          |  11 +-
 docs/development-guide.md                     |  13 +-
 docs/geo-blocking.md                          |  54 ++--
 docs/keyring-hooks.md                         |   7 +-
 docs/public-api.md                            |  32 +--
 docs/sdk-integration.md                       |   1 -
 docs/server-side-caching.md                   |  34 +--
 docs/vault-labels-and-verification.md         |  18 +-
 entities/euler/labels.ts                      |   6 +-
 nuxt.config.ts                                |   5 +-
 pages/borrow/index.vue                        |   4 +-
 pages/earn/index.vue                          |   2 +-
 pages/explore/index.vue                       |   4 +-
 pages/lend/index.vue                          |   4 +-
 scripts/execution-record.mjs                  |   2 +-
 .../internal/labels/[chainId]/[file].get.ts   |  64 -----
 server/api/internal/labels/[file].get.ts      | 235 ----------------
 server/api/internal/public-labels.get.ts      |  35 +++
 server/plugins/warm-cache.ts                  |  35 ++-
 server/utils/labels-base-url.ts               |  14 +-
 server/utils/labels-helpers.ts                |  11 -
 server/utils/labels-source.ts                 | 262 ++++++++++++++++++
 server/utils/labels-view.ts                   |   5 +-
 server/utils/public-labels-source.ts          | 122 ++++++++
 server/utils/sdk-server.ts                    |   2 -
 server/utils/v3-proxy.ts                      |  10 -
 server/utils/vault-metadata.ts                |   7 +-
 server/utils/vaults-cache.ts                  |  49 +---
 tests/composables/useEulerLabels.test.ts      | 101 ++++---
 tests/composables/useEulerSdk.test.ts         |   8 -
 tests/server/labels-base-url.test.ts          |  33 +++
 tests/server/labels-validate-node.test.ts     |  49 +++-
 tests/server/public-labels-endpoint.test.ts   |  78 ++++++
 tests/server/public-labels-source.test.ts     | 132 +++++++++
 tests/server/sdk-server.test.ts               |   7 -
 tests/server/v3-proxy.test.ts                 |  15 -
 tests/server/vaults-cache.test.ts             |  21 +-
 tests/utils/discovery-calculations.test.ts    |  22 +-
 tests/utils/public-labels.test.ts             |  97 ++++---
 .../utils/vault/governor-verification.test.ts |   2 +-
 utils/public-labels.ts                        | 229 ++++++++++++---
 utils/vault/governor-verification.ts          |   6 +-
 55 files changed, 1195 insertions(+), 803 deletions(-)
 delete mode 100644 server/api/internal/labels/[chainId]/[file].get.ts
 delete mode 100644 server/api/internal/labels/[file].get.ts
 create mode 100644 server/api/internal/public-labels.get.ts
 create mode 100644 server/utils/labels-source.ts
 create mode 100644 server/utils/public-labels-source.ts
 create mode 100644 tests/server/labels-base-url.test.ts
 create mode 100644 tests/server/public-labels-endpoint.test.ts
 create mode 100644 tests/server/public-labels-source.test.ts

diff --git a/.env.example b/.env.example
index b116d7e3c..158a59c24 100644
--- a/.env.example
+++ b/.env.example
@@ -117,12 +117,15 @@ NUXT_PUBLIC_CONFIG_APP_DESCRIPTION="Lightweight interface for Euler Finance."
 # Recommended: 1200x630 or larger (2400x1260), PNG or JPG. Must be publicly
 # reachable — X, Slack, Discord fetch it directly. Empty = no preview image.
 NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL=
-NUXT_PUBLIC_CONFIG_LABELS_REPO="euler-xyz/euler-labels"
-NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH="master"
 NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_REPO="euler-xyz/oracle-checks"
-# Base URL for labels data (S3/CDN). When set, LABELS_REPO and LABELS_REPO_BRANCH are ignored.
-# Must serve the same directory structure (e.g. {baseUrl}/{chainId}/products.json, {baseUrl}/logo/{file}).
-NUXT_PUBLIC_CONFIG_LABELS_BASE_URL=
+# Temporary server-only effective-policy source for block/restricted/discovery rules.
+# Public display labels, products, entities, logos, tags, campaigns, and deprecation
+# come from V3. When set, EFFECTIVE_POLICY_REPO and its branch are ignored.
+# Must serve {baseUrl}/{chainId}/{products,earn-vaults,assets}.json and
+# {baseUrl}/all/assets.json until V3 publishes the resolved effective decision.
+EFFECTIVE_POLICY_REPO="euler-xyz/euler-labels"
+EFFECTIVE_POLICY_REPO_BRANCH="master"
+EFFECTIVE_POLICY_BASE_URL=
 # Base URL for oracle checks data. When set, ORACLE_CHECKS_REPO is ignored.
 # Must serve files at {baseUrl}/{chainId}/adapters/{address}.json.
 NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL=
diff --git a/README.md b/README.md
index 1da1078cc..09633e0a2 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,8 @@ Euler Lite uses the [Euler V2 SDK](https://github.com/euler-xyz/euler-sdks) for
 | `TENDERLY_ACCESS_KEY`, `TENDERLY_ACCOUNT_SLUG`, `TENDERLY_PROJECT_SLUG` | Optional Tenderly simulation configuration. |
 | `FUUL_API_URL` or `NUXT_PUBLIC_FUUL_API_URL` | Optional Fuul API upstream override. |
 | `INCENTRA_API_URL` or `NUXT_PUBLIC_INCENTRA_API_URL` | Optional Incentra/Brevis API upstream override. |
+| `EFFECTIVE_POLICY_REPO`, `EFFECTIVE_POLICY_REPO_BRANCH` | Temporary server-only effective visibility/geo policy repository and branch. |
+| `EFFECTIVE_POLICY_BASE_URL` | Optional effective-policy CDN base URL; overrides the repository settings. |
 
 #### Branding & Feature Flags
 
@@ -94,9 +96,6 @@ These use Nuxt's `runtimeConfig` and are set via `NUXT_PUBLIC_CONFIG_*` env vars
 | `NUXT_PUBLIC_CONFIG_APP_DESCRIPTION`        | `Lightweight interface for Euler Finance.` | App description                                       |
 | `NUXT_PUBLIC_CONFIG_LOGO_URL`               | —                                          | Custom logo URL (falls back to built-in Euler logo)   |
 | `NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL`       | —                                          | Absolute URL to social share image (og:image / twitter:image), 1200×630+ |
-| `NUXT_PUBLIC_CONFIG_LABELS_REPO`            | `euler-xyz/euler-labels`                   | GitHub labels repo                                    |
-| `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH`     | `master`                                   | Branch to fetch labels from                           |
-| `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL`        | —                                          | S3/CDN base URL for labels (overrides repo/branch)    |
 | `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_REPO`     | `euler-xyz/oracle-checks`                  | GitHub repo for oracle check results                  |
 | `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL` | —                                          | S3/CDN base URL for oracle checks (overrides repo)    |
 | `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL`       | —                                          | URL for EulerChains.json, used when no Euler interfaces branch is configured |
@@ -217,27 +216,11 @@ The resolution order in `getAssetLogoUrl(address, symbol)`:
 2. `logoURI` from the unified token list (Euler SDK token list > DefiLlama > Uniswap > Merkl)
 3. Empty string (component shows initials fallback)
 
-#### EulerEarn Vaults
+#### Public Labels
 
-If using a custom labels repository, create chain-specific `earn-vaults.json` files to curate which EulerEarn vaults appear:
+Vault inventory, products, entities, hosted logos, tags, campaigns, and deprecation metadata come from the versioned Public Labels API at `V3_API_URL`. Lite resolves `version=latest` to one immutable publication before fetching a chain bundle and follows every paginated list through `meta.total`.
 
-```
-your-labels-repo/
-├── 1/earn-vaults.json          # Ethereum
-├── 42161/earn-vaults.json      # Arbitrum
-└── 8453/earn-vaults.json       # Base
-```
-
-Each file is a JSON array of vault addresses:
-
-```json
-[
-  "0x1234567890123456789012345678901234567890",
-  "0xabcdefabcdefabcdefabcdefabcdefabcdefabcd"
-]
-```
-
-When using the default `euler-xyz/euler-labels` repository, all verified EulerEarn vaults are shown automatically.
+The labels-repository settings above are a temporary server-only compatibility source for effective `block`, `restricted`, and discovery-visibility rules. They do not provide display content or browser/SDK label routes. Raw V3 assessment and geo-policy records remain informational until V3 publishes the resolved effective decision and precedence contract.
 
 ### 4. Development
 
diff --git a/components/entities/portfolio/PortfolioNotice.vue b/components/entities/portfolio/PortfolioNotice.vue
index 4fe840269..5ba74ced3 100644
--- a/components/entities/portfolio/PortfolioNotice.vue
+++ b/components/entities/portfolio/PortfolioNotice.vue
@@ -14,7 +14,7 @@ defineProps<{ notice: string }>()
       name="info-circle"
       class="!w-20 !h-20 text-accent-600 shrink-0"
     />
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <span
       class="text-accent-700 text-p4 auto-link"
       @click="stopLinkPropagation"
diff --git a/components/entities/vault/VaultPoints.vue b/components/entities/vault/VaultPoints.vue
index 34ad28689..a13b85155 100644
--- a/components/entities/vault/VaultPoints.vue
+++ b/components/entities/vault/VaultPoints.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import type { EulerEarn, EVault, SecuritizeCollateralVault } from '@eulerxyz/euler-v2-sdk'
-import { getEulerLabelEntityLogo, getEulerLabelPointLogo } from '~/entities/euler/labels'
+import { getEulerLabelPointLogo } from '~/entities/euler/labels'
 import { useModal } from '~/components/ui/composables/useModal'
 import { VaultPointsModal } from '#components'
 
@@ -15,14 +15,6 @@ const points = computed(() => allPoints.filter(point =>
 ))
 const modal = useModal()
 
-const onLogoError = (event: Event, logoFileName: string) => {
-  const img = event.target as HTMLImageElement
-  if (!img.dataset.triedFallback) {
-    img.dataset.triedFallback = 'true'
-    img.src = getEulerLabelEntityLogo(logoFileName)
-  }
-}
-
 const onPointClick = (
   point: { name: string, logo: string },
   event: MouseEvent | TouchEvent,
@@ -44,18 +36,15 @@ const onPointClick = (
     v-if="points.length"
     class="text-p1 flex items-center gap-0 hover:gap-8 transition-[gap] duration-300 ease-in-out"
   >
-    <img
+    <BaseAvatar
       v-for="(point, index) in points"
       :key="point.name"
-      class="w-16 h-16 rounded-full cursor-pointer select-none"
+      class="icon--16 rounded-full cursor-pointer select-none"
       :class="{ '-ml-6': index > 0 }"
       :src="getEulerLabelPointLogo(point.logo)"
-      alt="Points entity logo"
-      referrerpolicy="no-referrer"
-      draggable="false"
+      :label="point.name"
       @click="onPointClick(point, $event)"
-      @error="onLogoError($event, point.logo)"
       @contextmenu.prevent
-    >
+    />
   </div>
 </template>
diff --git a/components/entities/vault/VaultPointsModal.vue b/components/entities/vault/VaultPointsModal.vue
index 48a1080f0..fb68569fe 100644
--- a/components/entities/vault/VaultPointsModal.vue
+++ b/components/entities/vault/VaultPointsModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { getEulerLabelEntityLogo, getEulerLabelPointLogo } from '~/entities/euler/labels'
+import { getEulerLabelPointLogo } from '~/entities/euler/labels'
 
 defineEmits(['close'])
 const { pointName, pointLogo, campaignType = 'deposit' } = defineProps<{
@@ -8,14 +8,6 @@ const { pointName, pointLogo, campaignType = 'deposit' } = defineProps<{
   campaignType?: 'deposit' | 'borrow'
 }>()
 
-const onLogoError = (event: Event) => {
-  const img = event.target as HTMLImageElement
-  if (!img.dataset.triedFallback) {
-    img.dataset.triedFallback = 'true'
-    img.src = getEulerLabelEntityLogo(pointLogo)
-  }
-}
-
 const escapeHtml = (unsafe: string): string => {
   return unsafe
     .replace(/&/g, '&amp;')
@@ -69,14 +61,12 @@ const formattedPointName = computed(() => convertMarkdownLinks(pointName))
   >
     <div class="flex items-center gap-12">
       <span class="text-p2">{{ campaignType === 'borrow' ? 'Borrowing earns' : 'Supply earns' }}</span>
-      <img
+      <BaseAvatar
         :src="getEulerLabelPointLogo(pointLogo)"
-        alt="Point logo"
-        referrerpolicy="no-referrer"
-        class="w-20 h-20 rounded-full"
-        @error="onLogoError"
-      >
-      <!-- eslint-disable vue/no-v-html -- trusted label content -->
+        :label="pointName"
+        class="icon--20 rounded-full"
+      />
+      <!-- eslint-disable vue/no-v-html -- formattedPointName escapes campaign text before adding links -->
       <span
         class="text-p2"
         v-html="formattedPointName"
diff --git a/components/entities/vault/overview/SecuritizeVaultOverview.vue b/components/entities/vault/overview/SecuritizeVaultOverview.vue
index 5febee351..f2479a560 100644
--- a/components/entities/vault/overview/SecuritizeVaultOverview.vue
+++ b/components/entities/vault/overview/SecuritizeVaultOverview.vue
@@ -161,7 +161,7 @@ const supplyCapPercentageDisplay = computed(() => {
         v-if="description"
         class="w-full rounded-12 p-16 bg-surface-tertiary"
       >
-        <!-- eslint-disable vue/no-v-html -- trusted label content -->
+        <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
         <p
           class="text-p3 text-content-secondary auto-link"
           v-html="autoLink(description)"
diff --git a/components/entities/vault/overview/VaultDeprecationBanner.vue b/components/entities/vault/overview/VaultDeprecationBanner.vue
index 17d8f6370..0de813786 100644
--- a/components/entities/vault/overview/VaultDeprecationBanner.vue
+++ b/components/entities/vault/overview/VaultDeprecationBanner.vue
@@ -11,7 +11,7 @@ defineProps<{ reason: string }>()
         name="warning"
         class="!w-20 !h-20 flex-shrink-0"
       />
-      <!-- eslint-disable vue/no-v-html -- deprecationReason is validated server-side in server/api/internal/labels/[file].get.ts -->
+      <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
       <p
         v-if="reason"
         class="text-p3 text-warning-500 auto-link"
diff --git a/components/entities/vault/overview/VaultOverviewBlockGeneral.vue b/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
index cf0b1c65d..88d4644c3 100644
--- a/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
+++ b/components/entities/vault/overview/VaultOverviewBlockGeneral.vue
@@ -169,7 +169,7 @@ watchEffect(() => {
         </p>
       </div>
     </div>
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <p
       v-if="description"
       class="text-p2 text-content-secondary auto-link"
diff --git a/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue b/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
index 9d1434ce0..cdc0ce864 100644
--- a/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
+++ b/components/entities/vault/overview/earn/VaultOverviewEarnBlockGeneral.vue
@@ -69,7 +69,7 @@ const feeDisplay = computed(() => {
         </p>
       </div>
     </div>
-    <!-- eslint-disable vue/no-v-html -- trusted label content -->
+    <!-- eslint-disable vue/no-v-html -- autoLink escapes label text before adding links -->
     <p
       v-if="earnDescription"
       class="text-p2 text-content-secondary auto-link"
diff --git a/composables/useDeployConfig.ts b/composables/useDeployConfig.ts
index 06c299080..fe1f9d680 100644
--- a/composables/useDeployConfig.ts
+++ b/composables/useDeployConfig.ts
@@ -6,8 +6,6 @@ export const useDeployConfig = () => {
     const s = String(val)
     return s !== 'false' && s !== '0'
   }
-  const labelsBaseUrl = (rc.configLabelsBaseUrl || '').trim().replace(/\/+$/, '')
-
   return {
     // URLs (empty string = not configured, hide UI element)
     docsUrl: rc.configDocsUrl,
@@ -28,11 +26,6 @@ export const useDeployConfig = () => {
     logoUrl: envConfig.logoUrl,
     socialImageUrl: envConfig.socialImageUrl,
 
-    // Repos (labelsRepo/branch/baseUrl still needed for logo URL construction)
-    labelsRepo: rc.configLabelsRepo || 'euler-xyz/euler-labels',
-    labelsRepoBranch: rc.configLabelsRepoBranch || 'master',
-    labelsBaseUrl,
-
     // Feature flags: all enabled by default, set env var to 'false' to disable
     enableTosSignature: !!rc.configTosMdUrl,
     enableEntityBranding: isEnabled(rc.configEnableEntityBranding),
diff --git a/composables/useEulerConfig.ts b/composables/useEulerConfig.ts
index 4628b9bae..4be1449b4 100644
--- a/composables/useEulerConfig.ts
+++ b/composables/useEulerConfig.ts
@@ -5,21 +5,12 @@ import {
 
 export const useEulerConfig = () => {
   const envConfig = useEnvConfig()
-  const { labelsRepo, labelsRepoBranch, labelsBaseUrl: configLabelsBaseUrl } = useDeployConfig()
-
-  const resolvedLabelsBaseUrl = (
-    configLabelsBaseUrl
-    || `https://raw.githubusercontent.com/${labelsRepo}/refs/heads/${labelsRepoBranch}`
-  ).replace(/\/+$/, '')
 
   return {
     // APIs (from constants)
     DEFILLAMA_YIELDS_URL,
     MERKL_API_BASE_URL,
 
-    // Labels
-    EULER_LABELS_ENTITY_LOGO_URL: `${resolvedLabelsBaseUrl}/logo`,
-
     // Runtime app config APIs
     SWAP_API_URL: envConfig.swapApiUrl,
     PYTH_HERMES_URL: envConfig.pythHermesUrl,
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index 4c02797d2..b7aca3ec1 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -12,7 +12,6 @@ import { toReactive, until } from '@vueuse/core'
 import { decodeFunctionResult, encodeFunctionData, type Hex, type PublicClient } from 'viem'
 import { computed, ref, shallowReactive, shallowRef, unref, type Ref } from 'vue'
 import { logWarn } from '~/utils/errorHandling'
-import { invalidateSdkQueries } from '~/utils/sdk-query-cache'
 import type { EulerLabelEntity, EulerLabelProduct, EulerLabelPointReward } from '~/entities/euler/labels'
 import { eulerLabelProductEmpty } from '~/entities/euler/labels'
 import { getEulerSdk } from '~/composables/useEulerSdk'
@@ -21,20 +20,11 @@ import { erc4626AssetAbi } from '~/abis/erc4626'
 import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
 import {
-  fetchPublicLabelsData,
+  normalizePublicLabelsData,
   type MigratedEulerLabelsData,
-  type PublicLabelsQuery,
-  type PublicLabelsResponse,
+  type PublicLabelsBundle,
 } from '~/utils/public-labels'
 
-const LABEL_QUERY_NAMES = [
-  'queryEulerLabelsEntities',
-  'queryEulerLabelsProducts',
-  'queryEulerLabelsPoints',
-  'queryEulerLabelsEarnVaults',
-  'queryEulerLabelsAssets',
-] as const
-
 const createEmptyEulerLabelsData = (): MigratedEulerLabelsData => ({
   products: {},
   entities: {},
@@ -121,22 +111,17 @@ const getLabelsFetch = (chainId: number, forceRefresh: boolean) => {
   const pendingFetch = pendingLabelsFetches.get(chainId)
   if (pendingFetch && !forceRefresh) return pendingFetch
 
-  const request = async <T>(path: string, query: PublicLabelsQuery): Promise<PublicLabelsResponse<T>> =>
-    $fetch<PublicLabelsResponse<T>>(`/api/internal/v3${path}`, { query })
-
   const fetchPromise = (async () => {
-    if (forceRefresh) await invalidateSdkQueries([...LABEL_QUERY_NAMES])
-    const sdk = await getEulerSdk()
-    const legacy = sdk.eulerLabelsService.fetchEulerLabelsData(chainId)
     try {
-      return await fetchPublicLabelsData(request, chainId, undefined, legacy)
+      const bundle = await $fetch<PublicLabelsBundle>('/api/internal/public-labels', {
+        query: { chainId },
+        ...(forceRefresh && { headers: { 'cache-control': 'no-cache' } }),
+      })
+      return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
     }
     catch (error) {
       logWarn('labels/public-v3', error)
-      return {
-        ...await legacy,
-        rawGeoPolicies: [],
-      } as MigratedEulerLabelsData
+      throw error
     }
   })()
 
diff --git a/composables/useEulerSdk.ts b/composables/useEulerSdk.ts
index c3e7ca4b7..0928f2723 100644
--- a/composables/useEulerSdk.ts
+++ b/composables/useEulerSdk.ts
@@ -95,8 +95,7 @@ const buildV3ProxyApiPath = () => buildAppApiPath(INTERNAL_API_BASE)
 // one server-side TTL cache across browser tabs, (2) take the cold-TLS
 // hit once at proxy startup rather than on every user, and (3) keep
 // upstream URLs (and any auth) server-only. See
-// `server/api/internal/proxy/{merkl,fuul,incentra,subgraph}/[...path].ts` and
-// `server/api/internal/labels/[chainId]/[file].get.ts`.
+// `server/api/internal/proxy/{merkl,fuul,incentra,subgraph}/[...path].ts`.
 const buildMerklProxyApiPath = () => buildAppApiPath('/api/internal/proxy/merkl')
 const buildFuulProxyApiPath = (path = '') =>
   buildAppApiPath(`/api/internal/proxy/fuul${path ? `/${path.replace(/^\/+/, '')}` : ''}`)
@@ -109,7 +108,6 @@ const buildTurtleProxyApiPath = () => buildAppApiPath('/api/internal/proxy/turtl
 // the one actually serving queryAccountVaults.
 export const buildSubgraphProxyApiPath = (chainId: number) =>
   buildAppApiPath(`/api/internal/proxy/subgraph/${chainId}`)
-const buildLabelsProxyApiPath = () => buildAppApiPath('/api/internal/labels')
 const buildMorphoProxyApiPath = () => buildAppApiPath('/api/internal/proxy/morpho')
 const buildAaveProxyApiPath = () => buildAppApiPath('/api/internal/proxy/aave')
 
@@ -166,7 +164,6 @@ const buildSdkStaticConfig = (backend: SdkBackend) => {
   const oracleChecksBaseUrl = cleanUrl(rc.configOracleChecksBaseUrl)
   const swapApiUrl = cleanUrl(rc.swapApiUrl)
   const v3ApiUrl = buildV3ProxyApiPath()
-  const labelsProxyUrl = buildLabelsProxyApiPath()
   const subgraphUrls = buildSubgraphUrlMap()
   const { enableV3Backend, browserVaultSource, eulerInterfacesBranch } = useEnvConfig()
   // 'fast' resolves to whatever NUXT_PUBLIC_BROWSER_VAULT_SOURCE pins.
@@ -182,11 +179,6 @@ const buildSdkStaticConfig = (backend: SdkBackend) => {
     ...(v3ApiUrl ? { v3ApiUrl, tokenlistApiBaseUrl: v3ApiUrl, intrinsicApyV3ApiUrl: v3ApiUrl } : {}),
     eulerInterfacesBranch,
     deploymentsUrl: buildAppApiPath('/api/internal/euler-chains'),
-    // Labels always go through the local /api/internal/labels proxy. Server-side env
-    // (`NUXT_PUBLIC_CONFIG_LABELS_BASE_URL`/`*_REPO`) controls where the proxy
-    // fetches upstream, so callers see a single internal hostname. Same
-    // pattern as `tokenlistApiBaseUrl` above.
-    eulerLabelsBaseUrl: labelsProxyUrl,
     ...(oracleChecksBaseUrl ? { oracleAdaptersBaseUrl: oracleChecksBaseUrl } : {}),
     ...(swapApiUrl ? { swapApiUrl } : {}),
     ...(enableMerkl ? { rewardsMerklApiUrl: buildMerklProxyApiPath() } : { rewardsEnableMerkl: false }),
diff --git a/docs/architecture.md b/docs/architecture.md
index bbc48c057..9ef290556 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -182,8 +182,8 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 ├─────────────────────────────────────────────────────────────────┤
 │              Server-Side Proxy Layer (Nuxt server/)             │
 │  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐                │
-│  │ /api/internal│ │ /api/internal/pyth   │ │ /api/internal/labels │                │
-│  │ /token-list │ │ /updates    │ │ /rpc/[chain]│                │
+│  │ /api/internal│ │ /api/internal/pyth   │ │ /api/internal/public │                │
+│  │ /token-list │ │ /updates    │ │ -labels, /rpc/[chain]│       │
 │  └─────────────┘ └─────────────┘ └─────────────┘                │
 ├─────────────────────────────────────────────────────────────────┤
 │                    External Services                            │
@@ -195,14 +195,13 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 └─────────────────────────────────────────────────────────────────┘
 ```
 
-**Server-Side Proxy Layer**: External data sources (token lists, Pyth Hermes, labels, oracle checks, RPC) are proxied through Nuxt server endpoints rather than called directly from the browser. This provides caching, rate limiting, CORS avoidance, and keeps credentials server-side. Vault reads use the Euler SDK from the client layer. See [Development Guide - Server-Side Data Proxies](./development-guide.md#server-side-data-proxies) for the full endpoint reference.
+**Server-Side Proxy Layer**: External data sources (token lists, Pyth Hermes, Public Labels, oracle checks, RPC) are reached through Nuxt server endpoints rather than called directly from the browser. This provides caching, rate limiting, CORS avoidance, and keeps credentials server-side. Vault reads use the Euler SDK from the client layer. See [Development Guide - Server-Side Data Proxies](./development-guide.md#server-side-data-proxies) for the full endpoint reference.
 
 **Proxy cache strategy**:
 
 | Endpoint | TTL | Notes |
 |----------|-----|-------|
-| `/api/internal/labels/{file}` | 5 min | Query-shape labels endpoint (`?chainId=N`); used internally by Lite helpers. 404 → empty shape; stale-fallback on upstream error |
-| `/api/internal/labels/{chainId}/{file}` | 5 min | Path-shape labels endpoint matching the SDK's default `eulerLabelsBaseUrl` template; shares the underlying cache with the query-shape route |
+| `/api/internal/public-labels` | 5 min | One chain/version-scoped Public Labels V3 bundle; in-flight dedup and bounded stale fallback |
 | `/api/internal/token-list` | 5 min | Four sources merged via `Promise.allSettled` (Euler SDK, DefiLlama, Uniswap, Merkl); per-source cache with stale fallback |
 | `/api/internal/oracle-adapter` | 5 min | Lazy per-address fetch |
 | `/api/internal/euler-chains` | 5 min | Static chain-agnostic config from `euler-interfaces` repo |
@@ -215,7 +214,7 @@ The application follows Vue 3's Composition API pattern, organizing code into lo
 
 Every cacheable proxy above uses the same pattern: TTL cache for fresh hits, stale-cache fallback on upstream failure, and in-flight request deduplication so concurrent cache-miss callers (e.g. warm-cache racing real traffic) collapse onto a single upstream fetch per cache key. The in-flight dedup pattern itself is a shared util — `createInFlightDedup` / `scheduleBackgroundRefresh` in `server/utils/in-flight.ts`. The per-host proxies (`/api/internal/proxy/{merkl,fuul,incentra,subgraph}`) share a common forwarder at `server/utils/external-proxy.ts`.
 
-`server/plugins/warm-cache.ts` pre-populates labels and token-list for every enabled chain, plus `/api/internal/euler-chains` once globally, on a 5-min cycle. The vault snapshot runs on its own faster timer (1 min when V3 is configured, 5 min otherwise) so V3-backed refreshes stay tight without hammering upstream. Every warm task is a **direct function call** to a `refreshX()` that bypasses the handler's fresh-cache short-circuit and writes straight to the cache. This matters: if warm cycled via HTTP, the handler would short-circuit on the still-fresh entry from the previous cycle (age ≈ TTL − 2 s) and the entry would then expire with no refresh until the next cycle — leaving a stale window per cycle. With direct refresh calls, the cache is always rewritten while the previous entry is still serving live traffic, so user requests arriving during a refresh continue to read the fresh previous entry (no blocking on the in-flight refresh). Warming runs fire-and-forget so Nitro's listener is never delayed; caches are typically hot within ~5 s of boot, and users arriving before that just pay the usual cold-upstream latency for whichever endpoints they hit.
+`server/plugins/warm-cache.ts` pre-populates the Public Labels bundle, its temporary effective-policy overlay, and the token list for every enabled chain, plus Euler Chains once globally, on a 5-minute cycle. The vault snapshot runs on its own faster timer (1 minute when V3 is configured, 5 minutes otherwise). Warm calls refresh the shared utilities directly; concurrent requests deduplicate against the same in-flight work, and stale fallback is bounded by `createTtlCache`.
 
 For the full setup — per-host proxies, vault snapshot pipeline, two-pass client hydration, V3-conditional cadence, and the bigint wire codec — see [Server-Side Caching](./server-side-caching.md).
 
diff --git a/docs/development-guide.md b/docs/development-guide.md
index 55fbef5b6..39f8f0c08 100644
--- a/docs/development-guide.md
+++ b/docs/development-guide.md
@@ -73,7 +73,7 @@ Configuration is split into two mechanisms:
 
 1. **`useEnvConfig()`** (`composables/useEnvConfig.ts`) — API URLs, Pyth, Reown, branding, and deployment announcements. Injected at runtime via `server/plugins/app-config.ts` into `window.__APP_CONFIG__`, with `NUXT_PUBLIC_*` values as build-time fallbacks. Browser V3 data services use the same-origin `/api/internal/v3` proxy. The proxy reads `V3_API_URL`, `EULER_SDK_V3_API_URL`, or `NUXT_PUBLIC_V3_API_URL` for the upstream URL and `EULER_SDK_V3_API_KEY` for the optional server-side API key.
 
-2. **Nuxt `runtimeConfig`** (`useDeployConfig()`) — social links, feature flags, labels/oracle source URLs, and static deployment fallbacks. Set via `NUXT_PUBLIC_CONFIG_*` env vars. Includes `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL`, `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL`, and `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL` for configuring upstream data sources (GitHub or S3/CDN). All three are fetched through server-side proxy endpoints with 5-minute caching — see [Server-Side Data Proxies](#server-side-data-proxies) below.
+2. **Nuxt `runtimeConfig`** (`useDeployConfig()`) — social links, feature flags, oracle source URLs, and static deployment fallbacks. Set via `NUXT_PUBLIC_CONFIG_*` env vars. The temporary visibility/geo compatibility policy is server-only and configured through `EFFECTIVE_POLICY_*`; display content comes from Public Labels V3. `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL` and `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL` configure their respective upstream data sources.
 
 3. **Chain config** (`useChainConfig()`) — derived dynamically from `RPC_URL_<chainId>` env vars at server startup, injected via `window.__CHAIN_CONFIG__`.
 
@@ -85,13 +85,12 @@ Announcement modal content can be supplied as runtime `CONFIG_ANNOUNCEMENT_TITLE
 
 ## Server-Side Data Proxies
 
-External metadata (contract addresses, labels, oracle checks) is fetched through Nuxt server proxy endpoints rather than directly from GitHub/CDN. This deduplicates upstream requests across users, adds stale-fallback resilience, and avoids GitHub rate limits.
+External metadata (contract addresses, Public Labels, oracle checks) is fetched through Nuxt server endpoints rather than directly from the browser. This deduplicates upstream requests across users, adds stale-fallback resilience, and avoids upstream rate limits.
 
 | Endpoint | Upstream source | Cache TTL | Env var override |
 |----------|----------------|-----------|------------------|
 | `GET /api/internal/euler-chains` | `EulerChains.json` from `EULER_SDK_EULER_INTERFACES_BRANCH` (`master`) | 5 min | `NUXT_PUBLIC_CONFIG_EULER_CHAINS_URL` when no interfaces branch is configured |
-| `GET /api/internal/labels/:file?chainId=X` | `{chainId}/{file}` from euler-labels (query-shape; used by Lite helpers). Reads through the shared TTL cache — a fresh entry short-circuits without upstream. | 5 min read-through | `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` |
-| `GET /api/internal/labels/:chainId/:file` | `{chainId}/{file}` from euler-labels (path-shape; SDK `eulerLabelsBaseUrl` template). Calls `refreshLabelFile()` directly — bypasses the fresh-cache check and joins any in-flight refresh for the same `scope:file`. Shared cache is write + stale-fallback only on this route. | 5 min shared cache (stale fallback; not read-through) | `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` |
+| `GET /api/internal/public-labels?chainId=X&version=latest` | Versioned Public Labels V3 content plus the temporary effective-policy overlay | 5 min server cache; 30 s browser/CDN | `V3_API_URL`, optional `EULER_SDK_V3_API_KEY`; `EFFECTIVE_POLICY_BASE_URL` for policy only |
 | `GET /api/internal/oracle-adapter?chainId=X&address=0x...` | Per-adapter JSON from oracle-checks | 5 min | `NUXT_PUBLIC_CONFIG_ORACLE_CHECKS_BASE_URL` |
 | `GET /api/internal/token-list?chainId=X` | Euler V3 + Uniswap + DefiLlama + Merkl reward-tokens | 5 min | `V3_API_URL`, `EULER_SDK_V3_API_URL`, `NUXT_PUBLIC_V3_API_URL`, `EULER_SDK_V3_API_KEY`, `NUXT_PUBLIC_CONFIG_UNISWAP_TOKEN_LIST_URL`, `NUXT_PUBLIC_CONFIG_DEFILLAMA_TOKEN_LIST_URL` |
 | `GET /api/internal/vaults?chainId=X` | Pre-computed chain vault snapshot built by the server-side SDK | 2 min (V3 configured) / 5 min (no V3) | `V3_API_URL`, `EULER_SDK_V3_API_URL`, `NUXT_PUBLIC_V3_API_URL` (presence selects cadence) |
@@ -102,14 +101,14 @@ External metadata (contract addresses, labels, oracle checks) is fetched through
 | `GET\|POST /api/internal/v3/...path` | Exact SDK-owned V3 endpoint allowlist (`tokens`, `prices`, APYs, rewards, account positions, activity/liquidations, vault reads, vault batch/resolve) | none — forwards upstream; `503` during failure backoff | `V3_API_URL`, `EULER_SDK_V3_API_URL`, `NUXT_PUBLIC_V3_API_URL`, `EULER_SDK_V3_API_KEY` |
 | `GET /api/internal/pyth/updates?ids[]=...` | Pyth Hermes (`https://hermes.pyth.network/v2/updates/price/latest`) | No cache | `PYTH_API_KEY` (server-only) |
 
-All listed endpoints use rate limiting. Local-TTL endpoints (everything in the table except `/api/internal/v3/...` and `/api/internal/pyth/updates`) return stale cached data when upstream is unavailable. The V3 proxy has no local TTL cache: it forwards the upstream response, or returns `503` during failure backoff / upstream outage with `retry-after`. `/api/internal/pyth/updates` requires real-time data and returns no-store cache headers. The shared caching utility is in `server/utils/cache.ts`; the per-host external proxies share `server/utils/external-proxy.ts`. See [Server-Side Caching](./server-side-caching.md) for V3 allowlist, backoff, and labels handler divergence detail.
+All listed endpoints use rate limiting. Local-TTL endpoints (everything in the table except `/api/internal/v3/...` and `/api/internal/pyth/updates`) return bounded stale cached data when upstream is unavailable. The V3 proxy has no local TTL cache: it forwards the upstream response, or returns `503` during failure backoff / upstream outage with `retry-after`. `/api/internal/pyth/updates` requires real-time data and returns no-store cache headers. The shared caching utility is in `server/utils/cache.ts`; the per-host external proxies share `server/utils/external-proxy.ts`. See [Server-Side Caching](./server-side-caching.md) for details.
 
 **Startup cache warming**: `server/plugins/warm-cache.ts` runs at Nitro startup. Two timers:
 
-- **Global cycle (5 min)**: `/api/internal/euler-chains` once, cross-chain `labels/all/assets.json` once, then per-chain `/api/internal/labels/*` and `/api/internal/token-list` for every enabled non-deprecated chain, serialized so cross-chain upstreams dedupe via the in-flight cache.
+- **Global cycle (5 min)**: Euler Chains once, the cross-chain effective asset policy once, then each enabled non-deprecated chain's Public Labels bundle, effective product/Earn/asset policy, and token list.
 - **Vaults cycle (1 min when V3 is configured, otherwise 5 min)**: `/api/internal/vaults` per chain, also serialized.
 
-Each warm task is a **direct function call** (`refreshX()`) that bypasses any handler fresh-cache short-circuit and forces an upstream fetch, so the entry is always overwritten before it can expire. Handlers that read through the cache (query-shape labels, vault snapshot, and similar) keep serving the still-fresh previous entry during that refresh. The path-shape labels handler does not: it calls `refreshLabelFile()` and joins the in-flight refresh instead. Warming runs in the background — Nitro's node-server preset doesn't await plugins before starting the HTTP listener, so users arriving in the first ~5 s of a freshly-booted instance's lifetime pay the usual cold-upstream latency for whichever endpoints they hit; everyone after that sees cached responses from read-through handlers.
+Each warm task is a **direct function call** (`refreshX()`) that forces an upstream fetch and replaces the cached value before expiry. Concurrent refreshes join the same in-flight operation; request paths continue to use the previous fresh value or the bounded stale fallback. Warming runs in the background — Nitro's node-server preset does not await plugins before starting the HTTP listener, so users arriving in the first few seconds of a freshly booted instance may pay the cold-upstream latency.
 
 For the full setup — per-host proxies, vault snapshot pipeline, two-pass client hydration, V3-conditional cadence, and the bigint wire codec — see [Server-Side Caching](./server-side-caching.md).
 
diff --git a/docs/geo-blocking.md b/docs/geo-blocking.md
index bdc494628..0eab6fac4 100644
--- a/docs/geo-blocking.md
+++ b/docs/geo-blocking.md
@@ -110,7 +110,7 @@ This list is checked first. If the user's country matches, the function returns
 
 ### 2. Product-Level Blocks
 
-Each product in `products.json` (from the euler-labels repo) can have a `block` array of country codes or group aliases:
+Each product in the temporary effective-policy `products.json` can have a `block` array of country codes or group aliases:
 
 ```json
 {
@@ -143,7 +143,7 @@ When a vault has an override with a `block` field, the override **replaces** (no
 
 ### 4. Earn Vault Blocks
 
-Earn vaults have a separate blocking mechanism in `earn-vaults.json`. Entries can be a plain address string (no blocking) or an object with a `block` array:
+Earn vaults have a separate blocking mechanism in the temporary effective-policy `earn-vaults.json`. Entries can be a plain address string (no blocking) or an object with a `block` array:
 
 ```json
 [
@@ -156,7 +156,7 @@ These are stored in a dedicated `earnVaultBlocks` map (keyed by lowercase addres
 
 ### 5. Asset-Level Blocks
 
-A vault's **underlying ERC-20 asset** can carry its own block rules in `assets.json` (from the euler-labels repo). When the user's country matches a rule for a vault's underlying asset, the vault is treated as blocked — in addition to any product-level or earn-level rules. This is the primary mechanism for compliance-driven blocks that apply to a token regardless of which vault wraps it.
+A vault's **underlying ERC-20 asset** can carry its own block rules in the temporary effective-policy `assets.json`. When the user's country matches a rule for a vault's underlying asset, the vault is treated as blocked — in addition to any product-level or earn-level rules. This is the primary mechanism for compliance-driven blocks that apply to a token regardless of which vault wraps it.
 
 The same rules also drive the `SwapTokenSelector`, so users cannot route around a vault block by picking the blocked underlying as a pay-with, withdraw-to, borrow swap-in, or swap-deposit source.
 
@@ -173,7 +173,7 @@ Stored in the `assetBlocks` and `assetRestrictions` maps (keyed by lowercase add
 
 #### Pattern-based entries
 
-External token lists (Uniswap, DefiLlama, Merkl) surface addresses the labels repo hasn't enumerated. When a given issuer publishes many tokens with a shared naming convention (e.g. Ondo's USDY, OUSG, OMPL), pattern rules match by symbol or name instead of address:
+External token lists (Uniswap, DefiLlama, Merkl) surface addresses the temporary effective-policy source has not enumerated. When a given issuer publishes many tokens with a shared naming convention (e.g. Ondo's USDY, OUSG, OMPL), pattern rules match by symbol or name instead of address:
 
 ```json
 [
@@ -191,7 +191,7 @@ External token lists (Uniswap, DefiLlama, Merkl) surface addresses the labels re
 
 #### Cross-chain rules: `all/assets.json`
 
-Per-chain `assets.json` files (e.g. `1/assets.json`, `8453/assets.json`) are the right home for address-based rules because addresses are chain-specific. Pattern rules usually apply identically across every chain (USDY is USDY wherever it's deployed), so the labels repo hosts them in a special cross-chain directory:
+Per-chain `assets.json` files (e.g. `1/assets.json`, `8453/assets.json`) are the right home for address-based rules because addresses are chain-specific. Pattern rules usually apply identically across every chain (USDY is USDY wherever it is deployed), so the temporary effective-policy repository hosts them in a cross-chain directory:
 
 ```text
 euler-labels/
@@ -200,7 +200,7 @@ euler-labels/
 └── all/assets.json        ← cross-chain rules (usually patterns)
 ```
 
-The `/api/internal/labels/assets.json?chainId=N` proxy transparently **unions** the per-chain file with `all/assets.json` before returning — the client sees a single merged list. If either file is absent upstream the proxy serves only the present side (empty-shape fallback on 404, matching every other label file). Both files accept both shapes; conventionally addresses live per-chain and patterns live in `all/`, but nothing enforces that split.
+`server/utils/labels-source.ts` **unions** the per-chain file with `all/assets.json` while assembling the server-side effective policy. If either file is absent upstream it uses only the present side. Both files accept both shapes; conventionally addresses live per-chain and patterns live in `all/`, but nothing enforces that split.
 
 The global file is warmed once on server boot in `warm-cache.ts` alongside the per-chain entries.
 
@@ -417,18 +417,13 @@ App Startup
   │                  undefined → null (fail-closed) on unknown/error (prod)
   │                  undefined → "--" (non-null sentinel, fail-open) on unknown in dev
   │
-  └─ loadLabels() ──► euler-labels data source (GitHub or S3/CDN) ─► products.json ─► product.block
-                                                                    product.vaultOverrides[addr].block
-                                                                    product.vaultOverrides[addr].restricted
-                                                 ► earn-vaults.json ─► earnVaultBlocks map
-                                                                       earnVaultRestrictions map
-                                                 ► assets.json ─────► union of {chainId}/assets.json
-                                                                       + all/assets.json
-                                                                     → assetBlocks / assetRestrictions maps
-                                                                       (address entries)
-                                                                     → assetPatternRules list
-                                                                       (compiled symbols/regex)
-                                                   (5-min cache)
+  └─ loadLabels() ──► /api/internal/public-labels
+                       ├─ Public Labels V3: products, vault content, entities, campaigns
+                       └─ temporary effective policy:
+                            products.json ─► product/vault block + restriction maps
+                            earn-vaults.json ─► Earn block + restriction maps
+                            chain/all assets.json ─► exact + pattern asset rules
+                          (5-min server cache)
 
 Server-Side (every API request):
   geo-gate.ts reads CF-IPCountry
@@ -492,16 +487,16 @@ All blocking and restriction configuration lives outside the app codebase:
 |------|-------|--------|
 | Global sanctions list | `entities/constants.ts` — `SANCTIONED_COUNTRIES` | Blocks all vaults for listed countries |
 | Country group definitions | `entities/constants.ts` — `COUNTRY_GROUPS` | Defines EU, EEA, EFTA aliases |
-| Product-level blocks | `euler-labels` repo — `products.json` `block` field | Blocks all vaults in a product |
-| Per-vault block overrides | `euler-labels` repo — `products.json` `vaultOverrides[addr].block` | Overrides product block for one vault |
-| Per-vault restrictions | `euler-labels` repo — `products.json` `vaultOverrides[addr].restricted` | Soft-restricts one vault (no product fallback) |
-| Earn vault blocks | `euler-labels` repo — `earn-vaults.json` `block` field | Hard-blocks specific earn vaults |
-| Earn vault restrictions | `euler-labels` repo — `earn-vaults.json` `restricted` field | Soft-restricts specific earn vaults |
-| Asset-level blocks/restrictions (per-chain) | `euler-labels` repo — `{chainId}/assets.json` | Blocks/restricts any vault whose underlying is listed + the token in the swap picker |
-| Asset-level blocks/restrictions (cross-chain) | `euler-labels` repo — `all/assets.json` | Same as per-chain, usually pattern rules (`symbols`/`symbolRegex`/`names`/`nameRegex`) that apply on every chain |
+| Product-level blocks | Effective-policy source — `products.json` `block` field | Blocks all vaults in a product |
+| Per-vault block overrides | Effective-policy source — `products.json` `vaultOverrides[addr].block` | Overrides product block for one vault |
+| Per-vault restrictions | Effective-policy source — `products.json` `vaultOverrides[addr].restricted` | Soft-restricts one vault (no product fallback) |
+| Earn vault blocks | Effective-policy source — `earn-vaults.json` `block` field | Hard-blocks specific earn vaults |
+| Earn vault restrictions | Effective-policy source — `earn-vaults.json` `restricted` field | Soft-restricts specific earn vaults |
+| Asset-level blocks/restrictions (per-chain) | Effective-policy source — `{chainId}/assets.json` | Blocks/restricts any vault whose underlying is listed + the token in the swap picker |
+| Asset-level blocks/restrictions (cross-chain) | Effective-policy source — `all/assets.json` | Same as per-chain, usually pattern rules (`symbols`/`symbolRegex`/`names`/`nameRegex`) that apply on every chain |
 | Dev country simulation | `.env` — `DEV_GEO_COUNTRY=GB` | Simulates a country in dev (no effect outside dev) |
 
-Changes to `products.json`, `earn-vaults.json`, `{chainId}/assets.json`, or `all/assets.json` in the euler-labels data source (GitHub repo or S3/CDN) take effect within 5 minutes (the label cache TTL) without any app deployment.
+Changes to the effective-policy files take effect within 5 minutes without an app deployment. This compatibility source remains necessary until V3 publishes the resolved global/product/vault/asset precedence; raw V3 geo-policy rows are not applied directly.
 
 ## Key Files
 
@@ -511,10 +506,11 @@ Changes to `products.json`, `earn-vaults.json`, `{chainId}/assets.json`, or `all
 | `server/middleware/cors.ts` | Strips client `x-country-code`, derives authoritative value from `CF-IPCountry`, emits as response header |
 | `server/middleware/geo-gate.ts` | Server-side sanctioned-country block; fail-closed on unknown country in prod |
 | `composables/useGeoBlock.ts` | Core blocking logic, `isVaultBlockedByCountry`, `isVaultRestrictedByCountry`, `isAssetBlockedByCountry`, `isAssetRestrictedByCountry`, `getVaultTags`; `AssetLike` type |
-| `composables/useEulerLabels.ts` | SDK-backed label loading and current label snapshot |
+| `composables/useEulerLabels.ts` | Aggregate Public Labels loading and current normalized snapshot |
 | `utils/eulerLabelsUtils.ts` | Getter helpers `getVaultBlock`, `getEarnVaultBlock`, `getVaultRestricted`, `getEarnVaultRestricted`, `getAssetBlock`, `getAssetRestricted`, `getAssetPatternRules` |
-| `server/api/internal/labels/[file].get.ts` | Labels proxy. Unions `{chainId}/assets.json` with `all/assets.json`. Validates `symbolRegex` / `nameRegex` (compile check + 512-char cap). `refreshLabelFile(scope, file)` where `scope: number \| 'all'` |
-| `server/plugins/warm-cache.ts` | Warms `all/assets.json` once globally plus per-chain label files |
+| `server/utils/labels-source.ts` | Server-only compatibility policy fetch, validation, chain/global asset union, caching, and bounded stale fallback |
+| `server/utils/public-labels-source.ts` | Combines Public Labels V3 content with effective policy into one cached bundle |
+| `server/plugins/warm-cache.ts` | Warms Public Labels and effective policy |
 | `entities/constants.ts` | `SANCTIONED_COUNTRIES`, `COUNTRY_GROUPS` (EU/EEA/EFTA) |
 | `entities/euler/labels.ts` | TypeScript types (`EulerLabelProduct`, `EulerLabelVaultOverride`, `EulerLabelAssetEntry` union with address + pattern fields) |
 | `components/entities/asset/SwapTokenSelector.vue` | Arbitrary-asset selector. Disables blocked/restricted rows (mode-aware) via `getAssetGeoState(asset, mode)` |
diff --git a/docs/keyring-hooks.md b/docs/keyring-hooks.md
index e3aed7318..f9e28d901 100644
--- a/docs/keyring-hooks.md
+++ b/docs/keyring-hooks.md
@@ -10,13 +10,14 @@ Certain Euler vaults are configured with a **hook target** contract that interce
 
 ### Detection: Labels
 
-Keyring vaults are flagged via the labels system (`products.json`):
+Keyring vaults are flagged through Public Labels `tags` on the vault. Lite emits
+a product-level tag only when every assigned vault carries the same tag:
 
 ```jsonc
 {
-  "private-market": {
+  "product": {
     "name": "Private Market",
-    "tags": ["keyring"],       // All vaults in this product require keyring
+    "tags": ["keyring"],       // Derived only when every product vault has the tag
     "vaults": ["0x1234..."],
     "vaultOverrides": {
       "0x5678...": {
diff --git a/docs/public-api.md b/docs/public-api.md
index 5e71f8f23..f8818e291 100644
--- a/docs/public-api.md
+++ b/docs/public-api.md
@@ -16,12 +16,12 @@ A vault is **verified** through one of two paths:
 
 - **Escrow path**: the address appears in the on-chain set returned by `escrowedCollateralPerspective.verifiedArray()` for the chain. Escrow vaults are trusted unconditionally; no product, entity, or governor check applies.
 - **Label + authority path**:
-  - EVK / Securitize vaults must appear under a product's `vaults[]` or `deprecatedVaults[]` in `products.json`.
+  - EVK / Securitize vaults must be assigned to a Public Labels V3 product.
   - The product must declare at least one `entity` key.
   - The vault's `governorAdmin` must be in the `addresses` map of one of the product's declared entities. If the vault's oracle router has a non-zero governor, that governor must also match.
   - A product whose `entity` field is empty or omitted is treated as having no on-chain authority to claim the vault — every vault under such a product is unverified, regardless of its `governorAdmin`.
 
-Earn vaults listed only in `earn-vaults.json` are trusted on the strength of the Earn label entry. If an Earn vault also appears under a product, the current verifier applies an owner/entity match against that product; current labels do not use that shape.
+Standalone Earn vaults published in the V3 inventory are trusted on the strength of that label. If an Earn vault is assigned to a product, the verifier applies an owner/entity match against that product.
 
 For EVK / Securitize vaults, the same governor check applies to active and deprecated vaults — deprecation does not change the verification rule. The `notExplorable` flag does **not** change verification either: vaults hidden from Explore are still verified.
 
@@ -74,15 +74,15 @@ Addresses are validated via viem's `isAddress` (strict EIP-55 checks) and normal
 |--------|--------------------------------------------------------------------------|
 | `400`  | Missing/invalid `chainId`, `chainId` not supported by this deployment, >100 addresses, or a malformed address. |
 | `429`  | Rate limit exceeded for this client IP.                                  |
-| `502`  | All upstream sources (labels endpoint, chains config, RPC proxy) failed and no stale cache is available. |
+| `502`  | Public Labels V3, chains config, or RPC failed and no bounded stale cache is available. |
 
 ### Caching and propagation
 
 - **Response header**: `Cache-Control: public, max-age=30, stale-while-revalidate=30`. CDNs and browsers can cache for 30 s and serve stale for another 30 s while revalidating.
 - **Server-side cache**: per-chain in-memory verified set with a 5-minute TTL. A warm-cache process rebuilds every cache entry every 5 minutes on its own schedule (force-refresh, ignores fresh entries), so the cache is always continuously fresh in steady state.
 - **In-flight dedup**: concurrent cold requests for the same chain collapse onto a single upstream pass.
-- **Propagation**: on-chain governor changes and `products.json` / `entities.json` edits typically propagate within **~5 minutes**. The labels / vault snapshot and the verified-set cache are warmed on the same 5-minute cycle, so a label edit picked up by the labels cache flows into the next bridge rebuild within the same cycle.
-- **Stale fallback**: during prolonged upstream outages (labels endpoint, vault snapshot, or RPC failing), the bridge serves the last-known-good verified set for up to 10 minutes past TTL before returning a hard error.
+- **Propagation**: on-chain governor changes and `version=latest` Public Labels updates typically propagate within **~5 minutes**. Public Labels, the vault snapshot, and the verified-set cache are warmed on the same cycle.
+- **Stale fallback**: during upstream outages, the bridge serves only the last-known-good data within each cache's configured stale ceiling before returning a hard error.
 
 ### Rate limit
 
@@ -141,13 +141,13 @@ This endpoint answers "what is this vault?" — the trust verdict (`is-known`) i
 |-------------|----------|----------|-----------------------------------------------------------------------------|
 | `chainId`   | integer  | yes      | EVM chain ID (e.g. `1` for mainnet).                                        |
 | `addresses` | string   | no       | Comma-separated list of vault addresses. Max 100. Same casing rules as `/is-known`. Omit to return every known vault on the chain ("list mode"). |
-| `productId` | string   | no       | Product slug from `products.json` (e.g. `euler-prime`). When set, only entries whose `productId` equals this value are returned. Combines with `addresses`: an address that resolves but belongs to a different product returns `null`. `[a-zA-Z0-9_-]+`, max 100 chars. |
+| `productId` | string   | no       | Public Labels V3 product ID (e.g. `euler-prime`). When set, only entries whose `productId` equals this value are returned. Combines with `addresses`: an address that resolves but belongs to a different product returns `null`. `[a-zA-Z0-9_-]+`, max 100 chars. |
 
 ### Response
 
 Status `200`, JSON object keyed by EIP-55 checksum addresses.
 
-**Lookup mode** (`addresses` provided): one entry per input address. Unknown addresses (not in any labels file and not in the on-chain escrow perspective) resolve to `null`.
+**Lookup mode** (`addresses` provided): one entry per input address. Unknown addresses (not in Public Labels and not in the on-chain escrow perspective) resolve to `null`.
 
 **List mode** (`addresses` omitted): every known vault on the chain. No `null` values.
 
@@ -164,7 +164,7 @@ interface VaultMetadata {
   deprecationReason: string | null
   deprecated: boolean                        // true if listed under any product's deprecatedVaults or earn entry has deprecated: true
   governanceLimited: boolean                 // true when the owning product has the "governance limited" tag. False for vaults without a product.
-  productId: string | null                   // product slug from products.json that owns this vault; null for escrow and for vaults with no product entry
+  productId: string | null                   // Public Labels product ID; null for escrow and standalone vaults
   asset: {
     address: string                          // checksummed
     symbol: string
@@ -174,7 +174,7 @@ interface VaultMetadata {
   } | null
   entities: Array<{
     name: string
-    logo: string                             // full URL composed from the labels CDN config
+    logo: string                             // hosted URL from the Public Labels entity profile
     description: string | null
     url: string | null                       // entity website; only set when http(s) URL
   }>                                         // empty array when no entity matches (escrow, unverified, or no product); usually 0 or 1 entry, but can be N when a product declares multiple entities that all match the on-chain governor
@@ -183,18 +183,18 @@ interface VaultMetadata {
 
 ### Resolution rules
 
-Label-derived display fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`) are sourced from labels regardless of verification state — they are authoritative content set by the team that listed the vault. For product-owned EVK / Securitize vaults, per-vault `vaultOverrides` take precedence over product-level values. Earn vault metadata comes from the `earn-vaults.json` entry, with product fallback fields only if an Earn address is also present in `products.json`. The on-chain ERC-20 `name` is only a fallback when no label name is defined.
+Label-derived display fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`) are sourced from Public Labels V3 regardless of verification state. Vault fields take precedence over product fields. Standalone Earn metadata comes from its V3 inventory row. The on-chain ERC-20 `name` is only a fallback when no published label name is defined.
 
 `entities` identifies every declared product entity whose `addresses` contain the vault's `governorAdmin` (or `owner` for an Earn vault that also appears under a product). A product can declare multiple entity keys, and more than one of those can match — the array preserves the declared-key order. Resolution depends on the vault's verification state:
 
-- **Verified non-escrow vault** (governor match against at least one declared entity): `entities` contains every matching entity from `entities.json`, with `logo` composed as a full URL. Usually 1 entry, but can be N.
+- **Verified non-escrow vault** (governor match against at least one declared entity): `entities` contains every matching Public Labels entity profile, including its hosted `logo` URL. Usually 1 entry, but can be N.
 - **Unverified vault** (in labels but governor mismatch, or in a product that declares no entity): `entities` is `[]`. Other label fields (`name`, `description`, `portfolioNotice`, `deprecationReason`, `productId`, `deprecated`) are still populated. `asset` and `type` are also populated.
-- **Earn vault without a product entry** (`earn-vaults.json` only): `entities` is `[]`.
+- **Standalone Earn vault**: `entities` is `[]`.
 - **Escrow vault** (`escrowedCollateralPerspective.verifiedArray()`): `name` is the constant `"Escrowed collateral"`; all label-derived fields and `productId` are `null`; `entities` is `[]`; `deprecated: false`; `asset` comes from the snapshot when the address is in the referenced subset, otherwise `null`.
 
 The `deprecated` boolean distinguishes deprecated-but-otherwise-fine vaults from genuinely unverified ones. For EVK / Securitize vaults, the same governor check applies to deprecated and active vaults — deprecation only sets the `deprecated` flag and (typically) populates `deprecationReason`.
 
-Earn vaults resolve with `description` / `portfolioNotice` / `deprecationReason` from the earn entry. Current labels do not place Earn vaults in `products.json`, so they resolve with `productId: null` and `entities: []`.
+Standalone Earn vaults resolve with `description`, `portfolioNotice`, and `deprecationReason` from the V3 inventory row and return `productId: null`, `entities: []`.
 
 #### `entities` is not equivalent to `is-known`
 
@@ -208,7 +208,7 @@ Use `/api/public/is-known` for the verification verdict. Use the non-`null` / `n
 |--------|--------------------------------------------------------------------------|
 | `400`  | Missing/invalid `chainId`, `chainId` not supported, >100 addresses, or a malformed address. |
 | `429`  | Rate limit exceeded for this client IP.                                  |
-| `502`  | Required upstream sources (`products.json`, `entities.json`, vault snapshot) failed and no stale cache is available. |
+| `502`  | Required Public Labels V3, effective-policy, or vault-snapshot data failed and no stale cache is available. |
 
 ### Caching and propagation
 
@@ -260,7 +260,7 @@ curl 'https://<host>/api/public/metadata?chainId=1&addresses=0xD8b27CF359b7D1571
     "entities": [
       {
         "name": "Euler DAO",
-        "logo": "https://raw.githubusercontent.com/euler-xyz/euler-labels/refs/heads/master/logo/euler.svg",
+        "logo": "https://token-images.euler.finance/labels/euler",
         "description": "Euler DAO is responsible for the governance of the Euler protocol.",
         "url": "https://euler.finance"
       }
@@ -284,4 +284,4 @@ curl 'https://<host>/api/public/metadata?chainId=1'
 - Metadata builder + cache: `server/utils/vault-metadata.ts`
 - Shared verification rule (also used by the client UI): `utils/vault/governor-verification.ts`
 - CORS bypass for the `/api/public/` prefix lives in `server/middleware/cors.ts`.
-- Escrow vaults are read via an `eth_call` to `escrowedCollateralPerspective.verifiedArray()`. The perspective address is looked up from `EulerChains.json` (served by `/api/internal/euler-chains`), and the RPC endpoint is taken from `RPC_URL_<chainId>`. Products and earn-vault label files are fetched via internal self-calls to `/api/internal/labels/<file>` to reuse the labels endpoint's own cache and validation. Entity logo URLs are composed from `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` (or the `REPO`/`REPO_BRANCH` fallback) so they match the URL the app itself renders.
+- Escrow vaults are read via an `eth_call` to `escrowedCollateralPerspective.verifiedArray()`. The perspective address is looked up from `EulerChains.json` (served by `/api/internal/euler-chains`), and the RPC endpoint is taken from `RPC_URL_<chainId>`. Public endpoints use the same cached `getPublicEulerLabelsData()` source as the browser and vault snapshot; there are no internal self-HTTP label calls. Entity logo URLs come directly from Public Labels profiles.
diff --git a/docs/sdk-integration.md b/docs/sdk-integration.md
index f0047de9c..8d84853c1 100644
--- a/docs/sdk-integration.md
+++ b/docs/sdk-integration.md
@@ -90,7 +90,6 @@ The server-side snapshot builder has its own independent `SERVER_VAULT_CACHE_SOU
 | `v3ApiUrl`, `tokenlistApiBaseUrl` | `/api/internal` | V3 proxy with exact SDK browser endpoint allowlist (`server/api/internal/v3/[...path].ts`) |
 | `eulerInterfacesBranch` | `EULER_SDK_EULER_INTERFACES_BRANCH` (`master`) | Runtime Euler Interfaces ABI source |
 | `deploymentsUrl` | `/api/internal/euler-chains` | Local proxy |
-| `eulerLabelsBaseUrl` | `/api/internal/labels` | Path-shape labels endpoint (see [server-side caching](./server-side-caching.md)) |
 | `rewardsMerklApiUrl` | `/api/internal/proxy/merkl` | Merkl proxy |
 | `rewardsFuulApiUrl` | `/api/internal/proxy/fuul` | Fuul proxy |
 | `rewardsBrevisApiUrl` | `/api/internal/proxy/incentra/sdk/v1/eulerCampaigns` | Incentra/Brevis proxy |
diff --git a/docs/server-side-caching.md b/docs/server-side-caching.md
index ba8143903..3db00e205 100644
--- a/docs/server-side-caching.md
+++ b/docs/server-side-caching.md
@@ -1,6 +1,6 @@
 # Server-Side Caching
 
-Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, the labels repo, the Euler V3 backend, and the chain RPC. The layer accomplishes four things:
+Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, Public Labels V3, the temporary effective-policy source, and the chain RPC. The layer accomplishes four things:
 
 1. **Cross-tab sharing.** Every browser session against the same origin hits the same in-process cache.
 2. **Authentication / credentials stay server-side.** Browsers don't need V3 API keys, subgraph project IDs, or any provider tokens.
@@ -18,8 +18,9 @@ This document covers the per-host proxies, the vault snapshot pipeline, the warm
 | `server/api/internal/proxy/fuul/[...path].ts` | Proxies Fuul (`api.fuul.xyz/api/v1`) |
 | `server/api/internal/proxy/incentra/[...path].ts` | Proxies Incentra / Brevis (`incentra-prd.brevis.network`) |
 | `server/api/internal/proxy/subgraph/[chainId].post.ts` | Proxies the per-chain Goldsky subgraph |
-| `server/api/internal/labels/[file].get.ts` | Query-shape labels endpoint (`?chainId=X`) — used internally |
-| `server/api/internal/labels/[chainId]/[file].get.ts` | Path-shape labels endpoint — matches the SDK's default URL template |
+| `server/api/internal/public-labels.get.ts` | Chain/version-scoped aggregate Public Labels endpoint |
+| `server/utils/public-labels-source.ts` | Public Labels V3 pagination, 5-minute cache, in-flight dedup, and bounded stale fallback |
+| `server/utils/labels-source.ts` | Temporary effective visibility/geo policy source used until V3 publishes resolved policy |
 | `server/api/internal/v3/[...path].ts` | Rate-limited V3 backend proxy for SDK browser endpoints (`/api/internal/v3/...` → `v3.euler.finance/v3/...`) |
 | `server/api/internal/vaults.get.ts` | Per-chain consolidated vault snapshot endpoint |
 | `server/utils/vaults-cache.ts` | `refreshChainVaults` + `vaultsCache` |
@@ -67,16 +68,11 @@ Each proxy carries a rate limiter (`createRateLimiter`) and returns 405 for disa
 - **Goldsky subgraph**: Each chain's URL is a per-deployment Goldsky deployment ID. Proxying keeps the project ID server-side and amortizes GraphQL responses across tabs.
 - **Merkl**: CORS, plus credential handling.
 
-### Labels
+### Public Labels
 
-Two endpoints, same `refreshLabelFile` engine:
+`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines that immutable display dataset with the temporary effective-policy overlay. The result is cached for 5 minutes by chain and version, concurrent misses share one in-flight operation, and an upstream failure can serve only the bounded stale entry.
 
-- **`/api/internal/labels/{file}?chainId=N`** (`[file].get.ts`) — query-shape, used by internal callers (`labels-helpers.ts`).
-- **`/api/internal/labels/{chainId}/{file}`** (`[chainId]/[file].get.ts`) — path-shape, matches the SDK's default `eulerLabelsBaseUrl` template (`${base}/{chainId}/{file}.json`). The SDK is pointed at `/api/internal/labels`, default templates land here.
-
-Both endpoints write to and fall back on the same in-memory TTL cache, but only the query-shape handler reads through it. It checks `cache.get()` first (and uses the `getOrRefresh` helper for the `assets.json` union), so a fresh entry short-circuits without touching upstream. The path-shape handler calls `refreshLabelFile` directly, and that function is the force-refresh primitive — it skips the fresh-entry check and only deduplicates while a fetch is in flight. Every path-shape request therefore reaches upstream unless it coincides with an in-flight fetch for the same key, so the warm-cache entry acts as a stale fallback on that route rather than as a read-through cache. Since the SDK's default template targets the path shape, that is the route most label traffic takes. Warm callers (`warm-cache.ts`, `vaults-cache.ts`) use `refreshLabelFile` intentionally — see [Warm-Cache Plugin](#warm-cache-plugin) for why. The path handler's file header documents the shared TTL cache / upstream-fetch pipeline and that this route force-refreshes rather than reading through.
-
-Upstream is resolved by `NUXT_PUBLIC_CONFIG_LABELS_BASE_URL` if set, else `NUXT_PUBLIC_CONFIG_LABELS_REPO` + `NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH` → GitHub raw.
+The legacy `/api/internal/labels/*` browser and SDK routes do not exist. `server/utils/labels-source.ts` still reads only `products.json`, `earn-vaults.json`, and chain/global `assets.json` as a server-internal compatibility contract for effective `block`, `restricted`, and discovery visibility. It does not contribute names, descriptions, entities, logos, products, tags, campaigns, or deprecation content. `EFFECTIVE_POLICY_BASE_URL` configures only that policy source until V3 publishes the resolved effective decision. The former `NUXT_PUBLIC_CONFIG_LABELS_*` names remain server-side fallbacks for existing deployments but are no longer part of Nuxt public runtime config.
 
 ### V3 proxy
 
@@ -183,7 +179,7 @@ Pipeline:
 
 ```text
 1. getServerSdk(chainId)          // lazy per-chain server SDK; reused across requests
-2. getLabels(chainId)             // verified addresses, earn vaults (read via refreshLabelFile)
+2. getPublicEulerLabelsData(chainId) // shared normalized Public Labels bundle
 3. sdk.eVaultService.fetchVerifiedVaultAddresses(chainId, [ESCROW])   // escrow set
 4. sdk.vaultMetaService.fetchVaultTypes(chainId, candidates)          // partition EVK vs Securitize vs Earn
 5. Promise.all([
@@ -313,11 +309,11 @@ The pipeline always succeeds eventually — the snapshot is the *fast path*, not
 ```text
 Global cycle (5 min)                   Vaults cycle (1 min if V3, else 5 min)
 ─────────────────────                  ──────────────────────────────────────
-- /api/internal/euler-chains                    - refreshChainVaults(chain) for each
-- labels/all/assets.json                 enabled non-deprecated chain,
-- per-chain:                             sequential (lets cross-chain V3
-    labels/{file}.json (×5)              upstreams dedupe via in-flight)
-    /api/internal/token-list
+- Euler Chains                         - refreshChainVaults(chain) for each
+- cross-chain effective asset policy     enabled non-deprecated chain
+- per-chain Public Labels bundle
+- per-chain effective policy
+- per-chain token list
 ```
 
 Vault snapshot has its own faster timer because V3-backed refreshes are cheap — one batched POST per chain hitting V3's own cache. Pulling a fresh snapshot every minute keeps it tight without hammering upstream. Without V3, the snapshot is built from heavier onchain lens multicalls, so it falls back to the global 5-min cadence.
@@ -326,9 +322,7 @@ When the two intervals are equal (V3 off), the timers naturally double-warm at e
 
 ### Why warm directly (not via HTTP)
 
-Every warm task is a **direct function call** (`refreshChainVaults(chainId)`, `refreshLabelFile(...)`, etc.) that bypasses the handler's fresh-cache short-circuit and writes straight to the cache. If we warm via HTTP, the handler short-circuits on the still-fresh previous entry (age ≈ TTL − 2 s) and the entry then expires without refresh until the next cycle — leaving a stale window per cycle. Direct calls ensure the entry is always rewritten *before* it expires.
-
-User requests arriving during a refresh continue to read the still-fresh previous entry via the handler's own `cache.get()` short-circuit, so there's no blocking on the in-flight refresh. This holds for handlers that actually short-circuit — the vault snapshot endpoint and the query-shape labels endpoint. The path-shape labels endpoint calls `refreshLabelFile` instead of reading through, so a concurrent request there joins the in-flight refresh rather than being served the previous entry (see [Labels](#labels)).
+Every warm task is a **direct function call** (`refreshChainVaults(chainId)`, `refreshPublicLabelsBundle(...)`, `refreshLabelFile(...)`, etc.) that replaces the cache before expiry. The Public Labels and policy refreshers deduplicate concurrent work, while normal reads use the previous fresh value and failures can fall back only within the configured stale ceiling.
 
 ### Boot behaviour
 
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 9b01808d6..aac589b7a 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -8,7 +8,7 @@ Not all vaults on-chain are equal. Public Labels maps chain-scoped vault address
 
 ## Label Data Sources
 
-`useEulerLabels` reads the immutable Public Labels dataset from V3 through the same-origin `/api/internal/v3` proxy. Normal application traffic uses `version=latest`; deterministic tests use the published version pinned in `utils/public-labels.ts`. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
+`useEulerLabels` reads one chain-scoped bundle from `/api/internal/public-labels`. The server resolves `version=latest` once through the published-versions endpoint, then pins every page and entity-address read in that aggregate to the resulting immutable version. Deterministic tests request the published version pinned in `utils/public-labels.ts` directly. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
 
 | Public data | V3 path |
 |---|---|
@@ -18,15 +18,15 @@ Not all vaults on-chain are equal. Public Labels maps chain-scoped vault address
 | Entity governance addresses | `GET /entities/{entityId}/addresses?chainId=...` |
 | Geo policy records | `GET /geo-policies?version=...` |
 
-The vault inventory is a union of label and assessment records. Lite includes a row in label-derived listing or verification state when it has a product/entity assignment or published label content such as display metadata, deprecation, tags, or campaigns. Plain-address labels and assessment-only rows share the same empty content shape, so an empty row is retained only when the SDK compatibility snapshot classifies the same inventory address as a verified or Earn vault. Other assessment-only rows are ignored.
+The vault inventory is a union of label and assessment records. Lite includes a row in label-derived listing or verification state when it has a product/entity assignment or published label content such as display metadata, deprecation, tags, or campaigns. Plain-address labels and assessment-only rows share the same empty content shape, so an empty row is retained only when the effective-policy snapshot classifies the same inventory address as a verified or Earn vault. Other assessment-only rows are ignored.
 
 Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-The current V3 assessment and geo-policy records are not final eligibility decisions. Lite does not use raw `/evk/vaults/{chainId}/{address}/assessment` or `/earn/vaults/{chainId}/{address}/assessment` responses to hide or verify vaults, and it does not resolve global/product/vault/asset geo precedence from raw policy rows. Until V3 publishes an effective derived contract, Lite preserves the effective `block`, `restricted`, and discovery-visibility values supplied by the SDK labels service. Raw geo policies are retained as informational data only.
+The current V3 assessment and geo-policy records are not final eligibility decisions. Lite does not use raw `/evk/vaults/{chainId}/{address}/assessment` or `/earn/vaults/{chainId}/{address}/assessment` responses to hide or verify vaults, and it does not resolve global/product/vault/asset geo precedence from raw policy rows. Until V3 publishes an effective derived contract, the server reads only effective `block`, `restricted`, and discovery-visibility values from the compatibility policy source. That source contributes no display content. Raw V3 geo policies are retained as informational data only.
 
 Oracle adapter metadata is fetched from a separate repository ([oracle-checks](https://github.com/euler-xyz/oracle-checks)) by default, loaded lazily per adapter via `GET /api/internal/oracle-adapter?chainId=X&address=0x...`.
 
-**Caching and fallback**: Public Labels requests share the client label load's chain-scoped in-flight deduplication and refresh lifecycle. The V3 proxy is request-scoped; V3 owns upstream caching. If a Public Labels read fails, the current load falls back to the SDK compatibility-label snapshot and logs the V3 failure.
+**Caching and fallback**: The server bundle has a 5-minute chain/version cache, concurrent cold loads share one in-flight fetch, and failures can return a bounded stale bundle. The browser also deduplicates chain-scoped loads. There is no second display-label source: if V3 fails without a stale bundle, the load fails closed and the client publishes an empty label snapshot.
 
 **Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
 
@@ -42,6 +42,8 @@ Vault campaigns have a `name`, hosted `logo`, and `type` of `deposit` or `borrow
 
 Classification markers use vault `tags`. Current UI-recognized tags include `keyring`, `access control`, `governance limited`, `recently added`, `suppress high utilisation warning`, and `cyclical note`.
 
+Vault tags stay scoped to their vault override. A product-level tag is emitted only when every assigned vault carries that tag, so one vault's classification cannot leak to sibling vaults.
+
 ---
 
 ## Oracle Adapter Files (oracle-checks repo)
@@ -82,7 +84,7 @@ This keeps the bridge endpoint verification aligned with the UI: label/entity ma
 | Vault Source | Verification Method |
 |-------------|---------------------|
 | **EVaults** | Address appears in `verifiedVaultAddresses` from labels |
-| **Earn vaults** | Default repo: loaded from `eulerEarnGovernedPerspective` on-chain. Alternative repos: verified if in `earnVaults` from labels |
+| **Earn vaults** | Published Public Labels inventory, plus `eulerEarnGovernedPerspective` on-chain for governed Earn discovery |
 | **Escrow vaults** | Loaded from `escrowedCollateralPerspective` on-chain (always verified) |
 | **Securitize vaults** | Address appears in `verifiedVaultAddresses` from labels |
 | **Unknown vaults** | Resolved via subgraph; verified only if in labels |
@@ -205,12 +207,14 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 | `entities/euler/labels.ts` | TypeScript type definitions for all label types |
 | `utils/public-labels.ts` | Public V3 pagination, normalization, and effective-visibility composition |
 | `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the normalized label snapshot |
-| `composables/useEulerLabels.ts` | Chain-scoped Public Labels and compatibility-visibility loading |
+| `server/utils/public-labels-source.ts` | Shared V3 aggregate cache used by browser, public APIs, and vault snapshots |
+| `server/utils/labels-source.ts` | Server-only temporary effective-policy overlay |
+| `composables/useEulerLabels.ts` | Chain-scoped aggregate loading and normalized label publication |
 | `composables/useVaultRegistry.ts` | Vault registry with type detection and unknown resolution |
 | `composables/useGeoBlock.ts` | Geo-blocking logic using label block/restricted fields |
 
 ## Programmatic verification lookup
 
-External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. This server endpoint uses the compatibility-label snapshot plus the on-chain `escrowedCollateralPerspective`, applies governor / router-governor / owner verification, and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults. Escrow vaults from the on-chain perspective and earn entries with no product entry are trusted unconditionally.
+External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. This server endpoint uses the same normalized Public Labels bundle as the UI plus the on-chain `escrowedCollateralPerspective`, applies governor / router-governor / owner verification, and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults. Escrow vaults from the on-chain perspective and standalone Earn entries are trusted unconditionally.
 
 Consumers that need display metadata (resolved name, description, governing entity, asset) on top of the verification verdict can call [`GET /api/public/metadata`](./public-api.md#get-apipublicmetadata), which applies the same labels / override / verification rules the client UI uses and returns a uniform shape across EVK, Securitize, and Earn vaults.
diff --git a/entities/euler/labels.ts b/entities/euler/labels.ts
index f00f58a54..a9225cba1 100644
--- a/entities/euler/labels.ts
+++ b/entities/euler/labels.ts
@@ -129,12 +129,10 @@ export const eulerLabelProductEmpty = {
 } as EulerLabelProduct
 
 export const getEulerLabelEntityLogo = (fileName: string) => {
-  if (/^https?:\/\//i.test(fileName)) return fileName
-  const { EULER_LABELS_ENTITY_LOGO_URL } = useEulerConfig()
-  return `${EULER_LABELS_ENTITY_LOGO_URL}/${fileName}`
+  return /^https?:\/\//i.test(fileName) ? fileName : ''
 }
 
 export const getEulerLabelPointLogo = (fileName: string) =>
-  /^https?:\/\//i.test(fileName) ? fileName : `/entities/${fileName}`
+  /^https?:\/\//i.test(fileName) ? fileName : ''
 
 export const getEntityLogoLocalPath = (fileName: string) => `/entities/${fileName}`
diff --git a/nuxt.config.ts b/nuxt.config.ts
index ac7a5f64b..e99cba23f 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -143,10 +143,7 @@ export default defineNuxtConfig({
       // Absolute URL to an image used for social share previews (og:image /
       // twitter:image). Empty default so forks don't inherit our branding.
       configSocialImageUrl: '',
-      configLabelsRepo: 'euler-xyz/euler-labels',
-      configLabelsRepoBranch: 'master',
       configOracleChecksRepo: 'euler-xyz/oracle-checks',
-      configLabelsBaseUrl: '',
       configOracleChecksBaseUrl: '',
       configEulerChainsUrl: '',
       // Feature flags: enabled by default. Set to 'false' to disable.
@@ -312,7 +309,7 @@ export default defineNuxtConfig({
           'Cloudflare-CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
         },
       },
-      '/api/internal/labels/**': {
+      '/api/internal/public-labels': {
         headers: {
           'CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
           'Cloudflare-CDN-Cache-Control': 'public, s-maxage=30, stale-while-revalidate=60',
diff --git a/pages/borrow/index.vue b/pages/borrow/index.vue
index 78d86bf26..be15ec6b3 100644
--- a/pages/borrow/index.vue
+++ b/pages/borrow/index.vue
@@ -425,7 +425,7 @@ const marketOptions = computed(() => {
     counted.add(dedupKey)
     const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
     const entityObj = entityName ? entities[entityName] : null
-    return [{ key: market.name, label: market.name, tvl, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
+    return [{ key: market.name, label: market.name, tvl, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
   }))
 })
 
@@ -438,7 +438,7 @@ const riskManagerOptions = computed(() => {
       const dedupKey = `${entity.name}:${pair.borrow.address}`
       const tvl = counted.has(dedupKey) ? 0 : pairTvl
       counted.add(dedupKey)
-      return { key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined }
+      return { key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined }
     })
   }))
 })
diff --git a/pages/earn/index.vue b/pages/earn/index.vue
index 3b03cdc99..c040342aa 100644
--- a/pages/earn/index.vue
+++ b/pages/earn/index.vue
@@ -164,7 +164,7 @@ const curatorOptions = computed(() => {
   return buildTvlSortedOptions(list.value.flatMap((vault) => {
     const tvl = vaultTotalSupplyUsd.value.get(vault.address) ?? 0
     return getEntitiesByEarnVault(vault).map(entity => ({
-      key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
+      key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
     }))
   }))
 })
diff --git a/pages/explore/index.vue b/pages/explore/index.vue
index 561fc7345..8019fa894 100644
--- a/pages/explore/index.vue
+++ b/pages/explore/index.vue
@@ -111,7 +111,7 @@ const marketOptions = computed(() => {
       seenInGroup.add(market.name)
       const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
       const entityObj = entityName ? entities[entityName] : null
-      entries.push({ key: market.name, label: market.name, tvl: group.metrics.totalTVL, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined })
+      entries.push({ key: market.name, label: market.name, tvl: group.metrics.totalTVL, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined })
     }
   }
   return buildTvlSortedOptions(entries)
@@ -141,7 +141,7 @@ const riskManagerOptions = computed(() => {
   for (const group of marketGroups.value) {
     if (group.source !== 'product') continue
     for (const entity of getUniqueEntitiesByVaults(group.vaults)) {
-      entries.push({ key: entity.name, label: entity.name, tvl: group.metrics.totalTVL, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined })
+      entries.push({ key: entity.name, label: entity.name, tvl: group.metrics.totalTVL, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined })
     }
   }
   return buildTvlSortedOptions(entries)
diff --git a/pages/lend/index.vue b/pages/lend/index.vue
index b55fc40e6..b8a25c746 100644
--- a/pages/lend/index.vue
+++ b/pages/lend/index.vue
@@ -196,7 +196,7 @@ const marketOptions = computed(() => {
     if (!market.name) return []
     const entityName = Array.isArray(market?.entity) ? market?.entity[0] : market?.entity
     const entityObj = entityName ? entities[entityName] : null
-    return [{ key: market.name, label: market.name, tvl: vaultUsdValues.value.get(vault.address) ?? 0, icon: entityObj?.logo ? `/entities/${entityObj.logo}` : undefined, iconFallback: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
+    return [{ key: market.name, label: market.name, tvl: vaultUsdValues.value.get(vault.address) ?? 0, icon: entityObj?.logo ? getEulerLabelEntityLogo(entityObj.logo) : undefined }]
   }))
 })
 
@@ -216,7 +216,7 @@ const riskManagerOptions = computed(() => {
   return buildTvlSortedOptions(borrowableVaults.value.flatMap((vault) => {
     const tvl = vaultUsdValues.value.get(vault.address) ?? 0
     return getEntitiesByVault(vault).map(entity => ({
-      key: entity.name, label: entity.name, tvl, icon: entity.logo ? `/entities/${entity.logo}` : undefined, iconFallback: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
+      key: entity.name, label: entity.name, tvl, icon: entity.logo ? getEulerLabelEntityLogo(entity.logo) : undefined,
     }))
   }))
 })
diff --git a/scripts/execution-record.mjs b/scripts/execution-record.mjs
index 455f049be..e316c2f85 100644
--- a/scripts/execution-record.mjs
+++ b/scripts/execution-record.mjs
@@ -1316,7 +1316,7 @@ function shouldCaptureUrl(rawUrl) {
       || pathName.startsWith('/api/internal/pyth')
       || pathName.startsWith('/api/internal/rpc')
       || pathName.startsWith('/api/internal/euler-chains')
-      || pathName.startsWith('/api/internal/labels')
+      || pathName.startsWith('/api/internal/public-labels')
       || pathName.startsWith('/api/internal/vaults')
       || pathName.startsWith('/api/internal/oracle-adapters')
       || pathName.startsWith('/api/internal/token-list')
diff --git a/server/api/internal/labels/[chainId]/[file].get.ts b/server/api/internal/labels/[chainId]/[file].get.ts
deleted file mode 100644
index 35a4c47c4..000000000
--- a/server/api/internal/labels/[chainId]/[file].get.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * Path-shape labels endpoint that mirrors the SDK's default URL template
- *
- *   `${eulerLabelsBaseUrl}/${chainId}/${file}.json`
- *
- * Point the SDK at `eulerLabelsBaseUrl: '/api/internal/labels'` and its built-in
- * fetcher hits this endpoint instead of `raw.githubusercontent.com`.
- *
- * `chainId` is either an integer or the literal string `all` (for the
- * cross-chain `all/assets.json` file the SDK's
- * `getEulerLabelsGlobalAssetsUrl` calls). Anything else 400s.
- *
- * Calls `refreshLabelFile` from the sibling query-shape endpoint, so both
- * paths share one in-memory TTL cache and one upstream-fetch pipeline.
- * Unlike the query-shape handler, this route does not short-circuit on a
- * fresh cache entry: every request force-refreshes (joining any in-flight
- * fetch for the same `scope:file`), and the shared cache is used for writes
- * and stale fallback only.
- */
-import { createError, getRouterParam, setResponseHeader } from 'h3'
-import { createRateLimiter } from '~/server/utils/rate-limit'
-import {
-  LABEL_FILES,
-  refreshLabelFile,
-  type LabelFile,
-  type LabelScope,
-} from '~/server/api/internal/labels/[file].get'
-
-const rateLimiter = createRateLimiter({
-  max: 1000,
-  windowMs: 60_000,
-  label: 'labels-by-path',
-})
-
-const isLabelFile = (file: string): file is LabelFile =>
-  (LABEL_FILES as readonly string[]).includes(file)
-
-const parseScope = (raw: string | undefined): LabelScope | undefined => {
-  if (!raw) return undefined
-  if (raw === 'all') return 'all'
-  const n = Number(raw)
-  if (Number.isInteger(n) && n > 0) return n
-  return undefined
-}
-
-export default defineEventHandler(async (event) => {
-  rateLimiter.consume(event)
-
-  const file = getRouterParam(event, 'file')
-  if (!file || !isLabelFile(file)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid label file' })
-  }
-
-  const scope = parseScope(getRouterParam(event, 'chainId'))
-  if (scope === undefined) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId (use an integer or "all")' })
-  }
-
-  // Pure pass-through: no chain/global union here. The SDK calls the
-  // global file via a separate `getEulerLabelsGlobalAssetsUrl()` and
-  // composes the result itself.
-  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
-  return await refreshLabelFile(scope, file)
-})
diff --git a/server/api/internal/labels/[file].get.ts b/server/api/internal/labels/[file].get.ts
deleted file mode 100644
index 1a3e35789..000000000
--- a/server/api/internal/labels/[file].get.ts
+++ /dev/null
@@ -1,235 +0,0 @@
-import { createError, getQuery, getRouterParam, setResponseHeader } from 'h3'
-import { createRateLimiter } from '~/server/utils/rate-limit'
-import { createTtlCache } from '~/server/utils/cache'
-import { fetchWithTimeout } from '~/server/utils/fetchWithTimeout'
-import { createInFlightDedup } from '~/server/utils/in-flight'
-import { resolveLabelsFileUrl } from '~/server/utils/labels-base-url'
-import { reportStatus } from '~/server/utils/log'
-
-const CACHE_TTL_MS = 300_000
-
-/** The set of label files this proxy serves. Also consumed by warm-cache. */
-export const LABEL_FILES = ['products.json', 'entities.json', 'earn-vaults.json', 'points.json', 'assets.json'] as const
-
-export type LabelFile = typeof LABEL_FILES[number]
-
-/** Scope for a label fetch: a chain ID for per-chain files, or 'all' for cross-chain rules. */
-export type LabelScope = number | 'all'
-
-// All label files are optional: any chain may legitimately ship without a given
-// file (new chains, test deployments, etc.). Missing or failing upstream fetches
-// resolve to a type-appropriate empty payload so clients degrade to "no data"
-// uniformly rather than splitting into a required/optional matrix.
-const EMPTY_SHAPES: Record<LabelFile, unknown> = {
-  'products.json': {},
-  'entities.json': {},
-  'earn-vaults.json': [],
-  'points.json': [],
-  'assets.json': [],
-}
-
-const rateLimiter = createRateLimiter({
-  max: 1000,
-  windowMs: 60_000,
-  label: 'labels',
-})
-
-const cache = createTtlCache<unknown>({ ttlMs: CACHE_TTL_MS })
-const inFlight = createInFlightDedup<string, unknown>()
-
-/** Fields whose values are rendered as HTML via autoLink() — check for markdown link injection. */
-const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
-/** Fields whose values are bound directly to :href in Vue templates. */
-const URL_KEYS = new Set(['url'])
-/** Fields whose values must be compilable as regular expressions (assets.json pattern rules). */
-const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
-/** Cap regex length as a basic ReDoS sanity guard — labels are curated, not user-submitted. */
-const MAX_REGEX_LEN = 512
-/**
- * Fields whose values are concatenated into image URLs (`${CDN}/${logo}`
- * and `/entities/${logo}`). Must be a bare filename — no slashes, no `..`,
- * no scheme — so a curator slip can't point the browser off-origin or
- * traverse outside the intended asset directory.
- */
-const LOGO_FILENAME_KEYS = new Set(['logo'])
-const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
-/**
- * Defensive size caps. Labels are trusted but version-controlled; these
- * are there to prevent a mistake (or a compromise of the labels repo)
- * from ballooning a single proxy response into a client-side DoS.
- */
-const MAX_STRING_LEN = 16_384
-const MAX_ARRAY_LEN = 10_000
-
-/**
- * Detects the markdown-link href-injection pattern: [text](https://..."....)
- * A double-quote inside the URL portion closes the href attribute, allowing
- * additional HTML attributes (e.g. style=) to be injected via HTML parser
- * error-recovery. Bare double-quotes in the link text are harmless.
- */
-const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
-
-function isSafeHttpUrl(value: string): boolean {
-  if (!value) return true
-  try {
-    const { protocol } = new URL(value)
-    return protocol === 'http:' || protocol === 'https:'
-  }
-  catch {
-    return false
-  }
-}
-
-export function validateNode(node: unknown, path: string): void {
-  if (Array.isArray(node)) {
-    if (node.length > MAX_ARRAY_LEN) {
-      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
-    }
-    node.forEach((item, i) => validateNode(item, `${path}[${i}]`))
-    return
-  }
-  if (node !== null && typeof node === 'object') {
-    for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
-      if (typeof value === 'string') {
-        if (value.length > MAX_STRING_LEN) {
-          throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
-        }
-        if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
-          throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
-        }
-        if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
-          throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
-        }
-        if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
-          throw new Error(`Injection pattern detected in ${path}.${key}`)
-        }
-        if (REGEX_KEYS.has(key)) {
-          if (value.length > MAX_REGEX_LEN) {
-            throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
-          }
-          try {
-            new RegExp(value)
-          }
-          catch {
-            throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
-          }
-        }
-      }
-      else if (value !== null && typeof value === 'object') {
-        validateNode(value, `${path}.${key}`)
-      }
-    }
-  }
-}
-
-function getUpstreamUrl(scope: LabelScope, file: string): string {
-  return resolveLabelsFileUrl(scope, file)
-}
-
-/**
- * Forces an upstream fetch, bypassing the fresh-cache check. Used by the
- * warm-cache plugin so every cycle actually refreshes the entry instead
- * of cache-hitting a still-fresh value and letting it expire before the
- * next cycle. Collapses concurrent refresh calls per `scope:file` via
- * the in-flight map.
- *
- * `persist=true` writes the empty shape into the cache so subsequent
- * requests skip upstream entirely. Reserved for the absent-file cases
- * (404 and 403 — see below), where the file is legitimately not published
- * for this scope. For other failures (transient 5xx, network errors,
- * JSON parse, validation) return empty but DON'T persist — otherwise a
- * single upstream blip pins the empty allowlist for 5 minutes, making
- * every verified vault appear unverified.
- */
-export function refreshLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const key = `${scope}:${file}`
-
-  const fallback = (persist: boolean): unknown => {
-    const stale = cache.getStale(key)
-    if (stale) return stale
-    const empty = EMPTY_SHAPES[file]
-    if (persist) cache.set(key, empty)
-    return empty
-  }
-
-  return inFlight.run(key, async (): Promise<unknown> => {
-    const statusKey = `${file}:${scope}`
-    try {
-      const resp = await fetchWithTimeout(getUpstreamUrl(scope, file))
-      if (!resp.ok) {
-        // 404 and 403 are both expected signals for "file not published
-        // at this scope". The labels CDN (S3+CloudFront origin without
-        // ListBucket grant) returns 403 AccessDenied for missing keys
-        // rather than 404, so we treat them identically: persist the
-        // empty fallback and stay quiet on subsequent warm cycles.
-        // Other non-2xx statuses (5xx etc.) are reported as transitions
-        // so the first occurrence surfaces but repeats do not.
-        if (resp.status === 404 || resp.status === 403) {
-          reportStatus('labels', statusKey, `absent-${resp.status}`)
-          return fallback(true)
-        }
-        reportStatus('labels', statusKey, `http-${resp.status}`,
-          `${file} upstream returned ${resp.status} for scope ${scope}; treating as absent`)
-        return fallback(false)
-      }
-
-      const data: unknown = await resp.json()
-      validateNode(data, file)
-      cache.set(key, data)
-      reportStatus('labels', statusKey, 'ok')
-      return data
-    }
-    catch (err) {
-      reportStatus('labels', statusKey, 'fetch-error',
-        `Failed to fetch ${file} for scope ${scope}: ${err instanceof Error ? err.message : err}`)
-      return fallback(false)
-    }
-  })
-}
-
-// Read-through helper: cache hit → return synchronously; otherwise refresh.
-// Used by the handler's assets.json union so each source can be served from
-// its own cache entry without triggering two upstream fetches on a warm cache.
-async function getOrRefresh(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const hit = cache.get(`${scope}:${file}`)
-  if (hit !== undefined) return hit
-  return refreshLabelFile(scope, file)
-}
-
-export default defineEventHandler(async (event) => {
-  rateLimiter.consume(event)
-
-  const file = getRouterParam(event, 'file')
-  if (!file || !Object.hasOwn(EMPTY_SHAPES, file)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid file' })
-  }
-
-  const query = getQuery(event)
-  const chainId = Number(query.chainId)
-  if (!Number.isInteger(chainId) || chainId <= 0) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId' })
-  }
-
-  // Labels are curated external metadata — CDN can short-circuit polls
-  // between warm cycles.
-  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
-
-  // assets.json is unioned with the cross-chain `all/assets.json` so global
-  // pattern rules (e.g. by issuer symbol) apply to every chain without the
-  // client knowing about the separate source.
-  if (file === 'assets.json') {
-    const [chainData, globalData] = await Promise.all([
-      getOrRefresh(chainId, 'assets.json'),
-      getOrRefresh('all', 'assets.json'),
-    ])
-    const chainArr = Array.isArray(chainData) ? chainData : []
-    const globalArr = Array.isArray(globalData) ? globalData : []
-    return [...chainArr, ...globalArr]
-  }
-
-  const key = `${chainId}:${file}`
-  const cached = cache.get(key)
-  if (cached) return cached
-
-  return refreshLabelFile(chainId, file as LabelFile)
-})
diff --git a/server/api/internal/public-labels.get.ts b/server/api/internal/public-labels.get.ts
new file mode 100644
index 000000000..995844c7b
--- /dev/null
+++ b/server/api/internal/public-labels.get.ts
@@ -0,0 +1,35 @@
+import { createError, getHeader, getQuery, setResponseHeader } from 'h3'
+import { createRateLimiter } from '~/server/utils/rate-limit'
+import {
+  getPublicLabelsBundle,
+  refreshPublicLabelsBundle,
+} from '~/server/utils/public-labels-source'
+import { PUBLIC_LABELS_RUNTIME_VERSION } from '~/utils/public-labels'
+
+const rateLimiter = createRateLimiter({
+  max: 1000,
+  windowMs: 60_000,
+  label: 'public-labels',
+})
+
+export default defineEventHandler(async (event) => {
+  rateLimiter.consume(event)
+  const query = getQuery(event)
+  const chainId = Number(query.chainId)
+  if (!Number.isInteger(chainId) || chainId <= 0) {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid chainId' })
+  }
+
+  const version = typeof query.version === 'string' && query.version.length > 0
+    ? query.version
+    : PUBLIC_LABELS_RUNTIME_VERSION
+  if (version !== PUBLIC_LABELS_RUNTIME_VERSION && !/^v[0-9]{17}$/.test(version)) {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid labels version' })
+  }
+
+  setResponseHeader(event, 'Cache-Control', 'public, max-age=30, stale-while-revalidate=30')
+  const forceRefresh = getHeader(event, 'cache-control')?.toLowerCase().includes('no-cache') === true
+  return forceRefresh
+    ? refreshPublicLabelsBundle(chainId, version)
+    : getPublicLabelsBundle(chainId, version)
+})
diff --git a/server/plugins/warm-cache.ts b/server/plugins/warm-cache.ts
index 50f5d32b4..784f4c4eb 100644
--- a/server/plugins/warm-cache.ts
+++ b/server/plugins/warm-cache.ts
@@ -1,6 +1,7 @@
 /**
  * Pre-populates the in-memory TTL caches for every proxy that serves
- * static/low-churn data (labels, token-list, euler-chains) and for the
+ * static/low-churn data (Public Labels, effective policy, token-list,
+ * Euler Chains) and for the
  * per-chain vault snapshot served at /api/internal/vaults.
  *
  * Nitro's node-server preset calls `server.listen()` synchronously right
@@ -14,9 +15,9 @@
  *
  * Two timers, each with its own cadence:
  *
- *   • Global cycle (5 min): /api/internal/euler-chains once, cross-chain
- *     `all/assets.json` once, then per-chain labels + token-list,
- *     serialized across chains.
+ *   • Global cycle (5 min): Euler Chains once, cross-chain effective asset
+ *     policy once, then each chain's Public Labels bundle, effective policy,
+ *     and token list, serialized across chains.
  *   • Vaults cycle (1 min when V3 is configured, otherwise 5 min):
  *     /api/internal/vaults per chain, serialized.
  *
@@ -35,10 +36,11 @@
  * Merkl's /tokens/reward payload is fetched transitively by /api/internal/token-list
  * (one of its sources).
  */
-import { LABEL_FILES, refreshLabelFile } from '../api/internal/labels/[file].get'
+import { EFFECTIVE_POLICY_LABEL_FILES, refreshLabelFile } from '../utils/labels-source'
 import { refreshEulerChains } from '../api/internal/euler-chains.get'
 import { refreshTokenList } from '../api/internal/token-list.get'
 import { refreshChainVaults } from '../utils/vaults-cache'
+import { refreshPublicLabelsBundle } from '../utils/public-labels-source'
 import {
   readDisableServerVaultCache,
   readV3ApiUrl,
@@ -98,20 +100,22 @@ const reportWarm = <T>(context: string, task: Promise<T>): Promise<T | undefined
 const warmEulerChains = () =>
   reportWarm('euler-chains', refreshEulerChains())
 
-// Cross-chain pattern rules for asset geo-blocking live at `all/assets.json`
-// upstream. The /api/internal/labels/assets.json handler unions this with the
-// per-chain file; warm it once so the first chain-scoped request doesn't
-// pay the cold-upstream cost.
+// Cross-chain pattern rules for effective asset policy live at
+// `all/assets.json`. Warm them once; the shared policy source combines them
+// with each chain's rules while assembling the Public Labels bundle.
 const warmGlobalAssets = () =>
   reportWarm('labels/assets.json scope=all', refreshLabelFile('all', 'assets.json'))
 
 // --- Per-chain warms (parallel across chains and within a chain) ---
 
-const warmLabels = (chainId: number): Promise<unknown>[] =>
-  LABEL_FILES.map(file =>
-    reportWarm(`labels/${file} chain=${chainId}`, refreshLabelFile(chainId, file)),
+const warmEffectivePolicy = (chainId: number): Promise<unknown>[] =>
+  EFFECTIVE_POLICY_LABEL_FILES.map(file =>
+    reportWarm(`labels-policy/${file} chain=${chainId}`, refreshLabelFile(chainId, file)),
   )
 
+const warmPublicLabels = (chainId: number) =>
+  reportWarm(`public-labels chain=${chainId}`, refreshPublicLabelsBundle(chainId))
+
 const warmTokenList = (chainId: number) =>
   reportWarm(`token-list chain=${chainId}`, refreshTokenList(chainId))
 
@@ -121,10 +125,11 @@ const warmTokenList = (chainId: number) =>
 const warmVaults = (chainId: number) =>
   reportWarm(`vaults chain=${chainId}`, refreshChainVaults(chainId))
 
-// Labels + token-list — refresh at the global 5-min interval. Vaults run
-// on their own faster timer (see `warmVaultsForChains` below).
+// Public Labels, effective policy, and token-list refresh at the global
+// 5-min interval. Vaults run on their own faster timer.
 const warmChainTasks = (chainId: number): Promise<unknown>[] => [
-  ...warmLabels(chainId),
+  ...warmEffectivePolicy(chainId),
+  warmPublicLabels(chainId),
   warmTokenList(chainId),
 ]
 
diff --git a/server/utils/labels-base-url.ts b/server/utils/labels-base-url.ts
index 4caef38ac..fe871264d 100644
--- a/server/utils/labels-base-url.ts
+++ b/server/utils/labels-base-url.ts
@@ -1,8 +1,16 @@
 export function resolveLabelsBaseUrl(): string {
-  const explicit = (process.env.NUXT_PUBLIC_CONFIG_LABELS_BASE_URL || '').trim().replace(/\/+$/, '')
+  const explicit = (
+    process.env.EFFECTIVE_POLICY_BASE_URL
+    || process.env.NUXT_PUBLIC_CONFIG_LABELS_BASE_URL
+    || ''
+  ).trim().replace(/\/+$/, '')
   if (explicit) return explicit
-  const repo = process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO || 'euler-xyz/euler-labels'
-  const branch = process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH || 'master'
+  const repo = process.env.EFFECTIVE_POLICY_REPO
+    || process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO
+    || 'euler-xyz/euler-labels'
+  const branch = process.env.EFFECTIVE_POLICY_REPO_BRANCH
+    || process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH
+    || 'master'
   return `https://raw.githubusercontent.com/${repo}/refs/heads/${branch}`
 }
 
diff --git a/server/utils/labels-helpers.ts b/server/utils/labels-helpers.ts
index ef78db881..c989a6123 100644
--- a/server/utils/labels-helpers.ts
+++ b/server/utils/labels-helpers.ts
@@ -1,5 +1,4 @@
 import { getAddress, type Address } from 'viem'
-import { INTERNAL_FETCH_HEADERS } from './internal-headers'
 
 export interface EntityEntry {
   addresses?: unknown
@@ -39,13 +38,3 @@ export function buildEntityAddressSets(
   }
   return map
 }
-
-export async function fetchLabels<T>(
-  chainId: number,
-  file: 'products.json' | 'entities.json' | 'earn-vaults.json',
-): Promise<T> {
-  return await $fetch<T>(`/api/internal/labels/${file}`, {
-    query: { chainId },
-    headers: INTERNAL_FETCH_HEADERS,
-  }) as unknown as T
-}
diff --git a/server/utils/labels-source.ts b/server/utils/labels-source.ts
new file mode 100644
index 000000000..a2b883042
--- /dev/null
+++ b/server/utils/labels-source.ts
@@ -0,0 +1,262 @@
+import { getAddress } from 'viem'
+import { createTtlCache } from './cache'
+import { fetchWithTimeout } from './fetchWithTimeout'
+import { createInFlightDedup } from './in-flight'
+import { resolveLabelsFileUrl } from './labels-base-url'
+import { reportStatus } from './log'
+import type { EffectiveLabelsSource } from '~/utils/public-labels'
+import type { EulerLabelAssetEntry } from '~/entities/euler/labels'
+
+const CACHE_TTL_MS = 300_000
+
+export const EFFECTIVE_POLICY_LABEL_FILES = ['products.json', 'earn-vaults.json', 'assets.json'] as const
+
+export type LabelFile = typeof EFFECTIVE_POLICY_LABEL_FILES[number]
+export type LabelScope = number | 'all'
+
+const EMPTY_SHAPES: Record<LabelFile, unknown> = {
+  'products.json': {},
+  'earn-vaults.json': [],
+  'assets.json': [],
+}
+
+const cache = createTtlCache<unknown>({ ttlMs: CACHE_TTL_MS })
+const inFlight = createInFlightDedup<string, unknown>()
+
+const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
+const URL_KEYS = new Set(['url'])
+const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
+const MAX_REGEX_LEN = 512
+const LOGO_FILENAME_KEYS = new Set(['logo'])
+const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
+const MAX_STRING_LEN = 16_384
+const MAX_ARRAY_LEN = 10_000
+const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
+
+const isSafeHttpUrl = (value: string): boolean => {
+  if (!value) return true
+  try {
+    const { protocol } = new URL(value)
+    return protocol === 'http:' || protocol === 'https:'
+  }
+  catch {
+    return false
+  }
+}
+
+export function validateNode(node: unknown, path: string): void {
+  if (Array.isArray(node)) {
+    if (node.length > MAX_ARRAY_LEN) {
+      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
+    }
+    node.forEach((item, index) => validateNode(item, `${path}[${index}]`))
+    return
+  }
+  if (node === null || typeof node !== 'object') return
+
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (typeof value === 'string') {
+      if (value.length > MAX_STRING_LEN) {
+        throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
+      }
+      if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
+        throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
+      }
+      if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
+        throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
+      }
+      if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
+        throw new Error(`Injection pattern detected in ${path}.${key}`)
+      }
+      if (REGEX_KEYS.has(key)) {
+        if (value.length > MAX_REGEX_LEN) {
+          throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
+        }
+        try {
+          new RegExp(value)
+        }
+        catch {
+          throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
+        }
+      }
+    }
+    else if (value !== null && typeof value === 'object') {
+      validateNode(value, `${path}.${key}`)
+    }
+  }
+}
+
+const fallbackForAbsent = (key: string, file: LabelFile): unknown => {
+  const stale = cache.getStale(key)
+  if (stale !== undefined) return stale
+  const empty = EMPTY_SHAPES[file]
+  cache.set(key, empty)
+  return empty
+}
+
+export function refreshLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
+  const key = `${scope}:${file}`
+  return inFlight.run(key, async () => {
+    const statusKey = `${file}:${scope}`
+    try {
+      const response = await fetchWithTimeout(resolveLabelsFileUrl(scope, file))
+      if (!response.ok) {
+        if (response.status === 404 || response.status === 403) {
+          reportStatus('labels-policy', statusKey, `absent-${response.status}`)
+          return fallbackForAbsent(key, file)
+        }
+        throw new Error(`${file} effective-policy source returned ${response.status} for scope ${scope}`)
+      }
+
+      const data: unknown = await response.json()
+      validateNode(data, file)
+      cache.set(key, data)
+      reportStatus('labels-policy', statusKey, 'ok')
+      return data
+    }
+    catch (error) {
+      reportStatus(
+        'labels-policy',
+        statusKey,
+        'fetch-error',
+        `Failed to fetch effective policy ${file} for scope ${scope}: ${error instanceof Error ? error.message : error}`,
+      )
+      const stale = cache.getStale(key)
+      if (stale !== undefined) return stale
+      throw error
+    }
+  })
+}
+
+export async function getLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
+  const hit = cache.get(`${scope}:${file}`)
+  return hit !== undefined ? hit : refreshLabelFile(scope, file)
+}
+
+const stringArray = (value: unknown): string[] | undefined => {
+  if (!Array.isArray(value)) return undefined
+  const result = value.filter((entry): entry is string => typeof entry === 'string')
+  return result.length > 0 ? result : undefined
+}
+
+const normalizeAddress = (value: unknown): string | undefined => {
+  if (typeof value !== 'string') return undefined
+  try {
+    return getAddress(value)
+  }
+  catch {
+    return undefined
+  }
+}
+
+const addressArray = (value: unknown): string[] | undefined => {
+  if (!Array.isArray(value)) return undefined
+  const result = value.map(normalizeAddress).filter((entry): entry is string => Boolean(entry))
+  return result.length > 0 ? result : undefined
+}
+
+const projectProductPolicies = (value: unknown): EffectiveLabelsSource['products'] => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {}
+  const result: EffectiveLabelsSource['products'] = {}
+  for (const [productId, raw] of Object.entries(value as Record<string, unknown>)) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue
+    const product = raw as Record<string, unknown>
+    const vaultOverrides: NonNullable<EffectiveLabelsSource['products'][string]['vaultOverrides']> = {}
+    if (product.vaultOverrides && typeof product.vaultOverrides === 'object' && !Array.isArray(product.vaultOverrides)) {
+      for (const [address, rawOverride] of Object.entries(product.vaultOverrides as Record<string, unknown>)) {
+        const normalizedAddress = normalizeAddress(address)
+        if (!normalizedAddress) continue
+        if (!rawOverride || typeof rawOverride !== 'object' || Array.isArray(rawOverride)) continue
+        const override = rawOverride as Record<string, unknown>
+        vaultOverrides[normalizedAddress] = {
+          ...(stringArray(override.block) && { block: stringArray(override.block) }),
+          ...(stringArray(override.restricted) && { restricted: stringArray(override.restricted) }),
+          ...(typeof override.notExplorableLend === 'boolean' && { notExplorableLend: override.notExplorableLend }),
+          ...(typeof override.notExplorableBorrow === 'boolean' && { notExplorableBorrow: override.notExplorableBorrow }),
+        }
+      }
+    }
+    result[productId] = {
+      ...(stringArray(product.block) && { block: stringArray(product.block) }),
+      ...(stringArray(product.restricted) && { restricted: stringArray(product.restricted) }),
+      ...(typeof product.notExplorable === 'boolean' && { notExplorable: product.notExplorable }),
+      ...(addressArray(product.vaults) && { vaults: addressArray(product.vaults) }),
+      ...(addressArray(product.deprecatedVaults) && { deprecatedVaults: addressArray(product.deprecatedVaults) }),
+      ...(Object.keys(vaultOverrides).length > 0 && { vaultOverrides }),
+    }
+  }
+  return result
+}
+
+const projectEarnPolicies = (value: unknown): EffectiveLabelsSource['earnVaults'] => {
+  if (!Array.isArray(value)) return []
+  const result: EffectiveLabelsSource['earnVaults'] = []
+  for (const raw of value) {
+    if (typeof raw === 'string') {
+      const address = normalizeAddress(raw)
+      if (address) result.push(address)
+      continue
+    }
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue
+    const entry = raw as Record<string, unknown>
+    const address = normalizeAddress(entry.address)
+    if (!address) continue
+    result.push({
+      address,
+      ...(stringArray(entry.block) && { block: stringArray(entry.block) }),
+      ...(stringArray(entry.restricted) && { restricted: stringArray(entry.restricted) }),
+      ...(typeof entry.notExplorable === 'boolean' && { notExplorable: entry.notExplorable }),
+    })
+  }
+  return result
+}
+
+const projectAssetPolicies = (value: unknown): EulerLabelAssetEntry[] => {
+  if (!Array.isArray(value)) return []
+  return value.flatMap((raw) => {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return []
+    const entry = raw as Record<string, unknown>
+    const address = normalizeAddress(entry.address)
+    const projected = {
+      ...(address && { address }),
+      ...(stringArray(entry.symbols) && { symbols: stringArray(entry.symbols) }),
+      ...(typeof entry.symbolRegex === 'string' && { symbolRegex: entry.symbolRegex }),
+      ...(stringArray(entry.names) && { names: stringArray(entry.names) }),
+      ...(typeof entry.nameRegex === 'string' && { nameRegex: entry.nameRegex }),
+      ...(stringArray(entry.block) && { block: stringArray(entry.block) }),
+      ...(stringArray(entry.restricted) && { restricted: stringArray(entry.restricted) }),
+    } as EulerLabelAssetEntry
+    return 'address' in projected
+      || 'symbols' in projected
+      || 'symbolRegex' in projected
+      || 'names' in projected
+      || 'nameRegex' in projected
+      ? [projected]
+      : []
+  })
+}
+
+export function projectEffectiveLabelsSource(
+  products: unknown,
+  earnVaults: unknown,
+  assets: unknown,
+): EffectiveLabelsSource {
+  return {
+    products: projectProductPolicies(products),
+    earnVaults: projectEarnPolicies(earnVaults),
+    assets: projectAssetPolicies(assets),
+  }
+}
+
+export async function getEffectiveLabelsSource(chainId: number): Promise<EffectiveLabelsSource> {
+  const [products, earnVaults, chainAssets, globalAssets] = await Promise.all([
+    getLabelFile(chainId, 'products.json'),
+    getLabelFile(chainId, 'earn-vaults.json'),
+    getLabelFile(chainId, 'assets.json'),
+    getLabelFile('all', 'assets.json'),
+  ])
+  return projectEffectiveLabelsSource(products, earnVaults, [
+    ...(Array.isArray(chainAssets) ? chainAssets : []),
+    ...(Array.isArray(globalAssets) ? globalAssets : []),
+  ])
+}
diff --git a/server/utils/labels-view.ts b/server/utils/labels-view.ts
index b877cfe5f..2ace1b35f 100644
--- a/server/utils/labels-view.ts
+++ b/server/utils/labels-view.ts
@@ -1,7 +1,7 @@
 /**
  * Per-chain "labels view" shared by /api/public/is-known and
  * /api/public/metadata. It keeps Lite's public API/cache policy in the app,
- * but sources normalized labels and vault entities through the SDK.
+ * and reads normalized label content from the shared Public Labels V3 source.
  */
 import {
   StandardEVaultPerspectives,
@@ -23,6 +23,7 @@ import { logger } from './logger'
 import { summarizeSdkIssue } from './observability'
 import { getServerSdk } from './sdk-server'
 import { isSdkErrorDiagnostic } from './sdk-diagnostics'
+import { getPublicEulerLabelsData } from './public-labels-source'
 import type { VerificationLabels } from '~/utils/vault/governor-verification'
 
 export interface ChainVaultsSnapshot {
@@ -331,7 +332,7 @@ async function buildSnapshot(
 async function assembleLabelsView(chainId: number): Promise<LabelsView> {
   const sdk = await getSdk(chainId)
   const [labels, tokens] = await Promise.allSettled([
-    sdk.eulerLabelsService.fetchEulerLabelsData(chainId),
+    getPublicEulerLabelsData(chainId),
     fetchTokenList(chainId),
   ])
 
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
new file mode 100644
index 000000000..c3a3769ec
--- /dev/null
+++ b/server/utils/public-labels-source.ts
@@ -0,0 +1,122 @@
+import { createTtlCache } from './cache'
+import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
+import { createInFlightDedup } from './in-flight'
+import { getEffectiveLabelsSource } from './labels-source'
+import { logger } from './logger'
+import {
+  fetchPublicLabelsSource,
+  normalizePublicLabelsData,
+  PUBLIC_LABELS_RUNTIME_VERSION,
+  type MigratedEulerLabelsData,
+  type PublicLabelsBundle,
+  type PublicLabelsQuery,
+  type PublicLabelsRequest,
+  type PublicLabelsResponse,
+} from '~/utils/public-labels'
+import { readResolvedV3ApiUrl, readV3ApiKey } from '~/utils/api-url-env'
+
+const CACHE_TTL_MS = 300_000
+const REFRESH_BUDGET_MS = 30_000
+
+const cache = createTtlCache<PublicLabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
+const inFlight = createInFlightDedup<string, PublicLabelsBundle>()
+
+const cacheKey = (chainId: number, version: string): string => `${chainId}:${version}`
+
+interface PublishedLabelVersion {
+  versionKey?: string
+  status?: string
+  aliases?: string[]
+  isLatest?: boolean
+}
+
+const buildRequest = (): PublicLabelsRequest => async <T>(
+  path: string,
+  query: PublicLabelsQuery,
+): Promise<PublicLabelsResponse<T>> => {
+  const base = new URL(readResolvedV3ApiUrl())
+  const basePath = base.pathname.replace(/\/+$/, '')
+  base.pathname = `${basePath.endsWith('/v3') ? basePath : `${basePath}/v3`}${path}`
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== undefined) base.searchParams.set(key, String(value))
+  }
+
+  const headers = new Headers({ accept: 'application/json' })
+  const apiKey = readV3ApiKey().trim()
+  if (apiKey) headers.set('X-API-Key', apiKey)
+
+  const response = await fetchWithTimeout(base.toString(), undefined, { headers })
+  if (!response.ok) {
+    throw new Error(`Public Labels V3 returned ${response.status} for ${path}`)
+  }
+  return await response.json() as PublicLabelsResponse<T>
+}
+
+const resolveVersion = async (
+  request: PublicLabelsRequest,
+  requestedVersion: string,
+): Promise<string> => {
+  if (requestedVersion !== PUBLIC_LABELS_RUNTIME_VERSION) return requestedVersion
+  const response = await request<PublishedLabelVersion[]>('/label-sets/public/versions', {})
+  if (!Array.isArray(response.data)) throw new Error('Invalid Public Labels versions response')
+  const published = response.data.find(version =>
+    version.status === 'published'
+    && (version.isLatest === true || version.aliases?.includes(PUBLIC_LABELS_RUNTIME_VERSION)),
+  )
+  if (!published?.versionKey || !/^v[0-9]{17}$/.test(published.versionKey)) {
+    throw new Error('Public Labels latest alias is unavailable')
+  }
+  return published.versionKey
+}
+
+export function refreshPublicLabelsBundle(
+  chainId: number,
+  version = PUBLIC_LABELS_RUNTIME_VERSION,
+): Promise<PublicLabelsBundle> {
+  const key = cacheKey(chainId, version)
+  return inFlight.run(key, async () => {
+    try {
+      const bundle = await withWallClock(
+        async () => {
+          const request = buildRequest()
+          const resolvedVersion = await resolveVersion(request, version)
+          const [publicLabels, effectivePolicy] = await Promise.all([
+            fetchPublicLabelsSource(request, chainId, resolvedVersion),
+            getEffectiveLabelsSource(chainId),
+          ])
+          // Validate the complete cross-source relationship before replacing
+          // a known-good raw bundle. Server consumers normalize it again into
+          // SDK-compatible Sets/RegExps; the browser receives JSON-safe data.
+          normalizePublicLabelsData(chainId, publicLabels, effectivePolicy)
+          return { version: resolvedVersion, publicLabels, effectivePolicy }
+        },
+        REFRESH_BUDGET_MS,
+        `public-labels chain=${chainId}`,
+      )
+      cache.set(key, bundle)
+      return bundle
+    }
+    catch (err) {
+      logger.warn({ ctx: 'public-labels-source', chainId, version, err }, 'refresh failed')
+      const stale = cache.getStale(key)
+      if (stale) return stale
+      throw err
+    }
+  })
+}
+
+export function getPublicLabelsBundle(
+  chainId: number,
+  version = PUBLIC_LABELS_RUNTIME_VERSION,
+): Promise<PublicLabelsBundle> {
+  const hit = cache.get(cacheKey(chainId, version))
+  return hit ? Promise.resolve(hit) : refreshPublicLabelsBundle(chainId, version)
+}
+
+export async function getPublicEulerLabelsData(
+  chainId: number,
+  version = PUBLIC_LABELS_RUNTIME_VERSION,
+): Promise<MigratedEulerLabelsData> {
+  const bundle = await getPublicLabelsBundle(chainId, version)
+  return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
+}
diff --git a/server/utils/sdk-server.ts b/server/utils/sdk-server.ts
index 91b3d743a..f4ae9daa7 100644
--- a/server/utils/sdk-server.ts
+++ b/server/utils/sdk-server.ts
@@ -33,7 +33,6 @@ import {
 } from '~/utils/api-url-env'
 import { parseChainIds } from '~/utils/parseChainIds'
 import { resolveRpcUrl } from './rpc'
-import { resolveLabelsBaseUrl } from './labels-base-url'
 
 const sdkByChain = new Map<number, Promise<EulerSDK>>()
 
@@ -81,7 +80,6 @@ const buildServerSdkConfig = (chainId: number): EulerSDKConfig => {
   return {
     rpcUrls: { [chainId]: rpcUrl },
     v3ApiUrl,
-    eulerLabelsBaseUrl: resolveLabelsBaseUrl(),
     tokenlistApiBaseUrl: v3ApiUrl,
     ...(v3ApiKey ? { v3ApiKey } : {}),
     ...adapterConfigForSource(source),
diff --git a/server/utils/v3-proxy.ts b/server/utils/v3-proxy.ts
index 17e98ad4a..291753dd5 100644
--- a/server/utils/v3-proxy.ts
+++ b/server/utils/v3-proxy.ts
@@ -11,18 +11,13 @@ const FORWARDED_RESPONSE_HEADERS = [
 const GET_ONLY_PATHS = new Set([
   '/v3/apys/intrinsic',
   '/v3/apys/rewards',
-  '/v3/curation/vaults',
   '/v3/earn/vaults',
-  '/v3/entities',
   '/v3/evk/vaults',
   '/v3/evk/vaults/bad-debt',
   '/v3/evk/vaults/open-interest',
   '/v3/evk/vaults/open-interest/by-collateral',
-  '/v3/geo-policies',
-  '/v3/label-sets/public/versions',
   '/v3/liquidations',
   '/v3/prices',
-  '/v3/products',
   '/v3/rewards/breakdown',
   '/v3/tokens',
 ])
@@ -31,14 +26,9 @@ const GET_ONLY_PATH_PATTERNS = [
   /^\/v3\/accounts\/[^/]+\/positions$/,
   /^\/v3\/activity\/accounts\/0x[a-fA-F0-9]{40}\/events$/,
   /^\/v3\/activity\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/events$/,
-  /^\/v3\/curation\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/labels$/,
-  /^\/v3\/entities\/[A-Za-z0-9_-]{1,100}$/,
-  /^\/v3\/entities\/[A-Za-z0-9_-]{1,100}\/addresses$/,
-  /^\/v3\/(?:earn|evk)\/vaults\/[1-9][0-9]{0,15}\/0x[a-fA-F0-9]{40}\/assessment$/,
   /^\/v3\/earn\/vaults\/[^/]+\/[^/]+$/,
   /^\/v3\/earn\/vaults\/[^/]+\/[^/]+\/totals$/,
   /^\/v3\/evk\/vaults\/[^/]+\/[^/]+\/totals$/,
-  /^\/v3\/products\/[1-9][0-9]{0,15}\/[A-Za-z0-9_-]{1,100}$/,
 ]
 
 const POST_ONLY_PATHS = new Set([
diff --git a/server/utils/vault-metadata.ts b/server/utils/vault-metadata.ts
index 94635da49..e129849a3 100644
--- a/server/utils/vault-metadata.ts
+++ b/server/utils/vault-metadata.ts
@@ -1,7 +1,6 @@
 import type { Address } from 'viem'
 import { createTtlCache } from './cache'
 import { tryChecksum } from './labels-helpers'
-import { resolveLabelsBaseUrl } from './labels-base-url'
 import {
   buildLabelsView,
   type EntityEntryFull,
@@ -48,11 +47,11 @@ export interface VaultMetadata {
   description: string | null
   portfolioNotice: string | null
   deprecationReason: string | null
-  /** True if the vault is listed under any product's `deprecatedVaults` (or earn-vaults `deprecated: true`). */
+  /** True when Public Labels marks the vault deprecated. */
   deprecated: boolean
   /** True when the owning product has the `governance limited` tag. False for vaults without a product. */
   governanceLimited: boolean
-  /** The owning product slug from products.json (e.g. "euler-prime"), or null for vaults outside any product (escrow, earn-only entries, governor mismatch with no product). */
+  /** The Public Labels product ID, or null for vaults outside a product. */
   productId: string | null
   asset: AssetInfo | null
   /** All declared product entities whose `addresses` contain the vault's on-chain governor (or owner, for Earn). Empty when no entity matches, the vault is escrow, or the vault is unverified. Multiple entries can occur when a product declares multiple entities and more than one matches. */
@@ -78,7 +77,7 @@ function strOrEmpty(value: unknown): string {
 }
 
 function entityLogoUrl(fileName: string): string {
-  return `${resolveLabelsBaseUrl()}/logo/${fileName}`
+  return /^https?:\/\//i.test(fileName) ? fileName : ''
 }
 
 function buildAsset(asset: VaultAsset | undefined, tokenLogos: Map<string, string>): AssetInfo | null {
diff --git a/server/utils/vaults-cache.ts b/server/utils/vaults-cache.ts
index 2aba06e8f..0eef35350 100644
--- a/server/utils/vaults-cache.ts
+++ b/server/utils/vaults-cache.ts
@@ -34,11 +34,7 @@ import { reportStatus } from './log'
 import { summarizeSdkIssue } from './observability'
 import { getServerSdk } from './sdk-server'
 import { isSdkErrorDiagnostic } from './sdk-diagnostics'
-import {
-  LABEL_FILES,
-  refreshLabelFile,
-  type LabelFile,
-} from '~/server/api/internal/labels/[file].get'
+import { getPublicEulerLabelsData } from './public-labels-source'
 import { encodeBigints } from '~/utils/snapshot-codec'
 import { readV3ApiUrl } from '~/utils/api-url-env'
 import {
@@ -92,39 +88,6 @@ const uniqueAddresses = (addresses: Iterable<string>): Address[] => {
   return [...result.values()]
 }
 
-interface LabelProduct { vaults?: string[], deprecatedVaults?: string[] }
-interface EarnVaultEntry { address?: string }
-
-const fetchLabel = async <T>(scope: number | 'all', file: LabelFile, fallback: T): Promise<T> => {
-  try {
-    return (await refreshLabelFile(scope, file)) as T
-  }
-  catch (err) {
-    logger.warn({ ctx: 'vaults-cache', scope, file, err }, 'failed to fetch label')
-    return fallback
-  }
-}
-
-const getLabels = async (chainId: number) => {
-  const [products, earn] = await Promise.all([
-    fetchLabel<Record<string, LabelProduct>>(chainId, 'products.json', {}),
-    fetchLabel<Array<string | EarnVaultEntry>>(chainId, 'earn-vaults.json', []),
-  ])
-  const verified = new Set<string>()
-  for (const product of Object.values(products)) {
-    product.vaults?.forEach(addr => verified.add(addr))
-    product.deprecatedVaults?.forEach(addr => verified.add(addr))
-  }
-  const earnVaults: string[] = earn.flatMap((entry) => {
-    if (typeof entry === 'string') return [entry]
-    return typeof entry?.address === 'string' ? [entry.address] : []
-  })
-  return {
-    verifiedVaultAddresses: uniqueAddresses(verified),
-    earnVaults: uniqueAddresses(earnVaults),
-  }
-}
-
 const partitionVerified = async (
   sdk: EulerSDK,
   chainId: number,
@@ -219,13 +182,13 @@ const fetchEVaultsForSnapshot = async (
 export const refreshChainVaults = (chainId: number): Promise<SerialisedSnapshot> =>
   inFlight.run(chainId, async () => {
     const sdk = await getServerSdk(chainId)
-    const labels = await getLabels(chainId)
+    const labels = await getPublicEulerLabelsData(chainId)
     const escrowAddrs = await fetchEscrowAddrs(sdk, chainId)
     const { evkAddrs, securitizeAddrs, earnAddrs } = await partitionVerified(
       sdk,
       chainId,
-      labels.verifiedVaultAddresses,
-      labels.earnVaults,
+      uniqueAddresses(labels.verifiedVaultAddresses),
+      uniqueAddresses(labels.earnVaults),
     )
 
     // populateCollaterals / populateStrategyVaults DISABLED — deferred to
@@ -285,7 +248,3 @@ export const refreshChainVaults = (chainId: number): Promise<SerialisedSnapshot>
     reportStatus('vaults-cache', `chain=${chainId}`, 'ok')
     return payload
   })
-
-// silence unused: LABEL_FILES is re-exported by callers via the labels
-// endpoint module, importing here keeps the file dependency edge explicit.
-void LABEL_FILES
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index 0a96adc80..5e7afeb6a 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -9,6 +9,7 @@ import {
   getEulerLabelWrapPairs,
   useEulerLabels,
 } from '~/composables/useEulerLabels'
+import type { PublicLabelsBundle } from '~/utils/public-labels'
 
 type Deferred<T> = {
   promise: Promise<T>
@@ -29,18 +30,14 @@ const deferred = <T>(): Deferred<T> => {
 
 const mocks = vi.hoisted(() => ({
   evcBatchCall: vi.fn(),
-  fetchEulerLabelsData: vi.fn(),
-  fetchPublicLabelsData: vi.fn(),
+  fetchPublicLabelsBundle: vi.fn(),
+  normalizePublicLabelsData: vi.fn(),
   getProvider: vi.fn(),
-  invalidateSdkQueries: vi.fn(),
   vaults: [] as Array<{ asset: { address: string } }>,
 }))
 
 vi.mock('~/composables/useEulerSdk', () => ({
   getEulerSdk: vi.fn(async () => ({
-    eulerLabelsService: {
-      fetchEulerLabelsData: mocks.fetchEulerLabelsData,
-    },
     providerService: {
       getProvider: mocks.getProvider,
     },
@@ -48,7 +45,7 @@ vi.mock('~/composables/useEulerSdk', () => ({
 }))
 
 vi.mock('~/utils/public-labels', () => ({
-  fetchPublicLabelsData: mocks.fetchPublicLabelsData,
+  normalizePublicLabelsData: mocks.normalizePublicLabelsData,
 }))
 
 vi.mock('~/composables/useEulerOracleAdapters', () => ({
@@ -77,10 +74,6 @@ vi.mock('~/utils/multicall', () => ({
   evcBatchCall: mocks.evcBatchCall,
 }))
 
-vi.mock('~/utils/sdk-query-cache', () => ({
-  invalidateSdkQueries: mocks.invalidateSdkQueries,
-}))
-
 const currentChainId = ref(1)
 const getCurrentChainConfig = computed(() => ({
   chainId: currentChainId.value,
@@ -97,19 +90,25 @@ const labelsFor = (marker: string) => ({
   },
 }) as unknown as EulerLabelsData
 
+const bundleFor = (labels: EulerLabelsData): PublicLabelsBundle => ({
+  version: 'v20260804151305236',
+  publicLabels: labels,
+  effectivePolicy: { products: {}, earnVaults: [], assets: [] },
+}) as unknown as PublicLabelsBundle
+
 const currentProductKeys = () => Object.keys(getCurrentEulerLabelsData().products)
 
 describe('useEulerLabels chain-scoped loading', () => {
   beforeEach(() => {
     currentChainId.value = 1
     mocks.evcBatchCall.mockReset().mockResolvedValue([])
-    mocks.fetchEulerLabelsData.mockReset()
-    mocks.fetchPublicLabelsData.mockReset().mockImplementation(
-      (_request: unknown, _chainId: number, _version: unknown, legacy: Promise<EulerLabelsData>) => legacy,
+    mocks.fetchPublicLabelsBundle.mockReset()
+    mocks.normalizePublicLabelsData.mockReset().mockImplementation(
+      (_chainId: number, labels: EulerLabelsData) => labels,
     )
     mocks.getProvider.mockReset().mockReturnValue({})
-    mocks.invalidateSdkQueries.mockReset().mockResolvedValue(undefined)
     mocks.vaults.length = 0
+    vi.stubGlobal('$fetch', mocks.fetchPublicLabelsBundle)
     vi.stubGlobal('useEulerAddresses', () => ({
       getCurrentChainConfig,
       loadEulerConfig: vi.fn(),
@@ -122,9 +121,10 @@ describe('useEulerLabels chain-scoped loading', () => {
   })
 
   it('starts a separate fetch for a new chain and ignores the stale response', async () => {
-    const chainOne = deferred<EulerLabelsData>()
-    const chainTwo = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
+    const chainOne = deferred<PublicLabelsBundle>()
+    const chainTwo = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
       if (chainId === 1) return chainOne.promise
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
@@ -132,35 +132,36 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     const labels = useEulerLabels()
     const firstLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     currentChainId.value = 2
     const secondLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     expect(labels.isLoading.value).toBe(true)
     expect(labels.isReady.value).toBe(false)
 
-    chainTwo.resolve(labelsFor('chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('chain-two')))
     await secondLoad
 
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
 
-    chainOne.resolve(labelsFor('stale-chain-one'))
+    chainOne.resolve(bundleFor(labelsFor('stale-chain-one')))
     await firstLoad
 
-    expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+    expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
   })
 
   it('reuses only the chain fetch while the latest wrapper controls publication', async () => {
-    const chainOne = deferred<EulerLabelsData>()
-    const chainTwo = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
+    const chainOne = deferred<PublicLabelsBundle>()
+    const chainTwo = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
       if (chainId === 1) return chainOne.promise
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
@@ -169,26 +170,26 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     const labels = useEulerLabels()
     const firstChainOneLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     currentChainId.value = 2
     const chainTwoLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     currentChainId.value = 1
     const latestChainOneLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
-    chainOne.resolve(labelsFor('latest-chain-one'))
+    chainOne.resolve(bundleFor(labelsFor('latest-chain-one')))
     await Promise.all([firstChainOneLoad, latestChainOneLoad])
 
-    expect(mocks.fetchEulerLabelsData.mock.calls.filter(([chainId]) => chainId === 1)).toHaveLength(1)
+    expect(mocks.fetchPublicLabelsBundle.mock.calls.filter(([, options]) => options.query.chainId === 1)).toHaveLength(1)
     expect(currentProductKeys()).toEqual(['latest-chain-one'])
     expect(getEulerLabelsVersion()).toBe(initialVersion + 4)
     expect(labels.isLoading.value).toBe(false)
     expect(labels.isReady.value).toBe(true)
 
-    chainTwo.resolve(labelsFor('stale-chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('stale-chain-two')))
     await chainTwoLoad
 
     expect(currentProductKeys()).toEqual(['latest-chain-one'])
@@ -196,30 +197,29 @@ describe('useEulerLabels chain-scoped loading', () => {
   })
 
   it('keeps a force-refresh replacement available when the older fetch settles first', async () => {
-    const original = deferred<EulerLabelsData>()
-    const refreshed = deferred<EulerLabelsData>()
-    mocks.fetchEulerLabelsData
+    const original = deferred<PublicLabelsBundle>()
+    const refreshed = deferred<PublicLabelsBundle>()
+    mocks.fetchPublicLabelsBundle
       .mockReturnValueOnce(original.promise)
       .mockReturnValueOnce(refreshed.promise)
 
     const labels = useEulerLabels()
     const originalLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1))
 
     const refreshLoad = labels.loadLabels(true)
     await vi.waitFor(() => {
-      expect(mocks.invalidateSdkQueries).toHaveBeenCalledTimes(1)
-      expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
     })
 
-    original.resolve(labelsFor('original'))
+    original.resolve(bundleFor(labelsFor('original')))
     await originalLoad
 
     const joinedRefreshLoad = labels.loadLabels()
     await Promise.resolve()
-    expect(mocks.fetchEulerLabelsData).toHaveBeenCalledTimes(2)
+    expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
 
-    refreshed.resolve(labelsFor('refreshed'))
+    refreshed.resolve(bundleFor(labelsFor('refreshed')))
     await Promise.all([refreshLoad, joinedRefreshLoad])
 
     expect(currentProductKeys()).toEqual(['refreshed'])
@@ -227,15 +227,13 @@ describe('useEulerLabels chain-scoped loading', () => {
     expect(labels.isReady.value).toBe(true)
   })
 
-  it('falls back to the compatibility snapshot when Public Labels V3 fails', async () => {
-    const fallback = labelsFor('compatibility-fallback')
-    mocks.fetchEulerLabelsData.mockResolvedValue(fallback)
-    mocks.fetchPublicLabelsData.mockRejectedValue(new Error('V3 unavailable'))
+  it('does not publish a second labels source when the aggregate endpoint fails', async () => {
+    mocks.fetchPublicLabelsBundle.mockRejectedValue(new Error('V3 unavailable'))
 
     const labels = useEulerLabels()
     await labels.loadLabels()
 
-    expect(currentProductKeys()).toEqual(['compatibility-fallback'])
+    expect(currentProductKeys()).toEqual([])
     expect(labels.geoPolicies.value).toEqual([])
     expect(labels.isReady.value).toBe(true)
   })
@@ -244,11 +242,12 @@ describe('useEulerLabels chain-scoped loading', () => {
     const wrapper = '0x0000000000000000000000000000000000000011'
     const underlying = '0x0000000000000000000000000000000000000022'
     const staleProbe = deferred<Array<{ success: boolean, result: string }>>()
-    const chainTwo = deferred<EulerLabelsData>()
+    const chainTwo = deferred<PublicLabelsBundle>()
     mocks.vaults.push({ asset: { address: wrapper } })
     mocks.evcBatchCall.mockReturnValueOnce(staleProbe.promise)
-    mocks.fetchEulerLabelsData.mockImplementation((chainId: number) => {
-      if (chainId === 1) return Promise.resolve(labelsFor('chain-one'))
+    mocks.fetchPublicLabelsBundle.mockImplementation((_url: string, options: { query: { chainId: number } }) => {
+      const chainId = options.query.chainId
+      if (chainId === 1) return Promise.resolve(bundleFor(labelsFor('chain-one')))
       if (chainId === 2) return chainTwo.promise
       throw new Error(`unexpected chain ${chainId}`)
     })
@@ -260,7 +259,7 @@ describe('useEulerLabels chain-scoped loading', () => {
     currentChainId.value = 2
     mocks.vaults.length = 0
     const chainTwoLoad = labels.loadLabels()
-    await vi.waitFor(() => expect(mocks.fetchEulerLabelsData).toHaveBeenCalledWith(2))
+    await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
 
     staleProbe.resolve([{
       success: true,
@@ -271,7 +270,7 @@ describe('useEulerLabels chain-scoped loading', () => {
 
     expect(getEulerLabelWrapPairs()).toEqual({})
 
-    chainTwo.resolve(labelsFor('chain-two'))
+    chainTwo.resolve(bundleFor(labelsFor('chain-two')))
     await chainTwoLoad
     expect(currentProductKeys()).toEqual(['chain-two'])
     expect(getEulerLabelWrapPairs()).toEqual({})
diff --git a/tests/composables/useEulerSdk.test.ts b/tests/composables/useEulerSdk.test.ts
index 65c0fc276..2b11caebd 100644
--- a/tests/composables/useEulerSdk.test.ts
+++ b/tests/composables/useEulerSdk.test.ts
@@ -13,7 +13,6 @@ type BuildEulerSDKOptions = {
     v3ApiUrl?: string
     tokenlistApiBaseUrl?: string
     deploymentsUrl?: string
-    eulerLabelsBaseUrl?: string
     oracleAdaptersBaseUrl?: string
     rewardsMerklApiUrl?: string
     rewardsBrevisApiUrl?: string
@@ -149,7 +148,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: 'https://example.test/EulerChains.json',
-        configLabelsBaseUrl: 'https://labels.example.test/',
         configOracleChecksBaseUrl: 'https://oracles.example.test/data/',
       },
     }))
@@ -166,7 +164,6 @@ describe('useEulerSdk', () => {
       v3ApiUrl: '/api/internal',
       tokenlistApiBaseUrl: '/api/internal',
       deploymentsUrl: '/api/internal/euler-chains',
-      eulerLabelsBaseUrl: '/api/internal/labels',
       oracleAdaptersBaseUrl: 'https://oracles.example.test/data',
     })
     expect(options.rpcUrls).toBeUndefined()
@@ -182,7 +179,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
         configOracleChecksBaseUrl: '',
       },
     }))
@@ -200,7 +196,6 @@ describe('useEulerSdk', () => {
       intrinsicApyV3ApiUrl: '/api/internal',
       eulerInterfacesBranch: 'account-lens-update',
       deploymentsUrl: '/api/internal/euler-chains',
-      eulerLabelsBaseUrl: '/api/internal/labels',
       rewardsMerklApiUrl: '/api/internal/proxy/merkl',
       rewardsBrevisApiUrl: '/api/internal/proxy/incentra/sdk/v1/eulerCampaigns',
       rewardsBrevisProofsApiUrl: '/api/internal/proxy/incentra/v1/getMerkleProofsBatch',
@@ -230,7 +225,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
         configOracleChecksBaseUrl: '',
       },
     }))
@@ -264,7 +258,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
         configOracleChecksBaseUrl: '',
       },
     }))
@@ -291,7 +284,6 @@ describe('useEulerSdk', () => {
     vi.stubGlobal('useRuntimeConfig', () => ({
       public: {
         configEulerChainsUrl: '',
-        configLabelsBaseUrl: '',
         configOracleChecksBaseUrl: '',
       },
     }))
diff --git a/tests/server/labels-base-url.test.ts b/tests/server/labels-base-url.test.ts
new file mode 100644
index 000000000..abb4739a6
--- /dev/null
+++ b/tests/server/labels-base-url.test.ts
@@ -0,0 +1,33 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
+
+describe('effective policy base URL', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('prefers the server-only effective-policy URL', () => {
+    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', 'https://policy.example.test/')
+    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', 'https://legacy.example.test')
+
+    expect(resolveLabelsBaseUrl()).toBe('https://policy.example.test')
+  })
+
+  it('retains the former public variable as a deployment fallback', () => {
+    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', '')
+    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', 'https://legacy.example.test/')
+
+    expect(resolveLabelsBaseUrl()).toBe('https://legacy.example.test')
+  })
+
+  it('builds the repository URL from server-only settings', () => {
+    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', '')
+    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', '')
+    vi.stubEnv('EFFECTIVE_POLICY_REPO', 'example/policy')
+    vi.stubEnv('EFFECTIVE_POLICY_REPO_BRANCH', 'published')
+
+    expect(resolveLabelsBaseUrl()).toBe(
+      'https://raw.githubusercontent.com/example/policy/refs/heads/published',
+    )
+  })
+})
diff --git a/tests/server/labels-validate-node.test.ts b/tests/server/labels-validate-node.test.ts
index cf45ca0e6..169b6a423 100644
--- a/tests/server/labels-validate-node.test.ts
+++ b/tests/server/labels-validate-node.test.ts
@@ -9,10 +9,55 @@
  *
  * If an assertion here starts failing, do not relax it before reviewing the
  * threat model in `docs/geo-blocking.md` and the PR that introduced the
- * corresponding defense (see git blame on server/api/internal/labels/[file].get.ts).
+ * corresponding defense (see git history for server/utils/labels-source.ts).
  */
 import { describe, it, expect } from 'vitest'
-import { validateNode } from '~/server/api/internal/labels/[file].get'
+import { projectEffectiveLabelsSource, validateNode } from '~/server/utils/labels-source'
+
+describe('effective labels policy projection', () => {
+  it('strips all legacy display content from the browser-facing overlay', () => {
+    const address = '0x0000000000000000000000000000000000000001'
+    const result = projectEffectiveLabelsSource({
+      product: {
+        name: 'Legacy name',
+        description: 'Legacy description',
+        entity: 'legacy-entity',
+        tags: ['legacy-tag'],
+        vaults: [address],
+        block: ['US'],
+        vaultOverrides: {
+          [address]: {
+            name: 'Legacy vault name',
+            restricted: ['CA'],
+          },
+        },
+      },
+    }, [{
+      address,
+      description: 'Legacy Earn description',
+      notExplorable: true,
+    }], [{
+      address,
+      name: 'Legacy asset name',
+      block: ['US'],
+    }])
+
+    expect(result).toEqual({
+      products: {
+        product: {
+          vaults: [address],
+          block: ['US'],
+          vaultOverrides: {
+            [address]: { restricted: ['CA'] },
+          },
+        },
+      },
+      earnVaults: [{ address, notExplorable: true }],
+      assets: [{ address, block: ['US'] }],
+    })
+    expect(JSON.stringify(result)).not.toContain('Legacy')
+  })
+})
 
 describe('validateNode — size caps', () => {
   it('rejects strings longer than 16 KiB (client-side DoS guard)', () => {
diff --git a/tests/server/public-labels-endpoint.test.ts b/tests/server/public-labels-endpoint.test.ts
new file mode 100644
index 000000000..eb9d6dbda
--- /dev/null
+++ b/tests/server/public-labels-endpoint.test.ts
@@ -0,0 +1,78 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  query: {} as Record<string, string>,
+  cacheControl: undefined as string | undefined,
+  getPublicLabelsBundle: vi.fn(),
+  refreshPublicLabelsBundle: vi.fn(),
+  consume: vi.fn(),
+  setResponseHeader: vi.fn(),
+}))
+
+vi.mock('h3', () => ({
+  createError: (args: { statusCode: number, statusMessage: string }) => Object.assign(
+    new Error(args.statusMessage),
+    args,
+  ),
+  getHeader: () => mocks.cacheControl,
+  getQuery: () => mocks.query,
+  setResponseHeader: mocks.setResponseHeader,
+}))
+
+vi.mock('~/server/utils/rate-limit', () => ({
+  createRateLimiter: () => ({ consume: mocks.consume }),
+}))
+
+vi.mock('~/server/utils/public-labels-source', () => ({
+  getPublicLabelsBundle: mocks.getPublicLabelsBundle,
+  refreshPublicLabelsBundle: mocks.refreshPublicLabelsBundle,
+}))
+
+const loadHandler = async () => {
+  vi.stubGlobal('defineEventHandler', (handler: unknown) => handler)
+  const route = await import('~/server/api/internal/public-labels.get')
+  return route.default as (event: unknown) => Promise<unknown>
+}
+
+describe('public labels aggregate endpoint', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+    mocks.query = { chainId: '1' }
+    mocks.cacheControl = undefined
+    mocks.getPublicLabelsBundle.mockReset().mockResolvedValue({ source: 'cache' })
+    mocks.refreshPublicLabelsBundle.mockReset().mockResolvedValue({ source: 'refresh' })
+    mocks.consume.mockReset()
+    mocks.setResponseHeader.mockReset()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('uses the cached latest bundle for a normal request', async () => {
+    const handler = await loadHandler()
+
+    await expect(handler({})).resolves.toEqual({ source: 'cache' })
+    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, 'latest')
+    expect(mocks.refreshPublicLabelsBundle).not.toHaveBeenCalled()
+  })
+
+  it('forces the selected deterministic version on no-cache requests', async () => {
+    mocks.query = { chainId: '1', version: 'v20260804151305236' }
+    mocks.cacheControl = 'no-cache'
+    const handler = await loadHandler()
+
+    await expect(handler({})).resolves.toEqual({ source: 'refresh' })
+    expect(mocks.refreshPublicLabelsBundle).toHaveBeenCalledWith(1, 'v20260804151305236')
+  })
+
+  it('rejects unsupported version shapes before fetching', async () => {
+    mocks.query = { chainId: '1', version: 'draft' }
+    const handler = await loadHandler()
+
+    await expect(handler({})).rejects.toMatchObject({ statusCode: 400 })
+    expect(mocks.getPublicLabelsBundle).not.toHaveBeenCalled()
+    expect(mocks.refreshPublicLabelsBundle).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
new file mode 100644
index 000000000..d3e433c13
--- /dev/null
+++ b/tests/server/public-labels-source.test.ts
@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  fetchWithTimeout: vi.fn(),
+  getEffectiveLabelsSource: vi.fn(),
+  warn: vi.fn(),
+}))
+
+vi.mock('~/server/utils/fetchWithTimeout', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('~/server/utils/fetchWithTimeout')>()
+  return {
+    ...actual,
+    fetchWithTimeout: mocks.fetchWithTimeout,
+  }
+})
+
+vi.mock('~/server/utils/labels-source', () => ({
+  getEffectiveLabelsSource: mocks.getEffectiveLabelsSource,
+}))
+
+vi.mock('~/server/utils/logger', () => ({
+  logger: { warn: mocks.warn },
+}))
+
+const emptyListResponse = () => new Response(JSON.stringify({
+  data: [],
+  meta: { total: 0, timestamp: '2026-08-04T15:13:05.236Z' },
+}), {
+  status: 200,
+  headers: { 'content-type': 'application/json' },
+})
+
+const versionsResponse = () => new Response(JSON.stringify({
+  data: [{
+    versionKey: 'v20260804151305236',
+    status: 'published',
+    aliases: ['latest'],
+    isLatest: true,
+  }],
+  meta: { timestamp: '2026-08-04T15:13:05.236Z' },
+}), {
+  status: 200,
+  headers: { 'content-type': 'application/json' },
+})
+
+describe('public labels server source', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
+    vi.stubEnv('V3_API_URL', 'https://v3.example.test')
+    mocks.fetchWithTimeout.mockReset().mockImplementation(async (url: string) =>
+      new URL(url).pathname.endsWith('/label-sets/public/versions')
+        ? versionsResponse()
+        : emptyListResponse(),
+    )
+    mocks.getEffectiveLabelsSource.mockReset().mockResolvedValue({
+      products: {},
+      earnVaults: [],
+      assets: [],
+    })
+    mocks.warn.mockReset()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.unstubAllEnvs()
+  })
+
+  it('deduplicates concurrent loads and serves the aggregate from cache', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+
+    const [first, concurrent] = await Promise.all([
+      getPublicLabelsBundle(1),
+      getPublicLabelsBundle(1),
+    ])
+    const cached = await getPublicLabelsBundle(1)
+
+    expect(concurrent).toBe(first)
+    expect(cached).toBe(first)
+    expect(first.version).toBe('v20260804151305236')
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(5)
+    expect(mocks.getEffectiveLabelsSource).toHaveBeenCalledTimes(1)
+    expect(mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url).pathname)).toEqual([
+      '/v3/label-sets/public/versions',
+      '/v3/curation/vaults',
+      '/v3/products',
+      '/v3/entities',
+      '/v3/geo-policies',
+    ])
+    expect(mocks.fetchWithTimeout.mock.calls.slice(1).every(([url]) =>
+      new URL(url).searchParams.get('version') === 'v20260804151305236',
+    )).toBe(true)
+  })
+
+  it('uses deterministic fixture versions directly without resolving latest', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+
+    const bundle = await getPublicLabelsBundle(1, 'v20260804151305236')
+
+    expect(bundle.version).toBe('v20260804151305236')
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(4)
+    expect(mocks.fetchWithTimeout.mock.calls.every(([url]) =>
+      !new URL(url).pathname.endsWith('/label-sets/public/versions'),
+    )).toBe(true)
+  })
+
+  it('serves a bounded stale bundle when a refresh fails', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+
+    vi.advanceTimersByTime(300_001)
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('V3 unavailable'))
+
+    await expect(getPublicLabelsBundle(1)).resolves.toBe(first)
+    expect(mocks.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ ctx: 'public-labels-source', chainId: 1 }),
+      'refresh failed',
+    )
+  })
+
+  it('fails closed when effective policy is unavailable without stale data', async () => {
+    mocks.getEffectiveLabelsSource.mockRejectedValue(new Error('policy unavailable'))
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('policy unavailable')
+    expect(mocks.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ ctx: 'public-labels-source', chainId: 1 }),
+      'refresh failed',
+    )
+  })
+})
diff --git a/tests/server/sdk-server.test.ts b/tests/server/sdk-server.test.ts
index 9b82dae0d..983ab2660 100644
--- a/tests/server/sdk-server.test.ts
+++ b/tests/server/sdk-server.test.ts
@@ -3,7 +3,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   buildEulerSDK: vi.fn(),
   resolveRpcUrl: vi.fn(),
-  resolveLabelsBaseUrl: vi.fn(),
 }))
 
 vi.mock('@eulerxyz/euler-v2-sdk', () => ({
@@ -14,19 +13,13 @@ vi.mock('~/server/utils/rpc', () => ({
   resolveRpcUrl: mocks.resolveRpcUrl,
 }))
 
-vi.mock('~/server/utils/labels-base-url', () => ({
-  resolveLabelsBaseUrl: mocks.resolveLabelsBaseUrl,
-}))
-
 describe('getServerSdk', () => {
   beforeEach(() => {
     vi.resetModules()
     mocks.buildEulerSDK.mockReset()
     mocks.resolveRpcUrl.mockReset()
-    mocks.resolveLabelsBaseUrl.mockReset()
     mocks.buildEulerSDK.mockImplementation(async options => ({ options }))
     mocks.resolveRpcUrl.mockReturnValue('https://rpc.example')
-    mocks.resolveLabelsBaseUrl.mockReturnValue('https://labels.example')
     process.env.V3_API_URL = 'https://v3.example'
     process.env.SERVER_VAULT_CACHE_SOURCE = 'fallback'
     // Routing is driven by ONCHAIN_SDK_CHAINS only; DEPRECATED_CHAINS is a
diff --git a/tests/server/v3-proxy.test.ts b/tests/server/v3-proxy.test.ts
index 5caa010ec..f0f6f6d88 100644
--- a/tests/server/v3-proxy.test.ts
+++ b/tests/server/v3-proxy.test.ts
@@ -36,26 +36,15 @@ describe('v3 proxy utilities', () => {
     expect(isV3ProxyPathAllowed(`/v3/activity/vaults/1/${VAULT}/events`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/apys/intrinsic')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/apys/rewards')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/curation/vaults')).toBe(true)
-    expect(isV3ProxyPathAllowed(`/v3/curation/vaults/1/${VAULT}/labels`)).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}`)).toBe(true)
-    expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}/assessment`)).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/earn/vaults/1/${VAULT}/totals`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/bad-debt')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/batch')).toBe(true)
     expect(isV3ProxyPathAllowed(`/v3/evk/vaults/1/${VAULT}/totals`)).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/open-interest')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/open-interest/by-collateral')).toBe(true)
-    expect(isV3ProxyPathAllowed(`/v3/evk/vaults/1/${VAULT}/assessment`)).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/entities')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/entities/kpk')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/entities/kpk/addresses')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/geo-policies')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/label-sets/public/versions')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/liquidations')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/prices')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/products')).toBe(true)
-    expect(isV3ProxyPathAllowed('/v3/products/1/kpk-securitize')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/resolve/vaults')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/rewards/breakdown')).toBe(true)
     expect(isV3ProxyPathAllowed('/v3/tokens')).toBe(true)
@@ -66,13 +55,9 @@ describe('v3 proxy utilities', () => {
     expect(isV3ProxyPathAllowed('/v3/accounting')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults/bad-debt/history')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/evk/vaults-admin')).toBe(false)
-    expect(isV3ProxyPathAllowed(`/v3/curation/vaults/1/${VAULT}/labels/admin`)).toBe(false)
-    expect(isV3ProxyPathAllowed('/v3/entities/kpk/addresses/admin')).toBe(false)
-    expect(isV3ProxyPathAllowed('/v3/entities/bad.dot')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/apys/unknown')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/liquidations/admin')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/liquidations-extra')).toBe(false)
-    expect(isV3ProxyPathAllowed('/v3/products/1/bad.dot')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/resolve')).toBe(false)
     expect(isV3ProxyPathAllowed('/v3/activity/accounts/not-an-address/events')).toBe(false)
     expect(isV3ProxyPathAllowed(`/v3/activity/accounts/${ACCOUNT}/events/admin`)).toBe(false)
diff --git a/tests/server/vaults-cache.test.ts b/tests/server/vaults-cache.test.ts
index 5cf88a7cd..ca04d34bc 100644
--- a/tests/server/vaults-cache.test.ts
+++ b/tests/server/vaults-cache.test.ts
@@ -15,7 +15,7 @@ const mocks = vi.hoisted(() => ({
   fetchVaults: vi.fn(),
   fetchVerifiedVaultAddresses: vi.fn(),
   fetchVaultTypes: vi.fn(),
-  refreshLabelFile: vi.fn(),
+  getPublicEulerLabelsData: vi.fn(),
   warn: vi.fn(),
   error: vi.fn(),
 }))
@@ -30,9 +30,8 @@ vi.mock('@eulerxyz/euler-v2-sdk', () => ({
   },
 }))
 
-vi.mock('~/server/api/internal/labels/[file].get', () => ({
-  LABEL_FILES: [],
-  refreshLabelFile: mocks.refreshLabelFile,
+vi.mock('~/server/utils/public-labels-source', () => ({
+  getPublicEulerLabelsData: mocks.getPublicEulerLabelsData,
 }))
 
 vi.mock('~/server/utils/sdk-server', () => ({
@@ -66,22 +65,16 @@ describe('vaults cache', () => {
     mocks.fetchVaults.mockReset()
     mocks.fetchVerifiedVaultAddresses.mockReset()
     mocks.fetchVaultTypes.mockReset()
-    mocks.refreshLabelFile.mockReset()
+    mocks.getPublicEulerLabelsData.mockReset()
     mocks.warn.mockReset()
     mocks.error.mockReset()
     process.env.EVAULT_FETCH_CHUNK_CHAINS = '146'
 
     mocks.fetchVerifiedVaultAddresses.mockResolvedValue([])
     mocks.fetchVaultTypes.mockResolvedValue({})
-    mocks.refreshLabelFile.mockImplementation(async (_scope, file) => {
-      if (file === 'products.json') {
-        return {
-          test: {
-            vaults: [...VAULTS],
-          },
-        }
-      }
-      return []
+    mocks.getPublicEulerLabelsData.mockResolvedValue({
+      verifiedVaultAddresses: [...VAULTS],
+      earnVaults: [],
     })
   })
 
diff --git a/tests/utils/discovery-calculations.test.ts b/tests/utils/discovery-calculations.test.ts
index c3a2f56a7..8eabf65b8 100644
--- a/tests/utils/discovery-calculations.test.ts
+++ b/tests/utils/discovery-calculations.test.ts
@@ -21,13 +21,13 @@ import { VaultRewardInfo } from '@eulerxyz/euler-v2-sdk'
 import { INTEREST_RATE_MODEL_TYPE } from '~/entities/constants'
 
 vi.mock('~/entities/euler/labels', () => ({
-  getEulerLabelEntityLogo: (logo: string) => `/entities/${logo}`,
+  getEulerLabelEntityLogo: (logo: string) => logo,
 }))
 
 vi.mock('~/utils/eulerLabelsUtils', () => ({
   getEntitiesByVault: (vault: { address?: string }) => {
-    if (vault.address === '0xBorrow') return [{ name: 'KPK', logo: 'kpk.svg' }]
-    if (vault.address === '0xSecuritize') return [{ name: 'Securitize', logo: 'securitize.png' }]
+    if (vault.address === '0xBorrow') return [{ name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' }]
+    if (vault.address === '0xSecuritize') return [{ name: 'Securitize', logo: 'https://token-images.euler.finance/labels/securitize' }]
     return []
   },
   isVaultCyclicalNote: () => false,
@@ -464,7 +464,10 @@ describe('getMarketEntities', () => {
 
     expect(getMarketEntities(market)).toEqual({
       name: 'KPK & Securitize',
-      logos: ['/entities/kpk.svg', '/entities/securitize.png'],
+      logos: [
+        'https://token-images.euler.finance/labels/kpk',
+        'https://token-images.euler.finance/labels/securitize',
+      ],
       labels: ['KPK', 'Securitize'],
     })
   })
@@ -473,16 +476,19 @@ describe('getMarketEntities', () => {
     const market = {
       ...makeMarket([makeVault('0xBorrow', [])]),
       source: 'product',
-      curator: { name: 'KPK', logo: 'kpk.svg' },
+      curator: { name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' },
       brandEntities: [
-        { name: 'KPK', logo: 'kpk.svg' },
-        { name: 'Securitize', logo: 'securitize.png' },
+        { name: 'KPK', logo: 'https://token-images.euler.finance/labels/kpk' },
+        { name: 'Securitize', logo: 'https://token-images.euler.finance/labels/securitize' },
       ],
     } as MarketGroup
 
     expect(getMarketEntities(market)).toEqual({
       name: 'KPK',
-      logos: ['/entities/kpk.svg', '/entities/securitize.png'],
+      logos: [
+        'https://token-images.euler.finance/labels/kpk',
+        'https://token-images.euler.finance/labels/securitize',
+      ],
       labels: ['KPK', 'Securitize'],
     })
   })
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
index 48b5dcd58..16d295266 100644
--- a/tests/utils/public-labels.test.ts
+++ b/tests/utils/public-labels.test.ts
@@ -1,4 +1,3 @@
-import type { EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
 import { getAddress } from 'viem'
 import { describe, expect, it, vi } from 'vitest'
 import {
@@ -10,6 +9,7 @@ import {
   PUBLIC_LABELS_PAGE_SIZE,
   type PublicLabelsRequest,
   type PublicProductLabel,
+  type EffectiveLabelsSource,
 } from '~/utils/public-labels'
 import {
   ASSESSMENT_ONLY_EARN,
@@ -94,13 +94,9 @@ describe('Public Labels pagination', () => {
 
 describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
   it('keeps KPK as owner, exposes Securitize as a co-brand, and maps hosted profiles', () => {
-    const legacy = {
+    const effectivePolicy: EffectiveLabelsSource = {
       products: {
         'kpk-securitize': {
-          name: 'Legacy KPK market',
-          description: '',
-          entity: KPK,
-          url: '',
           vaults: [getAddress(KPK_VAULT)],
           block: ['US'],
           vaultOverrides: {
@@ -108,16 +104,11 @@ describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
           },
         },
       },
-      assetBlocks: { '0xasset': ['GB'] },
-      assetRestrictions: {},
-      assetPatternRules: [],
-      earnVaultBlocks: {},
-      earnVaultRestrictions: {},
-      earnVaultEntries: {},
-      notExplorableEarnVaults: new Set<string>(),
-    } as unknown as EulerLabelsData
-
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+      earnVaults: [],
+      assets: [],
+    }
+
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
     const product = result.products['kpk-securitize']
 
     expect(product.entity).toBe(KPK)
@@ -140,13 +131,9 @@ describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
   })
 
   it('keeps neutral escrows unattributed and raw geo policies non-effective', () => {
-    const legacy = {
+    const effectivePolicy: EffectiveLabelsSource = {
       products: {
         'kpk-securitize': {
-          name: 'Legacy KPK market',
-          description: '',
-          entity: KPK,
-          url: '',
           vaults: [getAddress(KPK_VAULT)],
           block: ['US'],
           vaultOverrides: {
@@ -154,16 +141,11 @@ describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
           },
         },
       },
-      assetBlocks: {},
-      assetRestrictions: {},
-      assetPatternRules: [],
-      earnVaultBlocks: {},
-      earnVaultRestrictions: {},
-      earnVaultEntries: {},
-      notExplorableEarnVaults: new Set<string>(),
-    } as unknown as EulerLabelsData
-
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+      earnVaults: [],
+      assets: [],
+    }
+
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
     const product = result.products['kpk-securitize']
 
     expect(result.verifiedVaultAddresses).not.toContain(getAddress(NEUTRAL_ESCROW))
@@ -178,24 +160,53 @@ describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
   })
 
   it('retains compatibility-confirmed plain labels without trusting assessment-only rows', () => {
-    const legacy = {
-      products: {},
-      verifiedVaultAddresses: [getAddress(VERIFICATION_ONLY_EVK)],
+    const effectivePolicy: EffectiveLabelsSource = {
+      products: {
+        compatibility: { vaults: [getAddress(VERIFICATION_ONLY_EVK)] },
+      },
       earnVaults: [getAddress(VERIFICATION_ONLY_EARN)],
-      assetBlocks: {},
-      assetRestrictions: {},
-      assetPatternRules: [],
-      earnVaultBlocks: {},
-      earnVaultRestrictions: {},
-      earnVaultEntries: {},
-      notExplorableEarnVaults: new Set<string>(),
-    } as unknown as EulerLabelsData
+      assets: [],
+    }
 
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, legacy)
+    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
 
     expect(result.verifiedVaultAddresses).toContain(getAddress(VERIFICATION_ONLY_EVK))
     expect(result.verifiedVaultAddresses).not.toContain(getAddress(ASSESSMENT_ONLY_EVK))
     expect(result.earnVaults).toContain(getAddress(VERIFICATION_ONLY_EARN))
     expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
   })
+
+  it('keeps mixed vault tags scoped to their vault override', () => {
+    const sibling = {
+      ...publicLabelsFixture.vaults[0],
+      address: '0x00000000000000000000000000000000000000C1',
+      tags: [],
+    }
+    const result = normalizePublicLabelsData(1, {
+      ...publicLabelsFixture,
+      vaults: [publicLabelsFixture.vaults[0], sibling],
+    })
+    const product = result.products['kpk-securitize']
+
+    expect(product.tags).toBeUndefined()
+    expect(product.vaultOverrides?.[getAddress(KPK_VAULT)]?.tags).toContain('recently added')
+    expect(product.vaultOverrides?.[getAddress(sibling.address)]?.tags).toBeUndefined()
+  })
+
+  it('drops non-http profile and campaign URLs at the normalization boundary', () => {
+    const result = normalizePublicLabelsData(1, {
+      ...publicLabelsFixture,
+      entities: publicLabelsFixture.entities.map((entity, index) => index === 0
+        ? { ...entity, logo: 'data:image/svg+xml,bad', url: 'javascript:alert(1)', socialTwitter: 'file:///tmp/bad' }
+        : entity),
+      vaults: publicLabelsFixture.vaults.map((vault, index) => index === 0
+        ? { ...vault, campaigns: [{ name: 'Unsafe', logo: 'javascript:alert(1)', type: 'deposit' }] }
+        : vault),
+    })
+
+    expect(result.entities.kpk.logo).toBe('')
+    expect(result.entities.kpk.url).toBe('')
+    expect(result.entities.kpk.social.twitter).toBe('')
+    expect(result.points[getAddress(KPK_VAULT)]?.[0]?.logo).toBe('')
+  })
 })
diff --git a/tests/utils/vault/governor-verification.test.ts b/tests/utils/vault/governor-verification.test.ts
index 3b3553efb..e599b6412 100644
--- a/tests/utils/vault/governor-verification.test.ts
+++ b/tests/utils/vault/governor-verification.test.ts
@@ -208,7 +208,7 @@ describe('isEarnVaultOwnerVerified', () => {
     expect(isEarnVaultOwnerVerified(earn, labels)).toBe(false)
   })
 
-  it('trusts earn vaults without a product entry (earn-vaults.json sole anchor)', () => {
+  it('trusts a published earn vault without a product assignment', () => {
     const earn = makeEarn({ owner: GOV_A })
     const labels = buildLabels({ declaredKeys: {} })
     expect(isEarnVaultOwnerVerified(earn, labels)).toBe(true)
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index 28d29ce6e..22afac36a 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -1,7 +1,8 @@
-import type { EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
+import type { EulerLabelAssetPatternRule, EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
 import { getAddress } from 'viem'
 import type {
   EulerLabelEarnVaultEntry,
+  EulerLabelAssetEntry,
   EulerLabelEntity,
   EulerLabelPointReward,
   EulerLabelProduct,
@@ -120,6 +121,45 @@ export interface PublicLabelsSource {
   geoPolicies: PublicGeoPolicy[]
 }
 
+export interface EffectiveProductPolicy {
+  block?: string[]
+  restricted?: string[]
+  notExplorable?: boolean
+  vaults?: string[]
+  deprecatedVaults?: string[]
+  vaultOverrides?: Record<string, {
+    block?: string[]
+    restricted?: string[]
+    notExplorableLend?: boolean
+    notExplorableBorrow?: boolean
+  }>
+}
+
+export interface EffectiveEarnPolicy {
+  address: string
+  block?: string[]
+  restricted?: string[]
+  notExplorable?: boolean
+}
+
+/**
+ * Effective visibility remains a separate compatibility contract until V3
+ * publishes the resolved product/vault/asset policy result. No display
+ * content is read from this source.
+ */
+export interface EffectiveLabelsSource {
+  products: Record<string, EffectiveProductPolicy>
+  earnVaults: Array<string | EffectiveEarnPolicy>
+  assets: EulerLabelAssetEntry[]
+}
+
+export interface PublicLabelsBundle {
+  /** Concrete immutable version used for every request in this aggregate. */
+  version: string
+  publicLabels: PublicLabelsSource
+  effectivePolicy: EffectiveLabelsSource
+}
+
 export type PublicLabelsQuery = Record<string, string | number | undefined>
 export type PublicLabelsRequest = <T>(
   path: string,
@@ -214,14 +254,25 @@ export const fetchPublicLabelsData = async (
   request: PublicLabelsRequest,
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
-  legacy?: EulerLabelsData | Promise<EulerLabelsData>,
+  effectivePolicy?: EffectiveLabelsSource | Promise<EffectiveLabelsSource>,
 ): Promise<MigratedEulerLabelsData> => {
-  const [vaults, products, entities, geoPolicies, resolvedLegacy] = await Promise.all([
+  const [source, resolvedEffectivePolicy] = await Promise.all([
+    fetchPublicLabelsSource(request, chainId, version),
+    Promise.resolve(effectivePolicy),
+  ])
+  return normalizePublicLabelsData(chainId, source, resolvedEffectivePolicy)
+}
+
+export const fetchPublicLabelsSource = async (
+  request: PublicLabelsRequest,
+  chainId: number,
+  version = PUBLIC_LABELS_RUNTIME_VERSION,
+): Promise<PublicLabelsSource> => {
+  const [vaults, products, entities, geoPolicies] = await Promise.all([
     fetchAllPublicLabelPages<PublicVaultLabel>(request, '/curation/vaults', { version, chainId }),
     fetchAllPublicLabelPages<PublicProductLabel>(request, '/products', { version, chainId }),
     fetchAllPublicLabelPages<PublicEntityLabel>(request, '/entities', { version }),
     fetchAllPublicLabelPages<PublicGeoPolicy>(request, '/geo-policies', { version }),
-    Promise.resolve(legacy),
   ])
 
   const entityIds = [...new Set([
@@ -239,20 +290,40 @@ export const fetchPublicLabelsData = async (
     ),
   )
 
-  return normalizePublicLabelsData(chainId, {
+  return {
     vaults,
     products,
     entities,
     entityAddresses: entityAddressPages.flat(),
     geoPolicies,
-  }, resolvedLegacy)
+  }
 }
 
 const uniqueStrings = (values: Iterable<string>): string[] => [...new Set(values)]
 
+const tryAddress = (value: string): string | undefined => {
+  try {
+    return getAddress(value)
+  }
+  catch {
+    return undefined
+  }
+}
+
 const present = <T>(value: T | null | undefined): T | undefined =>
   value === null || value === undefined ? undefined : value
 
+const safeHttpUrl = (value: string | null | undefined): string => {
+  if (!value) return ''
+  try {
+    const protocol = new URL(value).protocol
+    return protocol === 'http:' || protocol === 'https:' ? value : ''
+  }
+  catch {
+    return ''
+  }
+}
+
 const makeVaultOverride = (vault: PublicVaultLabel): EulerLabelVaultOverride => ({
   ...present(vault.name) !== undefined && { name: vault.name! },
   ...present(vault.description) !== undefined && { description: vault.description! },
@@ -267,9 +338,9 @@ const buildEntity = (
 ): EulerLabelEntity => ({
   id: entity.id,
   name: entity.name,
-  logo: entity.logo ?? '',
+  logo: safeHttpUrl(entity.logo),
   description: entity.description ?? '',
-  url: entity.url ?? '',
+  url: safeHttpUrl(entity.url),
   ...present(entity.legalEntityName) !== undefined && { legalEntityName: entity.legalEntityName! },
   ...present(entity.riskMethodology) !== undefined && { riskMethodology: entity.riskMethodology! },
   ...present(entity.security) !== undefined && { security: entity.security! },
@@ -278,17 +349,20 @@ const buildEntity = (
   ...present(entity.disclaimers) !== undefined && { disclaimers: entity.disclaimers! },
   addresses: Object.fromEntries(addresses.map(entry => [getAddress(entry.address), entry.label ?? ''])),
   social: {
-    twitter: entity.socialTwitter ?? '',
-    youtube: entity.socialYoutube ?? '',
-    discord: entity.socialDiscord ?? '',
-    telegram: entity.socialTelegram ?? '',
-    github: entity.socialGithub ?? '',
-    defillama: entity.socialDefillama ?? '',
+    twitter: safeHttpUrl(entity.socialTwitter),
+    youtube: safeHttpUrl(entity.socialYoutube),
+    discord: safeHttpUrl(entity.socialDiscord),
+    telegram: safeHttpUrl(entity.socialTelegram),
+    github: safeHttpUrl(entity.socialGithub),
+    defillama: safeHttpUrl(entity.socialDefillama),
   },
 })
 
 const productTags = (vaults: PublicVaultLabel[]): string[] | undefined => {
-  const tags = uniqueStrings(vaults.flatMap(vault => vault.tags))
+  if (vaults.length === 0) return undefined
+  const tags = uniqueStrings(vaults[0].tags).filter(tag =>
+    vaults.every(vault => vault.tags.includes(tag)),
+  )
   return tags.length > 0 ? tags : undefined
 }
 
@@ -308,6 +382,7 @@ const buildProduct = (
   }
 
   const tags = productTags(vaults)
+  const logo = safeHttpUrl(product.logo)
   return {
     id: product.id,
     chainId: product.chainId,
@@ -316,8 +391,8 @@ const buildProduct = (
     ...(product.portfolioNotice && { portfolioNotice: product.portfolioNotice }),
     entity: product.entityId,
     coBrandEntityIds: [...(product.coBrandEntityIds ?? [])],
-    url: product.url ?? '',
-    ...(product.logo && { logo: product.logo }),
+    url: safeHttpUrl(product.url),
+    ...(logo && { logo }),
     vaults: active,
     deprecatedVaults: deprecated,
     ...(product.deprecationReason && { deprecationReason: product.deprecationReason }),
@@ -366,19 +441,81 @@ const buildStandaloneProduct = (vault: PublicVaultLabel): EulerLabelProduct => {
   }
 }
 
+const emptyEffectiveLabelsSource = (): EffectiveLabelsSource => ({
+  products: {},
+  earnVaults: [],
+  assets: [],
+})
+
+const getEffectiveVaultSets = (effective: EffectiveLabelsSource) => {
+  const verified = new Set<string>()
+  for (const product of Object.values(effective.products)) {
+    for (const address of [...(product.vaults ?? []), ...(product.deprecatedVaults ?? [])]) {
+      verified.add(address.toLowerCase())
+    }
+  }
+  const earn = new Set(effective.earnVaults.map(entry =>
+    (typeof entry === 'string' ? entry : entry.address).toLowerCase(),
+  ))
+  return { verified, earn }
+}
+
+const normalizeEffectiveEarnPolicy = (effective: EffectiveLabelsSource) => {
+  const blocks: Record<string, string[]> = {}
+  const restrictions: Record<string, string[]> = {}
+  const notExplorable = new Set<string>()
+  for (const raw of effective.earnVaults) {
+    if (typeof raw === 'string') continue
+    const address = tryAddress(raw.address)
+    if (!address) continue
+    const key = address.toLowerCase()
+    if (raw.block?.length) blocks[key] = [...raw.block]
+    if (raw.restricted?.length) restrictions[key] = [...raw.restricted]
+    if (raw.notExplorable) notExplorable.add(key)
+  }
+  return { blocks, restrictions, notExplorable }
+}
+
+const normalizeEffectiveAssets = (entries: EulerLabelAssetEntry[]) => {
+  const blocks: Record<string, string[]> = {}
+  const restrictions: Record<string, string[]> = {}
+  const patternRules: EulerLabelAssetPatternRule[] = []
+
+  for (const entry of entries) {
+    if (entry.address) {
+      const address = tryAddress(entry.address)
+      if (address) {
+        const key = address.toLowerCase()
+        if (entry.block?.length) blocks[key] = [...entry.block]
+        if (entry.restricted?.length) restrictions[key] = [...entry.restricted]
+      }
+    }
+
+    const rule: EulerLabelAssetPatternRule = {
+      ...(entry.block?.length && { block: [...entry.block] }),
+      ...(entry.restricted?.length && { restricted: [...entry.restricted] }),
+    }
+    if (!rule.block && !rule.restricted) continue
+    if (entry.symbols?.length) rule.symbolsLower = new Set(entry.symbols.map(value => value.toLowerCase()))
+    if (entry.names?.length) rule.namesLower = new Set(entry.names.map(value => value.toLowerCase()))
+    if (entry.symbolRegex) rule.symbolRegex = new RegExp(entry.symbolRegex, 'i')
+    if (entry.nameRegex) rule.nameRegex = new RegExp(entry.nameRegex, 'i')
+    if (rule.symbolsLower || rule.symbolRegex || rule.namesLower || rule.nameRegex) {
+      patternRules.push(rule)
+    }
+  }
+
+  return { blocks, restrictions, patternRules }
+}
+
 export const normalizePublicLabelsData = (
   chainId: number,
   source: PublicLabelsSource,
-  legacy?: EulerLabelsData,
+  effectivePolicy: EffectiveLabelsSource = emptyEffectiveLabelsSource(),
 ): MigratedEulerLabelsData => {
   const inventoryRows = source.vaults.filter(vault => vault.chainId === chainId)
   const chainVaults = inventoryRows.filter(hasPublishedVaultLabelContent)
-  const compatibilityVerified = new Set(
-    (legacy?.verifiedVaultAddresses ?? []).map(address => address.toLowerCase()),
-  )
-  const compatibilityEarn = new Set(
-    (legacy?.earnVaults ?? []).map(address => address.toLowerCase()),
-  )
+  const { verified: compatibilityVerified, earn: compatibilityEarn } = getEffectiveVaultSets(effectivePolicy)
   // Plain-address labels and assessment-only rows have the same empty content
   // shape in the inventory. Retain an empty row only when the compatibility
   // snapshot already classifies that exact published inventory address.
@@ -434,12 +571,14 @@ export const normalizePublicLabelsData = (
   const verifiedVaultAddresses: string[] = compatibilityVerifiedRows.map(vault => getAddress(vault.address))
   const earnVaults: string[] = []
   const earnVaultEntries: Record<string, EulerLabelEarnVaultEntry> = {}
-  const earnVaultBlocks: Record<string, string[]> = { ...(legacy?.earnVaultBlocks ?? {}) }
-  const earnVaultRestrictions: Record<string, string[]> = { ...(legacy?.earnVaultRestrictions ?? {}) }
+  const effectiveEarn = normalizeEffectiveEarnPolicy(effectivePolicy)
+  const effectiveAssets = normalizeEffectiveAssets(effectivePolicy.assets)
+  const earnVaultBlocks: Record<string, string[]> = effectiveEarn.blocks
+  const earnVaultRestrictions: Record<string, string[]> = effectiveEarn.restrictions
   const deprecatedEarnVaults: Record<string, string> = {}
   const earnVaultDescriptions: Record<string, string> = {}
   const earnVaultNotices: Record<string, string> = {}
-  const notExplorableEarnVaults = new Set<string>(legacy?.notExplorableEarnVaults ?? [])
+  const notExplorableEarnVaults = effectiveEarn.notExplorable
   const points: Record<string, EulerLabelPointReward[]> = {}
   for (const vault of [...chainVaults, ...compatibilityEarnRows]) {
     const address = getAddress(vault.address)
@@ -465,24 +604,30 @@ export const normalizePublicLabelsData = (
     if (vault.campaigns?.length) {
       points[address] = vault.campaigns.map(campaign => ({
         name: campaign.name,
-        logo: campaign.logo ?? '',
+        logo: safeHttpUrl(campaign.logo),
         type: campaign.type,
       }))
     }
   }
 
-  // Preserve the currently effective geo/visibility data. Raw V3 geo policies
+  // Apply the currently effective geo/visibility policy. Raw V3 geo policies
   // are intentionally not composed here: global/product/vault/asset precedence
   // and the final eligibility contract are not specified yet.
   for (const [productKey, product] of Object.entries(products)) {
-    const legacyProduct = legacy?.products?.[productKey] as EulerLabelProduct | undefined
-    if (!legacyProduct) continue
-    product.block = legacyProduct.block
-    product.restricted = legacyProduct.restricted
-    product.notExplorable = legacyProduct.notExplorable
+    const effectiveProduct = effectivePolicy.products[productKey]
+    if (!effectiveProduct) continue
+    product.block = effectiveProduct.block
+    product.restricted = effectiveProduct.restricted
+    product.notExplorable = effectiveProduct.notExplorable
+    const effectiveOverrides = new Map(
+      Object.entries(effectiveProduct.vaultOverrides ?? {}).map(([address, override]) => [
+        address.toLowerCase(),
+        override,
+      ]),
+    )
     for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
       const target = product.vaultOverrides?.[address]
-      const previous = legacyProduct.vaultOverrides?.[address]
+      const previous = effectiveOverrides.get(address.toLowerCase())
       if (!target || !previous) continue
       target.block = previous.block
       target.restricted = previous.restricted
@@ -491,11 +636,9 @@ export const normalizePublicLabelsData = (
     }
   }
   for (const [address, entry] of Object.entries(earnVaultEntries)) {
-    const previous = legacy?.earnVaultEntries?.[address]
-    if (!previous) continue
-    entry.block = previous.block
-    entry.restricted = previous.restricted
-    entry.notExplorable = previous.notExplorable
+    entry.block = effectiveEarn.blocks[address]
+    entry.restricted = effectiveEarn.restrictions[address]
+    entry.notExplorable = effectiveEarn.notExplorable.has(address)
   }
 
   return {
@@ -511,9 +654,9 @@ export const normalizePublicLabelsData = (
     earnVaultDescriptions,
     earnVaultNotices,
     notExplorableEarnVaults,
-    assetBlocks: { ...(legacy?.assetBlocks ?? {}) },
-    assetRestrictions: { ...(legacy?.assetRestrictions ?? {}) },
-    assetPatternRules: [...(legacy?.assetPatternRules ?? [])],
+    assetBlocks: effectiveAssets.blocks,
+    assetRestrictions: effectiveAssets.restrictions,
+    assetPatternRules: effectiveAssets.patternRules,
     rawGeoPolicies: source.geoPolicies.filter(policy =>
       policy.chainId === null || policy.chainId === chainId,
     ),
diff --git a/utils/vault/governor-verification.ts b/utils/vault/governor-verification.ts
index b4743acdc..6981b170b 100644
--- a/utils/vault/governor-verification.ts
+++ b/utils/vault/governor-verification.ts
@@ -95,9 +95,9 @@ export const isEarnVaultOwnerVerified = (
   if (!earnVault.verified) return false
 
   const declaredKeys = labels.getDeclaredEntityKeys(earnVault.address)
-  // Earn vaults outside any product are trusted on the strength of being in
-  // earn-vaults.json alone — earn curation lives in that file, not in
-  // products.json. Differs from EVK behaviour.
+  // A published Earn vault can be trusted without a product assignment.
+  // This differs from EVK governance verification, which requires a product
+  // with a declared managing entity.
   if (declaredKeys === undefined) return true
   // But if the earn vault IS in a product whose entity is empty/undefined,
   // the product has no on-chain authority to claim it — treat as unverified.

From 4b60be9905a0a25228fff79e1a72890b954ed4e5 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Wed, 5 Aug 2026 11:30:19 +0100
Subject: [PATCH 03/13] refactor: clarify public labels data naming

---
 composables/useEulerLabels.ts        | 18 ++++++++----------
 server/utils/public-labels-source.ts |  4 ++--
 utils/public-labels.ts               |  8 ++++----
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index b7aca3ec1..610f01309 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -21,11 +21,11 @@ import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
 import {
   normalizePublicLabelsData,
-  type MigratedEulerLabelsData,
+  type PublicEulerLabelsData,
   type PublicLabelsBundle,
 } from '~/utils/public-labels'
 
-const createEmptyEulerLabelsData = (): MigratedEulerLabelsData => ({
+const createEmptyEulerLabelsData = (): PublicEulerLabelsData => ({
   products: {},
   entities: {},
   points: {},
@@ -42,19 +42,19 @@ const createEmptyEulerLabelsData = (): MigratedEulerLabelsData => ({
   assetRestrictions: {},
   assetPatternRules: [],
   rawGeoPolicies: [],
-} as unknown as MigratedEulerLabelsData)
+} as unknown as PublicEulerLabelsData)
 
-const labelsData = shallowRef<MigratedEulerLabelsData>(createEmptyEulerLabelsData())
+const labelsData = shallowRef<PublicEulerLabelsData>(createEmptyEulerLabelsData())
 const labelsChainId = ref<number | null>(null)
 const labelsVersion = ref(0)
 const isLoading = ref(false)
 const isReady = ref(false)
-const pendingLabelsFetches = new Map<number, Promise<MigratedEulerLabelsData>>()
+const pendingLabelsFetches = new Map<number, Promise<PublicEulerLabelsData>>()
 let labelsLoadGeneration = 0
 let wrapPairProbeGeneration = 0
 const wrapPairs = shallowReactive<Record<string, string>>({})
 
-const setLabelsData = (data: MigratedEulerLabelsData, chainId: number | null) => {
+const setLabelsData = (data: PublicEulerLabelsData, chainId: number | null) => {
   labelsData.value = data
   labelsChainId.value = chainId
   labelsVersion.value += 1
@@ -62,8 +62,6 @@ const setLabelsData = (data: MigratedEulerLabelsData, chainId: number | null) =>
 
 export const getCurrentEulerLabelsData = (): EulerLabelsData => labelsData.value
 
-export const getCurrentMigratedEulerLabelsData = (): MigratedEulerLabelsData => labelsData.value
-
 export const getEulerLabelsVersion = (): number => labelsVersion.value
 
 export const getEulerLabelWrapPairs = (): Record<string, string> => wrapPairs
@@ -78,8 +76,8 @@ export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {})
     ...data,
     notExplorableEarnVaults: data.notExplorableEarnVaults ?? new Set(),
     assetPatternRules: data.assetPatternRules ?? [],
-    rawGeoPolicies: (data as Partial<MigratedEulerLabelsData>).rawGeoPolicies ?? [],
-  } as unknown as MigratedEulerLabelsData, null)
+    rawGeoPolicies: (data as Partial<PublicEulerLabelsData>).rawGeoPolicies ?? [],
+  } as unknown as PublicEulerLabelsData, null)
   isReady.value = true
   isLoading.value = false
 }
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index c3a3769ec..86b9f19b6 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -7,7 +7,7 @@ import {
   fetchPublicLabelsSource,
   normalizePublicLabelsData,
   PUBLIC_LABELS_RUNTIME_VERSION,
-  type MigratedEulerLabelsData,
+  type PublicEulerLabelsData,
   type PublicLabelsBundle,
   type PublicLabelsQuery,
   type PublicLabelsRequest,
@@ -116,7 +116,7 @@ export function getPublicLabelsBundle(
 export async function getPublicEulerLabelsData(
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
-): Promise<MigratedEulerLabelsData> {
+): Promise<PublicEulerLabelsData> {
   const bundle = await getPublicLabelsBundle(chainId, version)
   return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
 }
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index 22afac36a..ad5b160e5 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -166,7 +166,7 @@ export type PublicLabelsRequest = <T>(
   query: PublicLabelsQuery,
 ) => Promise<PublicLabelsResponse<T>>
 
-export type MigratedEulerLabelsData = Omit<EulerLabelsData, 'products' | 'entities'> & {
+export type PublicEulerLabelsData = Omit<EulerLabelsData, 'products' | 'entities'> & {
   products: Record<string, EulerLabelProduct>
   entities: Record<string, EulerLabelEntity>
   /** Versioned policy records are informational until effective precedence is specified. */
@@ -255,7 +255,7 @@ export const fetchPublicLabelsData = async (
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
   effectivePolicy?: EffectiveLabelsSource | Promise<EffectiveLabelsSource>,
-): Promise<MigratedEulerLabelsData> => {
+): Promise<PublicEulerLabelsData> => {
   const [source, resolvedEffectivePolicy] = await Promise.all([
     fetchPublicLabelsSource(request, chainId, version),
     Promise.resolve(effectivePolicy),
@@ -512,7 +512,7 @@ export const normalizePublicLabelsData = (
   chainId: number,
   source: PublicLabelsSource,
   effectivePolicy: EffectiveLabelsSource = emptyEffectiveLabelsSource(),
-): MigratedEulerLabelsData => {
+): PublicEulerLabelsData => {
   const inventoryRows = source.vaults.filter(vault => vault.chainId === chainId)
   const chainVaults = inventoryRows.filter(hasPublishedVaultLabelContent)
   const { verified: compatibilityVerified, earn: compatibilityEarn } = getEffectiveVaultSets(effectivePolicy)
@@ -660,5 +660,5 @@ export const normalizePublicLabelsData = (
     rawGeoPolicies: source.geoPolicies.filter(policy =>
       policy.chainId === null || policy.chainId === chainId,
     ),
-  } as MigratedEulerLabelsData
+  } as PublicEulerLabelsData
 }

From acacfc86ce31355c05773effaf5e539909be64c5 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Wed, 5 Aug 2026 12:06:25 +0100
Subject: [PATCH 04/13] refactor: consume public labels from sdk

Use the SDK feature branch for Public Labels transport, normalization, types, and branding helpers while retaining Lite's temporary effective-policy compatibility layer. Validate the paired branch in CI and Railway without changing the committed SDK version.
---
 .github/workflows/ci.yaml                     |   7 +
 README.md                                     |   2 +-
 composables/useMarketGroups.ts                |   2 +-
 entities/euler/labels.ts                      | 127 +----
 scripts/install-preview-sdk.sh                |  30 +-
 server/utils/public-labels-source.ts          |  43 +-
 .../public-labels-v20260804151305236.ts       |   2 +-
 tests/utils/public-labels.test.ts             |  77 +--
 utils/public-labels.ts                        | 536 ++----------------
 9 files changed, 126 insertions(+), 700 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c8f3ec9a1..32b3b21ae 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,9 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  EULER_SDK_BRANCH: feat/public-labels-v3-sdk
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -47,6 +50,8 @@ jobs:
 
       - run: npm ci
 
+      - run: sh scripts/install-preview-sdk.sh
+
       - run: npm run typecheck
 
   test:
@@ -66,6 +71,8 @@ jobs:
 
       - run: npm ci
 
+      - run: sh scripts/install-preview-sdk.sh
+
       # tests/utils/logger-bundle.test.ts inspects the production client bundle
       # at .output/public/_nuxt and hard-fails under CI when it is absent, so
       # the build must run before the test suite.
diff --git a/README.md b/README.md
index 09633e0a2..439f0fef0 100644
--- a/README.md
+++ b/README.md
@@ -298,7 +298,7 @@ docker build \
 
 When `EULER_SDK_BRANCH` is set, the builder clones `euler-xyz/euler-sdks`, builds `packages/euler-v2-sdk`, packs it, and installs that tarball with `--no-save` before running the Lite build. The committed Lite package files still point at the installed npm version.
 
-Railway PR builds use the same Dockerfile. Set `EULER_SDK_BRANCH` for previews that should consume a branch from `https://github.com/euler-xyz/euler-sdks.git`; leave it unset for previews that should use the npm version in `package-lock.json`.
+Railway PR builds use the same Dockerfile. Set `EULER_SDK_BRANCH` for previews that should consume a branch from `https://github.com/euler-xyz/euler-sdks.git`; leave it unset for previews that should use the npm version in `package-lock.json`. Paired Lite PRs can run `sh scripts/install-preview-sdk.sh` after `npm ci` in CI to validate the same SDK branch without changing the committed dependency.
 
 The SDK preview build installs `pnpm@10` by default. Set `EULER_SDK_PNPM_VERSION` if the SDK branch requires another pnpm version.
 
diff --git a/composables/useMarketGroups.ts b/composables/useMarketGroups.ts
index 12eaa461c..0b7081d47 100644
--- a/composables/useMarketGroups.ts
+++ b/composables/useMarketGroups.ts
@@ -1,4 +1,5 @@
 import { isEVault, type EVault } from '@eulerxyz/euler-v2-sdk'
+import { getEulerLabelProductBrandEntities } from '@eulerxyz/euler-v2-sdk/public-labels'
 import { getAddress, type Address } from 'viem'
 import { logWarn } from '~/utils/errorHandling'
 import type { EulerLabelEntity, EulerLabelProduct } from '~/entities/euler/labels'
@@ -9,7 +10,6 @@ import { isVaultNotExplorable, isVaultRecentlyAdded, isVaultDeprecated, getProdu
 import { isLiveCollateralEdge } from '~/utils/vault/ltv'
 import { isVaultBorrowable } from '~/utils/vault/classification'
 import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
-import { getEulerLabelProductBrandEntities } from '~/utils/public-labels'
 
 // -- Helpers --
 
diff --git a/entities/euler/labels.ts b/entities/euler/labels.ts
index a9225cba1..378fb2e69 100644
--- a/entities/euler/labels.ts
+++ b/entities/euler/labels.ts
@@ -1,106 +1,23 @@
-export type EulerLabelEntity = {
-  id?: string
-  name: string
-  logo: string
-  description: string
-  url: string
-  legalEntityName?: string
-  riskMethodology?: string
-  security?: string
-  termsOfService?: string
-  licenses?: string
-  disclaimers?: string
-  addresses: Record<string, string>
-  social: {
-    twitter: string
-    youtube: string
-    discord: string
-    telegram: string
-    github: string
-    [key: string]: string | undefined
-  }
-}
-export type EulerLabelVaultOverride = {
-  name?: string
-  description?: string
-  portfolioNotice?: string
-  deprecationReason?: string
-  block?: string[]
-  restricted?: string[]
-  notExplorableLend?: boolean
-  notExplorableBorrow?: boolean
-  tags?: string[]
-}
-
-export type EulerLabelProduct = {
-  id?: string
-  chainId?: number
-  name: string
-  description: string
-  portfolioNotice?: string
+import type {
+  EulerLabelAssetEntry as SdkEulerLabelAssetEntry,
+  EulerLabelEarnVaultEntry as SdkEulerLabelEarnVaultEntry,
+  EulerLabelEntity as SdkEulerLabelEntity,
+  EulerLabelPoint as SdkEulerLabelPoint,
+  EulerLabelProduct as SdkEulerLabelProduct,
+  EulerLabelVaultOverride as SdkEulerLabelVaultOverride,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export type EulerLabelEntity = SdkEulerLabelEntity
+export type EulerLabelVaultOverride = SdkEulerLabelVaultOverride
+export type EulerLabelEarnVaultEntry = SdkEulerLabelEarnVaultEntry
+export type EulerLabelAssetEntry = SdkEulerLabelAssetEntry
+export type EulerLabelPoint = SdkEulerLabelPoint
+export type EulerLabelPointReward = SdkEulerLabelPoint
+
+// Lite's existing UI assumes every rendered product has a managing entity.
+// Public Labels normalization guarantees that shape for product records.
+export type EulerLabelProduct = Omit<SdkEulerLabelProduct, 'entity'> & {
   entity: string[] | string
-  /** Display-only brand partners. These do not participate in manager verification. */
-  coBrandEntityIds?: string[]
-  isDeprecated?: boolean
-  /** Local compatibility wrapper for a labeled vault that has no product. */
-  isStandalone?: boolean
-  url: string
-  vaults: string[]
-  deprecatedVaults?: string[]
-  deprecationReason?: string
-  notExplorable?: boolean
-  block?: string[]
-  restricted?: string[]
-  vaultOverrides?: Record<string, EulerLabelVaultOverride>
-  // Freeform classification tags, e.g. 'keyring', 'access control', or
-  // 'governance limited'. Replaces the former bespoke classification booleans.
-  tags?: string[]
-}
-
-export type EulerLabelEarnVaultEntry = {
-  address: string
-  block?: string[]
-  restricted?: string[]
-  tags?: string[]
-  deprecated?: boolean
-  deprecationReason?: string
-  description?: string
-  portfolioNotice?: string
-  notExplorable?: boolean
-}
-
-/**
- * Asset-level geo-blocking entry. At least one match field
- * (`address` | `symbols` | `symbolRegex` | `names` | `nameRegex`) must be
- * set. When multiple match fields are set they are OR-composed: the entry
- * matches an asset if ANY populated match field matches.
- *
- * All string comparisons (`symbols`, `names`) are case-insensitive. Regex
- * fields are compiled with the `i` flag at load time. Invalid regexes are
- * dropped with a warning.
- *
- * `block` (hard) and `restricted` (soft) follow the same semantics as
- * vault-level rules; countries accept the `EU` / `EEA` / `EFTA` aliases.
- */
-export type EulerLabelAssetEntry = {
-  address?: string
-  symbols?: string[]
-  symbolRegex?: string
-  names?: string[]
-  nameRegex?: string
-  block?: string[]
-  restricted?: string[]
-}
-export type EulerLabelPoint = {
-  name: string
-  logo: string
-  collateralVaults?: string[]
-}
-
-export type EulerLabelPointReward = {
-  name: string
-  logo: string
-  type?: 'deposit' | 'borrow'
 }
 
 export const eulerLabelEntityEmpty = {
@@ -117,6 +34,7 @@ export const eulerLabelEntityEmpty = {
     github: '',
   },
 } as EulerLabelEntity
+
 export const eulerLabelProductEmpty = {
   name: '',
   description: '',
@@ -128,9 +46,8 @@ export const eulerLabelProductEmpty = {
   vaultOverrides: {},
 } as EulerLabelProduct
 
-export const getEulerLabelEntityLogo = (fileName: string) => {
-  return /^https?:\/\//i.test(fileName) ? fileName : ''
-}
+export const getEulerLabelEntityLogo = (fileName: string) =>
+  /^https?:\/\//i.test(fileName) ? fileName : ''
 
 export const getEulerLabelPointLogo = (fileName: string) =>
   /^https?:\/\//i.test(fileName) ? fileName : ''
diff --git a/scripts/install-preview-sdk.sh b/scripts/install-preview-sdk.sh
index c4a5e2afa..c16c8a5ec 100644
--- a/scripts/install-preview-sdk.sh
+++ b/scripts/install-preview-sdk.sh
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 
+APP_DIR="${EULER_LITE_APP_DIR:-$(pwd)}"
+export APP_DIR
+
 if [ -z "${EULER_SDK_BRANCH:-}" ]; then
   echo "EULER_SDK_BRANCH is not set; using @eulerxyz/euler-v2-sdk from package-lock.json."
   npm ls @eulerxyz/euler-v2-sdk --depth=0
@@ -14,7 +17,7 @@ case "$EULER_SDK_BRANCH" in
     ;;
 esac
 
-APP_SDK_VERSION="$(node -p "const p=require('/usr/src/app/package.json'); const spec=(p.dependencies||{})['@eulerxyz/euler-v2-sdk'] || (p.devDependencies||{})['@eulerxyz/euler-v2-sdk'] || ''; spec.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] || ''")"
+APP_SDK_VERSION="$(node -p "const p=require(process.env.APP_DIR + '/package.json'); const spec=(p.dependencies||{})['@eulerxyz/euler-v2-sdk'] || (p.devDependencies||{})['@eulerxyz/euler-v2-sdk'] || ''; spec.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] || ''")"
 
 SDK_REPO="https://github.com/euler-xyz/euler-sdks.git"
 SDK_DIR="/tmp/euler-sdks"
@@ -38,7 +41,7 @@ if [ -n "$APP_SDK_VERSION" ]; then
     SDK_RELEASE_COMMIT="$(git rev-parse "refs/tags/${SDK_RELEASE_TAG}^{}")"
     if git merge-base --is-ancestor HEAD "$SDK_RELEASE_COMMIT"; then
       echo "SDK branch ${EULER_SDK_BRANCH} is already included in ${SDK_RELEASE_TAG}; using @eulerxyz/euler-v2-sdk from package-lock.json."
-      cd /usr/src/app
+      cd "$APP_DIR"
       npm ls @eulerxyz/euler-v2-sdk --depth=0
       exit 0
     fi
@@ -65,7 +68,11 @@ fi
 
 case "$SDK_PNPM_PACKAGE" in
   pnpm@*|pnpm)
-    npm install --global "$SDK_PNPM_PACKAGE"
+    if command -v pnpm >/dev/null 2>&1 && pnpm --version >/dev/null 2>&1; then
+      echo "Using existing pnpm $(pnpm --version)."
+    else
+      npm install --global "$SDK_PNPM_PACKAGE"
+    fi
     ;;
   *)
     echo "Unsupported SDK pnpm package: ${SDK_PNPM_PACKAGE}" >&2
@@ -84,7 +91,7 @@ const fs = require('node:fs')
 
 const packageJsonPath = 'packages/euler-v2-sdk/package.json'
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
-const appPackageJson = JSON.parse(fs.readFileSync('/usr/src/app/package.json', 'utf8'))
+const appPackageJson = JSON.parse(fs.readFileSync(`${process.env.APP_DIR}/package.json`, 'utf8'))
 const appSdkSpec = appPackageJson.dependencies?.['@eulerxyz/euler-v2-sdk']
   || appPackageJson.devDependencies?.['@eulerxyz/euler-v2-sdk']
   || ''
@@ -105,22 +112,31 @@ NODE
 mkdir -p "$SDK_PACK_DIR"
 npm pack --ignore-scripts ./packages/euler-v2-sdk --pack-destination "$SDK_PACK_DIR"
 
-cd /usr/src/app
+cd "$APP_DIR"
 npm install --no-save --ignore-scripts "$SDK_PACK_DIR"/*.tgz
 if ! npm ls @eulerxyz/euler-v2-sdk --depth=0; then
   echo "npm ls reported a version mismatch for the preview SDK tarball; validating runtime exports instead."
 fi
 
 node --input-type=module - <<'NODE'
-import { buildEulerSDK, PositionMigrationService } from '@eulerxyz/euler-v2-sdk'
+import {
+  buildEulerSDK,
+  PositionMigrationService,
+} from '@eulerxyz/euler-v2-sdk'
+import {
+  normalizePublicLabelsData,
+  PublicLabelsV3Adapter,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
 
 const missing = []
 if (typeof buildEulerSDK !== 'function') missing.push('buildEulerSDK')
 if (typeof PositionMigrationService !== 'function') missing.push('PositionMigrationService')
+if (typeof PublicLabelsV3Adapter !== 'function') missing.push('PublicLabelsV3Adapter')
+if (typeof normalizePublicLabelsData !== 'function') missing.push('normalizePublicLabelsData')
 
 if (missing.length > 0) {
   throw new Error(`Preview SDK is missing expected exports: ${missing.join(', ')}`)
 }
 
-console.log('Preview @eulerxyz/euler-v2-sdk migration exports are available.')
+console.log('Preview @eulerxyz/euler-v2-sdk branch exports are available.')
 NODE
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index 86b9f19b6..525a560fe 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -3,8 +3,8 @@ import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
 import { createInFlightDedup } from './in-flight'
 import { getEffectiveLabelsSource } from './labels-source'
 import { logger } from './logger'
+import { PublicLabelsV3Adapter } from '@eulerxyz/euler-v2-sdk/public-labels'
 import {
-  fetchPublicLabelsSource,
   normalizePublicLabelsData,
   PUBLIC_LABELS_RUNTIME_VERSION,
   type PublicEulerLabelsData,
@@ -23,13 +23,6 @@ const inFlight = createInFlightDedup<string, PublicLabelsBundle>()
 
 const cacheKey = (chainId: number, version: string): string => `${chainId}:${version}`
 
-interface PublishedLabelVersion {
-  versionKey?: string
-  status?: string
-  aliases?: string[]
-  isLatest?: boolean
-}
-
 const buildRequest = (): PublicLabelsRequest => async <T>(
   path: string,
   query: PublicLabelsQuery,
@@ -52,23 +45,6 @@ const buildRequest = (): PublicLabelsRequest => async <T>(
   return await response.json() as PublicLabelsResponse<T>
 }
 
-const resolveVersion = async (
-  request: PublicLabelsRequest,
-  requestedVersion: string,
-): Promise<string> => {
-  if (requestedVersion !== PUBLIC_LABELS_RUNTIME_VERSION) return requestedVersion
-  const response = await request<PublishedLabelVersion[]>('/label-sets/public/versions', {})
-  if (!Array.isArray(response.data)) throw new Error('Invalid Public Labels versions response')
-  const published = response.data.find(version =>
-    version.status === 'published'
-    && (version.isLatest === true || version.aliases?.includes(PUBLIC_LABELS_RUNTIME_VERSION)),
-  )
-  if (!published?.versionKey || !/^v[0-9]{17}$/.test(published.versionKey)) {
-    throw new Error('Public Labels latest alias is unavailable')
-  }
-  return published.versionKey
-}
-
 export function refreshPublicLabelsBundle(
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
@@ -79,16 +55,23 @@ export function refreshPublicLabelsBundle(
       const bundle = await withWallClock(
         async () => {
           const request = buildRequest()
-          const resolvedVersion = await resolveVersion(request, version)
-          const [publicLabels, effectivePolicy] = await Promise.all([
-            fetchPublicLabelsSource(request, chainId, resolvedVersion),
+          const adapter = new PublicLabelsV3Adapter({
+            endpoint: readResolvedV3ApiUrl(),
+            request,
+          })
+          const [snapshot, effectivePolicy] = await Promise.all([
+            adapter.fetchPublicLabelsSnapshot(chainId, version),
             getEffectiveLabelsSource(chainId),
           ])
           // Validate the complete cross-source relationship before replacing
           // a known-good raw bundle. Server consumers normalize it again into
           // SDK-compatible Sets/RegExps; the browser receives JSON-safe data.
-          normalizePublicLabelsData(chainId, publicLabels, effectivePolicy)
-          return { version: resolvedVersion, publicLabels, effectivePolicy }
+          normalizePublicLabelsData(chainId, snapshot.publicLabels, effectivePolicy)
+          return {
+            version: snapshot.version,
+            publicLabels: snapshot.publicLabels,
+            effectivePolicy,
+          }
         },
         REFRESH_BUDGET_MS,
         `public-labels chain=${chainId}`,
diff --git a/tests/fixtures/public-labels-v20260804151305236.ts b/tests/fixtures/public-labels-v20260804151305236.ts
index 57904d7ba..0b6b2141b 100644
--- a/tests/fixtures/public-labels-v20260804151305236.ts
+++ b/tests/fixtures/public-labels-v20260804151305236.ts
@@ -1,4 +1,4 @@
-import type { PublicLabelsSource } from '~/utils/public-labels'
+import type { PublicLabelsSource } from '@eulerxyz/euler-v2-sdk/public-labels'
 
 export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
 
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
index 16d295266..75cefb2ee 100644
--- a/tests/utils/public-labels.test.ts
+++ b/tests/utils/public-labels.test.ts
@@ -1,14 +1,11 @@
 import { getAddress } from 'viem'
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import {
-  fetchAllPublicLabelPages,
-  fetchPublicLabelsData,
   getEulerLabelProductBrandEntities,
   getEulerLabelProductBrandEntityKeys,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+import {
   normalizePublicLabelsData,
-  PUBLIC_LABELS_PAGE_SIZE,
-  type PublicLabelsRequest,
-  type PublicProductLabel,
   type EffectiveLabelsSource,
 } from '~/utils/public-labels'
 import {
@@ -24,74 +21,6 @@ import {
   publicLabelsFixture,
 } from '~/tests/fixtures/public-labels-v20260804151305236'
 
-describe('Public Labels pagination', () => {
-  it('follows meta.total with limit/offset using the pinned fixture version', async () => {
-    const rows = Array.from({ length: 167 }, (_, index) => ({ id: `product-${index}` }))
-    const request = vi.fn(async (_path: string, query: Record<string, string | number | undefined>) => {
-      const offset = Number(query.offset)
-      return {
-        data: rows.slice(offset, offset + PUBLIC_LABELS_PAGE_SIZE),
-        meta: {
-          total: rows.length,
-          offset,
-          limit: PUBLIC_LABELS_PAGE_SIZE,
-          timestamp: '2026-08-04T15:13:05.236Z',
-        },
-      }
-    })
-
-    const result = await fetchAllPublicLabelPages<Pick<PublicProductLabel, 'id'>>(
-      request as PublicLabelsRequest,
-      '/products',
-      { version: PUBLIC_LABELS_FIXTURE_VERSION },
-    )
-
-    expect(result).toHaveLength(167)
-    expect(request.mock.calls.map(([, query]) => query)).toEqual([
-      { version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
-      { version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 100 },
-    ])
-  })
-
-  it('fails closed when pagination stops before meta.total', async () => {
-    const request = vi.fn(async () => ({
-      data: [],
-      meta: { total: 1, timestamp: '2026-08-04T15:13:05.236Z' },
-    })) as PublicLabelsRequest
-
-    await expect(fetchAllPublicLabelPages(request, '/products', {
-      version: PUBLIC_LABELS_FIXTURE_VERSION,
-    })).rejects.toThrow('pagination stalled')
-  })
-
-  it('pins entity governance-address reads to the selected dataset version', async () => {
-    const rowsByPath: Record<string, unknown[]> = {
-      '/curation/vaults': publicLabelsFixture.vaults,
-      '/products': publicLabelsFixture.products,
-      '/entities': publicLabelsFixture.entities,
-      '/geo-policies': publicLabelsFixture.geoPolicies,
-      '/entities/kpk/addresses': publicLabelsFixture.entityAddresses,
-      '/entities/securitize/addresses': [],
-    }
-    const request = vi.fn(async (path: string) => ({
-      data: rowsByPath[path] ?? [],
-      meta: {
-        total: (rowsByPath[path] ?? []).length,
-        timestamp: '2026-08-04T15:13:05.236Z',
-      },
-    })) as PublicLabelsRequest
-
-    await fetchPublicLabelsData(request, 1, PUBLIC_LABELS_FIXTURE_VERSION)
-
-    const addressCalls = vi.mocked(request).mock.calls.filter(([path]) => path.endsWith('/addresses'))
-    expect(addressCalls).toHaveLength(2)
-    expect(addressCalls.map(([, query]) => query)).toEqual([
-      { chainId: 1, version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
-      { chainId: 1, version: PUBLIC_LABELS_FIXTURE_VERSION, limit: 100, offset: 0 },
-    ])
-  })
-})
-
 describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
   it('keeps KPK as owner, exposes Securitize as a co-brand, and maps hosted profiles', () => {
     const effectivePolicy: EffectiveLabelsSource = {
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index ad5b160e5..64f43714b 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -1,125 +1,33 @@
-import type { EulerLabelAssetPatternRule, EulerLabelsData } from '@eulerxyz/euler-v2-sdk'
+import {
+  hasPublishedVaultLabelContent,
+  normalizePublicLabelsData as normalizeSdkPublicLabelsData,
+  type EulerLabelAssetPatternRule,
+  type PublicEulerLabelsData,
+  type PublicLabelsSource,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
 import { getAddress } from 'viem'
-import type {
-  EulerLabelEarnVaultEntry,
-  EulerLabelAssetEntry,
-  EulerLabelEntity,
-  EulerLabelPointReward,
-  EulerLabelProduct,
-  EulerLabelVaultOverride,
-} from '~/entities/euler/labels'
+import type { EulerLabelAssetEntry, EulerLabelProduct } from '~/entities/euler/labels'
+
+export {
+  PUBLIC_LABELS_RUNTIME_VERSION,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export type {
+  PublicEntityAddress,
+  PublicEntityLabel,
+  PublicEulerLabelsData,
+  PublicGeoPolicy,
+  PublicLabelsMeta,
+  PublicLabelsQuery,
+  PublicLabelsRequest,
+  PublicLabelsResponse,
+  PublicLabelsSource,
+  PublicProductLabel,
+  PublicVaultCampaign,
+  PublicVaultLabel,
+} from '@eulerxyz/euler-v2-sdk/public-labels'
 
-export const PUBLIC_LABELS_RUNTIME_VERSION = 'latest'
 export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
-export const PUBLIC_LABELS_PAGE_SIZE = 100
-
-const MAX_PUBLIC_LABEL_RECORDS = 10_000
-const ENTITY_ADDRESS_CONCURRENCY = 8
-
-export interface PublicLabelsMeta {
-  total?: number
-  limit?: number
-  offset?: number
-  timestamp: string
-}
-
-export interface PublicLabelsResponse<T> {
-  data: T
-  meta: PublicLabelsMeta
-}
-
-export interface PublicVaultCampaign {
-  name: string
-  logo: string | null
-  type: 'deposit' | 'borrow'
-}
-
-export interface PublicVaultLabel {
-  chainId: number
-  address: string
-  vaultType: 'evk' | 'earn' | 'securitize' | 'escrow'
-  productId: string | null
-  entityId: string | null
-  name: string | null
-  description: string | null
-  portfolioNotice: string | null
-  isDeprecated: boolean
-  deprecationReason: string | null
-  tags: string[]
-  campaigns: PublicVaultCampaign[] | null
-  createdAt: string
-  updatedAt: string
-}
-
-export interface PublicProductLabel {
-  id: string
-  chainId: number
-  entityId: string
-  coBrandEntityIds?: string[] | null
-  name: string
-  logo?: string | null
-  description: string | null
-  url: string | null
-  portfolioNotice: string | null
-  isDeprecated: boolean
-  deprecationReason: string | null
-  governanceMode: string
-  createdAt: string
-  updatedAt: string
-}
-
-export interface PublicEntityLabel {
-  id: string
-  name: string
-  logo: string | null
-  description: string | null
-  url: string | null
-  socialTwitter: string | null
-  socialYoutube: string | null
-  socialDiscord: string | null
-  socialTelegram: string | null
-  socialGithub: string | null
-  socialDefillama: string | null
-  legalEntityName: string | null
-  riskMethodology: string | null
-  security: string | null
-  termsOfService: string | null
-  licenses: string | null
-  disclaimers: string | null
-  createdAt: string
-  updatedAt: string
-}
-
-export interface PublicEntityAddress {
-  entityId: string
-  chainId: number
-  address: string
-  label: string | null
-}
-
-export interface PublicGeoPolicy {
-  id: string
-  chainId: number | null
-  productId: string | null
-  vaultAddress: string | null
-  assetAddress: string | null
-  assetSymbols?: string[] | null
-  assetSymbolRegex?: string | null
-  assetNames?: string[] | null
-  assetNameRegex?: string | null
-  countries: string[]
-  policyType: 'block' | 'restrict'
-  reason: string | null
-  createdAt: string
-}
-
-export interface PublicLabelsSource {
-  vaults: PublicVaultLabel[]
-  products: PublicProductLabel[]
-  entities: PublicEntityLabel[]
-  entityAddresses: PublicEntityAddress[]
-  geoPolicies: PublicGeoPolicy[]
-}
 
 export interface EffectiveProductPolicy {
   block?: string[]
@@ -160,144 +68,11 @@ export interface PublicLabelsBundle {
   effectivePolicy: EffectiveLabelsSource
 }
 
-export type PublicLabelsQuery = Record<string, string | number | undefined>
-export type PublicLabelsRequest = <T>(
-  path: string,
-  query: PublicLabelsQuery,
-) => Promise<PublicLabelsResponse<T>>
-
-export type PublicEulerLabelsData = Omit<EulerLabelsData, 'products' | 'entities'> & {
-  products: Record<string, EulerLabelProduct>
-  entities: Record<string, EulerLabelEntity>
-  /** Versioned policy records are informational until effective precedence is specified. */
-  rawGeoPolicies: PublicGeoPolicy[]
-}
-
-export const getEulerLabelProductBrandEntityKeys = (product: EulerLabelProduct): string[] => {
-  const ownerKeys = Array.isArray(product.entity) ? product.entity : [product.entity]
-  return [...new Set([...ownerKeys.filter(Boolean), ...(product.coBrandEntityIds ?? [])])]
-}
-
-export const getEulerLabelProductBrandEntities = (
-  product: EulerLabelProduct,
-  entities: Record<string, EulerLabelEntity>,
-): EulerLabelEntity[] => getEulerLabelProductBrandEntityKeys(product)
-  .map(key => entities[key])
-  .filter((entity): entity is EulerLabelEntity => Boolean(entity))
-
-const isNonNegativeInteger = (value: unknown): value is number =>
-  typeof value === 'number' && Number.isInteger(value) && value >= 0
-
-const assertListResponse = <T>(
-  response: PublicLabelsResponse<T[]>,
-  path: string,
-): { items: T[], total: number } => {
-  if (!response || !Array.isArray(response.data)) {
-    throw new Error(`Invalid Public Labels response for ${path}`)
-  }
-  const total = response.meta?.total
-  if (!isNonNegativeInteger(total) || total > MAX_PUBLIC_LABEL_RECORDS) {
-    throw new Error(`Invalid Public Labels total for ${path}`)
-  }
-  return { items: response.data, total }
-}
-
-export const fetchAllPublicLabelPages = async <T>(
-  request: PublicLabelsRequest,
-  path: string,
-  query: PublicLabelsQuery,
-): Promise<T[]> => {
-  const result: T[] = []
-  let offset = 0
-
-  while (true) {
-    const response = await request<T[]>(path, {
-      ...query,
-      limit: PUBLIC_LABELS_PAGE_SIZE,
-      offset,
-    })
-    const { items, total } = assertListResponse(response, path)
-    result.push(...items)
-
-    if (result.length >= total) return result.slice(0, total)
-    if (items.length === 0) {
-      throw new Error(`Public Labels pagination stalled for ${path}`)
-    }
-    offset += items.length
-  }
-}
-
-const mapWithConcurrency = async <T, R>(
-  values: T[],
-  concurrency: number,
-  mapper: (value: T) => Promise<R>,
-): Promise<R[]> => {
-  const result = new Array<R>(values.length)
-  let nextIndex = 0
-
-  const worker = async () => {
-    while (nextIndex < values.length) {
-      const index = nextIndex++
-      result[index] = await mapper(values[index])
-    }
-  }
-
-  await Promise.all(
-    Array.from({ length: Math.min(concurrency, values.length) }, () => worker()),
-  )
-  return result
-}
-
-const isSafeEntityId = (value: string): boolean => /^[A-Za-z0-9_-]{1,100}$/.test(value)
-
-export const fetchPublicLabelsData = async (
-  request: PublicLabelsRequest,
-  chainId: number,
-  version = PUBLIC_LABELS_RUNTIME_VERSION,
-  effectivePolicy?: EffectiveLabelsSource | Promise<EffectiveLabelsSource>,
-): Promise<PublicEulerLabelsData> => {
-  const [source, resolvedEffectivePolicy] = await Promise.all([
-    fetchPublicLabelsSource(request, chainId, version),
-    Promise.resolve(effectivePolicy),
-  ])
-  return normalizePublicLabelsData(chainId, source, resolvedEffectivePolicy)
-}
-
-export const fetchPublicLabelsSource = async (
-  request: PublicLabelsRequest,
-  chainId: number,
-  version = PUBLIC_LABELS_RUNTIME_VERSION,
-): Promise<PublicLabelsSource> => {
-  const [vaults, products, entities, geoPolicies] = await Promise.all([
-    fetchAllPublicLabelPages<PublicVaultLabel>(request, '/curation/vaults', { version, chainId }),
-    fetchAllPublicLabelPages<PublicProductLabel>(request, '/products', { version, chainId }),
-    fetchAllPublicLabelPages<PublicEntityLabel>(request, '/entities', { version }),
-    fetchAllPublicLabelPages<PublicGeoPolicy>(request, '/geo-policies', { version }),
-  ])
-
-  const entityIds = [...new Set([
-    ...products.flatMap(product => [product.entityId, ...(product.coBrandEntityIds ?? [])]),
-    ...vaults.flatMap(vault => vault.entityId ? [vault.entityId] : []),
-  ])].filter(isSafeEntityId)
-
-  const entityAddressPages = await mapWithConcurrency(
-    entityIds,
-    ENTITY_ADDRESS_CONCURRENCY,
-    entityId => fetchAllPublicLabelPages<PublicEntityAddress>(
-      request,
-      `/entities/${entityId}/addresses`,
-      { chainId, version },
-    ),
-  )
-
-  return {
-    vaults,
-    products,
-    entities,
-    entityAddresses: entityAddressPages.flat(),
-    geoPolicies,
-  }
-}
+const emptyEffectiveLabelsSource = (): EffectiveLabelsSource => ({
+  products: {},
+  earnVaults: [],
+  assets: [],
+})
 
 const uniqueStrings = (values: Iterable<string>): string[] => [...new Set(values)]
 
@@ -310,143 +85,6 @@ const tryAddress = (value: string): string | undefined => {
   }
 }
 
-const present = <T>(value: T | null | undefined): T | undefined =>
-  value === null || value === undefined ? undefined : value
-
-const safeHttpUrl = (value: string | null | undefined): string => {
-  if (!value) return ''
-  try {
-    const protocol = new URL(value).protocol
-    return protocol === 'http:' || protocol === 'https:' ? value : ''
-  }
-  catch {
-    return ''
-  }
-}
-
-const makeVaultOverride = (vault: PublicVaultLabel): EulerLabelVaultOverride => ({
-  ...present(vault.name) !== undefined && { name: vault.name! },
-  ...present(vault.description) !== undefined && { description: vault.description! },
-  ...present(vault.portfolioNotice) !== undefined && { portfolioNotice: vault.portfolioNotice! },
-  ...present(vault.deprecationReason) !== undefined && { deprecationReason: vault.deprecationReason! },
-  ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
-})
-
-const buildEntity = (
-  entity: PublicEntityLabel,
-  addresses: PublicEntityAddress[],
-): EulerLabelEntity => ({
-  id: entity.id,
-  name: entity.name,
-  logo: safeHttpUrl(entity.logo),
-  description: entity.description ?? '',
-  url: safeHttpUrl(entity.url),
-  ...present(entity.legalEntityName) !== undefined && { legalEntityName: entity.legalEntityName! },
-  ...present(entity.riskMethodology) !== undefined && { riskMethodology: entity.riskMethodology! },
-  ...present(entity.security) !== undefined && { security: entity.security! },
-  ...present(entity.termsOfService) !== undefined && { termsOfService: entity.termsOfService! },
-  ...present(entity.licenses) !== undefined && { licenses: entity.licenses! },
-  ...present(entity.disclaimers) !== undefined && { disclaimers: entity.disclaimers! },
-  addresses: Object.fromEntries(addresses.map(entry => [getAddress(entry.address), entry.label ?? ''])),
-  social: {
-    twitter: safeHttpUrl(entity.socialTwitter),
-    youtube: safeHttpUrl(entity.socialYoutube),
-    discord: safeHttpUrl(entity.socialDiscord),
-    telegram: safeHttpUrl(entity.socialTelegram),
-    github: safeHttpUrl(entity.socialGithub),
-    defillama: safeHttpUrl(entity.socialDefillama),
-  },
-})
-
-const productTags = (vaults: PublicVaultLabel[]): string[] | undefined => {
-  if (vaults.length === 0) return undefined
-  const tags = uniqueStrings(vaults[0].tags).filter(tag =>
-    vaults.every(vault => vault.tags.includes(tag)),
-  )
-  return tags.length > 0 ? tags : undefined
-}
-
-const buildProduct = (
-  product: PublicProductLabel,
-  vaults: PublicVaultLabel[],
-): EulerLabelProduct => {
-  const active: string[] = []
-  const deprecated: string[] = []
-  const vaultOverrides: Record<string, EulerLabelVaultOverride> = {}
-
-  for (const vault of vaults) {
-    const address = getAddress(vault.address)
-    if (vault.isDeprecated) deprecated.push(address)
-    else active.push(address)
-    vaultOverrides[address] = makeVaultOverride(vault)
-  }
-
-  const tags = productTags(vaults)
-  const logo = safeHttpUrl(product.logo)
-  return {
-    id: product.id,
-    chainId: product.chainId,
-    name: product.name,
-    description: product.description ?? '',
-    ...(product.portfolioNotice && { portfolioNotice: product.portfolioNotice }),
-    entity: product.entityId,
-    coBrandEntityIds: [...(product.coBrandEntityIds ?? [])],
-    url: safeHttpUrl(product.url),
-    ...(logo && { logo }),
-    vaults: active,
-    deprecatedVaults: deprecated,
-    ...(product.deprecationReason && { deprecationReason: product.deprecationReason }),
-    ...(product.isDeprecated && { isDeprecated: true }),
-    ...(tags && { tags }),
-    vaultOverrides,
-  }
-}
-
-const standaloneProductKey = (address: string): string => `__vault_${address.toLowerCase()}`
-
-/**
- * The inventory is a union of label and assessment records. A row with only
- * identity/type/timestamps is assessment-only and must not affect listing or
- * verification state.
- */
-export const hasPublishedVaultLabelContent = (vault: PublicVaultLabel): boolean => Boolean(
-  vault.productId
-  || vault.entityId
-  || vault.name
-  || vault.description
-  || vault.portfolioNotice
-  || vault.isDeprecated
-  || vault.deprecationReason
-  || vault.tags.length
-  || vault.campaigns?.length,
-)
-
-const buildStandaloneProduct = (vault: PublicVaultLabel): EulerLabelProduct => {
-  const address = getAddress(vault.address)
-  return {
-    id: standaloneProductKey(address),
-    chainId: vault.chainId,
-    isStandalone: true,
-    name: vault.name ?? '',
-    description: vault.description ?? '',
-    ...(vault.portfolioNotice && { portfolioNotice: vault.portfolioNotice }),
-    entity: vault.entityId ?? '',
-    coBrandEntityIds: [],
-    url: '',
-    vaults: vault.isDeprecated ? [] : [address],
-    deprecatedVaults: vault.isDeprecated ? [address] : [],
-    ...(vault.deprecationReason && { deprecationReason: vault.deprecationReason }),
-    ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
-    vaultOverrides: { [address]: makeVaultOverride(vault) },
-  }
-}
-
-const emptyEffectiveLabelsSource = (): EffectiveLabelsSource => ({
-  products: {},
-  earnVaults: [],
-  assets: [],
-})
-
 const getEffectiveVaultSets = (effective: EffectiveLabelsSource) => {
   const verified = new Set<string>()
   for (const product of Object.values(effective.products)) {
@@ -508,14 +146,19 @@ const normalizeEffectiveAssets = (entries: EulerLabelAssetEntry[]) => {
   return { blocks, restrictions, patternRules }
 }
 
+/**
+ * Adds Lite's temporary effective-policy compatibility layer to the canonical
+ * Public Labels content normalized by the SDK.
+ */
 export const normalizePublicLabelsData = (
   chainId: number,
   source: PublicLabelsSource,
   effectivePolicy: EffectiveLabelsSource = emptyEffectiveLabelsSource(),
 ): PublicEulerLabelsData => {
+  const data = normalizeSdkPublicLabelsData(chainId, source)
   const inventoryRows = source.vaults.filter(vault => vault.chainId === chainId)
-  const chainVaults = inventoryRows.filter(hasPublishedVaultLabelContent)
   const { verified: compatibilityVerified, earn: compatibilityEarn } = getEffectiveVaultSets(effectivePolicy)
+
   // Plain-address labels and assessment-only rows have the same empty content
   // shape in the inventory. Retain an empty row only when the compatibility
   // snapshot already classifies that exact published inventory address.
@@ -530,85 +173,22 @@ export const normalizePublicLabelsData = (
     && vault.vaultType !== 'escrow'
     && compatibilityVerified.has(vault.address.toLowerCase()),
   )
-  const productRows = source.products.filter(product => product.chainId === chainId)
-  const vaultsByProduct = new Map<string, PublicVaultLabel[]>()
-  for (const vault of chainVaults) {
-    if (!vault.productId) continue
-    const rows = vaultsByProduct.get(vault.productId) ?? []
-    rows.push(vault)
-    vaultsByProduct.set(vault.productId, rows)
-  }
-
-  const products: Record<string, EulerLabelProduct> = {}
-  for (const product of productRows) {
-    products[product.id] = buildProduct(product, vaultsByProduct.get(product.id) ?? [])
-  }
 
-  for (const vault of chainVaults) {
-    if (vault.productId) {
-      if (!products[vault.productId]) {
-        throw new Error(`Public Labels vault references missing product ${vault.productId}`)
-      }
-      continue
-    }
-    if (vault.vaultType !== 'earn' && vault.vaultType !== 'escrow') {
-      products[standaloneProductKey(vault.address)] = buildStandaloneProduct(vault)
-    }
-  }
-
-  const addressesByEntity = new Map<string, PublicEntityAddress[]>()
-  for (const address of source.entityAddresses) {
-    if (address.chainId !== chainId) continue
-    const rows = addressesByEntity.get(address.entityId) ?? []
-    rows.push(address)
-    addressesByEntity.set(address.entityId, rows)
+  const verifiedVaultAddresses = [
+    ...data.verifiedVaultAddresses,
+    ...compatibilityVerifiedRows.map(vault => getAddress(vault.address)),
+  ]
+  const earnVaults = [...data.earnVaults]
+  const earnVaultEntries = { ...data.earnVaultEntries }
+  for (const vault of compatibilityEarnRows) {
+    const address = getAddress(vault.address)
+    earnVaults.push(address)
+    earnVaultEntries[address.toLowerCase()] ??= { address }
   }
-  const entities = Object.fromEntries(source.entities.map(entity => [
-    entity.id,
-    buildEntity(entity, addressesByEntity.get(entity.id) ?? []),
-  ])) as Record<string, EulerLabelEntity>
 
-  const verifiedVaultAddresses: string[] = compatibilityVerifiedRows.map(vault => getAddress(vault.address))
-  const earnVaults: string[] = []
-  const earnVaultEntries: Record<string, EulerLabelEarnVaultEntry> = {}
+  const products = data.products as Record<string, EulerLabelProduct>
   const effectiveEarn = normalizeEffectiveEarnPolicy(effectivePolicy)
   const effectiveAssets = normalizeEffectiveAssets(effectivePolicy.assets)
-  const earnVaultBlocks: Record<string, string[]> = effectiveEarn.blocks
-  const earnVaultRestrictions: Record<string, string[]> = effectiveEarn.restrictions
-  const deprecatedEarnVaults: Record<string, string> = {}
-  const earnVaultDescriptions: Record<string, string> = {}
-  const earnVaultNotices: Record<string, string> = {}
-  const notExplorableEarnVaults = effectiveEarn.notExplorable
-  const points: Record<string, EulerLabelPointReward[]> = {}
-  for (const vault of [...chainVaults, ...compatibilityEarnRows]) {
-    const address = getAddress(vault.address)
-    const lower = address.toLowerCase()
-    if (vault.vaultType === 'earn') {
-      earnVaults.push(address)
-      earnVaultEntries[lower] = {
-        address,
-        ...(vault.tags.length > 0 && { tags: [...vault.tags] }),
-        ...(vault.isDeprecated && { deprecated: true }),
-        ...(vault.deprecationReason && { deprecationReason: vault.deprecationReason }),
-        ...(vault.description && { description: vault.description }),
-        ...(vault.portfolioNotice && { portfolioNotice: vault.portfolioNotice }),
-      }
-      if (vault.isDeprecated) deprecatedEarnVaults[lower] = vault.deprecationReason ?? ''
-      if (vault.description) earnVaultDescriptions[lower] = vault.description
-      if (vault.portfolioNotice) earnVaultNotices[lower] = vault.portfolioNotice
-    }
-    else if (vault.vaultType !== 'escrow') {
-      verifiedVaultAddresses.push(address)
-    }
-
-    if (vault.campaigns?.length) {
-      points[address] = vault.campaigns.map(campaign => ({
-        name: campaign.name,
-        logo: safeHttpUrl(campaign.logo),
-        type: campaign.type,
-      }))
-    }
-  }
 
   // Apply the currently effective geo/visibility policy. Raw V3 geo policies
   // are intentionally not composed here: global/product/vault/asset precedence
@@ -635,6 +215,7 @@ export const normalizePublicLabelsData = (
       target.notExplorableBorrow = previous.notExplorableBorrow
     }
   }
+
   for (const [address, entry] of Object.entries(earnVaultEntries)) {
     entry.block = effectiveEarn.blocks[address]
     entry.restricted = effectiveEarn.restrictions[address]
@@ -642,23 +223,16 @@ export const normalizePublicLabelsData = (
   }
 
   return {
+    ...data,
     products,
-    entities,
-    points,
     verifiedVaultAddresses: uniqueStrings(verifiedVaultAddresses),
     earnVaults: uniqueStrings(earnVaults),
     earnVaultEntries,
-    earnVaultBlocks,
-    earnVaultRestrictions,
-    deprecatedEarnVaults,
-    earnVaultDescriptions,
-    earnVaultNotices,
-    notExplorableEarnVaults,
+    earnVaultBlocks: effectiveEarn.blocks,
+    earnVaultRestrictions: effectiveEarn.restrictions,
+    notExplorableEarnVaults: effectiveEarn.notExplorable,
     assetBlocks: effectiveAssets.blocks,
     assetRestrictions: effectiveAssets.restrictions,
     assetPatternRules: effectiveAssets.patternRules,
-    rawGeoPolicies: source.geoPolicies.filter(policy =>
-      policy.chainId === null || policy.chainId === chainId,
-    ),
-  } as PublicEulerLabelsData
+  }
 }

From 24caa867108f2b3c6450ad9aa2064320e9f1f0d3 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Wed, 5 Aug 2026 12:32:49 +0100
Subject: [PATCH 05/13] chore: keep sdk preview injection in railway

Remove the temporary SDK branch environment and install steps from GitHub CI. Railway remains responsible for injecting the preview branch during Docker builds.
---
 .github/workflows/ci.yaml | 7 -------
 README.md                 | 2 +-
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 32b3b21ae..c8f3ec9a1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,9 +10,6 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  EULER_SDK_BRANCH: feat/public-labels-v3-sdk
-
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -50,8 +47,6 @@ jobs:
 
       - run: npm ci
 
-      - run: sh scripts/install-preview-sdk.sh
-
       - run: npm run typecheck
 
   test:
@@ -71,8 +66,6 @@ jobs:
 
       - run: npm ci
 
-      - run: sh scripts/install-preview-sdk.sh
-
       # tests/utils/logger-bundle.test.ts inspects the production client bundle
       # at .output/public/_nuxt and hard-fails under CI when it is absent, so
       # the build must run before the test suite.
diff --git a/README.md b/README.md
index 439f0fef0..09633e0a2 100644
--- a/README.md
+++ b/README.md
@@ -298,7 +298,7 @@ docker build \
 
 When `EULER_SDK_BRANCH` is set, the builder clones `euler-xyz/euler-sdks`, builds `packages/euler-v2-sdk`, packs it, and installs that tarball with `--no-save` before running the Lite build. The committed Lite package files still point at the installed npm version.
 
-Railway PR builds use the same Dockerfile. Set `EULER_SDK_BRANCH` for previews that should consume a branch from `https://github.com/euler-xyz/euler-sdks.git`; leave it unset for previews that should use the npm version in `package-lock.json`. Paired Lite PRs can run `sh scripts/install-preview-sdk.sh` after `npm ci` in CI to validate the same SDK branch without changing the committed dependency.
+Railway PR builds use the same Dockerfile. Set `EULER_SDK_BRANCH` for previews that should consume a branch from `https://github.com/euler-xyz/euler-sdks.git`; leave it unset for previews that should use the npm version in `package-lock.json`.
 
 The SDK preview build installs `pnpm@10` by default. Set `EULER_SDK_PNPM_VERSION` if the SDK branch requires another pnpm version.
 

From 7287488fe0380846ccc5c646e2fc74d3d7ce542d Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:45:31 +0100
Subject: [PATCH 06/13] fix: respect v3 visibility in labels integration

Consume the updated SDK contract and prevent compatibility policy from reopening hidden or pending vaults. Refresh fixtures and document the current migration boundary.
---
 docs/vault-labels-and-verification.md         | 20 +++++------
 .../public-labels-v20260804151305236.ts       | 15 ++++----
 tests/server/public-labels-source.test.ts     | 20 ++++++-----
 tests/utils/public-labels.test.ts             | 27 ++++++++++++++
 utils/public-labels.ts                        | 35 ++++++++++++++-----
 5 files changed, 83 insertions(+), 34 deletions(-)

diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 7febb9103..5e4fae658 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -8,21 +8,21 @@ Not all vaults on-chain are equal. Public Labels maps chain-scoped vault address
 
 ## Label Data Sources
 
-`useEulerLabels` reads one chain-scoped bundle from `/api/internal/public-labels`. The server resolves `version=latest` once through the published-versions endpoint, then pins every page and entity-address read in that aggregate to the resulting immutable version. Deterministic tests request the published version pinned in `utils/public-labels.ts` directly. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
+`useEulerLabels` reads one chain-scoped bundle from `/api/internal/public-labels`. The server resolves `version=latest` once through the published-versions endpoint, pins resolved metadata pages and entity profiles to that publication. Geo policies, global entity addresses, platform tags and visibility remain live even for a concrete version. Tests use captured fixtures for those live overlays. List reads follow `meta.total` with `limit=100` and increasing `offset`, because V3 caps each page at 100 records.
 
 | Public data | V3 path |
 |---|---|
-| Vault inventory and labels | `GET /curation/vaults?version=...&chainId=...` |
-| Products | `GET /products?version=...&chainId=...` |
-| Entities | `GET /entities?version=...` |
-| Entity governance addresses | `GET /entities/{entityId}/addresses?chainId=...` |
-| Geo policy records | `GET /geo-policies?version=...` |
+| Vault inventory and labels | `GET /labels/vaults?view=resolved&version=...&chainId=...` |
+| Products | `GET /labels/products?view=resolved&version=...&chainId=...` |
+| Entities | `GET /labels/entities?version=...` |
+| Entity governance addresses | `GET /labels/entities/{entityId}/addresses` |
+| Geo policy records | `GET /geo-policies` |
 
-The vault inventory is a union of label and assessment records. Lite includes a row in label-derived listing or verification state when it has a product/entity assignment or published label content such as display metadata, deprecation, tags, or campaigns. Plain-address labels and assessment-only rows share the same empty content shape, so an empty row is retained only when the effective-policy snapshot classifies the same inventory address as a verified or Earn vault. Other assessment-only rows are ignored.
+The adapter also reads `/evk/vaults` and `/earn/vaults` with explicit `visibility=visible,warning,hidden,pending_review`. Trusted label membership requires a visible or warning verdict and a managing entity. Plain-address compatibility entries require a visible or warning verdict as well. Hidden and pending metadata remain available without granting trusted membership. Per-side V3 explorability flags constrain listing; compatibility policy may hide additional vaults but cannot override a negative V3 verdict. On-chain governor checks still determine the stronger verification badge.
 
 Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-The current V3 assessment and geo-policy records are not final eligibility decisions. Lite does not use raw `/evk/vaults/{chainId}/{address}/assessment` or `/earn/vaults/{chainId}/{address}/assessment` responses to hide or verify vaults, and it does not resolve global/product/vault/asset geo precedence from raw policy rows. Until V3 publishes an effective derived contract, the server reads only effective `block`, `restricted`, and discovery-visibility values from the compatibility policy source. That source contributes no display content. Raw V3 geo policies are retained as informational data only.
+The draft retains the compatibility source for effective `block` and `restricted` rules. Raw live V3 geo policies, including `countriesResolved`, are transported for the hosted enforcement migration but are not yet evaluated by Lite. The compatibility source contributes no display content. Completing hosted geo enforcement, durable last-known-good storage, the static source switch and the bake/cutover remains separate work; this draft is not the complete CTO rollout.
 
 Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
 
@@ -34,9 +34,9 @@ Oracle adapter identity and health assessments come from Data V3 through the SDK
 
 ## Published Content Contract
 
-Products provide `entityId`, optional `coBrandEntityIds`, display name, description, URL, portfolio notice, and direct product deprecation metadata. Vault inventory rows provide vault type, product/entity assignment, display metadata, tags, campaigns, and direct vault deprecation metadata. Lite does not cascade product deprecation to a vault; cascading behavior belongs to the future effective derived contract.
+Products provide `entityId`, optional `coBrandEntityIds`, display name, description, URL, portfolio notice, and direct product deprecation metadata. Vault inventory rows provide vault type, product/entity assignment, display metadata, tags, campaigns, and resolved vault deprecation metadata. V3 resolves the display cascade; Lite preserves empty resolved overrides instead of re-inheriting product notices.
 
-Entity rows provide profile text, hosted logos, website/social links, and optional organization details. Lite separately fetches each relevant entity's chain-scoped governance addresses and checksums them before comparison with on-chain governor addresses.
+Entity rows provide profile text, hosted logos, website/social links, and optional organization details. Lite separately fetches each relevant entity's global governance addresses and checksums them before comparison with on-chain governor addresses.
 
 Vault campaigns have a `name`, hosted `logo`, and `type` of `deposit` or `borrow`. Deposit campaigns render beside supply APY and borrow campaigns render beside borrow APY. Campaign badges are informational and do not change reward APR calculations.
 
diff --git a/tests/fixtures/public-labels-v20260804151305236.ts b/tests/fixtures/public-labels-v20260804151305236.ts
index 0b6b2141b..5566dba29 100644
--- a/tests/fixtures/public-labels-v20260804151305236.ts
+++ b/tests/fixtures/public-labels-v20260804151305236.ts
@@ -13,6 +13,7 @@ export const VERIFICATION_ONLY_EARN = '0x00000000000000000000000000000000000000B
 export const KPK_GOVERNOR = '0x1572063377a9a4f8065BD7bA0D7fa135cd13051F'
 
 export const publicLabelsFixture: PublicLabelsSource = {
+  visibility: Object.fromEntries([KPK_VAULT, VERIFICATION_ONLY_EVK, VERIFICATION_ONLY_EARN].map(address => [address.toLowerCase(), { status: 'visible' as const, explorableLend: true, explorableBorrow: true, decidedBy: 'verified', reason: null }])),
   products: [{
     id: 'kpk-securitize',
     chainId: 1,
@@ -38,7 +39,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: 'KPK VBILL/USDC Lend',
     description: 'USDC lending vault for the KPK VBILL market.',
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: ['recently added', 'suppress high utilisation warning'],
     campaigns: [{
@@ -57,7 +58,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: null,
     description: null,
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: [],
     campaigns: null,
@@ -72,7 +73,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: null,
     description: null,
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: [],
     campaigns: null,
@@ -87,7 +88,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: null,
     description: null,
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: [],
     campaigns: null,
@@ -102,7 +103,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: null,
     description: null,
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: [],
     campaigns: null,
@@ -117,7 +118,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     name: null,
     description: null,
     portfolioNotice: null,
-    isDeprecated: false,
+    deprecated: false,
     deprecationReason: null,
     tags: [],
     campaigns: null,
@@ -167,7 +168,6 @@ export const publicLabelsFixture: PublicLabelsSource = {
   }],
   entityAddresses: [{
     entityId: KPK,
-    chainId: 1,
     address: KPK_GOVERNOR,
     label: 'KPK Euler RWA Curation Safe',
   }],
@@ -178,6 +178,7 @@ export const publicLabelsFixture: PublicLabelsSource = {
     vaultAddress: null,
     assetAddress: null,
     countries: ['DE'],
+    countriesResolved: ['DE'],
     policyType: 'block',
     reason: 'Raw fixture policy',
     createdAt: '2026-08-04T13:25:58.430Z',
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index d3e433c13..1e29ac9ef 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -50,7 +50,7 @@ describe('public labels server source', () => {
     vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
     vi.stubEnv('V3_API_URL', 'https://v3.example.test')
     mocks.fetchWithTimeout.mockReset().mockImplementation(async (url: string) =>
-      new URL(url).pathname.endsWith('/label-sets/public/versions')
+      new URL(url).pathname.endsWith('/labels/sets/public/versions')
         ? versionsResponse()
         : emptyListResponse(),
     )
@@ -79,16 +79,18 @@ describe('public labels server source', () => {
     expect(concurrent).toBe(first)
     expect(cached).toBe(first)
     expect(first.version).toBe('v20260804151305236')
-    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(5)
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(7)
     expect(mocks.getEffectiveLabelsSource).toHaveBeenCalledTimes(1)
     expect(mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url).pathname)).toEqual([
-      '/v3/label-sets/public/versions',
-      '/v3/curation/vaults',
-      '/v3/products',
-      '/v3/entities',
+      '/v3/labels/sets/public/versions',
+      '/v3/labels/vaults',
+      '/v3/labels/products',
+      '/v3/labels/entities',
       '/v3/geo-policies',
+      '/v3/evk/vaults',
+      '/v3/earn/vaults',
     ])
-    expect(mocks.fetchWithTimeout.mock.calls.slice(1).every(([url]) =>
+    expect(mocks.fetchWithTimeout.mock.calls.slice(1, 4).every(([url]) =>
       new URL(url).searchParams.get('version') === 'v20260804151305236',
     )).toBe(true)
   })
@@ -99,9 +101,9 @@ describe('public labels server source', () => {
     const bundle = await getPublicLabelsBundle(1, 'v20260804151305236')
 
     expect(bundle.version).toBe('v20260804151305236')
-    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(4)
+    expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(6)
     expect(mocks.fetchWithTimeout.mock.calls.every(([url]) =>
-      !new URL(url).pathname.endsWith('/label-sets/public/versions'),
+      !new URL(url).pathname.endsWith('/labels/sets/public/versions'),
     )).toBe(true)
   })
 
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
index 75cefb2ee..e1f74880a 100644
--- a/tests/utils/public-labels.test.ts
+++ b/tests/utils/public-labels.test.ts
@@ -105,6 +105,33 @@ describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
     expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
   })
 
+  it.each(['hidden', 'pending_review'] as const)('does not let compatibility policy override %s visibility', (status) => {
+    const visibility = Object.fromEntries(Object.keys(publicLabelsFixture.visibility).map(address => [address, {
+      status, explorableLend: false, explorableBorrow: false, decidedBy: 'unclaimed', reason: null,
+    }]))
+    const result = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility }, {
+      products: { compatibility: { vaults: [KPK_VAULT, VERIFICATION_ONLY_EVK] } },
+      earnVaults: [VERIFICATION_ONLY_EARN], assets: [],
+    })
+    expect(result.verifiedVaultAddresses).toEqual([])
+    expect(result.earnVaults).toEqual([])
+    expect(result.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]?.notExplorableLend).toBe(true)
+    expect(result.notExplorableEarnVaults.has(VERIFICATION_ONLY_EARN.toLowerCase())).toBe(true)
+  })
+
+  it('keeps per-side V3 listing flags when compatibility flags allow listing', () => {
+    const source = { ...publicLabelsFixture, visibility: { ...publicLabelsFixture.visibility,
+      [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false },
+    } }
+    const result = normalizePublicLabelsData(1, source, {
+      products: { 'kpk-securitize': { vaults: [KPK_VAULT], vaultOverrides: { [getAddress(KPK_VAULT)]: { notExplorableLend: false, notExplorableBorrow: false } } } },
+      earnVaults: [], assets: [],
+    })
+    const override = result.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]
+    expect(override?.notExplorableLend).toBe(true)
+    expect(override?.notExplorableBorrow).toBe(false)
+  })
+
   it('keeps mixed vault tags scoped to their vault override', () => {
     const sibling = {
       ...publicLabelsFixture.vaults[0],
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index 64f43714b..c6c52954a 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -51,9 +51,8 @@ export interface EffectiveEarnPolicy {
 }
 
 /**
- * Effective visibility remains a separate compatibility contract until V3
- * publishes the resolved product/vault/asset policy result. No display
- * content is read from this source.
+ * Compatibility geo rules and additional discovery restrictions. V3 visibility
+ * is required independently; this source cannot override a negative verdict.
  */
 export interface EffectiveLabelsSource {
   products: Record<string, EffectiveProductPolicy>
@@ -62,7 +61,7 @@ export interface EffectiveLabelsSource {
 }
 
 export interface PublicLabelsBundle {
-  /** Concrete immutable version used for every request in this aggregate. */
+  /** Metadata publication; geo, entity addresses, platform tags and visibility remain live. */
   version: string
   publicLabels: PublicLabelsSource
   effectivePolicy: EffectiveLabelsSource
@@ -156,7 +155,10 @@ export const normalizePublicLabelsData = (
   effectivePolicy: EffectiveLabelsSource = emptyEffectiveLabelsSource(),
 ): PublicEulerLabelsData => {
   const data = normalizeSdkPublicLabelsData(chainId, source)
-  const inventoryRows = source.vaults.filter(vault => vault.chainId === chainId)
+  const inventoryRows = source.vaults.filter((vault) => {
+    const verdict = source.visibility[vault.address.toLowerCase()]
+    return vault.chainId === chainId && (verdict?.status === 'visible' || verdict?.status === 'warning')
+  })
   const { verified: compatibilityVerified, earn: compatibilityEarn } = getEffectiveVaultSets(effectivePolicy)
 
   // Plain-address labels and assessment-only rows have the same empty content
@@ -190,9 +192,8 @@ export const normalizePublicLabelsData = (
   const effectiveEarn = normalizeEffectiveEarnPolicy(effectivePolicy)
   const effectiveAssets = normalizeEffectiveAssets(effectivePolicy.assets)
 
-  // Apply the currently effective geo/visibility policy. Raw V3 geo policies
-  // are intentionally not composed here: global/product/vault/asset precedence
-  // and the final eligibility contract are not specified yet.
+  // The draft retains the compatibility geo evaluator. V3 rules are transported
+  // separately until the hosted geo enforcement path is wired and validated.
   for (const [productKey, product] of Object.entries(products)) {
     const effectiveProduct = effectivePolicy.products[productKey]
     if (!effectiveProduct) continue
@@ -222,6 +223,24 @@ export const normalizePublicLabelsData = (
     entry.notExplorable = effectiveEarn.notExplorable.has(address)
   }
 
+  // V3 flags are final per-side listing decisions. Compatibility restrictions
+  // may hide more, but cannot make a hidden or pending vault explorable.
+  for (const product of Object.values(products)) {
+    for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
+      const verdict = source.visibility[address.toLowerCase()]
+      const override = product.vaultOverrides?.[address]
+      if (!override) continue
+      override.notExplorableLend = override.notExplorableLend || verdict?.explorableLend !== true
+      override.notExplorableBorrow = override.notExplorableBorrow || verdict?.explorableBorrow !== true
+    }
+  }
+  for (const [address, entry] of Object.entries(earnVaultEntries)) {
+    if (source.visibility[address]?.explorableLend !== true) {
+      entry.notExplorable = true
+      effectiveEarn.notExplorable.add(address)
+    }
+  }
+
   return {
     ...data,
     products,

From a766857ae96459188f35bdcbfaec94f3fd743e42 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 12:08:55 +0100
Subject: [PATCH 07/13] fix: refresh live label verification in open tabs

Refresh aged labels on a timer and tab return, expire verification after prolonged refresh failures, and prevent cached registry flags from overriding hosted revocations.
---
 app.vue                                  | 19 ++++++++-
 composables/useEulerLabels.ts            | 29 ++++++++++++--
 composables/useVaultRegistry.ts          | 10 +++--
 docs/vault-labels-and-verification.md    |  2 +-
 tests/composables/useEulerLabels.test.ts | 49 ++++++++++++++++++++++++
 tests/composables/useVaults.test.ts      | 24 ++++++++++++
 6 files changed, 123 insertions(+), 10 deletions(-)

diff --git a/app.vue b/app.vue
index 91891a3de..81d6916c0 100644
--- a/app.vue
+++ b/app.vue
@@ -14,7 +14,7 @@ let isAnnouncementOpen = false
 const { loadEulerConfig, chainId } = useEulerAddresses()
 const { loadVaults, isReady: isVaultsReady, resetVaultsState, refreshVaults, setShowAllLabelEntries } = useVaults()
 const { loadTokenList, isLoaded: isTokenListLoaded } = useTokenList()
-const { loadLabels, retryLabels, isReady: isLabelsReady, isLoading: isLabelsLoading, loadError: labelsLoadError } = useEulerLabels()
+const { loadLabels, refreshLabelsIfStale, retryLabels, isReady: isLabelsReady, isLoading: isLabelsLoading, loadError: labelsLoadError } = useEulerLabels()
 const { loadCountry } = useGeoBlock()
 const { updateBalances, resetBalances } = useWallets()
 const { isConnected, address } = useWagmi()
@@ -162,6 +162,23 @@ watch([chainId, showAllLabelEntries], () => {
   })
 }, { immediate: true })
 
+// Refresh live label verdicts for an open tab and after returning from a
+// suspended/background tab. The labels store owns freshness and deduplication.
+let labelsRefreshInterval: ReturnType<typeof setInterval> | undefined
+const refreshVisibleLabels = () => {
+  if (document.visibilityState === 'visible') void refreshLabelsIfStale()
+}
+onMounted(() => {
+  labelsRefreshInterval = setInterval(refreshVisibleLabels, POLL_INTERVAL_60S_MS)
+  window.addEventListener('focus', refreshVisibleLabels)
+  document.addEventListener('visibilitychange', refreshVisibleLabels)
+})
+onUnmounted(() => {
+  clearInterval(labelsRefreshInterval)
+  window.removeEventListener('focus', refreshVisibleLabels)
+  document.removeEventListener('visibilitychange', refreshVisibleLabels)
+})
+
 // Refresh balances when token list finishes loading (includes new DefiLlama tokens)
 watch(isTokenListLoaded, (loaded) => {
   if (loaded && (isConnected.value || isVaultsReady.value)) {
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index be0a8384b..b18605272 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -50,6 +50,9 @@ const labelsVersion = ref(0)
 const isLoading = ref(false)
 const isReady = ref(false)
 const loadError = ref<string | undefined>()
+const LABELS_REFRESH_INTERVAL_MS = 5 * 60_000
+const LABELS_MAX_AGE_MS = 15 * 60_000
+let lastSuccessfulLoadAt = 0
 let hasSuccessfulSnapshot = false
 const pendingLabelsFetches = new Map<number, Promise<PublicEulerLabelsData>>()
 let labelsLoadGeneration = 0
@@ -72,6 +75,7 @@ export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {})
   labelsLoadGeneration += 1
   wrapPairProbeGeneration += 1
   pendingLabelsFetches.clear()
+  lastSuccessfulLoadAt = 0
   Object.keys(wrapPairs).forEach(key => Reflect.deleteProperty(wrapPairs, key))
   setLabelsData({
     ...createEmptyEulerLabelsData(),
@@ -102,6 +106,7 @@ const entities = toReactive(computed(() => labelsData.value.entities as Record<s
 const points = toReactive(computed(() => labelsData.value.points as Record<string, EulerLabelPointReward[]>))
 const verifiedVaultAddresses = computed(() => labelsData.value.verifiedVaultAddresses)
 const earnVaults = computed(() => labelsData.value.earnVaults)
+const visibility = computed(() => labelsData.value.visibility)
 const geoPolicies = computed(() => labelsData.value.rawGeoPolicies)
 
 const isCurrentLabelsLoad = (chainId: number, generation: number) => {
@@ -117,6 +122,7 @@ const getLabelsFetch = (chainId: number, forceRefresh: boolean) => {
     try {
       const bundle = await $fetch<PublicLabelsBundle>('/api/internal/public-labels', {
         query: { chainId },
+        timeout: 35_000,
         ...(forceRefresh && { headers: { 'cache-control': 'no-cache' } }),
       })
       return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
@@ -136,13 +142,15 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
 
   const { getCurrentChainConfig } = useEulerAddresses()
   if (getCurrentChainConfig.value?.chainId !== chainId) return
-  if (!forceRefresh && labelsChainId.value === chainId && isReady.value) return
+  const hasCurrentSnapshot = labelsChainId.value === chainId && hasSuccessfulSnapshot
+  if (!forceRefresh && hasCurrentSnapshot && isReady.value
+    && Date.now() - lastSuccessfulLoadAt < LABELS_REFRESH_INTERVAL_MS) return
 
   const generation = ++labelsLoadGeneration
   const isCurrentLoad = () => isCurrentLabelsLoad(chainId, generation)
   if (!isCurrentLoad()) return
 
-  isReady.value = false
+  isReady.value = hasCurrentSnapshot && Date.now() - lastSuccessfulLoadAt < LABELS_MAX_AGE_MS
   isLoading.value = true
   loadError.value = undefined
   const probeGeneration = ++wrapPairProbeGeneration
@@ -153,13 +161,16 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
     setLabelsData(createEmptyEulerLabelsData(), chainId)
   }
 
-  const fetchPromise = getLabelsFetch(chainId, forceRefresh)
+  // A scheduled refresh requests current server data; concurrent ordinary
+  // callers still join the existing fetch instead of restarting it.
+  const fetchPromise = getLabelsFetch(chainId, forceRefresh || (hasCurrentSnapshot && !pendingLabelsFetches.has(chainId)))
 
   try {
     const data = await fetchPromise
     if (isCurrentLoad()) {
       setLabelsData(data, chainId)
       hasSuccessfulSnapshot = true
+      lastSuccessfulLoadAt = Date.now()
     }
     if (isCurrentLoad()) {
       void probeWrapPairs(chainId, generation, probeGeneration)
@@ -175,11 +186,19 @@ const loadLabels = async (forceRefresh = false): Promise<void> => {
     }
     if (isCurrentLoad()) {
       isLoading.value = false
-      isReady.value = hasSuccessfulSnapshot
+      isReady.value = hasSuccessfulSnapshot && Date.now() - lastSuccessfulLoadAt < LABELS_MAX_AGE_MS
     }
   }
 }
 
+const refreshLabelsIfStale = async () => {
+  if (hasSuccessfulSnapshot && Date.now() - lastSuccessfulLoadAt >= LABELS_MAX_AGE_MS) {
+    isReady.value = false
+  }
+  if (isLoading.value) return
+  await loadLabels()
+}
+
 const retryLabels = async () => {
   if (isLoading.value) return
   await loadLabels(true)
@@ -278,7 +297,9 @@ export const useEulerLabels = () => {
     oracleAssessmentsAvailable: oracleAdapters.oracleAssessmentsAvailable,
     earnVaults,
     geoPolicies,
+    visibility,
     loadLabels,
+    refreshLabelsIfStale,
     retryLabels,
     loadOracleAdapter: oracleAdapters.loadOracleAdapter,
     loadOracleAdapters: oracleAdapters.loadOracleAdapters,
diff --git a/composables/useVaultRegistry.ts b/composables/useVaultRegistry.ts
index 459c649a7..68f3bab29 100644
--- a/composables/useVaultRegistry.ts
+++ b/composables/useVaultRegistry.ts
@@ -244,7 +244,7 @@ const getVerifiedEVaults = (includeNotExplorable = false): EVault[] => {
   return activeEntries()
     .filter(entry =>
       entry.type === 'evk'
-      && entry.verified === true
+      && isVerifiedVault(entry.vault.address)
       && (includeNotExplorable || !isVaultNotExplorable(entry.vault.address)),
     )
     .map(entry => entry.vault) as EVault[]
@@ -265,10 +265,12 @@ const isEarnVault = (address: string): boolean => getType(address) === 'earn'
 const isSecuritizeVault = (address: string): boolean => getType(address) === 'securitize'
 const isEVaultAddress = (address: string): boolean => getType(address) === 'evk'
 const isVerifiedVault = (address: string): boolean => {
-  const { verifiedVaultAddresses, earnVaults } = useEulerLabels()
+  const { verifiedVaultAddresses, earnVaults, visibility } = useEulerLabels()
   const normalized = normalizeAddress(address)
-  return get(normalized)?.verified === true
-    || isKnownEscrowAddress(normalized)
+  // Registry metadata describes the fetch that created the entry. Current
+  // labels must be able to revoke that earlier positive verification.
+  return isEscrowVault(normalized)
+    || (visibility?.value === undefined && get(normalized)?.verified === true)
     || verifiedVaultAddresses.value.some(vault => normalizeAddress(vault) === normalized)
     || earnVaults.value.some(vault => normalizeAddress(vault) === normalized)
 }
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 5e4fae658..d6bbd5539 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -26,7 +26,7 @@ The draft retains the compatibility source for effective `block` and `restricted
 
 Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
 
-**Caching and fallback**: The server bundle has a 5-minute chain/version cache, concurrent cold loads share one in-flight fetch, and failures can return a bounded stale bundle. The browser deduplicates chain-scoped loads and rejects superseded responses. An initial failure leaves labels unavailable with a retry action; a failed same-chain refresh retains the last successful snapshot. Retry requests a fresh bundle and reloads vault discovery after labels recover.
+**Caching and fallback**: The server bundle has a 5-minute chain/version cache, concurrent cold loads share one in-flight fetch, and failures can return a bounded stale bundle. The browser deduplicates chain-scoped loads and rejects superseded responses. Visible tabs check freshness every minute and on focus/visibility changes, requesting a fresh server bundle after five minutes. Same-chain refreshes retain display data; verification becomes unavailable after fifteen minutes without a successful response. Requests time out after 35 seconds. Current hosted membership overrides cached positive registry flags, so refreshed revocations also update verification guards and verified EVault lists. Escrow perspective trust remains independent. An initial failure leaves labels unavailable with a retry action. Retry requests a fresh bundle and reloads vault discovery after labels recover.
 
 **Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
 
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index 2cc862f5f..f6f296da1 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -144,6 +144,55 @@ describe('useEulerLabels chain-scoped loading', () => {
     expect(currentProductKeys()).toEqual(['cached'])
   })
 
+  it('refreshes an aged successful snapshot and joins overlapping poll events', async () => {
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    try {
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('visible')))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      clock.mockReturnValue(1_000_000 + 299_999)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(1)
+
+      const refreshed = deferred<PublicLabelsBundle>()
+      mocks.fetchPublicLabelsBundle.mockReturnValueOnce(refreshed.promise)
+      clock.mockReturnValue(1_000_000 + 300_000)
+      const pending = labels.refreshLabelsIfStale()
+      await vi.waitFor(() => expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2))
+      expect(labels.isReady.value).toBe(true)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenCalledTimes(2)
+      expect(mocks.fetchPublicLabelsBundle).toHaveBeenLastCalledWith('/api/internal/public-labels', expect.objectContaining({ headers: { 'cache-control': 'no-cache' } }))
+      refreshed.resolve(bundleFor(labelsFor('revoked')))
+      await pending
+      expect(currentProductKeys()).toEqual(['revoked'])
+    }
+    finally { clock.mockRestore() }
+  })
+
+  it('expires verification after refresh failures while retaining display data', async () => {
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    try {
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('cached')))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      mocks.fetchPublicLabelsBundle.mockRejectedValue(new Error('outage'))
+      clock.mockReturnValue(1_000_000 + 300_000)
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(true)
+      clock.mockReturnValue(1_000_000 + 900_000)
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(false)
+      expect(labels.loadError.value).toContain('Unable to load')
+      expect(currentProductKeys()).toEqual(['cached'])
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(labelsFor('recovered')))
+      await labels.refreshLabelsIfStale()
+      expect(labels.isReady.value).toBe(true)
+      expect(currentProductKeys()).toEqual(['recovered'])
+    }
+    finally { clock.mockRestore() }
+  })
+
   it('starts a separate fetch for a new chain and ignores the stale response', async () => {
     const chainOne = deferred<PublicLabelsBundle>()
     const chainTwo = deferred<PublicLabelsBundle>()
diff --git a/tests/composables/useVaults.test.ts b/tests/composables/useVaults.test.ts
index db3ca826e..1c08ae5db 100644
--- a/tests/composables/useVaults.test.ts
+++ b/tests/composables/useVaults.test.ts
@@ -2,6 +2,7 @@ import { EVault as SdkEVault, type EVault, type EulerEarn, type IEVault } from '
 import { getAddress, type Address } from 'viem'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
+import type { PublicEulerLabelsData } from '~/utils/public-labels'
 import { __setEulerLabelsDataForTest, useEulerLabels } from '~/composables/useEulerLabels'
 import { useVaultRegistry } from '~/composables/useVaultRegistry'
 import { useVaults } from '~/composables/useVaults'
@@ -259,6 +260,29 @@ describe('useVaults EVault verification metadata', () => {
     expect(vaults.isEarnVaultOwnerVerified(registry.get(BASE_EARN_VAULT)!.vault as EulerEarn)).toBe(true)
   })
 
+  it('revokes cached EVault and Earn verification when the hosted snapshot removes them', () => {
+    const registry = useVaultRegistry()
+    const snapshot = {
+      verifiedVaultAddresses: [getAddress(LABELED_EVAULT)],
+      earnVaults: [getAddress(BASE_EARN_VAULT)],
+      visibility: {},
+    } as Partial<PublicEulerLabelsData>
+    __setEulerLabelsDataForTest(snapshot)
+    registry.set(LABELED_EVAULT, makeVault(LABELED_EVAULT), 'evk', { verified: true })
+    registry.set(BASE_EARN_VAULT, makeEarnVault(BASE_EARN_VAULT), 'earn', { verified: true })
+    registry.setEscrowAddresses([ESCROW_EVAULT])
+    expect(registry.isVerifiedVault(LABELED_EVAULT)).toBe(true)
+    expect(registry.isVerifiedVault(BASE_EARN_VAULT)).toBe(true)
+
+    __setEulerLabelsDataForTest({ visibility: {} } as Partial<PublicEulerLabelsData>)
+    expect(registry.isVerifiedVault(LABELED_EVAULT)).toBe(false)
+    expect(registry.isVerifiedVault(BASE_EARN_VAULT)).toBe(false)
+    expect(registry.getVerifiedEVaults(true)).toEqual([])
+    expect(registry.isVerifiedVault(ESCROW_EVAULT)).toBe(true)
+    expect(registry.getVault(LABELED_EVAULT)).toBeDefined()
+    expect(registry.getVault(BASE_EARN_VAULT)).toBeDefined()
+  })
+
   it('clears stale Earn verification when a vault is removed from curation', async () => {
     const registry = useVaultRegistry()
     registry.set(BASE_EARN_VAULT, makeEarnVault(BASE_EARN_VAULT), 'earn', { verified: true })

From c21fe5e2eaf854d2ec283d68d89544d666d5e948 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 12:25:32 +0100
Subject: [PATCH 08/13] feat: enforce live v3 geo policies

Evaluate current V3 scopes and resolved countries, persist last-known-good policies, and deny acquisition while compliance data is unavailable.
---
 .env.example                                 |   4 +
 composables/useEulerLabels.ts                |   6 +-
 composables/useGeoBlock.ts                   |  40 ++-
 composables/useOperationGuard.ts             |  15 +-
 docs/geo-blocking.md                         | 357 ++-----------------
 docs/server-side-caching.md                  |   6 +-
 docs/vault-labels-and-verification.md        |   4 +-
 pages/earn/[vault]/[subAccount]/withdraw.vue |   2 +-
 pages/lend/[vault]/[subAccount]/withdraw.vue |   2 +-
 pages/position/[number]/repay.vue            |   2 +-
 pages/position/[number]/withdraw.vue         |   2 +-
 server/utils/geo-policy-source.ts            |  60 ++++
 server/utils/public-labels-source.ts         |  16 +-
 tests/composables/useGeoBlock-v3.test.ts     |  60 ++++
 tests/composables/useOperationGuard.test.ts  |  17 +-
 tests/server/geo-policy-source.test.ts       |  45 +++
 tests/server/public-labels-source.test.ts    |  22 +-
 utils/geo-policies.ts                        |  55 +++
 utils/public-labels.ts                       |  17 +-
 19 files changed, 372 insertions(+), 360 deletions(-)
 create mode 100644 server/utils/geo-policy-source.ts
 create mode 100644 tests/composables/useGeoBlock-v3.test.ts
 create mode 100644 tests/server/geo-policy-source.test.ts
 create mode 100644 utils/geo-policies.ts

diff --git a/.env.example b/.env.example
index f4a3acb21..58daccafb 100644
--- a/.env.example
+++ b/.env.example
@@ -227,3 +227,7 @@ SUBGRAPH_URL_80094="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn
 SUBGRAPH_URL_8453="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-base/latest/gn"
 SUBGRAPH_URL_9745="https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-plasma/latest/gn"
 SUBGRAPH_URL_999=https://api.goldsky.com/api/public/project_cm4iagnemt1wp01xn4gh1agft/subgraphs/euler-simple-hyperevm/1.0.2/gn
+
+# Mount this directory on persistent storage to retain geo policies across redeploys.
+# Default: .data/geo-policies (survives process restarts only on the same filesystem).
+GEO_POLICY_CACHE_DIR=
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index b18605272..bb5299766 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -42,6 +42,7 @@ const createEmptyEulerLabelsData = (): PublicEulerLabelsData => ({
   assetRestrictions: {},
   assetPatternRules: [],
   rawGeoPolicies: [],
+  geoContext: { policies: undefined, chainId: null, productByVault: {} },
 } as unknown as PublicEulerLabelsData)
 
 const labelsData = shallowRef<PublicEulerLabelsData>(createEmptyEulerLabelsData())
@@ -67,11 +68,13 @@ const setLabelsData = (data: PublicEulerLabelsData, chainId: number | null) => {
 
 export const getCurrentEulerLabelsData = (): EulerLabelsData => labelsData.value
 
+export const getEulerGeoContext = () => labelsData.value.geoContext
+
 export const getEulerLabelsVersion = (): number => labelsVersion.value
 
 export const getEulerLabelWrapPairs = (): Record<string, string> => wrapPairs
 
-export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {}) => {
+export const __setEulerLabelsDataForTest = (data: Partial<PublicEulerLabelsData> = {}) => {
   labelsLoadGeneration += 1
   wrapPairProbeGeneration += 1
   pendingLabelsFetches.clear()
@@ -80,6 +83,7 @@ export const __setEulerLabelsDataForTest = (data: Partial<EulerLabelsData> = {})
   setLabelsData({
     ...createEmptyEulerLabelsData(),
     ...data,
+    geoContext: data.geoContext, // Explicit static fixtures use the compatibility evaluator.
     notExplorableEarnVaults: data.notExplorableEarnVaults ?? new Set(),
     assetPatternRules: data.assetPatternRules ?? [],
     rawGeoPolicies: (data as Partial<PublicEulerLabelsData>).rawGeoPolicies ?? [],
diff --git a/composables/useGeoBlock.ts b/composables/useGeoBlock.ts
index 035911a81..24ce650ce 100644
--- a/composables/useGeoBlock.ts
+++ b/composables/useGeoBlock.ts
@@ -11,7 +11,8 @@ import {
   patternRuleMatches,
   isWrapPair,
 } from '~/utils/eulerLabelsUtils'
-import { getEulerLabelsVersion } from '~/composables/useEulerLabels'
+import { matchesHostedGeo } from '~/utils/geo-policies'
+import { getEulerGeoContext, getEulerLabelsVersion } from '~/composables/useEulerLabels'
 import { useVaultRegistry } from '~/composables/useVaultRegistry'
 import { SANCTIONED_COUNTRIES, COUNTRY_GROUPS } from '~/entities/constants'
 
@@ -35,7 +36,11 @@ export const useGeoBlock = () => {
     }
   }
 
-  return { country, loadCountry }
+  const isPolicyAvailable = computed(() => {
+    const hosted = getEulerGeoContext()
+    return !hosted || hosted.policies !== undefined
+  })
+  return { country, loadCountry, isPolicyAvailable }
 }
 
 const isCountryInList = (codes: readonly string[]): boolean => {
@@ -133,6 +138,9 @@ export const isAssetBlockedByCountry = (asset: AssetLike): boolean => {
   // Sanctioned countries are always blocked
   if (isCountryInList(SANCTIONED_COUNTRIES)) return cacheSet(assetBlockCache, cacheKey, true)
 
+  const hosted = getEulerGeoContext()
+  if (hosted) return cacheSet(assetBlockCache, cacheKey, matchesHostedGeo(hosted, country.value, 'block', fields))
+
   if (fields.address) {
     const assetBlock = getAssetBlock(fields.address)
     if (assetBlock?.length && isCountryInList(expandBlockList(assetBlock))) {
@@ -162,11 +170,16 @@ export const isAssetRestrictedByCountry = (
   asset: AssetLike,
   opts?: { counterpart?: AssetLike },
 ): boolean => {
+  const hosted = getEulerGeoContext()
+  if (hosted && hosted.policies === undefined) return true
   const fields = toAssetFields(asset)
   if (!fields) return false
   if (country.value === undefined) return true // unresolved policy must fail closed
   if (country.value === null) return true // loaded, country unknown
 
+  // Global/chain rules cannot be exempted by a wrap or same-asset transfer.
+  if (hosted && matchesHostedGeo(hosted, country.value, 'restrict', fields, undefined, 'non-asset')) return true
+
   const cacheKey = makeAssetCacheKey(fields)
   const cached = assetRestrictedCache.get(cacheKey)
   const restricted = cached !== undefined ? cached : computeAssetRestricted(fields, cacheKey)
@@ -188,6 +201,9 @@ const computeAssetRestricted = (
   fields: { address?: string, symbol?: string, name?: string },
   cacheKey: string,
 ): boolean => {
+  const hosted = getEulerGeoContext()
+  if (hosted) return cacheSet(assetRestrictedCache, cacheKey, matchesHostedGeo(hosted, country.value!, 'restrict', fields, undefined, 'asset'))
+
   if (fields.address) {
     const assetRestricted = getAssetRestricted(fields.address)
     if (assetRestricted?.length && isCountryInList(expandBlockList(assetRestricted))) {
@@ -221,6 +237,14 @@ export const isVaultBlockedByCountry = (
   if (isCountryInList(SANCTIONED_COUNTRIES)) return true
   if (!vaultAddress) return false
 
+  const hosted = getEulerGeoContext()
+  if (hosted) {
+    if (hosted.policies === undefined) return false // No new exposure; exits are not hard blocked.
+    const asset = toAssetFields(opts?.asset ?? getVaultUnderlyingAsset(vaultAddress))
+    return matchesHostedGeo(hosted, country.value, 'block', asset, vaultAddress)
+      || !asset
+  }
+
   const productBlock = getVaultBlock(vaultAddress)
   if (productBlock?.length && isCountryInList(expandBlockList(productBlock))) return true
 
@@ -246,6 +270,18 @@ export const isVaultRestrictedByCountry = (
   if (country.value === null) return true // loaded, country unknown
   if (!vaultAddress) return false
 
+  const hosted = getEulerGeoContext()
+  if (hosted) {
+    if (hosted.policies === undefined) return true
+    const asset = toAssetFields(opts?.asset ?? getVaultUnderlyingAsset(vaultAddress))
+    if (matchesHostedGeo(hosted, country.value, 'restrict', asset, vaultAddress, 'non-asset')) return true
+    if (!asset) return true
+    if (!matchesHostedGeo(hosted, country.value, 'restrict', asset, vaultAddress, 'asset')) return false
+    const counterpart = toAssetFields(opts?.counterpart)
+    return !(asset.address && counterpart?.address
+      && (asset.address.toLowerCase() === counterpart.address.toLowerCase() || isWrapPair(asset.address, counterpart.address)))
+  }
+
   const vaultRestricted = getVaultRestricted(vaultAddress)
   if (vaultRestricted?.length && isCountryInList(expandBlockList(vaultRestricted))) return true
 
diff --git a/composables/useOperationGuard.ts b/composables/useOperationGuard.ts
index e3b678174..dc386f444 100644
--- a/composables/useOperationGuard.ts
+++ b/composables/useOperationGuard.ts
@@ -6,9 +6,22 @@ import { useTosGuard } from '~/composables/guards/useTosGuard'
 import { useUnverifiedVaultGuard } from '~/composables/guards/useUnverifiedVaultGuard'
 import { clearOperationMeta, registerOperationBlocker, setOperationMeta, unregisterOperationBlocker } from '~/utils/operationGuardRegistry'
 import { clearSdkKeyringCredential, setSdkKeyringCredential } from '~/utils/sdk-keyring'
+import { useGeoBlock } from '~/composables/useGeoBlock'
 import { isVaultKeyring } from '~/utils/eulerLabelsUtils'
 
-export const useOperationGuard = (vaultAddresses: Ref<(string | undefined)[]> | (string | undefined)[]) => {
+let geoGuardSequence = 0
+
+export const useOperationGuard = (
+  vaultAddresses: Ref<(string | undefined)[]> | (string | undefined)[],
+  options: { acquiresExposure?: boolean } = {},
+) => {
+  const { isPolicyAvailable } = useGeoBlock()
+  const geoBlockerKey = `geo-policy:${++geoGuardSequence}`
+  watch(isPolicyAvailable, (available) => {
+    if (!available && options.acquiresExposure !== false) registerOperationBlocker(geoBlockerKey, 'Compliance data unavailable. Please retry.')
+    else unregisterOperationBlocker(geoBlockerKey)
+  }, { immediate: true })
+  onUnmounted(() => unregisterOperationBlocker(geoBlockerKey))
   const { address: userAddress } = useWagmi()
   const chainId = useChainId()
   const { chainId: appChainId } = useEulerAddresses()
diff --git a/docs/geo-blocking.md b/docs/geo-blocking.md
index b7c7d9c74..16ae28c1a 100644
--- a/docs/geo-blocking.md
+++ b/docs/geo-blocking.md
@@ -7,7 +7,7 @@ This document explains how Euler Lite restricts vault access based on the user's
 Certain jurisdictions are prohibited from interacting with specific vaults (or all vaults) due to regulatory requirements. The geo-blocking system:
 
 1. Detects the user's country from an HTTP response header.
-2. Evaluates blocking rules at four levels: global sanctions, product-level blocks, per-vault overrides, and **asset-level blocks** keyed by the vault's underlying ERC-20.
+2. Evaluates blocking rules at four levels: global sanctions, V3 global/chain rules, product/vault rules, and **asset-level blocks** keyed by the vault's underlying ERC-20.
 3. Evaluates soft restriction rules that prevent users from acquiring more exposure to a restricted asset.
 4. Extends those rules to the arbitrary-asset selectors used by pay-with (repay), withdraw-to, borrow swap-in, and swap-deposit flows, so a user can't route around a vault block by picking the blocked underlying asset as a swap leg.
 5. Prevents blocked users from submitting transactions while still showing blocked vaults in the UI (dimmed, with a "Restricted" chip).
@@ -93,234 +93,32 @@ Request → cors.ts (strip client x-country-code, set response x-country-code fr
 
 When the gate blocks a request or flags VPN/proxy usage it logs the request path. VPN evidence is audit-only here — it does not fail the request, and it does not replace [address screening](./address-screening.md) at wallet connect. Because some `/api/*` routes embed a wallet address in the path (e.g. `/api/internal/proxy/merkl/users/0x.../rewards`), the path is first run through `safePathTemplate` (`server/utils/observability.ts`), which replaces address and numeric segments with `:address`/`:number` placeholders. This keeps wallet addresses (PII) out of the log sink while preserving the route shape for observability. Routing and matching still operate on the real path.
 
-## Blocking Rules
+## Hosted policy evaluation
 
-**File**: `composables/useGeoBlock.ts`
+The SDK paginates live `GET /v3/geo-policies` without a metadata version or chain filter and validates the complete collection. Lite embeds it with the published metadata snapshot. `utils/geo-policies.ts` evaluates `countriesResolved` directly; country groups such as EEA are expanded by V3, including Norway.
 
-The function `isVaultBlockedByCountry(vaultAddress)` evaluates three layers in order:
+Rules accumulate across global, chain, product, vault and asset scopes. A vault rule cannot remove a product restriction. Product matching uses the resolved vault's current `productId`, including vaults outside the discovery allowlist. Non-null chain/product/vault selectors constrain matching; asset address, symbol, name and regex selectors are alternatives. Address and asset text matching is case-insensitive. Standalone asset selectors apply global/chain/asset rules and cannot resolve product or vault scopes.
 
-### 1. Sanctioned Countries (Global Block)
+Regex expressions are compile-checked and limited to 512 characters by the SDK. Lite treats token metadata longer than 128 characters as a match without running its regex. Missing vault asset metadata remains fail-closed. Same-asset and known wrap-pair exemptions apply only to soft asset restrictions, never global/product/vault restrictions, hard blocks, or unavailable policy data.
 
-Defined in `entities/constants.ts` as `SANCTIONED_COUNTRIES`. Users from these countries are blocked from **all** vaults unconditionally:
+Sanctions remain in `SANCTIONED_COUNTRIES`, enforced independently at the server edge and in client helpers. The compatibility evaluator and `COUNTRY_GROUPS` remain available for static label data; hosted snapshots always use V3 rules. No deployed static-source switch is configured here.
 
-```text
-AF, CF, CU, KP, CD, ET, IR, IQ, LB, LY, ML, MM, NI, RU, SO, SS, SD, SY, VE, YE, ZW
-```
-
-This list is checked first. If the user's country matches, the function returns `true` immediately without checking product or vault-level blocks.
-
-### 2. Product-Level Blocks
-
-Each product in the temporary effective-policy `products.json` can have a `block` array of country codes or group aliases:
-
-```json
-{
-  "name": "Example Vault",
-  "vaults": ["0x1234..."],
-  "block": ["US", "EU"]
-}
-```
-
-All vaults listed under that product inherit the block list. The function `getVaultBlock(address)` in `useEulerLabels.ts` resolves this.
-
-### 3. Per-Vault Overrides
-
-A product can override blocking rules for individual vaults via `vaultOverrides`:
-
-```json
-{
-  "name": "Example Product",
-  "vaults": ["0xAAA...", "0xBBB..."],
-  "block": ["US"],
-  "vaultOverrides": {
-    "0xBBB...": {
-      "block": ["US", "EU", "CH"]
-    }
-  }
-}
-```
-
-When a vault has an override with a `block` field, the override **replaces** (not merges with) the product-level block list. In the example above, `0xAAA` is blocked for `US` only, while `0xBBB` is blocked for `US`, `EU`, and `CH`.
-
-### 4. Earn Vault Blocks
-
-Earn vaults have a separate blocking mechanism in the temporary effective-policy `earn-vaults.json`. Entries can be a plain address string (no blocking) or an object with a `block` array:
-
-```json
-[
-  "0x1111...",
-  { "address": "0x2222...", "block": ["EU", "CH"] }
-]
-```
-
-These are stored in a dedicated `earnVaultBlocks` map (keyed by lowercase address) and checked by `getEarnVaultBlock(address)`.
-
-### 5. Asset-Level Blocks
-
-A vault's **underlying ERC-20 asset** can carry its own block rules in the temporary effective-policy `assets.json`. When the user's country matches a rule for a vault's underlying asset, the vault is treated as blocked — in addition to any product-level or earn-level rules. This is the primary mechanism for compliance-driven blocks that apply to a token regardless of which vault wraps it.
-
-The same rules also drive the `SwapTokenSelector`, so users cannot route around a vault block by picking the blocked underlying as a pay-with, withdraw-to, borrow swap-in, or swap-deposit source.
-
-#### Address-based entries
-
-```json
-[
-  { "address": "0xf6b1117ec07684D3958caD8BEb1b302bfD21103f", "block": ["CA", "US"] },
-  { "address": "0xFeDC5f4a6c38211c1338aa411018DFAf26612c08", "restricted": ["EU", "EFTA"] }
-]
-```
-
-Stored in the `assetBlocks` and `assetRestrictions` maps (keyed by lowercase address), accessed via `getAssetBlock(address)` and `getAssetRestricted(address)`.
-
-#### Pattern-based entries
-
-External token lists (Uniswap, DefiLlama, Merkl) surface addresses the temporary effective-policy source has not enumerated. When a given issuer publishes many tokens with a shared naming convention (e.g. Ondo's USDY, OUSG, OMPL), pattern rules match by symbol or name instead of address:
-
-```json
-[
-  { "symbols": ["USDY", "OUSG", "OMPL"], "block": ["CA", "US"] },
-  { "symbolRegex": "^(USDY|OUSG|OMPL)$", "restricted": ["EU"] },
-  { "names": ["Ondo Short-Term US Govt"], "block": ["CA", "US"] },
-  { "nameRegex": "^Ondo\\s", "block": ["CA", "US"] }
-]
-```
-
-- All string comparisons are **case-insensitive**. Regex fields are compiled with the `i` flag at load time.
-- An entry may combine multiple match fields (`symbols` + `nameRegex`, etc.); they are **OR-composed** — the entry matches if any populated match field matches.
-- Invalid regex strings are rejected at the proxy layer (compile check + 512-char cap) and dropped with a warning at load time.
-- Pattern entries compile into `assetPatternRules`, an ordered list iterated on each asset lookup. Exact-match symbols/names are kept in pre-lowercased `Set`s for O(1) membership; regexes stay as `RegExp` objects.
-
-#### Cross-chain rules: `all/assets.json`
-
-Per-chain `assets.json` files (e.g. `1/assets.json`, `8453/assets.json`) are the right home for address-based rules because addresses are chain-specific. Pattern rules usually apply identically across every chain (USDY is USDY wherever it is deployed), so the temporary effective-policy repository hosts them in a cross-chain directory:
-
-```text
-euler-labels/
-├── 1/assets.json
-├── 8453/assets.json
-└── all/assets.json        ← cross-chain rules (usually patterns)
-```
-
-`server/utils/labels-source.ts` **unions** the per-chain file with `all/assets.json` while assembling the server-side effective policy. If either file is absent upstream it uses only the present side. Both files accept both shapes; conventionally addresses live per-chain and patterns live in `all/`, but nothing enforces that split.
-
-The global file is warmed once on server boot in `warm-cache.ts` alongside the per-chain entries.
-
-#### Resolution via the vault registry
-
-`isVaultBlockedByCountry(address)` resolves the vault's underlying asset via `useVaultRegistry().getVault(address).asset` and calls `isAssetBlockedByCountry(asset)`, passing the full asset object (address + symbol + name) so pattern rules also fire. Before the registry is warm the lookup returns `undefined` and the asset-level branch is a no-op — product/earn-level rules still apply as before.
-
-## Restriction Rules (Soft Block)
-
-**File**: `composables/useGeoBlock.ts`
+## Availability and durable fallback
 
-The function `isVaultRestrictedByCountry(vaultAddress)` checks for soft restrictions:
+`server/utils/geo-policy-source.ts` refreshes the full live collection every five minutes, deduplicates concurrent reads, and writes an atomic, upstream-specific checkpoint containing `policies` and `fetchedAt`. A failed or malformed fetch retains last-known-good policies without an age limit and logs their age. A successful empty collection clears previous rules. Partial pagination never replaces the checkpoint.
 
-### Per-Vault Override Restrictions
+Set `GEO_POLICY_CACHE_DIR` to a mounted persistent directory to survive container replacement. The default `.data/geo-policies` survives process restarts on the same filesystem. Failed checkpoint writes are logged; current validated live rules remain in use, but that write is not durable. Log monitoring must alert on stale-policy age and checkpoint failures; this code does not provision production alerting.
 
-A product can specify `restricted` in vault overrides (vault-level only, no product-level fallback):
+A cold start with no valid policy snapshot fails the entire labels response. The client distinguishes unavailable policies from an authored empty collection. `useOperationGuard` registers “Compliance data unavailable. Please retry.” for acquisition forms, including direct wallet deposits. Repay and withdrawal forms opt out of this availability blocker. Existing verification, country, sanctions and operation-specific checks still apply. Soft restriction helpers also deny acquisition while policies are unavailable, including wrap exemptions.
 
-```json
-{
-  "name": "Example Product",
-  "vaults": ["0xAAA...", "0xBBB..."],
-  "vaultOverrides": {
-    "0xBBB...": {
-      "restricted": ["US", "EU"]
-    }
-  }
-}
-```
-
-### Earn Vault Restrictions
-
-Earn vault entries in `earn-vaults.json` can also have a `restricted` array:
-
-```json
-[
-  "0x1111...",
-  { "address": "0x2222...", "restricted": ["US"], "block": ["IR"] }
-]
-```
-
-A vault can have both `block` and `restricted`. The `block` check takes precedence — if a vault is blocked, the restricted check is not evaluated (blocked is stricter).
-
-### Asset-Level Restrictions
-
-`assets.json` entries (per-chain and `all/`) accept the same `restricted` field with the same semantics as vault-level restrictions. Both address entries and pattern entries support it:
-
-```json
-[
-  { "address": "0xFeDC...", "restricted": ["EU"] },
-  { "symbols": ["USDY"], "restricted": ["EU"] }
-]
-```
-
-Because asset-level rules propagate to `isVaultRestrictedByCountry(address)` via the vault's underlying, a soft-restriction on asset X automatically restricts every vault that uses X — including Earn and Securitize variants — and every swap flow that would acquire X.
-
-#### Soft-restrict semantics by flow context
-
-The picker / flow behavior is preserved by context:
-
-| Flow context | Hard-block | Soft-restrict |
-|---|---|---|
-| Swap target / receive-as / borrow-into / multiply (acquire) | Disabled | Disabled |
-| Swap source / pay-with / swap-deposit input (reduce) | Disabled | Allowed |
-
-## Country Groups
-
-**File**: `entities/constants.ts`
-
-Block and restriction lists can reference group aliases instead of individual country codes. The `expandBlockList()` function in `useGeoBlock.ts` resolves these before matching:
-
-| Alias | Expansion | Count |
-|-------|-----------|-------|
-| `EU` | All 27 EU member states (AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE) | 27 |
-| `EEA` | EU + IS, LI, NO | 30 |
-| `EFTA` | IS, LI, NO, CH | 4 |
-
-Group aliases can be mixed with individual codes: `["EU", "CH", "US"]` blocks all EU countries plus Switzerland and the US.
-
-## Helper Functions
+## Helper functions
 
-### `isVaultBlockedByCountry(address): boolean`
-
-The core hard-block check. Returns `true` if the vault is blocked for the detected country or its underlying asset cannot be resolved. Callers that already hold a chain-scoped vault can pass its asset through `opts.asset`.
-
-### `isAnyVaultBlockedByCountry(...addresses): boolean`
-
-Returns `true` if **any** of the provided vault addresses are blocked. Used on action pages that involve multiple vaults (e.g. a borrow position has both a collateral vault and a borrow vault).
-
-### `isVaultRestrictedByCountry(address): boolean`
-
-The soft-restriction check. Returns `true` if the vault has a `restricted` entry matching the user's country or its underlying asset cannot be resolved. Only checks vault-level overrides and earn vault restrictions (no product-level fallback).
-
-### `isAnyVaultRestrictedByCountry(...addresses): boolean`
-
-Returns `true` if **any** of the provided vault addresses are restricted. Used for multi-vault restriction checks (e.g. multiply requires checking both long and short vaults).
-
-### `isAssetBlockedByCountry(asset: AssetLike): boolean`
-
-Asset-level hard-block check. Accepts either a bare address string (backward compat) or an asset-like object `{ address?, symbol?, name? }` — `VaultAsset` satisfies the latter. The object form is required for pattern rules to fire; string-only callers skip the pattern path.
-
-Lookup order: sanctioned-country check → address-map lookup (via `getAssetBlock`) → iterate `assetPatternRules` and test each rule's `symbolsLower` / `symbolRegex` / `namesLower` / `nameRegex` against the lowercased asset symbol/name.
-
-### `isAssetRestrictedByCountry(asset: AssetLike): boolean`
-
-Asset-level soft-restriction check. Same signature and lookup order as the block variant, but consults `getAssetRestricted` and rule `restricted` lists.
-
-Both helpers are called from form-level sites (pay-with, withdraw-to, swap-deposit source, borrow swap-in) where the full asset object is in hand, and also from the `SwapTokenSelector` per visible row. The vault-level helpers (`isVaultBlockedByCountry` / `isVaultRestrictedByCountry`) use them internally by resolving `vault.asset` via the registry.
-
-### `getVaultTags(address, context?): { tags: string[], disabled: boolean }`
-
-Combines geo-blocking, soft-restriction, and deprecation status into a single result for UI consumption. Returns tags like `["Restricted"]`, `["Deprecated"]`, or `["Restricted", "Deprecated"]`.
-
-The `context` parameter controls when the "Restricted" chip appears for soft-restricted vaults:
-
-| Context | When Used | Shows Restricted Chip? |
-|---------|-----------|----------------------|
-| `'browse'` (default) | Browse pages, general display | Only for hard-blocked vaults |
-| `'swap-target'` | Vault selection modals for swap/borrow TO targets | Yes (prevents acquiring exposure) |
-| `'supply-source'` | Vault selection modals for supply FROM sources, multiply collateral | No (user is spending, not acquiring) |
+- `isVaultBlockedByCountry(address, { asset? })` combines sanctions and matching V3 block policies.
+- `isVaultRestrictedByCountry(address, { asset?, counterpart? })` evaluates soft restrictions.
+- `isAnyVaultBlockedByCountry` / `isAnyVaultRestrictedByCountry` combine decisions across vaults.
+- `isAssetBlockedByCountry` / `isAssetRestrictedByCountry` evaluate standalone asset choices.
+- `getVaultTags(address, context)` presents restrictions and deprecation. `swap-target` disables soft-restricted destinations; `supply-source` permits existing exposure to be used for repayment.
+- `useGeoBlock().isPolicyAvailable` distinguishes successful empty data from unavailable data.
 
 ## UI Enforcement
 
@@ -407,121 +205,10 @@ Uses `useSwapCollateralOptions` with `tagContext: 'supply-source'` so collateral
 
 Existing positions in blocked vaults show the "Restricted" chip. No chip for soft-restricted vaults (positions are already open).
 
-## Data Flow
+## Data flow and validation
 
-```text
-App Startup
-  │
-  ├─ loadCountry() ─► HEAD / ─► cors.ts sets x-country-code from the edge context
-  │                  ◄─────────── x-country-code: DE ──────────────────────────
-  │                  country ref: "DE" (5-min cache)
-  │                  undefined → null (fail-closed) on unknown/error (geo-capable edge, prod)
-  │                  undefined → "--" (non-null sentinel, fail-open) on unknown in dev or under the `none` preset
-  │
-  └─ loadLabels() ──► /api/internal/public-labels
-                       ├─ Public Labels V3: products, vault content, entities, campaigns
-                       └─ temporary effective policy:
-                            products.json ─► product/vault block + restriction maps
-                            earn-vaults.json ─► Earn block + restriction maps
-                            chain/all assets.json ─► exact + pattern asset rules
-                          (5-min server cache)
-
-Server-Side (every API request):
-  geo-gate.ts reads the country from the edge context (EDGE_PROVIDER preset)
-  ├─ unknown/XX/T1 + geo-capable edge + prod → HTTP 451 (fail-closed)
-  ├─ unknown + dev, or `none` preset → allow
-  └─ known country → check SANCTIONED_COUNTRIES → block or allow
-
-Runtime Check: isVaultBlockedByCountry("0x1234...")
-  │
-  ├─ country === undefined (loading) → true (policy pending, fail-closed)
-  ├─ country === null (unknown, fail-closed) → true (blocked)
-  │
-  ├─ 1. SANCTIONED_COUNTRIES includes "DE"?  ─► yes → blocked
-  │
-  ├─ 2. getVaultBlock("0x1234...")
-  │     └─ product.vaultOverrides["0x1234..."]?.block ?? product.block
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → blocked
-  │
-  ├─ 3. getEarnVaultBlock("0x1234...")
-  │     └─ earnVaultBlocks[lowercase addr]
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → blocked
-  │
-  ├─ 4. Asset-level: resolve vault.asset via vault registry
-  │     ├─ unresolved asset → blocked
-  │     └─ isAssetBlockedByCountry({ address, symbol, name })
-  │           ├─ assetBlocks[asset.address.toLowerCase()] includes "DE"? ─► blocked
-  │           └─ iterate assetPatternRules (with block list):
-  │                 symbolsLower.has(symbol.toLowerCase()) ||
-  │                 symbolRegex.test(symbol.toLowerCase()) ||
-  │                 namesLower.has(name.toLowerCase())     ||
-  │                 nameRegex.test(name.toLowerCase())       ─► blocked
-  │
-  └─ 5. Not blocked → return false
-
-Runtime Check: isVaultRestrictedByCountry("0x1234...")
-  │
-  ├─ country === undefined (loading) → true (policy pending, fail-closed)
-  ├─ country === null (unknown, fail-closed) → true (restricted)
-  │
-  ├─ 1. getVaultRestricted("0x1234...")
-  │     └─ product.vaultOverrides["0x1234..."]?.restricted (no product fallback)
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → restricted
-  │
-  ├─ 2. getEarnVaultRestricted("0x1234...")
-  │     └─ earnVaultRestrictions[lowercase addr]
-  │     └─ expandBlockList(codes) → includes "DE"?  ─► yes → restricted
-  │
-  ├─ 3. Asset-level: resolve vault.asset via vault registry
-  │     ├─ unresolved asset → restricted
-  │     └─ isAssetRestrictedByCountry({ address, symbol, name })
-  │           ├─ assetRestrictions[asset.address.toLowerCase()] → restricted
-  │           └─ iterate assetPatternRules (with restricted list):
-  │                 symbol/name match as above ─► restricted
-  │
-  └─ 4. Not restricted → return false
-```
+V3 live policies → SDK pagination/validation → Lite disk checkpoint → atomic labels bundle → current vault assignments + country → Lite eligibility helpers and operation guards.
+
+The server bundle cache is five minutes; open tabs refresh labels after five minutes, checked once a minute and on focus. Policy updates do not depend on a metadata publication. The labels snapshot revision invalidates asset decision caches.
 
-## Configuration
-
-All blocking and restriction configuration lives outside the app codebase:
-
-| What | Where | Effect |
-|------|-------|--------|
-| Global sanctions list | `entities/constants.ts` — `SANCTIONED_COUNTRIES` | Blocks all vaults for listed countries |
-| Country group definitions | `entities/constants.ts` — `COUNTRY_GROUPS` | Defines EU, EEA, EFTA aliases |
-| Product-level blocks | Effective-policy source — `products.json` `block` field | Blocks all vaults in a product |
-| Per-vault block overrides | Effective-policy source — `products.json` `vaultOverrides[addr].block` | Overrides product block for one vault |
-| Per-vault restrictions | Effective-policy source — `products.json` `vaultOverrides[addr].restricted` | Soft-restricts one vault (no product fallback) |
-| Earn vault blocks | Effective-policy source — `earn-vaults.json` `block` field | Hard-blocks specific earn vaults |
-| Earn vault restrictions | Effective-policy source — `earn-vaults.json` `restricted` field | Soft-restricts specific earn vaults |
-| Asset-level blocks/restrictions (per-chain) | Effective-policy source — `{chainId}/assets.json` | Blocks/restricts any vault whose underlying is listed + the token in the swap picker |
-| Asset-level blocks/restrictions (cross-chain) | Effective-policy source — `all/assets.json` | Same as per-chain, usually pattern rules (`symbols`/`symbolRegex`/`names`/`nameRegex`) that apply on every chain |
-| Edge provider preset | `.env` — `EDGE_PROVIDER` | Selects the trusted-header mapping (geo, client IP, VPN evidence); required in production |
-| Dev country simulation | `.env` — `DEV_GEO_COUNTRY=GB` | Simulates a country when the edge provides none (dev, previews); production refuses to boot with it set |
-
-Changes to the effective-policy files take effect within 5 minutes without an app deployment. This compatibility source remains necessary until V3 publishes the resolved global/product/vault/asset precedence; raw V3 geo-policy rows are not applied directly.
-
-## Key Files
-
-| File | Role |
-|------|------|
-| `services/country.ts` | Client-side country detection via HEAD request and `x-country-code` response header |
-| `server/middleware/cors.ts` | Strips client `x-country-code`, derives authoritative value from the edge context, emits as response header |
-| `server/utils/edge.ts` + `utils/edge-presets.ts` | Normalized edge context (`getEdgeContext`) and the per-provider trusted-header mapping (`EDGE_PROVIDER` presets) |
-| `server/middleware/geo-gate.ts` | Server-side sanctioned-country block; fail-closed on unknown country in prod |
-| `composables/useGeoBlock.ts` | Core blocking logic, `isVaultBlockedByCountry`, `isVaultRestrictedByCountry`, `isAssetBlockedByCountry`, `isAssetRestrictedByCountry`, `getVaultTags`; `AssetLike` type |
-| `composables/useEulerLabels.ts` | Aggregate Public Labels loading and current normalized snapshot |
-| `utils/eulerLabelsUtils.ts` | Getter helpers `getVaultBlock`, `getEarnVaultBlock`, `getVaultRestricted`, `getEarnVaultRestricted`, `getAssetBlock`, `getAssetRestricted`, `getAssetPatternRules` |
-| `server/utils/labels-source.ts` | Server-only compatibility policy fetch, validation, chain/global asset union, caching, and bounded stale fallback |
-| `server/utils/public-labels-source.ts` | Combines Public Labels V3 content with effective policy into one cached bundle |
-| `server/plugins/warm-cache.ts` | Warms Public Labels and effective policy |
-| `entities/constants.ts` | `SANCTIONED_COUNTRIES`, `COUNTRY_GROUPS` (EU/EEA/EFTA) |
-| `entities/euler/labels.ts` | TypeScript types (`EulerLabelProduct`, `EulerLabelVaultOverride`, `EulerLabelAssetEntry` union with address + pattern fields) |
-| `components/entities/asset/SwapTokenSelector.vue` | Arbitrary-asset selector. Disables blocked/restricted rows (mode-aware) via `getAssetGeoState(asset, mode)` |
-| `components/entities/vault/VaultItem.vue` | Browse page "Restricted" chip (hard-block only) |
-| `components/entities/vault/VaultBorrowItem.vue` | Borrow browse page "Restricted" chip (hard-block + soft-restricted) |
-| `components/entities/vault/ChooseCollateralModal.vue` | Selection modal disabled state and warning chips |
-| `composables/useSwapCollateralOptions.ts` | Collateral selection with `tagContext` parameter |
-| `composables/useSwapDebtOptions.ts` | Debt selection with `'swap-target'` context |
-| `composables/useMultiplyCollateralOptions.ts` | Multiply collateral selection with `'supply-source'` context |
+Tests cover resolved Norway membership, cumulative scopes, product reassignment, chain isolation, case-insensitive asset patterns, input bounds, unavailable versus empty data, acquisition guards, disk restart recovery and malformed/partial fetches. Production canary deployment and alert wiring are separate operational work.
diff --git a/docs/server-side-caching.md b/docs/server-side-caching.md
index 749bf89a2..c2c9e8954 100644
--- a/docs/server-side-caching.md
+++ b/docs/server-side-caching.md
@@ -20,7 +20,7 @@ This document covers the per-host proxies, the vault snapshot pipeline, the warm
 | `server/api/internal/proxy/subgraph/[chainId].post.ts` | Proxies the per-chain Goldsky subgraph |
 | `server/api/internal/public-labels.get.ts` | Chain/version-scoped aggregate Public Labels endpoint |
 | `server/utils/public-labels-source.ts` | Public Labels V3 pagination, 5-minute cache, in-flight dedup, and bounded stale fallback |
-| `server/utils/labels-source.ts` | Temporary effective visibility/geo policy source used until V3 publishes resolved policy |
+| `server/utils/labels-source.ts` | Compatibility discovery source; hosted geo comes from V3 |
 | `server/api/internal/v3/[...path].ts` | Rate-limited V3 backend proxy for SDK browser endpoints (`/api/internal/v3/...` → `v3.euler.finance/v3/...`) |
 | `server/api/internal/vaults.get.ts` | Per-chain consolidated vault snapshot endpoint |
 | `server/utils/vaults-cache.ts` | `refreshChainVaults` + `vaultsCache` |
@@ -70,9 +70,9 @@ Each proxy carries a rate limiter (`createRateLimiter`) and returns 405 for disa
 
 ### Public Labels
 
-`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines that immutable display dataset with the temporary effective-policy overlay. The result is cached for 5 minutes by chain and version, concurrent misses share one in-flight operation, and an upstream failure can serve only the bounded stale entry.
+`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines that immutable display dataset with the temporary effective-policy overlay. The result is cached for 5 minutes by chain and version; concurrent misses share one in-flight operation. Bundle stale fallback is bounded. Geo separately retains a validated, fetchedAt-stamped disk checkpoint with unbounded stale-on-error fallback; cold starts without geo cannot publish a bundle. Mount `GEO_POLICY_CACHE_DIR` for cross-container persistence.
 
-The legacy `/api/internal/labels/*` browser and SDK routes do not exist. `server/utils/labels-source.ts` still reads only `products.json`, `earn-vaults.json`, and chain/global `assets.json` as a server-internal compatibility contract for effective `block`, `restricted`, and discovery visibility. It does not contribute names, descriptions, entities, logos, products, tags, campaigns, or deprecation content. `EFFECTIVE_POLICY_BASE_URL` configures only that policy source until V3 publishes the resolved effective decision. The former `NUXT_PUBLIC_CONFIG_LABELS_*` names remain server-side fallbacks for existing deployments but are no longer part of Nuxt public runtime config.
+The legacy `/api/internal/labels/*` browser and SDK routes do not exist. `server/utils/labels-source.ts` still reads only `products.json`, `earn-vaults.json`, and chain/global `assets.json` as a server-internal compatibility contract. Hosted enforcement ignores its `block` and `restricted` fields; only its discovery membership/restrictions remain active. It does not contribute names, descriptions, entities, logos, products, tags, campaigns, or deprecation content. `EFFECTIVE_POLICY_BASE_URL` configures only that policy source for discovery compatibility. The former `NUXT_PUBLIC_CONFIG_LABELS_*` names remain server-side fallbacks for existing deployments but are no longer part of Nuxt public runtime config.
 
 ### V3 proxy
 
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index d6bbd5539..43b19ec79 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -22,7 +22,7 @@ The adapter also reads `/evk/vaults` and `/earn/vaults` with explicit `visibilit
 
 Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-The draft retains the compatibility source for effective `block` and `restricted` rules. Raw live V3 geo policies, including `countriesResolved`, are transported for the hosted enforcement migration but are not yet evaluated by Lite. The compatibility source contributes no display content. Completing hosted geo enforcement, durable last-known-good storage, the static source switch and the bake/cutover remains separate work; this draft is not the complete CTO rollout.
+Lite evaluates live V3 geo policies using `countriesResolved` and cumulative global/chain/product/vault/asset rules. The server embeds a validated geo collection with each snapshot and retains a disk checkpoint for stale-on-error recovery. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for redeploy durability. Compatibility data still supplies discovery membership/restrictions; it does not control hosted geo enforcement. The static source switch and production bake/canary remain separate rollout work. See [Geo-Blocking](./geo-blocking.md).
 
 Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
 
@@ -253,7 +253,7 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 | `server/utils/labels-source.ts` | Server-only temporary effective-policy overlay |
 | `composables/useEulerLabels.ts` | Chain-scoped aggregate loading and normalized label publication |
 | `composables/useVaultRegistry.ts` | Vault registry with type detection and unknown resolution |
-| `composables/useGeoBlock.ts` | Geo-blocking logic using label block/restricted fields |
+| `composables/useGeoBlock.ts` | V3 country evaluation and independent sanctions gate |
 
 ## Programmatic verification lookup
 
diff --git a/pages/earn/[vault]/[subAccount]/withdraw.vue b/pages/earn/[vault]/[subAccount]/withdraw.vue
index 1a6db55f2..f9e37c27d 100644
--- a/pages/earn/[vault]/[subAccount]/withdraw.vue
+++ b/pages/earn/[vault]/[subAccount]/withdraw.vue
@@ -28,7 +28,7 @@ const { isConnected, isSpyMode, effectiveAddress } = useEffectiveAddress()
 const { runSimulation, simulationError, clearSimulationError } = useTransactionPlanSimulation()
 const { viewer, visibleTotal } = useApyVisibility()
 const vaultAddress = route.params.vault as string
-useOperationGuard([vaultAddress])
+useOperationGuard([vaultAddress], { acquiresExposure: false })
 const product = useEulerProductOfVault(vaultAddress)
 const subAccountIndex = Number(route.params.subAccount)
 const subAccount = computed(() => {
diff --git a/pages/lend/[vault]/[subAccount]/withdraw.vue b/pages/lend/[vault]/[subAccount]/withdraw.vue
index 428206466..b7b0e340e 100644
--- a/pages/lend/[vault]/[subAccount]/withdraw.vue
+++ b/pages/lend/[vault]/[subAccount]/withdraw.vue
@@ -57,7 +57,7 @@ const {
 const { settings } = useUserSettings()
 const enableIntrinsicApy = computed(() => settings.value.enableIntrinsicApy)
 const vaultAddress = route.params.vault as string
-useOperationGuard([vaultAddress])
+useOperationGuard([vaultAddress], { acquiresExposure: false })
 const subAccountIndex = Number(route.params.subAccount)
 const subAccount = computed(() => {
   const addr = effectiveAddress.value
diff --git a/pages/position/[number]/repay.vue b/pages/position/[number]/repay.vue
index e465c48a2..6507e4706 100644
--- a/pages/position/[number]/repay.vue
+++ b/pages/position/[number]/repay.vue
@@ -68,7 +68,7 @@ const collateralVault = computed<EVault | SecuritizeCollateralVault | undefined>
 const positionCollateralVaults = computed(() =>
   resolvePositionRoeCollateralVaults(position.value, collateralVault.value),
 )
-useOperationGuard(computed(() => [borrowVault.value?.address].filter(Boolean)))
+useOperationGuard(computed(() => [borrowVault.value?.address].filter(Boolean)), { acquiresExposure: false })
 const assets = computed<VaultAsset[]>(() => [collateralVault.value?.asset, borrowVault.value?.asset].filter((asset): asset is VaultAsset => !!asset))
 const assetsLabel = usePositionPairLabel(position)
 const isEligibleForLiquidation = computed(() => position.value?.liquidatable ?? false)
diff --git a/pages/position/[number]/withdraw.vue b/pages/position/[number]/withdraw.vue
index 009d33f4c..3620c6bc9 100644
--- a/pages/position/[number]/withdraw.vue
+++ b/pages/position/[number]/withdraw.vue
@@ -180,7 +180,7 @@ const form = useCollateralForm({
   },
   usePreparedPipeline: true,
 })
-useOperationGuard(computed(() => [form.collateralVault.value?.address, form.borrowVault.value?.address].filter(Boolean)))
+useOperationGuard(computed(() => [form.collateralVault.value?.address, form.borrowVault.value?.address].filter(Boolean)), { acquiresExposure: false })
 const withdrawableCollateralAssets = computed(() => cashLimitedCollateralAssets())
 
 // True when the requested amount covers the entire collateral balance. The Max
diff --git a/server/utils/geo-policy-source.ts b/server/utils/geo-policy-source.ts
new file mode 100644
index 000000000..40462cbcd
--- /dev/null
+++ b/server/utils/geo-policy-source.ts
@@ -0,0 +1,60 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fetchPublicGeoPolicies, validatePublicGeoPolicies, type PublicGeoPolicy, type PublicLabelsRequest } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { logger } from './logger'
+import { withWallClock } from './fetchWithTimeout'
+
+interface GeoSnapshot { fetchedAt: number, policies: PublicGeoPolicy[] }
+
+/** A source-specific disk checkpoint survives process restarts; mount the directory for redeploys. */
+export const createGeoPolicySource = (source: string, directory: string) => {
+  const file = join(directory, `${createHash('sha256').update(source).digest('hex')}.json`)
+  let lastGood: GeoSnapshot | undefined
+  let pending: Promise<GeoSnapshot> | undefined
+  let diskLoaded = false
+
+  const refresh = async (request: PublicLabelsRequest): Promise<GeoSnapshot> => {
+    if (!diskLoaded) {
+      diskLoaded = true
+      try {
+        const saved = JSON.parse(await readFile(file, 'utf8')) as GeoSnapshot
+        if (!Number.isFinite(saved.fetchedAt) || saved.fetchedAt <= 0 || saved.fetchedAt > Date.now()) throw new Error('Invalid geo checkpoint timestamp')
+        lastGood = { fetchedAt: saved.fetchedAt, policies: validatePublicGeoPolicies(saved.policies) }
+      }
+      catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') logger.warn({ ctx: 'geo-policy-source', err }, 'geo checkpoint unavailable')
+      }
+    }
+    try {
+      const policies = await withWallClock(() => fetchPublicGeoPolicies(request), 10_000, 'geo-policies')
+      const snapshot = { policies, fetchedAt: Date.now() }
+      // A failed checkpoint write must not cause use of older, less restrictive live rules.
+      lastGood = snapshot
+      try {
+        await mkdir(directory, { recursive: true })
+        const temporary = `${file}.${randomUUID()}.tmp`
+        await writeFile(temporary, JSON.stringify(snapshot), { mode: 0o600 })
+        await rename(temporary, file)
+      }
+      catch (err) {
+        logger.warn({ ctx: 'geo-policy-source', err }, 'geo checkpoint write failed; restart persistence unavailable')
+      }
+      return snapshot
+    }
+    catch (err) {
+      if (!lastGood) throw err
+      logger.warn({ ctx: 'geo-policy-source', ageMs: Date.now() - lastGood.fetchedAt, fetchedAt: lastGood.fetchedAt, err }, 'using last-known-good geo policies')
+      return lastGood
+    }
+  }
+  return (request: PublicLabelsRequest): Promise<GeoSnapshot> => {
+    if (pending) return pending
+    // Freshness is bounded; stale use is permitted only after a failed refresh.
+    if (lastGood && Date.now() - lastGood.fetchedAt < 300_000) return Promise.resolve(lastGood)
+    pending = refresh(request).finally(() => {
+      pending = undefined
+    })
+    return pending
+  }
+}
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index 525a560fe..dfe5cdb10 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -1,3 +1,4 @@
+import { createGeoPolicySource } from './geo-policy-source'
 import { createTtlCache } from './cache'
 import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
 import { createInFlightDedup } from './in-flight'
@@ -21,6 +22,17 @@ const REFRESH_BUDGET_MS = 30_000
 const cache = createTtlCache<PublicLabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
 const inFlight = createInFlightDedup<string, PublicLabelsBundle>()
 
+const geoSources = new Map<string, ReturnType<typeof createGeoPolicySource>>()
+const getGeoSource = () => {
+  const source = readResolvedV3ApiUrl()
+  let loader = geoSources.get(source)
+  if (!loader) {
+    loader = createGeoPolicySource(source, process.env.GEO_POLICY_CACHE_DIR || '.data/geo-policies')
+    geoSources.set(source, loader)
+  }
+  return loader
+}
+
 const cacheKey = (chainId: number, version: string): string => `${chainId}:${version}`
 
 const buildRequest = (): PublicLabelsRequest => async <T>(
@@ -59,8 +71,9 @@ export function refreshPublicLabelsBundle(
             endpoint: readResolvedV3ApiUrl(),
             request,
           })
+          const geo = await getGeoSource()(request)
           const [snapshot, effectivePolicy] = await Promise.all([
-            adapter.fetchPublicLabelsSnapshot(chainId, version),
+            adapter.fetchPublicLabelsSnapshot(chainId, version, geo.policies),
             getEffectiveLabelsSource(chainId),
           ])
           // Validate the complete cross-source relationship before replacing
@@ -69,6 +82,7 @@ export function refreshPublicLabelsBundle(
           normalizePublicLabelsData(chainId, snapshot.publicLabels, effectivePolicy)
           return {
             version: snapshot.version,
+            geoFetchedAt: geo.fetchedAt,
             publicLabels: snapshot.publicLabels,
             effectivePolicy,
           }
diff --git a/tests/composables/useGeoBlock-v3.test.ts b/tests/composables/useGeoBlock-v3.test.ts
new file mode 100644
index 000000000..e0cc91cd7
--- /dev/null
+++ b/tests/composables/useGeoBlock-v3.test.ts
@@ -0,0 +1,60 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PublicGeoPolicy } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { __setEulerLabelsDataForTest } from '~/composables/useEulerLabels'
+import { isAssetBlockedByCountry, isAssetRestrictedByCountry, isVaultBlockedByCountry, isVaultRestrictedByCountry, useGeoBlock } from '~/composables/useGeoBlock'
+
+vi.mock('~/composables/useVaultRegistry', () => ({ useVaultRegistry: () => ({ getVault: () => undefined }) }))
+const vault = '0x1111111111111111111111111111111111111111'
+const asset = { address: '0x2222222222222222222222222222222222222222', name: 'Ondo token', symbol: 'TEST' }
+const rule = (overrides: Partial<PublicGeoPolicy> = {}): PublicGeoPolicy => ({ id: 'rule', chainId: null, productId: null, vaultAddress: null, assetAddress: null, policyType: 'block', countries: ['EEA'], countriesResolved: ['NO', 'DE'], reason: null, createdAt: '', ...overrides })
+const set = (policies: PublicGeoPolicy[] | undefined, productId = 'current', chainId = 1) => __setEulerLabelsDataForTest({ geoContext: { policies, chainId, productByVault: { [vault]: productId } } })
+
+describe('V3 geo enforcement', () => {
+  beforeEach(() => {
+    set([])
+    useGeoBlock().country.value = 'NO'
+  })
+  it('uses countriesResolved, including Norway, without expanding aliases in Lite', () => {
+    set([rule()])
+    expect(isAssetBlockedByCountry(asset)).toBe(true)
+    useGeoBlock().country.value = 'FR'
+    expect(isAssetBlockedByCountry(asset)).toBe(false)
+  })
+  it('ORs global, product, vault and asset rules without narrowing overrides', () => {
+    for (const specific of [{}, { chainId: 1, productId: 'current' }, { chainId: 1, vaultAddress: vault }, { chainId: 1, assetAddress: asset.address }]) {
+      set([rule(specific), rule({ chainId: 1, vaultAddress: vault, countriesResolved: ['US'] })])
+      expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    }
+  })
+  it('uses current assignments and excludes other chains and scoped rules from standalone assets', () => {
+    set([rule({ chainId: 1, productId: 'old' }), rule({ chainId: 8453, vaultAddress: vault })])
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+    set([rule({ chainId: 1, productId: 'current' })])
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    expect(isAssetBlockedByCountry(asset)).toBe(false)
+    set([rule({ chainId: 1, productId: 'current' })], 'new')
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+  })
+  it('distinguishes unavailable from authored empty, preserving exits and sanctions', () => {
+    set(undefined)
+    expect(useGeoBlock().isPolicyAvailable.value).toBe(false)
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(true)
+    expect(isAssetRestrictedByCountry(asset, { counterpart: asset })).toBe(true)
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(false)
+    set([])
+    expect(useGeoBlock().isPolicyAvailable.value).toBe(true)
+    expect(isVaultRestrictedByCountry(vault, { asset })).toBe(false)
+    useGeoBlock().country.value = 'KP'
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+    useGeoBlock().country.value = null
+    expect(isVaultBlockedByCountry(vault, { asset })).toBe(true)
+  })
+  it('preserves bounded pattern matching and limits same-asset exemptions to asset restrictions', () => {
+    set([rule({ policyType: 'restrict', assetNameRegex: '^ondo' })])
+    expect(isAssetRestrictedByCountry(asset)).toBe(true)
+    expect(isAssetRestrictedByCountry({ name: 'x'.repeat(129) })).toBe(true)
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(false)
+    set([rule({ policyType: 'restrict', chainId: 1, productId: 'current' })])
+    expect(isVaultRestrictedByCountry(vault, { asset, counterpart: asset })).toBe(true)
+  })
+})
diff --git a/tests/composables/useOperationGuard.test.ts b/tests/composables/useOperationGuard.test.ts
index e12895e29..80c6fbf3b 100644
--- a/tests/composables/useOperationGuard.test.ts
+++ b/tests/composables/useOperationGuard.test.ts
@@ -5,7 +5,12 @@ import { mainnet, monad } from 'viem/chains'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { useOperationGuard } from '~/composables/useOperationGuard'
 
-vi.mock('~/composables/useEulerLabels', () => ({ getEulerLabelsVersion: () => 1 }))
+import type { HostedGeoContext } from '~/utils/geo-policies'
+import { operationBlockerEntries } from '~/utils/operationGuardRegistry'
+
+const hostedGeo = ref<HostedGeoContext | undefined>()
+
+vi.mock('~/composables/useEulerLabels', () => ({ getEulerLabelsVersion: () => 1, getEulerGeoContext: () => hostedGeo.value }))
 vi.mock('~/composables/guards/useTosGuard', () => ({ useTosGuard: () => ({}) }))
 vi.mock('~/utils/eulerLabelsUtils', () => ({ isVaultKeyring: () => false }))
 vi.mock('~/composables/useKeyring', () => ({
@@ -22,7 +27,8 @@ vi.mock('~/composables/useKeyring', () => ({
 describe('operation verification chain', () => {
   afterEach(() => vi.unstubAllGlobals())
 
-  it('verifies a Monad Earn vault while disconnected Wagmi still defaults to Ethereum', async () => {
+  it.each([true, false])('guards missing geo only for acquisition=%s while using the app verification chain', async (acquiresExposure) => {
+    hostedGeo.value = { chainId: 143, policies: undefined, productByVault: {} }
     const vault = { address: '0x00000000000000000000000000000000000000a1', chainId: 143 }
     const verifyOwner = vi.fn(() => true)
     vi.stubGlobal('useWagmi', () => ({ address: ref(undefined) }))
@@ -58,7 +64,7 @@ describe('operation verification chain', () => {
     let state: ReturnType<typeof useOperationGuard> | undefined
     const app = renderer.createApp({
       setup() {
-        state = useOperationGuard([vault.address])
+        state = useOperationGuard([vault.address], { acquiresExposure })
         return () => h('span')
       },
     })
@@ -66,6 +72,10 @@ describe('operation verification chain', () => {
     app.mount({ type: 'root' })
     try {
       await nextTick()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(acquiresExposure)
+      hostedGeo.value = { chainId: 143, policies: [], productByVault: {} }
+      await nextTick()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(false)
       expect(config.state.chainId).toBe(1)
       expect(verifyOwner).toHaveBeenCalledWith(vault)
       expect(state?.unverifiedVaultGuard.isAcknowledgmentRequired).toBe(false)
@@ -76,6 +86,7 @@ describe('operation verification chain', () => {
     }
     finally {
       app.unmount()
+      expect(operationBlockerEntries.value.some(([key]) => key.startsWith('geo-policy:'))).toBe(false)
     }
   })
 })
diff --git a/tests/server/geo-policy-source.test.ts b/tests/server/geo-policy-source.test.ts
new file mode 100644
index 000000000..83c158bfd
--- /dev/null
+++ b/tests/server/geo-policy-source.test.ts
@@ -0,0 +1,45 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PublicGeoPolicy, PublicLabelsRequest } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { createGeoPolicySource } from '~/server/utils/geo-policy-source'
+
+vi.mock('~/server/utils/logger', () => ({ logger: { warn: vi.fn() } }))
+const policy: PublicGeoPolicy = { id: 'global', chainId: null, productId: null, vaultAddress: null, assetAddress: null, countries: ['US'], countriesResolved: ['US'], policyType: 'block', reason: null, createdAt: '' }
+const requestFor = (policies: PublicGeoPolicy[]) => vi.fn(async () => ({ data: policies, meta: { total: policies.length } })) as unknown as PublicLabelsRequest
+
+describe('durable geo source', () => {
+  let directory: string
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'geo-test-'))
+  })
+  afterEach(async () => {
+    vi.useRealTimers()
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  it('retains policies across restarts and unbounded outages; successful empty clears them', async () => {
+    const first = await createGeoPolicySource('v3', directory)(requestFor([policy]))
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(Date.now() + 365 * 86400_000)
+    const restarted = createGeoPolicySource('v3', directory)
+    const offline = vi.fn().mockRejectedValue(new Error('offline')) as PublicLabelsRequest
+    expect(await restarted(offline)).toEqual(first)
+    expect(await restarted(requestFor([]))).toEqual({ fetchedAt: Date.now(), policies: [] })
+  })
+
+  it('isolates upstream identities and rejects unavailable cold starts', async () => {
+    await createGeoPolicySource('v3-a', directory)(requestFor([policy]))
+    const offline = vi.fn().mockRejectedValue(new Error('offline')) as PublicLabelsRequest
+    await expect(createGeoPolicySource('v3-b', directory)(offline)).rejects.toThrow('offline')
+  })
+
+  it('never replaces the checkpoint with malformed or partially fetched policies', async () => {
+    const first = await createGeoPolicySource('v3', directory)(requestFor([policy]))
+    const invalid = requestFor([{ ...policy, countriesResolved: undefined } as unknown as PublicGeoPolicy])
+    expect(await createGeoPolicySource('v3', directory)(invalid)).toEqual(first)
+    const partial = vi.fn().mockResolvedValueOnce({ data: [policy], meta: { total: 2 } }).mockRejectedValueOnce(new Error('page two failed')) as PublicLabelsRequest
+    expect(await createGeoPolicySource('v3', directory)(partial)).toEqual(first)
+  })
+})
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index 1e29ac9ef..cff37e340 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -1,3 +1,6 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
@@ -44,7 +47,10 @@ const versionsResponse = () => new Response(JSON.stringify({
 })
 
 describe('public labels server source', () => {
-  beforeEach(() => {
+  let directory: string
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'geo-bundle-test-'))
+    vi.stubEnv('GEO_POLICY_CACHE_DIR', directory)
     vi.resetModules()
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
@@ -62,7 +68,8 @@ describe('public labels server source', () => {
     mocks.warn.mockReset()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await rm(directory, { recursive: true, force: true })
     vi.useRealTimers()
     vi.unstubAllEnvs()
   })
@@ -82,15 +89,15 @@ describe('public labels server source', () => {
     expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(7)
     expect(mocks.getEffectiveLabelsSource).toHaveBeenCalledTimes(1)
     expect(mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url).pathname)).toEqual([
+      '/v3/geo-policies',
       '/v3/labels/sets/public/versions',
       '/v3/labels/vaults',
       '/v3/labels/products',
       '/v3/labels/entities',
-      '/v3/geo-policies',
       '/v3/evk/vaults',
       '/v3/earn/vaults',
     ])
-    expect(mocks.fetchWithTimeout.mock.calls.slice(1, 4).every(([url]) =>
+    expect(mocks.fetchWithTimeout.mock.calls.slice(2, 5).every(([url]) =>
       new URL(url).searchParams.get('version') === 'v20260804151305236',
     )).toBe(true)
   })
@@ -121,6 +128,13 @@ describe('public labels server source', () => {
     )
   })
 
+  it('does not publish a snapshot when geo is unavailable on a cold start', async () => {
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('geo unavailable'))
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('geo unavailable')
+    expect(mocks.getEffectiveLabelsSource).not.toHaveBeenCalled()
+  })
+
   it('fails closed when effective policy is unavailable without stale data', async () => {
     mocks.getEffectiveLabelsSource.mockRejectedValue(new Error('policy unavailable'))
     const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
diff --git a/utils/geo-policies.ts b/utils/geo-policies.ts
new file mode 100644
index 000000000..5a64280f1
--- /dev/null
+++ b/utils/geo-policies.ts
@@ -0,0 +1,55 @@
+import type { PublicGeoPolicy } from '@eulerxyz/euler-v2-sdk/public-labels'
+
+export interface HostedGeoContext {
+  chainId: number | null
+  /** Undefined means unavailable; [] is an authored empty collection. */
+  policies: PublicGeoPolicy[] | undefined
+  productByVault: Record<string, string | null>
+}
+
+type Asset = { address?: string, symbol?: string, name?: string }
+const patterns = new Map<string, RegExp>()
+const patternMatches = (pattern: string | null | undefined, input: string | undefined): boolean => {
+  if (!pattern || !input) return false
+  // Preserve the conservative legacy guard without evaluating unbounded token metadata.
+  if (input.length > 128) return true
+  let compiled = patterns.get(pattern)
+  if (!compiled) {
+    compiled = new RegExp(pattern, 'i')
+    if (patterns.size >= 1000) patterns.clear()
+    patterns.set(pattern, compiled)
+  }
+  return compiled.test(input)
+}
+
+export const isAssetGeoPolicy = (policy: PublicGeoPolicy): boolean =>
+  policy.assetAddress !== null || policy.assetSymbols != null || policy.assetNames != null
+  || policy.assetSymbolRegex != null || policy.assetNameRegex != null
+
+/** All matching rules accumulate. Selectors within the asset matcher are alternatives. */
+export const matchesHostedGeo = (
+  context: HostedGeoContext,
+  country: string,
+  type: PublicGeoPolicy['policyType'],
+  asset: Asset | undefined,
+  vaultAddress?: string,
+  scope: 'all' | 'asset' | 'non-asset' = 'all',
+): boolean => (context.policies ?? []).some((policy) => {
+  if (policy.policyType !== type || !policy.countriesResolved.includes(country.toUpperCase())) return false
+  if (policy.chainId !== null && policy.chainId !== context.chainId) return false
+  const vault = vaultAddress?.toLowerCase()
+  if (policy.vaultAddress && policy.vaultAddress.toLowerCase() !== vault) return false
+  if (policy.productId && (!vault || context.productByVault[vault] !== policy.productId)) return false
+  const assetRule = isAssetGeoPolicy(policy)
+  if (scope === 'asset' && !assetRule) return false
+  if (scope === 'non-asset' && assetRule) return false
+  if (!assetRule) return true
+  if (!asset) return false
+  return Boolean(
+    (policy.assetAddress && policy.assetAddress.toLowerCase() === asset.address?.toLowerCase())
+    || policy.assetSymbols?.some(value => value.toLowerCase() === asset.symbol?.toLowerCase())
+    || policy.assetNames?.some(value => value.toLowerCase() === asset.name?.toLowerCase())
+    || patternMatches(policy.assetSymbolRegex, asset.symbol)
+    || patternMatches(policy.assetNameRegex, asset.name),
+  )
+})
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index c6c52954a..c6187802b 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -2,9 +2,10 @@ import {
   hasPublishedVaultLabelContent,
   normalizePublicLabelsData as normalizeSdkPublicLabelsData,
   type EulerLabelAssetPatternRule,
-  type PublicEulerLabelsData,
+  type PublicEulerLabelsData as SdkPublicEulerLabelsData,
   type PublicLabelsSource,
 } from '@eulerxyz/euler-v2-sdk/public-labels'
+import type { HostedGeoContext } from '~/utils/geo-policies'
 import { getAddress } from 'viem'
 import type { EulerLabelAssetEntry, EulerLabelProduct } from '~/entities/euler/labels'
 
@@ -15,7 +16,6 @@ export {
 export type {
   PublicEntityAddress,
   PublicEntityLabel,
-  PublicEulerLabelsData,
   PublicGeoPolicy,
   PublicLabelsMeta,
   PublicLabelsQuery,
@@ -27,6 +27,8 @@ export type {
   PublicVaultLabel,
 } from '@eulerxyz/euler-v2-sdk/public-labels'
 
+export type PublicEulerLabelsData = SdkPublicEulerLabelsData & { geoContext?: HostedGeoContext }
+
 export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
 
 export interface EffectiveProductPolicy {
@@ -64,6 +66,7 @@ export interface PublicLabelsBundle {
   /** Metadata publication; geo, entity addresses, platform tags and visibility remain live. */
   version: string
   publicLabels: PublicLabelsSource
+  geoFetchedAt?: number
   effectivePolicy: EffectiveLabelsSource
 }
 
@@ -192,8 +195,8 @@ export const normalizePublicLabelsData = (
   const effectiveEarn = normalizeEffectiveEarnPolicy(effectivePolicy)
   const effectiveAssets = normalizeEffectiveAssets(effectivePolicy.assets)
 
-  // The draft retains the compatibility geo evaluator. V3 rules are transported
-  // separately until the hosted geo enforcement path is wired and validated.
+  // Compatibility fields support static consumers. Hosted enforcement exclusively
+  // uses geoContext, including assignments outside the discovery allowlist.
   for (const [productKey, product] of Object.entries(products)) {
     const effectiveProduct = effectivePolicy.products[productKey]
     if (!effectiveProduct) continue
@@ -243,6 +246,12 @@ export const normalizePublicLabelsData = (
 
   return {
     ...data,
+    geoContext: {
+      chainId,
+      policies: data.rawGeoPolicies,
+      productByVault: Object.fromEntries(source.vaults.filter(vault => vault.chainId === chainId)
+        .map(vault => [vault.address.toLowerCase(), vault.productId])),
+    },
     products,
     verifiedVaultAddresses: uniqueStrings(verifiedVaultAddresses),
     earnVaults: uniqueStrings(earnVaults),

From 1068f441a9632c274f49a9e6fdf39629e19d7668 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 12:41:09 +0100
Subject: [PATCH 09/13] feat: isolate hosted and static label sources

Remove hosted GitHub compatibility reads, retain atomic static authoring for forks, and close owner-verification, image-host and outage-exit gaps.
---
 .env.example                                  |  12 +-
 README.md                                     |   6 +-
 composables/guards/useUnverifiedVaultGuard.ts |   8 +-
 composables/useEulerLabels.ts                 |   6 +-
 composables/useOperationGuard.ts              |   1 +
 composables/useVaults.ts                      |   4 +
 docs/geo-blocking.md                          |   4 +-
 docs/server-side-caching.md                   |  12 +-
 docs/static-labels.md                         |  37 +++
 docs/vault-labels-and-verification.md         |   9 +-
 entities/euler/labels.ts                      |  10 +-
 .../reviewed-execution/policy/app-policy.ts   |  11 +-
 server/plugins/warm-cache.ts                  |  18 +-
 server/utils/labels-base-url.ts               |  28 +-
 server/utils/labels-source.ts                 | 262 ------------------
 server/utils/labels-view.ts                   |   6 +-
 server/utils/public-labels-source.ts          |  25 +-
 server/utils/static-labels-source.ts          |  89 ++++++
 server/utils/static-labels-validation.ts      |  87 ++++++
 server/utils/vault-metadata.ts                |  13 +-
 tests/composables/useEulerLabels.test.ts      |   2 +-
 .../useUnverifiedVaultGuard.test.ts           |  20 +-
 tests/fixtures/static-labels.json             |  60 ++++
 .../app-policy-vault-context.test.ts          |  10 +
 tests/server/labels-base-url.test.ts          |  44 ++-
 tests/server/labels-fetch-failure.test.ts     |  25 --
 tests/server/labels-validate-node.test.ts     |  47 +---
 tests/server/public-labels-source.test.ts     |  24 +-
 tests/server/static-labels-source.test.ts     |  66 +++++
 tests/utils/label-logo.test.ts                |  17 ++
 tests/utils/public-labels.test.ts             | 188 ++-----------
 .../utils/vault/governor-verification.test.ts |  15 +
 utils/label-logo.ts                           |  14 +
 utils/public-labels.ts                        | 247 +++--------------
 utils/vault/governor-verification.ts          |   8 +
 35 files changed, 587 insertions(+), 848 deletions(-)
 create mode 100644 docs/static-labels.md
 delete mode 100644 server/utils/labels-source.ts
 create mode 100644 server/utils/static-labels-source.ts
 create mode 100644 server/utils/static-labels-validation.ts
 create mode 100644 tests/fixtures/static-labels.json
 delete mode 100644 tests/server/labels-fetch-failure.test.ts
 create mode 100644 tests/server/static-labels-source.test.ts
 create mode 100644 tests/utils/label-logo.test.ts
 create mode 100644 utils/label-logo.ts

diff --git a/.env.example b/.env.example
index 58daccafb..37a12308f 100644
--- a/.env.example
+++ b/.env.example
@@ -163,14 +163,10 @@ NUXT_PUBLIC_CONFIG_LOGO_URL=
 # Recommended: 1200x630 or larger (2400x1260), PNG or JPG. Must be publicly
 # reachable — X, Slack, Discord fetch it directly. Empty = no preview image.
 NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL=
-# Temporary server-only effective-policy source for block/restricted/discovery rules.
-# Public display labels, products, entities, logos, tags, campaigns, and deprecation
-# come from V3. When set, EFFECTIVE_POLICY_REPO and its branch are ignored.
-# Must serve {baseUrl}/{chainId}/{products,earn-vaults,assets}.json and
-# {baseUrl}/all/assets.json until V3 publishes the resolved effective decision.
-EFFECTIVE_POLICY_REPO="euler-xyz/euler-labels"
-EFFECTIVE_POLICY_REPO_BRANCH="master"
-EFFECTIVE_POLICY_BASE_URL=
+# Hosted mode reads V3 only. Forks can select their own static label files.
+LABELS_SOURCE=v3
+# Required only for LABELS_SOURCE=static: operator-owned five-file labels directory.
+STATIC_LABELS_BASE_URL=
 # Full URL for EulerChains.json (contract addresses). Takes precedence over
 # EULER_SDK_EULER_INTERFACES_BRANCH and its public aliases — it is the
 # emergency repoint lever when the default GitHub source is unavailable.
diff --git a/README.md b/README.md
index e381d38a0..fc05a8dc8 100644
--- a/README.md
+++ b/README.md
@@ -83,8 +83,8 @@ Euler Lite uses the [Euler V2 SDK](https://github.com/euler-xyz/euler-sdks) for
 | `TENDERLY_ACCESS_KEY`, `TENDERLY_ACCOUNT_SLUG`, `TENDERLY_PROJECT_SLUG` | Optional Tenderly simulation configuration. |
 | `FUUL_API_URL` or `NUXT_PUBLIC_FUUL_API_URL` | Optional Fuul API upstream override. |
 | `INCENTRA_API_URL` or `NUXT_PUBLIC_INCENTRA_API_URL` | Optional Incentra/Brevis API upstream override. |
-| `EFFECTIVE_POLICY_REPO`, `EFFECTIVE_POLICY_REPO_BRANCH` | Temporary server-only effective visibility/geo policy repository and branch. |
-| `EFFECTIVE_POLICY_BASE_URL` | Optional effective-policy CDN base URL; overrides the repository settings. |
+| `LABELS_SOURCE` | `v3` (default) or `static`; selects the shared label snapshot producer. |
+| `STATIC_LABELS_BASE_URL` | Required directory URL for static authoring files; unused by hosted V3 mode. |
 | `TURTLE_EARN_API_URL` or `NUXT_PUBLIC_TURTLE_EARN_API_URL` | Optional Turtle reward-proof upstream override; defaults to `https://earn.turtle.xyz/v1`. |
 
 #### Branding & Feature Flags
@@ -222,7 +222,7 @@ The resolution order in `getAssetLogoUrl(address, symbol)`:
 
 Vault inventory, products, entities, hosted logos, tags, campaigns, and deprecation metadata come from the versioned Public Labels API at `V3_API_URL`. Lite resolves `version=latest` to one immutable publication before fetching a chain bundle and follows every paginated list through `meta.total`.
 
-The labels-repository settings above are a temporary server-only compatibility source for effective `block`, `restricted`, and discovery-visibility rules. They do not provide display content or browser/SDK label routes. Raw V3 assessment and geo-policy records remain informational until V3 publishes the resolved effective decision and precedence contract.
+Hosted labels, visibility and geo policies come exclusively from V3. Fork deployments can set `LABELS_SOURCE=static` and provide their own authoring files through `STATIC_LABELS_BASE_URL`. See [Static labels](docs/static-labels.md) for the format, failure semantics and on-chain data options.
 
 ### 4. Development
 
diff --git a/composables/guards/useUnverifiedVaultGuard.ts b/composables/guards/useUnverifiedVaultGuard.ts
index 7863af001..d7ecc54b7 100644
--- a/composables/guards/useUnverifiedVaultGuard.ts
+++ b/composables/guards/useUnverifiedVaultGuard.ts
@@ -16,6 +16,7 @@ interface UnverifiedVaultGuardContext {
   account: Ref<string | undefined>
   chainId: Ref<number | undefined>
   operation: ComputedRef<string>
+  allowUnavailableLabels?: boolean
 }
 
 let unverifiedVaultGuardSequence = 0
@@ -59,12 +60,12 @@ export const useUnverifiedVaultGuard = (
       return !!entry && !!context.chainId.value && entry.vault.chainId === context.chainId.value
     })
   })
-  const isVerificationReady = computed(() => labelsReady.value && hasVaultMetadata.value)
+  const isVerificationReady = computed(() => (labelsReady.value || context.allowUnavailableLabels === true) && hasVaultMetadata.value)
   const isVerificationLoading = computed(() =>
-    (!labelsReady.value && !labelsError.value) || (!hasVaultMetadata.value && isResolvingVaults.value),
+    (!context.allowUnavailableLabels && !labelsReady.value && !labelsError.value) || (!hasVaultMetadata.value && isResolvingVaults.value),
   )
   const verificationError = computed(() => {
-    if (!labelsReady.value && labelsError.value) return labelsError.value
+    if (!context.allowUnavailableLabels && !labelsReady.value && labelsError.value) return labelsError.value
     if (!hasVaultMetadata.value && !isResolvingVaults.value) return 'Unable to load vault verification. Please retry.'
     return undefined
   })
@@ -74,6 +75,7 @@ export const useUnverifiedVaultGuard = (
   }
 
   const hasCanonicalVerification = (address: string): boolean => {
+    if (!labelsReady.value) return false
     const entry = get(address)
     if (!entry || !context.chainId.value || entry.vault.chainId !== context.chainId.value) return false
 
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index bb5299766..0592f72ce 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -20,7 +20,7 @@ import { erc4626AssetAbi } from '~/abis/erc4626'
 import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
 import {
-  normalizePublicLabelsData,
+  normalizeLabelsBundle,
   type PublicEulerLabelsData,
   type PublicLabelsBundle,
 } from '~/utils/public-labels'
@@ -68,6 +68,8 @@ const setLabelsData = (data: PublicEulerLabelsData, chainId: number | null) => {
 
 export const getCurrentEulerLabelsData = (): EulerLabelsData => labelsData.value
 
+export const getEulerLabelsSourceData = () => labelsData.value
+
 export const getEulerGeoContext = () => labelsData.value.geoContext
 
 export const getEulerLabelsVersion = (): number => labelsVersion.value
@@ -129,7 +131,7 @@ const getLabelsFetch = (chainId: number, forceRefresh: boolean) => {
         timeout: 35_000,
         ...(forceRefresh && { headers: { 'cache-control': 'no-cache' } }),
       })
-      return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
+      return normalizeLabelsBundle(chainId, bundle)
     }
     catch (error) {
       logWarn('labels/public-v3', error)
diff --git a/composables/useOperationGuard.ts b/composables/useOperationGuard.ts
index dc386f444..c179d4492 100644
--- a/composables/useOperationGuard.ts
+++ b/composables/useOperationGuard.ts
@@ -41,6 +41,7 @@ export const useOperationGuard = (
     account: userAddress,
     chainId: appChainId,
     operation,
+    allowUnavailableLabels: options.acquiresExposure === false,
   })
 
   // --- Keyring guard ---
diff --git a/composables/useVaults.ts b/composables/useVaults.ts
index bff62b6fd..a9a9d1207 100644
--- a/composables/useVaults.ts
+++ b/composables/useVaults.ts
@@ -1,3 +1,5 @@
+import { getHostedEntityKeys } from '~/utils/vault/governor-verification'
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
 import type {
   EulerEarn as EulerEarnClass,
   DataIssue,
@@ -1248,6 +1250,8 @@ export const useVaults = () => {
     const { entities } = useEulerLabels()
     return {
       getDeclaredEntityKeys: (vaultAddress) => {
+        const hostedKeys = getHostedEntityKeys(getEulerLabelsSourceData(), vaultAddress)
+        if (hostedKeys !== undefined) return hostedKeys
         const productKey = getProductKeyByVault(vaultAddress)
         if (!productKey) return undefined
         const product = getProductByVault(vaultAddress)
diff --git a/docs/geo-blocking.md b/docs/geo-blocking.md
index 16ae28c1a..9da6d04b3 100644
--- a/docs/geo-blocking.md
+++ b/docs/geo-blocking.md
@@ -101,7 +101,7 @@ Rules accumulate across global, chain, product, vault and asset scopes. A vault
 
 Regex expressions are compile-checked and limited to 512 characters by the SDK. Lite treats token metadata longer than 128 characters as a match without running its regex. Missing vault asset metadata remains fail-closed. Same-asset and known wrap-pair exemptions apply only to soft asset restrictions, never global/product/vault restrictions, hard blocks, or unavailable policy data.
 
-Sanctions remain in `SANCTIONED_COUNTRIES`, enforced independently at the server edge and in client helpers. The compatibility evaluator and `COUNTRY_GROUPS` remain available for static label data; hosted snapshots always use V3 rules. No deployed static-source switch is configured here.
+Sanctions remain in `SANCTIONED_COUNTRIES`, enforced independently at the server edge and in client helpers. The compatibility evaluator and `COUNTRY_GROUPS` remain available for static label data; hosted snapshots always use V3 rules. `LABELS_SOURCE=static` selects the authored-file engine.
 
 ## Availability and durable fallback
 
@@ -109,7 +109,7 @@ Sanctions remain in `SANCTIONED_COUNTRIES`, enforced independently at the server
 
 Set `GEO_POLICY_CACHE_DIR` to a mounted persistent directory to survive container replacement. The default `.data/geo-policies` survives process restarts on the same filesystem. Failed checkpoint writes are logged; current validated live rules remain in use, but that write is not durable. Log monitoring must alert on stale-policy age and checkpoint failures; this code does not provision production alerting.
 
-A cold start with no valid policy snapshot fails the entire labels response. The client distinguishes unavailable policies from an authored empty collection. `useOperationGuard` registers “Compliance data unavailable. Please retry.” for acquisition forms, including direct wallet deposits. Repay and withdrawal forms opt out of this availability blocker. Existing verification, country, sanctions and operation-specific checks still apply. Soft restriction helpers also deny acquisition while policies are unavailable, including wrap exemptions.
+A cold start with no valid policy snapshot fails the entire labels response. The client distinguishes unavailable policies from an authored empty collection. `useOperationGuard` registers “Compliance data unavailable. Please retry.” for acquisition forms, including direct wallet deposits. Repay and withdrawal forms opt out of this availability blocker. Simple withdrawals/redemptions and repayment without swaps can acknowledge unverified-vault risk when labels are unavailable, in both the form and final reviewed-execution policy. Missing/wrong-chain vault metadata still blocks; swaps, borrowing and mixed acquisition batches still require labels. Country, sanctions and operation-specific checks still apply. Soft restriction helpers also deny acquisition while policies are unavailable, including wrap exemptions.
 
 ## Helper functions
 
diff --git a/docs/server-side-caching.md b/docs/server-side-caching.md
index c2c9e8954..4ce212faa 100644
--- a/docs/server-side-caching.md
+++ b/docs/server-side-caching.md
@@ -1,6 +1,6 @@
 # Server-Side Caching
 
-Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, Public Labels V3, the temporary effective-policy source, and the chain RPC. The layer accomplishes four things:
+Lite ships a layered cache between the browser and every external data source — third-party reward APIs, the Goldsky subgraph, Public Labels V3, the optional static authoring source, and the chain RPC. The layer accomplishes four things:
 
 1. **Cross-tab sharing.** Every browser session against the same origin hits the same in-process cache.
 2. **Authentication / credentials stay server-side.** Browsers don't need V3 API keys, subgraph project IDs, or any provider tokens.
@@ -20,7 +20,7 @@ This document covers the per-host proxies, the vault snapshot pipeline, the warm
 | `server/api/internal/proxy/subgraph/[chainId].post.ts` | Proxies the per-chain Goldsky subgraph |
 | `server/api/internal/public-labels.get.ts` | Chain/version-scoped aggregate Public Labels endpoint |
 | `server/utils/public-labels-source.ts` | Public Labels V3 pagination, 5-minute cache, in-flight dedup, and bounded stale fallback |
-| `server/utils/labels-source.ts` | Compatibility discovery source; hosted geo comes from V3 |
+| `server/utils/static-labels-source.ts` | Atomic static authoring snapshots, used only in static mode |
 | `server/api/internal/v3/[...path].ts` | Rate-limited V3 backend proxy for SDK browser endpoints (`/api/internal/v3/...` → `v3.euler.finance/v3/...`) |
 | `server/api/internal/vaults.get.ts` | Per-chain consolidated vault snapshot endpoint |
 | `server/utils/vaults-cache.ts` | `refreshChainVaults` + `vaultsCache` |
@@ -70,9 +70,9 @@ Each proxy carries a rate limiter (`createRateLimiter`) and returns 405 for disa
 
 ### Public Labels
 
-`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines that immutable display dataset with the temporary effective-policy overlay. The result is cached for 5 minutes by chain and version; concurrent misses share one in-flight operation. Bundle stale fallback is bounded. Geo separately retains a validated, fetchedAt-stamped disk checkpoint with unbounded stale-on-error fallback; cold starts without geo cannot publish a bundle. Mount `GEO_POLICY_CACHE_DIR` for cross-container persistence.
+`/api/internal/public-labels?chainId=N&version=latest` is the browser's single label read. `server/utils/public-labels-source.ts` paginates vaults, products, entities, entity governance addresses, and geo policies directly from V3, then combines published metadata with the live visibility and geo overlays. The result is cached for 5 minutes by chain and version; concurrent misses share one in-flight operation. Bundle stale fallback is bounded. Geo separately retains a validated, fetchedAt-stamped disk checkpoint with unbounded stale-on-error fallback; cold starts without geo cannot publish a bundle. Mount `GEO_POLICY_CACHE_DIR` for cross-container persistence.
 
-The legacy `/api/internal/labels/*` browser and SDK routes do not exist. `server/utils/labels-source.ts` still reads only `products.json`, `earn-vaults.json`, and chain/global `assets.json` as a server-internal compatibility contract. Hosted enforcement ignores its `block` and `restricted` fields; only its discovery membership/restrictions remain active. It does not contribute names, descriptions, entities, logos, products, tags, campaigns, or deprecation content. `EFFECTIVE_POLICY_BASE_URL` configures only that policy source for discovery compatibility. The former `NUXT_PUBLIC_CONFIG_LABELS_*` names remain server-side fallbacks for existing deployments but are no longer part of Nuxt public runtime config.
+`LABELS_SOURCE=v3` performs no label-file reads. `LABELS_SOURCE=static` reads the operator-owned authoring files on the same warm/refresh cycle and uses one atomic disk checkpoint for the entire collection. See [Static labels](./static-labels.md).
 
 ### V3 proxy
 
@@ -312,9 +312,9 @@ The pipeline always succeeds eventually — the snapshot is the *fast path*, not
 Global cycle (5 min)                   Vaults cycle (1 min if V3, else 5 min)
 ─────────────────────                  ──────────────────────────────────────
 - Euler Chains and runtime ABIs                         - refreshChainVaults(chain) for each
-- cross-chain effective asset policy     enabled non-deprecated chain
+- static source includes cross-chain assets     enabled non-deprecated chain
 - per-chain Public Labels bundle
-- per-chain effective policy
+- per-chain labels snapshot
 - per-chain token list
 ```
 
diff --git a/docs/static-labels.md b/docs/static-labels.md
new file mode 100644
index 000000000..a4500f4a6
--- /dev/null
+++ b/docs/static-labels.md
@@ -0,0 +1,37 @@
+# Static label authoring
+
+`LABELS_SOURCE=v3` is the default hosted mode. It reads published metadata, live visibility, governance addresses and geo policies from V3, without consulting any labels repository.
+
+Forks select `LABELS_SOURCE=static` and set `STATIC_LABELS_BASE_URL` to their own HTTP(S) directory. The server and browser consume the same normalized snapshot as hosted mode. Authored membership determines discovery; hosted curation/visibility is never consulted. The SDK provides the shared file derivation function, while Lite owns atomic fetching, validation, caching and logo policy.
+
+## Directory contract
+
+For each enabled chain, serve these JSON documents:
+
+| Path | Shape and fields |
+|---|---|
+| `{chainId}/products.json` | Object keyed by product slug. Each product includes `name`, `entity` (entity key or keys), `vaults`; optional `deprecatedVaults`, `deprecationReason`, `description`, `portfolioNotice`, `tags`, `notExplorable`, `block`, `restricted`, and address-keyed `vaultOverrides`. Overrides support text, tags, country rules and `notExplorableLend/Borrow`. |
+| `{chainId}/entities.json` | Object keyed by entity key. Profiles include `name`, `logo` filename, `description`, `url`, `addresses` (address-to-label map), and `social` URLs. These addresses drive governor/owner checks. |
+| `{chainId}/points.json` | Array of `{name, logo, collateralVaults}` campaigns. |
+| `{chainId}/earn-vaults.json` | Array of vault addresses or `{address, deprecated, deprecationReason, description, portfolioNotice, notExplorable, block, restricted, tags}` objects. |
+| `{chainId}/assets.json` | Array of address or symbol/name matchers: `address`, `symbols`, `names`, `symbolRegex`, `nameRegex`, plus `block` / `restricted`. |
+| `all/assets.json` | Global asset rules, combined with each chain's rules. |
+| `logo/{filename}` | Entity/product/points images on the same origin. |
+
+Use explicit `{}` or `[]` documents for empty collections, including both asset files. Missing files and HTTP errors are failures, not empty policy. A source missing optional files from older layouts must add those explicit empty documents. File syntax retains the five-file authoring format; no generated normalized snapshot needs editing. [`tests/fixtures/static-labels.json`](../tests/fixtures/static-labels.json) is an executable example of the file contents.
+
+Only HTTP(S) profile links and simple image filenames are accepted. Remote hosted label images must use `https://token-images.euler.finance`; static images may additionally use the configured source origin. Paths/credentials and lookalike hosts cannot bypass the image allowlist. The browser repeats the image check before rendering.
+
+## Failure behavior
+
+All six JSON documents load together. A failed, malformed or partial refresh retains the complete last-known-good snapshot, including its rules. No snapshot is published on a cold start without a valid complete set. Checkpoints are source-and-chain-specific, content-hashed and timestamped. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for container replacements; the default `.data/geo-policies` only persists on the same filesystem. Stale fallback and failed checkpoint writes are logged for alerting.
+
+Authored geo retains static country-group expansion and override semantics. This differs deliberately from hosted V3's cumulative rules. The contract test covers discovery, entities/authority addresses, points, logos, per-side flags, asset patterns, Earn restrictions and restart recovery.
+
+## On-chain data
+
+Static labels do not require running a V3 backend. A fork may use Euler's hosted quantitative endpoints for supported factory vaults, subject to API availability and access policy. Alternatively, configure `ONCHAIN_SDK_CHAINS` and the existing V3 feature gate for direct on-chain SDK reads. That mode has reduced history/activity/rewards coverage; static labels do not create an indexer or add support for arbitrary chains.
+
+## Rollout boundary
+
+Before switching production, compare authored and V3 membership, explorability, display content, geo decisions and full verification across enabled chains. Resolve unexplained differences; preserve public API behavior and measure revocation latency. On-chain governor verification remains active in hosted mode during this bake. SDK release/dependency changes, persistent volumes, alerting, compliance canary and production cutover are deployment work.
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 43b19ec79..21b30be50 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -18,11 +18,11 @@ Not all vaults on-chain are equal. Public Labels maps chain-scoped vault address
 | Entity governance addresses | `GET /labels/entities/{entityId}/addresses` |
 | Geo policy records | `GET /geo-policies` |
 
-The adapter also reads `/evk/vaults` and `/earn/vaults` with explicit `visibility=visible,warning,hidden,pending_review`. Trusted label membership requires a visible or warning verdict and a managing entity. Plain-address compatibility entries require a visible or warning verdict as well. Hidden and pending metadata remain available without granting trusted membership. Per-side V3 explorability flags constrain listing; compatibility policy may hide additional vaults but cannot override a negative V3 verdict. On-chain governor checks still determine the stronger verification badge.
+The adapter also reads `/evk/vaults` and `/earn/vaults` with explicit `visibility=visible,warning,hidden,pending_review`. Trusted label membership requires a visible or warning verdict and a managing entity. Hidden and pending metadata remain available without granting trusted membership. Per-side V3 explorability flags control hosted listing. On-chain governor checks still determine the stronger verification badge.
 
 Entity profiles supply hosted logo URLs. A product's `entityId` is its managing entity; `coBrandEntityIds` supplies additional display branding only. Co-brands do not participate in manager ownership, governor verification, or manager-profile market assignment. Neutral escrow inventory rows are not assigned to a product/entity and are not added to the labels-derived verified set.
 
-Lite evaluates live V3 geo policies using `countriesResolved` and cumulative global/chain/product/vault/asset rules. The server embeds a validated geo collection with each snapshot and retains a disk checkpoint for stale-on-error recovery. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for redeploy durability. Compatibility data still supplies discovery membership/restrictions; it does not control hosted geo enforcement. The static source switch and production bake/canary remain separate rollout work. See [Geo-Blocking](./geo-blocking.md).
+Lite evaluates live V3 geo policies using `countriesResolved` and cumulative global/chain/product/vault/asset rules. The server embeds a validated geo collection with each snapshot and retains a disk checkpoint for stale-on-error recovery. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for redeploy durability. Hosted snapshots have no GitHub-label dependency. `LABELS_SOURCE=static` supplies the same snapshot from operator-owned files; see [Static labels](./static-labels.md). Production bake/canary remain rollout work. See [Geo-Blocking](./geo-blocking.md).
 
 Oracle adapter identity and health assessments come from Data V3 through the SDK and Lite's same-origin V3 proxy. Detail views load an assessment per adapter; discovery loads the paginated chain catalogue. The UI uses V3's explicit `recognized` identity verdict and server-computed `checksStatus`, preserving `unknown` and `not_applicable` finding outcomes.
 
@@ -250,7 +250,7 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 | `utils/public-labels.ts` | Public V3 pagination, normalization, and effective-visibility composition |
 | `utils/eulerLabelsUtils.ts` | Lookup and helper functions backed by the normalized label snapshot |
 | `server/utils/public-labels-source.ts` | Shared V3 aggregate cache used by browser, public APIs, and vault snapshots |
-| `server/utils/labels-source.ts` | Server-only temporary effective-policy overlay |
+| `server/utils/static-labels-source.ts` | Atomic authoring-file source and durable checkpoint for forks |
 | `composables/useEulerLabels.ts` | Chain-scoped aggregate loading and normalized label publication |
 | `composables/useVaultRegistry.ts` | Vault registry with type detection and unknown resolution |
 | `composables/useGeoBlock.ts` | V3 country evaluation and independent sanctions gate |
@@ -260,3 +260,6 @@ These labels appear in address fields across all vault overview types (EVK, Earn
 External consumers that only need a yes/no answer for a vault address can call the public [`GET /api/public/is-known`](./public-api.md#get-apipublicis-known) endpoint instead of loading the full label set. This server endpoint uses the same normalized Public Labels bundle as the UI plus the on-chain `escrowedCollateralPerspective`, applies governor / router-governor / owner verification, and answers batches of up to 100 addresses per request. The same governor check applies to deprecated and active vaults. Escrow vaults from the on-chain perspective and standalone Earn entries are trusted unconditionally.
 
 Consumers that need display metadata (resolved name, description, governing entity, asset) on top of the verification verdict can call [`GET /api/public/metadata`](./public-api.md#get-apipublicmetadata), which applies the same labels / override / verification rules the client UI uses and returns a uniform shape across EVK, Securitize, and Earn vaults.
+
+
+Hosted full verification resolves the managing entity from the V3 vault row, including standalone Earn vaults. Missing manager data yields an empty authority set, so a visible/warning inventory entry alone cannot grant an owner-verification badge. Both client and public APIs apply this rule. Static Earn labels preserve their authored membership semantics. Hosted on-chain governor/owner checks remain in place until the verification bake justifies delegation to V3.
diff --git a/entities/euler/labels.ts b/entities/euler/labels.ts
index 378fb2e69..6229e6ed9 100644
--- a/entities/euler/labels.ts
+++ b/entities/euler/labels.ts
@@ -1,3 +1,5 @@
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
+import { resolveLabelLogo } from '~/utils/label-logo'
 import type {
   EulerLabelAssetEntry as SdkEulerLabelAssetEntry,
   EulerLabelEarnVaultEntry as SdkEulerLabelEarnVaultEntry,
@@ -47,9 +49,9 @@ export const eulerLabelProductEmpty = {
 } as EulerLabelProduct
 
 export const getEulerLabelEntityLogo = (fileName: string) =>
-  /^https?:\/\//i.test(fileName) ? fileName : ''
+  resolveLabelLogo(fileName, getEulerLabelsSourceData().logoBaseUrl)
 
-export const getEulerLabelPointLogo = (fileName: string) =>
-  /^https?:\/\//i.test(fileName) ? fileName : ''
+export const getEulerLabelPointLogo = getEulerLabelEntityLogo
 
-export const getEntityLogoLocalPath = (fileName: string) => `/entities/${fileName}`
+export const getEntityLogoLocalPath = (fileName: string) =>
+  /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i.test(fileName) ? `/entities/${fileName}` : ''
diff --git a/features/reviewed-execution/policy/app-policy.ts b/features/reviewed-execution/policy/app-policy.ts
index 61609b68f..3d8b1d98e 100644
--- a/features/reviewed-execution/policy/app-policy.ts
+++ b/features/reviewed-execution/policy/app-policy.ts
@@ -32,6 +32,8 @@ export const resolveAppPolicy = async (
   now = Date.now(),
   intents?: readonly OperationIntent[],
 ): Promise<Readonly<ReviewedPolicy>> => {
+  const exitsWithoutAcquisition = new Set(['withdraw', 'redeem', 'repay-from-wallet', 'repay-from-deposit', 'cleanup', 'reward-claim', 'reul-unlock'])
+  const onlyExits = Boolean(intents?.length && intents.every(intent => exitsWithoutAcquisition.has(intent.planner.name)))
   const expiresAt = now + 5 * 60_000
   const { get, getOrFetch, getVault, isVerifiedVault } = useVaultRegistry()
   const { getTokenByAddress } = useTokenList()
@@ -71,7 +73,7 @@ export const resolveAppPolicy = async (
       exactVaults.push({ address, vault: entry.vault as EVault | EulerEarn | SecuritizeCollateralVault, type: entry.type })
     }
 
-    if (requirements.vaults.length && !useEulerLabels().isReady.value) {
+    if (requirements.vaults.length && !useEulerLabels().isReady.value && !onlyExits) {
       throw new Error('Vault verification is unavailable')
     }
 
@@ -100,6 +102,7 @@ export const resolveAppPolicy = async (
   }
 
   const canonicallyVerified = (entry: NonNullable<typeof exactVaults>[number]) => {
+    if (!useEulerLabels().isReady.value) return false
     const { isVaultGovernorVerified, isSecuritizeGovernorVerified, isEarnVaultOwnerVerified } = useVaults()
     if (entry.type === 'earn') return isEarnVaultOwnerVerified(entry.vault as EulerEarn)
     if (entry.type === 'securitize') return isSecuritizeGovernorVerified(entry.vault as SecuritizeCollateralVault)
@@ -147,13 +150,13 @@ export const resolveAppPolicy = async (
       const address = addressOfSubject(requirement.subject)
       if (!address) throw new Error('Vault/contract policy subject is malformed')
       const vault = getVault(address)
-      if ((vault || vaultLabelSubjects.has(address)) && !useEulerLabels().isReady.value) {
+      if ((vault || vaultLabelSubjects.has(address)) && !useEulerLabels().isReady.value && !onlyExits) {
         throw new Error('Vault verification is unavailable')
       }
       if (vault) {
         if (!vault.asset?.address || !vault.type) throw new Error(`Vault metadata is incomplete for ${address}`)
-        if (!labelsVersion) throw new Error('Euler labels policy metadata is unavailable')
-        version = `vault:${vault.type}:${vault.asset.address}:${labelsVersion}`
+        if (!labelsVersion && !onlyExits) throw new Error('Euler labels policy metadata is unavailable')
+        version = `vault:${vault.type}:${vault.asset.address}:${useEulerLabels().isReady.value ? labelsVersion : 'unavailable-exit'}`
       }
       else version = `effect-target:${address}`
     }
diff --git a/server/plugins/warm-cache.ts b/server/plugins/warm-cache.ts
index 5c2173d0d..bf7591599 100644
--- a/server/plugins/warm-cache.ts
+++ b/server/plugins/warm-cache.ts
@@ -36,7 +36,6 @@
  * Merkl's /tokens/reward payload is fetched transitively by /api/internal/token-list
  * (one of its sources).
  */
-import { EFFECTIVE_POLICY_LABEL_FILES, refreshLabelFile } from '../utils/labels-source'
 import { refreshEulerChains } from '../api/internal/euler-chains.get'
 import { ABI_CONTRACTS, refreshAbi } from '../api/internal/abis/[contract].get'
 import { refreshTokenList } from '../api/internal/token-list.get'
@@ -109,19 +108,6 @@ const warmAbis = (): Promise<unknown>[] =>
     reportWarm(`abis/${contract}`, refreshAbi(contract)),
   )
 
-// Cross-chain pattern rules for effective asset policy live at
-// `all/assets.json`. Warm them once; the shared policy source combines them
-// with each chain's rules while assembling the Public Labels bundle.
-const warmGlobalAssets = () =>
-  reportWarm('labels/assets.json scope=all', refreshLabelFile('all', 'assets.json'))
-
-// --- Per-chain warms (parallel across chains and within a chain) ---
-
-const warmEffectivePolicy = (chainId: number): Promise<unknown>[] =>
-  EFFECTIVE_POLICY_LABEL_FILES.map(file =>
-    reportWarm(`labels-policy/${file} chain=${chainId}`, refreshLabelFile(chainId, file)),
-  )
-
 const warmPublicLabels = (chainId: number) =>
   reportWarm(`public-labels chain=${chainId}`, refreshPublicLabelsBundle(chainId))
 
@@ -134,10 +120,9 @@ const warmTokenList = (chainId: number) =>
 const warmVaults = (chainId: number) =>
   reportWarm(`vaults chain=${chainId}`, refreshChainVaults(chainId))
 
-// Public Labels, effective policy, and token-list refresh at the global
+// Labels and token-list refresh at the global
 // 5-min interval. Vaults run on their own faster timer.
 const warmChainTasks = (chainId: number): Promise<unknown>[] => [
-  ...warmEffectivePolicy(chainId),
   warmPublicLabels(chainId),
   warmTokenList(chainId),
 ]
@@ -175,7 +160,6 @@ export default defineNitroPlugin(() => {
       await Promise.allSettled([
         warmEulerChains(),
         ...warmAbis(),
-        warmGlobalAssets(),
         warmChainsSequentially(),
       ])
     }
diff --git a/server/utils/labels-base-url.ts b/server/utils/labels-base-url.ts
index fe871264d..33a4e5e46 100644
--- a/server/utils/labels-base-url.ts
+++ b/server/utils/labels-base-url.ts
@@ -1,19 +1,15 @@
-export function resolveLabelsBaseUrl(): string {
-  const explicit = (
-    process.env.EFFECTIVE_POLICY_BASE_URL
-    || process.env.NUXT_PUBLIC_CONFIG_LABELS_BASE_URL
-    || ''
-  ).trim().replace(/\/+$/, '')
-  if (explicit) return explicit
-  const repo = process.env.EFFECTIVE_POLICY_REPO
-    || process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO
-    || 'euler-xyz/euler-labels'
-  const branch = process.env.EFFECTIVE_POLICY_REPO_BRANCH
-    || process.env.NUXT_PUBLIC_CONFIG_LABELS_REPO_BRANCH
-    || 'master'
-  return `https://raw.githubusercontent.com/${repo}/refs/heads/${branch}`
+export const readLabelsSource = (): 'v3' | 'static' => {
+  const source = process.env.LABELS_SOURCE?.trim() || 'v3'
+  if (source !== 'v3' && source !== 'static') throw new Error('LABELS_SOURCE must be v3 or static')
+  return source
 }
 
-export function resolveLabelsFileUrl(scope: number | 'all', file: string): string {
-  return `${resolveLabelsBaseUrl()}/${scope}/${file}`
+export function resolveLabelsBaseUrl(): string {
+  const value = process.env.STATIC_LABELS_BASE_URL?.trim().replace(/\/+$/, '')
+  if (!value) throw new Error('STATIC_LABELS_BASE_URL is required for static labels')
+  const url = new URL(value)
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error('STATIC_LABELS_BASE_URL must be an HTTP(S) directory URL without credentials, query or fragment')
+  }
+  return value
 }
diff --git a/server/utils/labels-source.ts b/server/utils/labels-source.ts
deleted file mode 100644
index a2b883042..000000000
--- a/server/utils/labels-source.ts
+++ /dev/null
@@ -1,262 +0,0 @@
-import { getAddress } from 'viem'
-import { createTtlCache } from './cache'
-import { fetchWithTimeout } from './fetchWithTimeout'
-import { createInFlightDedup } from './in-flight'
-import { resolveLabelsFileUrl } from './labels-base-url'
-import { reportStatus } from './log'
-import type { EffectiveLabelsSource } from '~/utils/public-labels'
-import type { EulerLabelAssetEntry } from '~/entities/euler/labels'
-
-const CACHE_TTL_MS = 300_000
-
-export const EFFECTIVE_POLICY_LABEL_FILES = ['products.json', 'earn-vaults.json', 'assets.json'] as const
-
-export type LabelFile = typeof EFFECTIVE_POLICY_LABEL_FILES[number]
-export type LabelScope = number | 'all'
-
-const EMPTY_SHAPES: Record<LabelFile, unknown> = {
-  'products.json': {},
-  'earn-vaults.json': [],
-  'assets.json': [],
-}
-
-const cache = createTtlCache<unknown>({ ttlMs: CACHE_TTL_MS })
-const inFlight = createInFlightDedup<string, unknown>()
-
-const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
-const URL_KEYS = new Set(['url'])
-const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
-const MAX_REGEX_LEN = 512
-const LOGO_FILENAME_KEYS = new Set(['logo'])
-const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
-const MAX_STRING_LEN = 16_384
-const MAX_ARRAY_LEN = 10_000
-const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
-
-const isSafeHttpUrl = (value: string): boolean => {
-  if (!value) return true
-  try {
-    const { protocol } = new URL(value)
-    return protocol === 'http:' || protocol === 'https:'
-  }
-  catch {
-    return false
-  }
-}
-
-export function validateNode(node: unknown, path: string): void {
-  if (Array.isArray(node)) {
-    if (node.length > MAX_ARRAY_LEN) {
-      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
-    }
-    node.forEach((item, index) => validateNode(item, `${path}[${index}]`))
-    return
-  }
-  if (node === null || typeof node !== 'object') return
-
-  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
-    if (typeof value === 'string') {
-      if (value.length > MAX_STRING_LEN) {
-        throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
-      }
-      if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
-        throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
-      }
-      if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
-        throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
-      }
-      if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
-        throw new Error(`Injection pattern detected in ${path}.${key}`)
-      }
-      if (REGEX_KEYS.has(key)) {
-        if (value.length > MAX_REGEX_LEN) {
-          throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
-        }
-        try {
-          new RegExp(value)
-        }
-        catch {
-          throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
-        }
-      }
-    }
-    else if (value !== null && typeof value === 'object') {
-      validateNode(value, `${path}.${key}`)
-    }
-  }
-}
-
-const fallbackForAbsent = (key: string, file: LabelFile): unknown => {
-  const stale = cache.getStale(key)
-  if (stale !== undefined) return stale
-  const empty = EMPTY_SHAPES[file]
-  cache.set(key, empty)
-  return empty
-}
-
-export function refreshLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const key = `${scope}:${file}`
-  return inFlight.run(key, async () => {
-    const statusKey = `${file}:${scope}`
-    try {
-      const response = await fetchWithTimeout(resolveLabelsFileUrl(scope, file))
-      if (!response.ok) {
-        if (response.status === 404 || response.status === 403) {
-          reportStatus('labels-policy', statusKey, `absent-${response.status}`)
-          return fallbackForAbsent(key, file)
-        }
-        throw new Error(`${file} effective-policy source returned ${response.status} for scope ${scope}`)
-      }
-
-      const data: unknown = await response.json()
-      validateNode(data, file)
-      cache.set(key, data)
-      reportStatus('labels-policy', statusKey, 'ok')
-      return data
-    }
-    catch (error) {
-      reportStatus(
-        'labels-policy',
-        statusKey,
-        'fetch-error',
-        `Failed to fetch effective policy ${file} for scope ${scope}: ${error instanceof Error ? error.message : error}`,
-      )
-      const stale = cache.getStale(key)
-      if (stale !== undefined) return stale
-      throw error
-    }
-  })
-}
-
-export async function getLabelFile(scope: LabelScope, file: LabelFile): Promise<unknown> {
-  const hit = cache.get(`${scope}:${file}`)
-  return hit !== undefined ? hit : refreshLabelFile(scope, file)
-}
-
-const stringArray = (value: unknown): string[] | undefined => {
-  if (!Array.isArray(value)) return undefined
-  const result = value.filter((entry): entry is string => typeof entry === 'string')
-  return result.length > 0 ? result : undefined
-}
-
-const normalizeAddress = (value: unknown): string | undefined => {
-  if (typeof value !== 'string') return undefined
-  try {
-    return getAddress(value)
-  }
-  catch {
-    return undefined
-  }
-}
-
-const addressArray = (value: unknown): string[] | undefined => {
-  if (!Array.isArray(value)) return undefined
-  const result = value.map(normalizeAddress).filter((entry): entry is string => Boolean(entry))
-  return result.length > 0 ? result : undefined
-}
-
-const projectProductPolicies = (value: unknown): EffectiveLabelsSource['products'] => {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return {}
-  const result: EffectiveLabelsSource['products'] = {}
-  for (const [productId, raw] of Object.entries(value as Record<string, unknown>)) {
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue
-    const product = raw as Record<string, unknown>
-    const vaultOverrides: NonNullable<EffectiveLabelsSource['products'][string]['vaultOverrides']> = {}
-    if (product.vaultOverrides && typeof product.vaultOverrides === 'object' && !Array.isArray(product.vaultOverrides)) {
-      for (const [address, rawOverride] of Object.entries(product.vaultOverrides as Record<string, unknown>)) {
-        const normalizedAddress = normalizeAddress(address)
-        if (!normalizedAddress) continue
-        if (!rawOverride || typeof rawOverride !== 'object' || Array.isArray(rawOverride)) continue
-        const override = rawOverride as Record<string, unknown>
-        vaultOverrides[normalizedAddress] = {
-          ...(stringArray(override.block) && { block: stringArray(override.block) }),
-          ...(stringArray(override.restricted) && { restricted: stringArray(override.restricted) }),
-          ...(typeof override.notExplorableLend === 'boolean' && { notExplorableLend: override.notExplorableLend }),
-          ...(typeof override.notExplorableBorrow === 'boolean' && { notExplorableBorrow: override.notExplorableBorrow }),
-        }
-      }
-    }
-    result[productId] = {
-      ...(stringArray(product.block) && { block: stringArray(product.block) }),
-      ...(stringArray(product.restricted) && { restricted: stringArray(product.restricted) }),
-      ...(typeof product.notExplorable === 'boolean' && { notExplorable: product.notExplorable }),
-      ...(addressArray(product.vaults) && { vaults: addressArray(product.vaults) }),
-      ...(addressArray(product.deprecatedVaults) && { deprecatedVaults: addressArray(product.deprecatedVaults) }),
-      ...(Object.keys(vaultOverrides).length > 0 && { vaultOverrides }),
-    }
-  }
-  return result
-}
-
-const projectEarnPolicies = (value: unknown): EffectiveLabelsSource['earnVaults'] => {
-  if (!Array.isArray(value)) return []
-  const result: EffectiveLabelsSource['earnVaults'] = []
-  for (const raw of value) {
-    if (typeof raw === 'string') {
-      const address = normalizeAddress(raw)
-      if (address) result.push(address)
-      continue
-    }
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue
-    const entry = raw as Record<string, unknown>
-    const address = normalizeAddress(entry.address)
-    if (!address) continue
-    result.push({
-      address,
-      ...(stringArray(entry.block) && { block: stringArray(entry.block) }),
-      ...(stringArray(entry.restricted) && { restricted: stringArray(entry.restricted) }),
-      ...(typeof entry.notExplorable === 'boolean' && { notExplorable: entry.notExplorable }),
-    })
-  }
-  return result
-}
-
-const projectAssetPolicies = (value: unknown): EulerLabelAssetEntry[] => {
-  if (!Array.isArray(value)) return []
-  return value.flatMap((raw) => {
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return []
-    const entry = raw as Record<string, unknown>
-    const address = normalizeAddress(entry.address)
-    const projected = {
-      ...(address && { address }),
-      ...(stringArray(entry.symbols) && { symbols: stringArray(entry.symbols) }),
-      ...(typeof entry.symbolRegex === 'string' && { symbolRegex: entry.symbolRegex }),
-      ...(stringArray(entry.names) && { names: stringArray(entry.names) }),
-      ...(typeof entry.nameRegex === 'string' && { nameRegex: entry.nameRegex }),
-      ...(stringArray(entry.block) && { block: stringArray(entry.block) }),
-      ...(stringArray(entry.restricted) && { restricted: stringArray(entry.restricted) }),
-    } as EulerLabelAssetEntry
-    return 'address' in projected
-      || 'symbols' in projected
-      || 'symbolRegex' in projected
-      || 'names' in projected
-      || 'nameRegex' in projected
-      ? [projected]
-      : []
-  })
-}
-
-export function projectEffectiveLabelsSource(
-  products: unknown,
-  earnVaults: unknown,
-  assets: unknown,
-): EffectiveLabelsSource {
-  return {
-    products: projectProductPolicies(products),
-    earnVaults: projectEarnPolicies(earnVaults),
-    assets: projectAssetPolicies(assets),
-  }
-}
-
-export async function getEffectiveLabelsSource(chainId: number): Promise<EffectiveLabelsSource> {
-  const [products, earnVaults, chainAssets, globalAssets] = await Promise.all([
-    getLabelFile(chainId, 'products.json'),
-    getLabelFile(chainId, 'earn-vaults.json'),
-    getLabelFile(chainId, 'assets.json'),
-    getLabelFile('all', 'assets.json'),
-  ])
-  return projectEffectiveLabelsSource(products, earnVaults, [
-    ...(Array.isArray(chainAssets) ? chainAssets : []),
-    ...(Array.isArray(globalAssets) ? globalAssets : []),
-  ])
-}
diff --git a/server/utils/labels-view.ts b/server/utils/labels-view.ts
index 547537bf7..8ba050bfa 100644
--- a/server/utils/labels-view.ts
+++ b/server/utils/labels-view.ts
@@ -24,7 +24,7 @@ import { summarizeSdkIssue } from './observability'
 import { getServerSdk } from './sdk-server'
 import { isSdkErrorDiagnostic } from './sdk-diagnostics'
 import { getPublicEulerLabelsData } from './public-labels-source'
-import type { VerificationLabels } from '~/utils/vault/governor-verification'
+import { getHostedEntityKeys, type VerificationLabels } from '~/utils/vault/governor-verification'
 import { resolveEulerRouterGovernors } from '~/utils/vault/euler-router-governance'
 import { governableGovernorAbi } from '~/abis/oracle'
 
@@ -79,6 +79,7 @@ export interface ProductDescriptor {
 
 export interface LabelsView {
   chainId: number
+  logoBaseUrl?: string
   snapshot: ChainVaultsSnapshot
   productByVault: Map<Address, ProductDescriptor>
   deprecatedSet: Set<Address>
@@ -369,6 +370,8 @@ async function assembleLabelsView(chainId: number): Promise<LabelsView> {
 
   const verificationLabels: VerificationLabels = {
     getDeclaredEntityKeys: (addr) => {
+      const hostedKeys = getHostedEntityKeys(labels.value, addr)
+      if (hostedKeys !== undefined) return hostedKeys
       const checksum = tryChecksum(addr)
       if (!checksum) return undefined
       return productByVault.get(checksum)?.entityKeys
@@ -378,6 +381,7 @@ async function assembleLabelsView(chainId: number): Promise<LabelsView> {
 
   return {
     chainId,
+    logoBaseUrl: labels.value.logoBaseUrl,
     snapshot,
     productByVault,
     deprecatedSet,
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index dfe5cdb10..5bd6142ee 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -2,14 +2,16 @@ import { createGeoPolicySource } from './geo-policy-source'
 import { createTtlCache } from './cache'
 import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
 import { createInFlightDedup } from './in-flight'
-import { getEffectiveLabelsSource } from './labels-source'
+import { readLabelsSource } from './labels-base-url'
+import { getStaticLabelsBundle } from './static-labels-source'
 import { logger } from './logger'
 import { PublicLabelsV3Adapter } from '@eulerxyz/euler-v2-sdk/public-labels'
 import {
-  normalizePublicLabelsData,
+  normalizeLabelsBundle,
   PUBLIC_LABELS_RUNTIME_VERSION,
   type PublicEulerLabelsData,
   type PublicLabelsBundle,
+  type V3LabelsBundle,
   type PublicLabelsQuery,
   type PublicLabelsRequest,
   type PublicLabelsResponse,
@@ -19,8 +21,8 @@ import { readResolvedV3ApiUrl, readV3ApiKey } from '~/utils/api-url-env'
 const CACHE_TTL_MS = 300_000
 const REFRESH_BUDGET_MS = 30_000
 
-const cache = createTtlCache<PublicLabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
-const inFlight = createInFlightDedup<string, PublicLabelsBundle>()
+const cache = createTtlCache<V3LabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
+const inFlight = createInFlightDedup<string, V3LabelsBundle>()
 
 const geoSources = new Map<string, ReturnType<typeof createGeoPolicySource>>()
 const getGeoSource = () => {
@@ -61,6 +63,7 @@ export function refreshPublicLabelsBundle(
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
 ): Promise<PublicLabelsBundle> {
+  if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId, true)
   const key = cacheKey(chainId, version)
   return inFlight.run(key, async () => {
     try {
@@ -72,19 +75,12 @@ export function refreshPublicLabelsBundle(
             request,
           })
           const geo = await getGeoSource()(request)
-          const [snapshot, effectivePolicy] = await Promise.all([
-            adapter.fetchPublicLabelsSnapshot(chainId, version, geo.policies),
-            getEffectiveLabelsSource(chainId),
-          ])
-          // Validate the complete cross-source relationship before replacing
-          // a known-good raw bundle. Server consumers normalize it again into
-          // SDK-compatible Sets/RegExps; the browser receives JSON-safe data.
-          normalizePublicLabelsData(chainId, snapshot.publicLabels, effectivePolicy)
+          const snapshot = await adapter.fetchPublicLabelsSnapshot(chainId, version, geo.policies)
+          normalizeLabelsBundle(chainId, snapshot)
           return {
             version: snapshot.version,
             geoFetchedAt: geo.fetchedAt,
             publicLabels: snapshot.publicLabels,
-            effectivePolicy,
           }
         },
         REFRESH_BUDGET_MS,
@@ -106,6 +102,7 @@ export function getPublicLabelsBundle(
   chainId: number,
   version = PUBLIC_LABELS_RUNTIME_VERSION,
 ): Promise<PublicLabelsBundle> {
+  if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId)
   const hit = cache.get(cacheKey(chainId, version))
   return hit ? Promise.resolve(hit) : refreshPublicLabelsBundle(chainId, version)
 }
@@ -115,5 +112,5 @@ export async function getPublicEulerLabelsData(
   version = PUBLIC_LABELS_RUNTIME_VERSION,
 ): Promise<PublicEulerLabelsData> {
   const bundle = await getPublicLabelsBundle(chainId, version)
-  return normalizePublicLabelsData(chainId, bundle.publicLabels, bundle.effectivePolicy)
+  return normalizeLabelsBundle(chainId, bundle)
 }
diff --git a/server/utils/static-labels-source.ts b/server/utils/static-labels-source.ts
new file mode 100644
index 000000000..cf748c2b5
--- /dev/null
+++ b/server/utils/static-labels-source.ts
@@ -0,0 +1,89 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { EulerLabelsFileData } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
+import { resolveLabelsBaseUrl } from './labels-base-url'
+import { validateNode, validateStaticGeo } from './static-labels-validation'
+import { logger } from './logger'
+import { normalizeLabelsBundle, type StaticLabelsBundle } from '~/utils/public-labels'
+
+const cache = new Map<string, StaticLabelsBundle>()
+const pending = new Map<string, Promise<StaticLabelsBundle>>()
+
+const validate = (bundle: StaticLabelsBundle, chainId: number): StaticLabelsBundle => {
+  const files = bundle.files
+  if (!files || !Number.isFinite(bundle.fetchedAt) || bundle.fetchedAt <= 0) throw new Error('Invalid static labels checkpoint')
+  for (const key of ['products', 'entities'] as const) {
+    if (!files[key] || typeof files[key] !== 'object' || Array.isArray(files[key])) throw new Error(`Invalid static ${key}`)
+  }
+  for (const key of ['points', 'earnVaults', 'assets'] as const) {
+    if (!Array.isArray(files[key])) throw new Error(`Invalid static ${key}`)
+  }
+  validateNode(files, 'static-labels')
+  validateStaticGeo(files)
+  for (const rule of files.assets) {
+    if (!rule || typeof rule !== 'object' || !(rule.address || rule.symbols?.length || rule.names?.length || rule.symbolRegex || rule.nameRegex)) throw new Error('Static asset rule requires a matcher')
+  }
+  normalizeLabelsBundle(chainId, bundle)
+  return bundle
+}
+
+/** All six documents succeed together, or the entire last-known-good snapshot is retained. */
+export const getStaticLabelsBundle = (chainId: number, force = false): Promise<StaticLabelsBundle> => {
+  const base = resolveLabelsBaseUrl()
+  const key = `${base}:${chainId}`
+  const existing = pending.get(key)
+  if (existing) return existing
+  const hit = cache.get(key)
+  if (!force && hit && Date.now() - hit.fetchedAt < 300_000) return Promise.resolve(hit)
+  const directory = process.env.GEO_POLICY_CACHE_DIR || '.data/geo-policies'
+  const file = join(directory, `static-${createHash('sha256').update(key).digest('hex')}.json`)
+  const task = (async () => {
+    let lastGood = hit
+    if (!lastGood) {
+      try {
+        const saved = JSON.parse(await readFile(file, 'utf8')) as StaticLabelsBundle
+        if (saved.source !== 'static' || saved.logoBaseUrl !== base) throw new Error('Static labels checkpoint source mismatch')
+        lastGood = validate(saved, chainId)
+      }
+      catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') logger.warn({ ctx: 'static-labels', chainId, err }, 'checkpoint unavailable')
+      }
+    }
+    try {
+      const bundle = await withWallClock(async () => {
+        const read = async (scope: number | 'all', name: string) => {
+          const response = await fetchWithTimeout(`${base}/${scope}/${name}.json`)
+          if (!response.ok) throw new Error(`Static labels ${scope}/${name}: HTTP ${response.status}`)
+          return response.json()
+        }
+        const [products, entities, points, earnVaults, chainAssets, globalAssets] = await Promise.all([
+          read(chainId, 'products'), read(chainId, 'entities'), read(chainId, 'points'),
+          read(chainId, 'earn-vaults'), read(chainId, 'assets'), read('all', 'assets'),
+        ])
+        if (!Array.isArray(chainAssets) || !Array.isArray(globalAssets)) throw new Error('Static asset rules must be arrays')
+        const files = { products, entities, points, earnVaults, assets: [...chainAssets, ...globalAssets] } as EulerLabelsFileData
+        const version = createHash('sha256').update(JSON.stringify(files)).digest('hex')
+        return validate({ source: 'static', version, files, logoBaseUrl: base, fetchedAt: Date.now() }, chainId)
+      }, 30_000, `static-labels chain=${chainId}`)
+      cache.set(key, bundle)
+      try {
+        await mkdir(directory, { recursive: true })
+        const temporary = `${file}.${randomUUID()}.tmp`
+        await writeFile(temporary, JSON.stringify(bundle), { mode: 0o600 })
+        await rename(temporary, file)
+      }
+      catch (err) { logger.warn({ ctx: 'static-labels', chainId, err }, 'checkpoint write failed') }
+      return bundle
+    }
+    catch (err) {
+      if (!lastGood) throw err
+      cache.set(key, lastGood)
+      logger.warn({ ctx: 'static-labels', chainId, ageMs: Date.now() - lastGood.fetchedAt, err }, 'using last-known-good static labels')
+      return lastGood
+    }
+  })().finally(() => { pending.delete(key) })
+  pending.set(key, task)
+  return task
+}
diff --git a/server/utils/static-labels-validation.ts b/server/utils/static-labels-validation.ts
new file mode 100644
index 000000000..e83bac65f
--- /dev/null
+++ b/server/utils/static-labels-validation.ts
@@ -0,0 +1,87 @@
+import { isAddress } from 'viem'
+
+const LINK_TEXT_KEYS = new Set(['description', 'deprecationReason', 'deprecateReason', 'portfolioNotice'])
+const URL_KEYS = new Set(['url'])
+const REGEX_KEYS = new Set(['symbolRegex', 'nameRegex'])
+const MAX_REGEX_LEN = 512
+const LOGO_FILENAME_KEYS = new Set(['logo'])
+const SAFE_LOGO_FILENAME_RE = /^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i
+const MAX_STRING_LEN = 16_384
+const MAX_ARRAY_LEN = 10_000
+const MARKDOWN_LINK_INJECTION_RE = /\[[^\]]*\]\(https?:\/\/[^)]*"[^)]*\)/
+
+const isSafeHttpUrl = (value: string): boolean => {
+  if (!value) return true
+  try {
+    const { protocol } = new URL(value)
+    return protocol === 'http:' || protocol === 'https:'
+  }
+  catch {
+    return false
+  }
+}
+
+export function validateNode(node: unknown, path: string): void {
+  if (Array.isArray(node)) {
+    if (node.length > MAX_ARRAY_LEN) {
+      throw new Error(`Array too large at ${path}: ${node.length} exceeds ${MAX_ARRAY_LEN}`)
+    }
+    node.forEach((item, index) => validateNode(item, `${path}[${index}]`))
+    return
+  }
+  if (node === null || typeof node !== 'object') return
+
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (typeof value === 'string') {
+      if (value.length > MAX_STRING_LEN) {
+        throw new Error(`String too long at ${path}.${key}: ${value.length} exceeds ${MAX_STRING_LEN}`)
+      }
+      if (URL_KEYS.has(key) && !isSafeHttpUrl(value)) {
+        throw new Error(`Unsafe URL in ${path}.${key}: protocol must be http or https`)
+      }
+      if (LOGO_FILENAME_KEYS.has(key) && value !== '' && !SAFE_LOGO_FILENAME_RE.test(value)) {
+        throw new Error(`Unsafe logo filename in ${path}.${key}: ${value}`)
+      }
+      if (LINK_TEXT_KEYS.has(key) && MARKDOWN_LINK_INJECTION_RE.test(value)) {
+        throw new Error(`Injection pattern detected in ${path}.${key}`)
+      }
+      if (REGEX_KEYS.has(key)) {
+        if (value.length > MAX_REGEX_LEN) {
+          throw new Error(`Invalid regex in ${path}.${key}: pattern exceeds ${MAX_REGEX_LEN} chars`)
+        }
+        try {
+          new RegExp(value)
+        }
+        catch {
+          throw new Error(`Invalid regex in ${path}.${key}: ${value}`)
+        }
+      }
+    }
+    else if (value !== null && typeof value === 'object') {
+      validateNode(value, `${path}.${key}`)
+    }
+  }
+}
+
+/** Invalid geo fields cannot be silently discarded by permissive SDK normalization. */
+export function validateStaticGeo(node: unknown): void {
+  if (!node || typeof node !== 'object') return
+  if (Array.isArray(node)) {
+    for (const item of node) validateStaticGeo(item)
+    return
+  }
+  const row = node as Record<string, unknown>
+  for (const key of ['block', 'restricted']) {
+    if (row[key] !== undefined && (!Array.isArray(row[key]) || !(row[key] as unknown[]).every(code => typeof code === 'string' && /^[A-Z]{2,4}$/.test(code)))) {
+      throw new Error(`Invalid static geo ${key}`)
+    }
+  }
+  for (const key of ['symbolRegex', 'nameRegex']) {
+    if (row[key] !== undefined && typeof row[key] !== 'string') throw new Error(`Invalid static ${key}`)
+  }
+  for (const key of ['symbols', 'names']) {
+    if (row[key] !== undefined && (!Array.isArray(row[key]) || !(row[key] as unknown[]).every(item => typeof item === 'string'))) throw new Error(`Invalid static ${key}`)
+  }
+  if (row.address !== undefined && (typeof row.address !== 'string' || !isAddress(row.address))) throw new Error('Invalid static address')
+  for (const child of Object.values(row)) validateStaticGeo(child)
+}
diff --git a/server/utils/vault-metadata.ts b/server/utils/vault-metadata.ts
index e129849a3..a39efc5cf 100644
--- a/server/utils/vault-metadata.ts
+++ b/server/utils/vault-metadata.ts
@@ -1,3 +1,4 @@
+import { resolveLabelLogo } from '~/utils/label-logo'
 import type { Address } from 'viem'
 import { createTtlCache } from './cache'
 import { tryChecksum } from './labels-helpers'
@@ -76,10 +77,6 @@ function strOrEmpty(value: unknown): string {
   return typeof value === 'string' ? value : ''
 }
 
-function entityLogoUrl(fileName: string): string {
-  return /^https?:\/\//i.test(fileName) ? fileName : ''
-}
-
 function buildAsset(asset: VaultAsset | undefined, tokenLogos: Map<string, string>): AssetInfo | null {
   if (!asset) return null
   const addr = tryChecksum(asset.address)
@@ -93,7 +90,7 @@ function buildAsset(asset: VaultAsset | undefined, tokenLogos: Map<string, strin
   }
 }
 
-function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntryFull>): EntityInfo | null {
+function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntryFull>, logoBaseUrl?: string): EntityInfo | null {
   const entity = entities[entityKey]
   if (!entity) return null
   const name = strOrEmpty(entity.name)
@@ -102,7 +99,7 @@ function buildEntityInfo(entityKey: string, entities: Record<string, EntityEntry
   const url = strOrNull(entity.url)
   return {
     name,
-    logo: logoFile ? entityLogoUrl(logoFile) : '',
+    logo: logoFile ? resolveLabelLogo(logoFile, logoBaseUrl) : '',
     description: strOrNull(entity.description),
     url: url && /^https?:\/\//i.test(url) ? url : null,
   }
@@ -146,7 +143,7 @@ function buildEvkMetadata(
 
   const entityKeys = verified ? resolveGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
-    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw))
+    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw, ctx.view.logoBaseUrl))
     .filter((e): e is EntityInfo => e !== null)
 
   return {
@@ -183,7 +180,7 @@ function buildEarnMetadata(vault: EulerEarn, ctx: BuildContext): VaultMetadata |
 
   const entityKeys = verified ? resolveEarnGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
-    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw))
+    .map(key => buildEntityInfo(key, ctx.view.entitiesRaw, ctx.view.logoBaseUrl))
     .filter((e): e is EntityInfo => e !== null)
 
   return {
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index f6f296da1..ebd49df9b 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -45,7 +45,7 @@ vi.mock('~/composables/useEulerSdk', () => ({
 }))
 
 vi.mock('~/utils/public-labels', () => ({
-  normalizePublicLabelsData: mocks.normalizePublicLabelsData,
+  normalizeLabelsBundle: (_chainId: number, bundle: { publicLabels: unknown }) => mocks.normalizePublicLabelsData(_chainId, bundle.publicLabels),
 }))
 
 vi.mock('~/composables/useEulerOracleAdapters', () => ({
diff --git a/tests/composables/useUnverifiedVaultGuard.test.ts b/tests/composables/useUnverifiedVaultGuard.test.ts
index 5a53bb3bf..b3650f219 100644
--- a/tests/composables/useUnverifiedVaultGuard.test.ts
+++ b/tests/composables/useUnverifiedVaultGuard.test.ts
@@ -17,7 +17,7 @@ vi.mock('~/composables/useEulerLabels', () => ({
   getEulerLabelsVersion: () => 1,
 }))
 
-const mountGuard = (options?: { chainId?: Ref<number | undefined>, account?: Ref<string | undefined>, operation?: Ref<string> }) => {
+const mountGuard = (options?: { allowUnavailableLabels?: boolean, chainId?: Ref<number | undefined>, account?: Ref<string | undefined>, operation?: Ref<string> }) => {
   let state: UnverifiedVaultGuardState | undefined
   const chainId = options?.chainId ?? ref<number | undefined>(1)
   const account = options?.account ?? ref<string | undefined>(ACCOUNT)
@@ -39,6 +39,7 @@ const mountGuard = (options?: { chainId?: Ref<number | undefined>, account?: Ref
     setup() {
       useUnverifiedVaultGuard(computed(() => [VAULT]), {
         chainId,
+        allowUnavailableLabels: options?.allowUnavailableLabels,
         account,
         operation: computed(() => operation.value),
       })
@@ -133,6 +134,23 @@ describe('useUnverifiedVaultGuard canonical context', () => {
     mounted.app.unmount()
   })
 
+  it('allows a simple exit to acknowledge unavailable labels without granting verification', async () => {
+    entries.set(VAULT.toLowerCase(), { type: 'evk', vault: { chainId: 1, address: VAULT } })
+    labelsReady.value = false
+    labelsError.value = 'Unavailable'
+    verifyEVault.mockReturnValue(true)
+    const mounted = mountGuard({ allowUnavailableLabels: true })
+    await nextTick()
+    expect(mounted.state.verificationError).toBeUndefined()
+    expect(mounted.state.isVerificationLoading).toBe(false)
+    expect(mounted.state.isAcknowledgmentRequired).toBe(true)
+    expect(verifyEVault).not.toHaveBeenCalled()
+    mounted.state.acknowledgeRisk()
+    await nextTick()
+    expect(operationBlockerEntries.value).toEqual([])
+    mounted.app.unmount()
+  })
+
   it('removes the acknowledgement requirement when canonical verification recovers', async () => {
     entries.set(VAULT.toLowerCase(), { type: 'evk', vault: { chainId: 1, address: VAULT } })
     verifyEVault.mockReturnValue(false)
diff --git a/tests/fixtures/static-labels.json b/tests/fixtures/static-labels.json
new file mode 100644
index 000000000..30e666e82
--- /dev/null
+++ b/tests/fixtures/static-labels.json
@@ -0,0 +1,60 @@
+{
+  "products": {
+    "fork": {
+      "name": "Fork product",
+      "entity": "curator",
+      "vaults": [
+        "0x1111111111111111111111111111111111111111"
+      ],
+      "deprecatedVaults": [],
+      "block": [
+        "US"
+      ],
+      "vaultOverrides": {
+        "0x1111111111111111111111111111111111111111": {
+          "restricted": [
+            "CA"
+          ],
+          "notExplorableBorrow": true
+        }
+      }
+    }
+  },
+  "entities": {
+    "curator": {
+      "name": "Fork curator",
+      "logo": "curator.svg",
+      "description": "",
+      "url": "https://fork.test",
+      "addresses": {
+        "0x3333333333333333333333333333333333333333": "Owner"
+      },
+      "social": {}
+    }
+  },
+  "points": [
+    {
+      "name": "Fork points",
+      "logo": "points.svg",
+      "collateralVaults": [
+        "0x1111111111111111111111111111111111111111"
+      ]
+    }
+  ],
+  "earnVaults": [
+    {
+      "address": "0x2222222222222222222222222222222222222222",
+      "restricted": [
+        "GB"
+      ]
+    }
+  ],
+  "assets": [
+    {
+      "address": "0x4444444444444444444444444444444444444444",
+      "block": [
+        "US"
+      ]
+    }
+  ]
+}
diff --git a/tests/reviewed-execution/app-policy-vault-context.test.ts b/tests/reviewed-execution/app-policy-vault-context.test.ts
index 5ca8a1271..6ebc6334c 100644
--- a/tests/reviewed-execution/app-policy-vault-context.test.ts
+++ b/tests/reviewed-execution/app-policy-vault-context.test.ts
@@ -94,6 +94,16 @@ describe('final two-vault swap policy', () => {
       .rejects.toThrow('Vault verification is unavailable')
   })
 
+  it('allows an acknowledged simple withdrawal during a labels outage, but not a mixed swap batch', async () => {
+    geo.labelsReady.value = false
+    const intent = createOperationIntent({ kind: 'withdraw', planner: 'withdraw', args: { vaultAddress: TEST_VAULT, owner: TEST_ACCOUNT, assets: 1n }, chainId: 1, account: TEST_ACCOUNT, subAccounts: [TEST_ACCOUNT], source: 'test', operation: 'lend-withdraw', createdAt: 1, intentId: 'exit' })
+    const requestSet = makeReviewedExecution().requestSet
+    await expect(resolveAppPolicy(requestSet, 100, [intent])).rejects.toThrow('acknowledgement')
+    recordUnverifiedVaultAcknowledgement({ chainId: 1, account: TEST_ACCOUNT, operation: 'lend-withdraw', vaults: [TEST_VAULT] })
+    await expect(resolveAppPolicy(requestSet, 100, [intent])).resolves.toBeDefined()
+    await expect(resolveAppPolicy(requestSet, 100, [intent, swapIntent()])).rejects.toThrow('Vault verification is unavailable')
+  })
+
   it.each([
     ['omitted', true],
     ['empty', true],
diff --git a/tests/server/labels-base-url.test.ts b/tests/server/labels-base-url.test.ts
index abb4739a6..57c4860a7 100644
--- a/tests/server/labels-base-url.test.ts
+++ b/tests/server/labels-base-url.test.ts
@@ -1,33 +1,25 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
+import { readLabelsSource, resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
 
-describe('effective policy base URL', () => {
-  afterEach(() => {
-    vi.unstubAllEnvs()
+describe('label source configuration', () => {
+  afterEach(() => vi.unstubAllEnvs())
+  it('defaults to V3 regardless of obsolete GitHub settings', () => {
+    vi.stubEnv('LABELS_SOURCE', '')
+    vi.stubEnv('EFFECTIVE_POLICY_REPO', 'euler-xyz/euler-labels')
+    expect(readLabelsSource()).toBe('v3')
   })
-
-  it('prefers the server-only effective-policy URL', () => {
-    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', 'https://policy.example.test/')
-    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', 'https://legacy.example.test')
-
-    expect(resolveLabelsBaseUrl()).toBe('https://policy.example.test')
+  it('requires an explicit static URL and rejects invalid source selection', () => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', '')
+    expect(resolveLabelsBaseUrl).toThrow('required')
+    vi.stubEnv('LABELS_SOURCE', 'typo')
+    expect(readLabelsSource).toThrow('v3 or static')
   })
-
-  it('retains the former public variable as a deployment fallback', () => {
-    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', '')
-    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', 'https://legacy.example.test/')
-
-    expect(resolveLabelsBaseUrl()).toBe('https://legacy.example.test')
+  it('accepts operator-owned directories without a repository dependency', () => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', 'https://fork.example/labels/')
+    expect(resolveLabelsBaseUrl()).toBe('https://fork.example/labels')
   })
-
-  it('builds the repository URL from server-only settings', () => {
-    vi.stubEnv('EFFECTIVE_POLICY_BASE_URL', '')
-    vi.stubEnv('NUXT_PUBLIC_CONFIG_LABELS_BASE_URL', '')
-    vi.stubEnv('EFFECTIVE_POLICY_REPO', 'example/policy')
-    vi.stubEnv('EFFECTIVE_POLICY_REPO_BRANCH', 'published')
-
-    expect(resolveLabelsBaseUrl()).toBe(
-      'https://raw.githubusercontent.com/example/policy/refs/heads/published',
-    )
+  it.each(['file:///tmp/labels', 'https://user:password@example.test', 'https://example.test?token=x'])('rejects unsafe base %s', (base) => {
+    vi.stubEnv('STATIC_LABELS_BASE_URL', base)
+    expect(resolveLabelsBaseUrl).toThrow()
   })
 })
diff --git a/tests/server/labels-fetch-failure.test.ts b/tests/server/labels-fetch-failure.test.ts
deleted file mode 100644
index 775f97e7f..000000000
--- a/tests/server/labels-fetch-failure.test.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { fetchWithTimeout } from '~/server/utils/fetchWithTimeout'
-import { refreshLabelFile } from '~/server/utils/labels-source'
-
-vi.mock('~/server/utils/fetchWithTimeout', () => ({ fetchWithTimeout: vi.fn() }))
-
-describe('label policy source failure handling', () => {
-  it('returns an error for a transient failure without a usable cache', async () => {
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(new Response('', { status: 503 }))
-    await expect(refreshLabelFile(9001, 'earn-vaults.json')).rejects.toThrow('effective-policy source returned 503')
-  })
-
-  it('serves cached labels during an upstream outage', async () => {
-    const data = ['0x00000000000000000000000000000000000000A1']
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(Response.json(data))
-    expect(await refreshLabelFile(9002, 'earn-vaults.json')).toEqual(data)
-    vi.mocked(fetchWithTimeout).mockRejectedValueOnce(new Error('network error'))
-    expect(await refreshLabelFile(9002, 'earn-vaults.json')).toEqual(data)
-  })
-
-  it('keeps genuinely absent files valid and empty', async () => {
-    vi.mocked(fetchWithTimeout).mockResolvedValueOnce(new Response('', { status: 404 }))
-    expect(await refreshLabelFile(9003, 'earn-vaults.json')).toEqual([])
-  })
-})
diff --git a/tests/server/labels-validate-node.test.ts b/tests/server/labels-validate-node.test.ts
index 169b6a423..7d2650006 100644
--- a/tests/server/labels-validate-node.test.ts
+++ b/tests/server/labels-validate-node.test.ts
@@ -12,52 +12,7 @@
  * corresponding defense (see git history for server/utils/labels-source.ts).
  */
 import { describe, it, expect } from 'vitest'
-import { projectEffectiveLabelsSource, validateNode } from '~/server/utils/labels-source'
-
-describe('effective labels policy projection', () => {
-  it('strips all legacy display content from the browser-facing overlay', () => {
-    const address = '0x0000000000000000000000000000000000000001'
-    const result = projectEffectiveLabelsSource({
-      product: {
-        name: 'Legacy name',
-        description: 'Legacy description',
-        entity: 'legacy-entity',
-        tags: ['legacy-tag'],
-        vaults: [address],
-        block: ['US'],
-        vaultOverrides: {
-          [address]: {
-            name: 'Legacy vault name',
-            restricted: ['CA'],
-          },
-        },
-      },
-    }, [{
-      address,
-      description: 'Legacy Earn description',
-      notExplorable: true,
-    }], [{
-      address,
-      name: 'Legacy asset name',
-      block: ['US'],
-    }])
-
-    expect(result).toEqual({
-      products: {
-        product: {
-          vaults: [address],
-          block: ['US'],
-          vaultOverrides: {
-            [address]: { restricted: ['CA'] },
-          },
-        },
-      },
-      earnVaults: [{ address, notExplorable: true }],
-      assets: [{ address, block: ['US'] }],
-    })
-    expect(JSON.stringify(result)).not.toContain('Legacy')
-  })
-})
+import { validateNode } from '~/server/utils/static-labels-validation'
 
 describe('validateNode — size caps', () => {
   it('rejects strings longer than 16 KiB (client-side DoS guard)', () => {
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index cff37e340..1cce842af 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -5,7 +5,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   fetchWithTimeout: vi.fn(),
-  getEffectiveLabelsSource: vi.fn(),
   warn: vi.fn(),
 }))
 
@@ -17,10 +16,6 @@ vi.mock('~/server/utils/fetchWithTimeout', async (importOriginal) => {
   }
 })
 
-vi.mock('~/server/utils/labels-source', () => ({
-  getEffectiveLabelsSource: mocks.getEffectiveLabelsSource,
-}))
-
 vi.mock('~/server/utils/logger', () => ({
   logger: { warn: mocks.warn },
 }))
@@ -54,17 +49,13 @@ describe('public labels server source', () => {
     vi.resetModules()
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
+    vi.stubEnv('LABELS_SOURCE', 'v3')
     vi.stubEnv('V3_API_URL', 'https://v3.example.test')
     mocks.fetchWithTimeout.mockReset().mockImplementation(async (url: string) =>
       new URL(url).pathname.endsWith('/labels/sets/public/versions')
         ? versionsResponse()
         : emptyListResponse(),
     )
-    mocks.getEffectiveLabelsSource.mockReset().mockResolvedValue({
-      products: {},
-      earnVaults: [],
-      assets: [],
-    })
     mocks.warn.mockReset()
   })
 
@@ -87,7 +78,6 @@ describe('public labels server source', () => {
     expect(cached).toBe(first)
     expect(first.version).toBe('v20260804151305236')
     expect(mocks.fetchWithTimeout).toHaveBeenCalledTimes(7)
-    expect(mocks.getEffectiveLabelsSource).toHaveBeenCalledTimes(1)
     expect(mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url).pathname)).toEqual([
       '/v3/geo-policies',
       '/v3/labels/sets/public/versions',
@@ -132,17 +122,5 @@ describe('public labels server source', () => {
     mocks.fetchWithTimeout.mockRejectedValue(new Error('geo unavailable'))
     const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
     await expect(getPublicLabelsBundle(1)).rejects.toThrow('geo unavailable')
-    expect(mocks.getEffectiveLabelsSource).not.toHaveBeenCalled()
-  })
-
-  it('fails closed when effective policy is unavailable without stale data', async () => {
-    mocks.getEffectiveLabelsSource.mockRejectedValue(new Error('policy unavailable'))
-    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
-
-    await expect(getPublicLabelsBundle(1)).rejects.toThrow('policy unavailable')
-    expect(mocks.warn).toHaveBeenCalledWith(
-      expect.objectContaining({ ctx: 'public-labels-source', chainId: 1 }),
-      'refresh failed',
-    )
   })
 })
diff --git a/tests/server/static-labels-source.test.ts b/tests/server/static-labels-source.test.ts
new file mode 100644
index 000000000..545f19d3a
--- /dev/null
+++ b/tests/server/static-labels-source.test.ts
@@ -0,0 +1,66 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
+import files from '~/tests/fixtures/static-labels.json'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+
+const fetchMock = vi.hoisted(() => vi.fn())
+vi.mock('~/server/utils/fetchWithTimeout', async original => ({ ...await original<typeof import('~/server/utils/fetchWithTimeout')>(), fetchWithTimeout: fetchMock }))
+vi.mock('~/server/utils/logger', () => ({ logger: { warn: vi.fn() } }))
+
+describe('static authoring source', () => {
+  let directory: string
+  beforeEach(async () => {
+    vi.resetModules()
+    directory = await mkdtemp(join(tmpdir(), 'static-labels-'))
+    vi.stubEnv('GEO_POLICY_CACHE_DIR', directory)
+    vi.stubEnv('STATIC_LABELS_BASE_URL', 'https://fork.test/labels')
+    vi.stubEnv('LABELS_SOURCE', 'static')
+    fetchMock.mockReset().mockImplementation(async (url: string) => {
+      const filename = url.split('/').pop()
+      const key = filename === 'earn-vaults.json' ? 'earnVaults' : filename?.replace('.json', '')
+      return Response.json(url.includes('/all/') ? [{ nameRegex: '^ond[o]', restricted: ['EEA'] }] : files[key as keyof typeof files])
+    })
+  })
+  afterEach(async () => {
+    vi.unstubAllEnvs()
+    await rm(directory, { recursive: true, force: true })
+  })
+  it('feeds authored membership, governance, points, logos, explorability and geo into the same snapshot without V3', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const raw = await getPublicLabelsBundle(1)
+    const data = normalizeLabelsBundle(1, raw)
+    expect(fetchMock).toHaveBeenCalledTimes(6)
+    expect(fetchMock.mock.calls.every(([url]) => url.startsWith('https://fork.test/labels/'))).toBe(true)
+    expect(data.visibility).toBeUndefined()
+    expect(data.geoContext).toBeUndefined()
+    expect(data.verifiedVaultAddresses).toEqual(['0x' + '1'.repeat(40)])
+    expect(data.earnVaults).toEqual(['0x' + '2'.repeat(40)])
+    expect(data.products.fork).toMatchObject({ entity: 'curator', block: ['US'], vaultOverrides: { ['0x' + '1'.repeat(40)]: { restricted: ['CA'], notExplorableBorrow: true } } })
+    expect(data.entities.curator.addresses).toEqual({ ['0x' + '3'.repeat(40)]: 'Owner' })
+    expect(data.entities.curator.logo).toBe('https://fork.test/labels/logo/curator.svg')
+    expect(data.points['0x' + '1'.repeat(40)]?.[0]).toMatchObject({ name: 'Fork points', logo: 'https://fork.test/labels/logo/points.svg' })
+    expect(data.assetBlocks).toEqual({ ['0x' + '4'.repeat(40)]: ['US'] })
+    expect(data.assetPatternRules[0]?.nameRegex?.test('ondo')).toBe(true)
+    expect(data.earnVaultRestrictions).toEqual({ ['0x' + '2'.repeat(40)]: ['GB'] })
+  })
+  it('fails cold on an absent asset file instead of treating 404 as empty policy', async () => {
+    fetchMock.mockResolvedValue(Response.json({}, { status: 404 }))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    await expect(getStaticLabelsBundle(1)).rejects.toThrow('HTTP 404')
+  })
+  it('rejects malformed geo fields instead of silently dropping restrictions', async () => {
+    fetchMock.mockImplementation(async (url: string) => Response.json(url.endsWith('/assets.json') ? [{ nameRegex: 42, block: ['US'] }] : url.endsWith('/products.json') || url.endsWith('/entities.json') ? {} : []))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    await expect(getStaticLabelsBundle(1)).rejects.toThrow('Invalid static nameRegex')
+  })
+  it('retains the entire checkpoint after restart when any file fails', async () => {
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const first = await getStaticLabelsBundle(1)
+    vi.resetModules()
+    fetchMock.mockRejectedValue(new Error('offline'))
+    const restarted = await import('~/server/utils/static-labels-source')
+    expect(await restarted.getStaticLabelsBundle(1)).toEqual(first)
+  })
+})
diff --git a/tests/utils/label-logo.test.ts b/tests/utils/label-logo.test.ts
new file mode 100644
index 000000000..48fe7e655
--- /dev/null
+++ b/tests/utils/label-logo.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { resolveLabelLogo } from '~/utils/label-logo'
+
+describe('label image hosts', () => {
+  it('allows the dedicated HTTPS host', () => {
+    expect(resolveLabelLogo('https://token-images.euler.finance/labels/kpk')).toBe('https://token-images.euler.finance/labels/kpk')
+  })
+  it.each(['https://token-images.euler.finance.evil.test/x', 'https://evil.test/logo.svg', 'http://token-images.euler.finance/x', 'https://user@token-images.euler.finance/x', '//evil.test/x', 'data:image/svg+xml,x'])('rejects %s', (url) => {
+    expect(resolveLabelLogo(url)).toBe('')
+  })
+  it('allows static filenames and URLs only on the configured source origin', () => {
+    expect(resolveLabelLogo('fork.svg', 'https://fork.test/labels')).toBe('https://fork.test/labels/logo/fork.svg')
+    expect(resolveLabelLogo('https://fork.test/labels/logo/fork.svg', 'https://fork.test/labels')).toBe('https://fork.test/labels/logo/fork.svg')
+    expect(resolveLabelLogo('../secret', 'https://fork.test/labels')).toBe('')
+    expect(resolveLabelLogo('https://elsewhere.test/x', 'https://fork.test/labels')).toBe('')
+  })
+})
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
index e1f74880a..7cf86dbb9 100644
--- a/tests/utils/public-labels.test.ts
+++ b/tests/utils/public-labels.test.ts
@@ -1,168 +1,34 @@
 import { getAddress } from 'viem'
 import { describe, expect, it } from 'vitest'
-import {
-  getEulerLabelProductBrandEntities,
-  getEulerLabelProductBrandEntityKeys,
-} from '@eulerxyz/euler-v2-sdk/public-labels'
-import {
-  normalizePublicLabelsData,
-  type EffectiveLabelsSource,
-} from '~/utils/public-labels'
-import {
-  ASSESSMENT_ONLY_EARN,
-  ASSESSMENT_ONLY_EVK,
-  KPK,
-  KPK_GOVERNOR,
-  KPK_VAULT,
-  NEUTRAL_ESCROW,
-  PUBLIC_LABELS_FIXTURE_VERSION,
-  VERIFICATION_ONLY_EARN,
-  VERIFICATION_ONLY_EVK,
-  publicLabelsFixture,
-} from '~/tests/fixtures/public-labels-v20260804151305236'
-
-describe(`Public Labels ${PUBLIC_LABELS_FIXTURE_VERSION} normalization`, () => {
-  it('keeps KPK as owner, exposes Securitize as a co-brand, and maps hosted profiles', () => {
-    const effectivePolicy: EffectiveLabelsSource = {
-      products: {
-        'kpk-securitize': {
-          vaults: [getAddress(KPK_VAULT)],
-          block: ['US'],
-          vaultOverrides: {
-            [getAddress(KPK_VAULT)]: { restricted: ['CA'] },
-          },
-        },
-      },
-      earnVaults: [],
-      assets: [],
-    }
-
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
-    const product = result.products['kpk-securitize']
-
-    expect(product.entity).toBe(KPK)
-    expect(product.coBrandEntityIds).toEqual(['securitize'])
-    expect(getEulerLabelProductBrandEntityKeys(product)).toEqual([KPK, 'securitize'])
-    expect(getEulerLabelProductBrandEntities(product, result.entities).map(entity => entity.id)).toEqual([
-      KPK,
-      'securitize',
-    ])
-    expect(product.vaults).toEqual([getAddress(KPK_VAULT)])
-    expect(result.entities.kpk.logo).toBe('https://token-images.euler.finance/labels/kpk')
-    expect(result.entities.kpk.addresses).toEqual({
-      [getAddress(KPK_GOVERNOR)]: 'KPK Euler RWA Curation Safe',
-    })
-    expect(result.points[getAddress(KPK_VAULT)]).toEqual([{
-      name: 'KPK RWA points',
-      logo: 'https://token-images.euler.finance/labels/kpk',
-      type: 'deposit',
-    }])
-  })
-
-  it('keeps neutral escrows unattributed and raw geo policies non-effective', () => {
-    const effectivePolicy: EffectiveLabelsSource = {
-      products: {
-        'kpk-securitize': {
-          vaults: [getAddress(KPK_VAULT)],
-          block: ['US'],
-          vaultOverrides: {
-            [getAddress(KPK_VAULT)]: { restricted: ['CA'] },
-          },
-        },
-      },
-      earnVaults: [],
-      assets: [],
-    }
-
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
-    const product = result.products['kpk-securitize']
-
-    expect(result.verifiedVaultAddresses).not.toContain(getAddress(NEUTRAL_ESCROW))
-    expect(result.verifiedVaultAddresses).not.toContain(getAddress(ASSESSMENT_ONLY_EVK))
-    expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
-    expect(Object.keys(result.products)).not.toContain(`__vault_${NEUTRAL_ESCROW.toLowerCase()}`)
-    expect(Object.keys(result.products)).not.toContain(`__vault_${ASSESSMENT_ONLY_EVK.toLowerCase()}`)
-    expect(product.block).toEqual(['US'])
-    expect(product.vaultOverrides?.[getAddress(KPK_VAULT)]?.restricted).toEqual(['CA'])
-    expect(product.block).not.toContain('DE')
-    expect(result.rawGeoPolicies).toEqual(publicLabelsFixture.geoPolicies)
-  })
-
-  it('retains compatibility-confirmed plain labels without trusting assessment-only rows', () => {
-    const effectivePolicy: EffectiveLabelsSource = {
-      products: {
-        compatibility: { vaults: [getAddress(VERIFICATION_ONLY_EVK)] },
-      },
-      earnVaults: [getAddress(VERIFICATION_ONLY_EARN)],
-      assets: [],
-    }
-
-    const result = normalizePublicLabelsData(1, publicLabelsFixture, effectivePolicy)
-
-    expect(result.verifiedVaultAddresses).toContain(getAddress(VERIFICATION_ONLY_EVK))
-    expect(result.verifiedVaultAddresses).not.toContain(getAddress(ASSESSMENT_ONLY_EVK))
-    expect(result.earnVaults).toContain(getAddress(VERIFICATION_ONLY_EARN))
-    expect(result.earnVaults).not.toContain(getAddress(ASSESSMENT_ONLY_EARN))
+import { getEulerLabelProductBrandEntityKeys } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { normalizePublicLabelsData } from '~/utils/public-labels'
+import { ASSESSMENT_ONLY_EARN, ASSESSMENT_ONLY_EVK, KPK_VAULT, NEUTRAL_ESCROW, VERIFICATION_ONLY_EVK, VERIFICATION_ONLY_EARN, publicLabelsFixture } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+describe('V3-only label normalization', () => {
+  it('preserves managing entities, co-branding, campaigns and current geo assignments', () => {
+    const data = normalizePublicLabelsData(1, publicLabelsFixture)
+    expect(getEulerLabelProductBrandEntityKeys(data.products['kpk-securitize'])).toEqual(['kpk', 'securitize'])
+    expect(data.entities.kpk.logo).toBe('https://token-images.euler.finance/labels/kpk')
+    expect(data.points[getAddress(KPK_VAULT)]?.[0]?.name).toBe('KPK RWA points')
+    expect(data.geoContext?.productByVault[KPK_VAULT.toLowerCase()]).toBe('kpk-securitize')
+    expect(data.geoContext?.policies).toEqual(publicLabelsFixture.geoPolicies)
   })
-
-  it.each(['hidden', 'pending_review'] as const)('does not let compatibility policy override %s visibility', (status) => {
-    const visibility = Object.fromEntries(Object.keys(publicLabelsFixture.visibility).map(address => [address, {
-      status, explorableLend: false, explorableBorrow: false, decidedBy: 'unclaimed', reason: null,
-    }]))
-    const result = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility }, {
-      products: { compatibility: { vaults: [KPK_VAULT, VERIFICATION_ONLY_EVK] } },
-      earnVaults: [VERIFICATION_ONLY_EARN], assets: [],
-    })
-    expect(result.verifiedVaultAddresses).toEqual([])
-    expect(result.earnVaults).toEqual([])
-    expect(result.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]?.notExplorableLend).toBe(true)
-    expect(result.notExplorableEarnVaults.has(VERIFICATION_ONLY_EARN.toLowerCase())).toBe(true)
+  it('never uses old file membership to trust empty or unclaimed inventory', () => {
+    const data = normalizePublicLabelsData(1, publicLabelsFixture)
+    for (const address of [ASSESSMENT_ONLY_EVK, NEUTRAL_ESCROW, VERIFICATION_ONLY_EVK]) expect(data.verifiedVaultAddresses).not.toContain(getAddress(address))
+    for (const address of [ASSESSMENT_ONLY_EARN, VERIFICATION_ONLY_EARN]) expect(data.earnVaults).not.toContain(getAddress(address))
   })
-
-  it('keeps per-side V3 listing flags when compatibility flags allow listing', () => {
-    const source = { ...publicLabelsFixture, visibility: { ...publicLabelsFixture.visibility,
-      [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false },
-    } }
-    const result = normalizePublicLabelsData(1, source, {
-      products: { 'kpk-securitize': { vaults: [KPK_VAULT], vaultOverrides: { [getAddress(KPK_VAULT)]: { notExplorableLend: false, notExplorableBorrow: false } } } },
-      earnVaults: [], assets: [],
-    })
-    const override = result.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]
-    expect(override?.notExplorableLend).toBe(true)
-    expect(override?.notExplorableBorrow).toBe(false)
+  it.each(['hidden', 'pending_review'] as const)('enforces %s and per-side flags', (status) => {
+    const visibility = Object.fromEntries(Object.keys(publicLabelsFixture.visibility).map(address => [address, { status, explorableLend: false, explorableBorrow: false, decidedBy: 'unclaimed', reason: null }]))
+    const data = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility })
+    expect(data.verifiedVaultAddresses).toEqual([])
+    expect(data.earnVaults).toEqual([])
+    expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]?.notExplorableLend).toBe(true)
+    expect(data.notExplorableEarnVaults.has(VERIFICATION_ONLY_EARN.toLowerCase())).toBe(true)
   })
-
-  it('keeps mixed vault tags scoped to their vault override', () => {
-    const sibling = {
-      ...publicLabelsFixture.vaults[0],
-      address: '0x00000000000000000000000000000000000000C1',
-      tags: [],
-    }
-    const result = normalizePublicLabelsData(1, {
-      ...publicLabelsFixture,
-      vaults: [publicLabelsFixture.vaults[0], sibling],
-    })
-    const product = result.products['kpk-securitize']
-
-    expect(product.tags).toBeUndefined()
-    expect(product.vaultOverrides?.[getAddress(KPK_VAULT)]?.tags).toContain('recently added')
-    expect(product.vaultOverrides?.[getAddress(sibling.address)]?.tags).toBeUndefined()
-  })
-
-  it('drops non-http profile and campaign URLs at the normalization boundary', () => {
-    const result = normalizePublicLabelsData(1, {
-      ...publicLabelsFixture,
-      entities: publicLabelsFixture.entities.map((entity, index) => index === 0
-        ? { ...entity, logo: 'data:image/svg+xml,bad', url: 'javascript:alert(1)', socialTwitter: 'file:///tmp/bad' }
-        : entity),
-      vaults: publicLabelsFixture.vaults.map((vault, index) => index === 0
-        ? { ...vault, campaigns: [{ name: 'Unsafe', logo: 'javascript:alert(1)', type: 'deposit' }] }
-        : vault),
-    })
-
-    expect(result.entities.kpk.logo).toBe('')
-    expect(result.entities.kpk.url).toBe('')
-    expect(result.entities.kpk.social.twitter).toBe('')
-    expect(result.points[getAddress(KPK_VAULT)]?.[0]?.logo).toBe('')
+  it('does not infer one side from the other', () => {
+    const visibility = { ...publicLabelsFixture.visibility, [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false, explorableBorrow: true } }
+    const data = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility })
+    expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: true, notExplorableBorrow: false })
   })
 })
diff --git a/tests/utils/vault/governor-verification.test.ts b/tests/utils/vault/governor-verification.test.ts
index d3083a3fc..9158099b9 100644
--- a/tests/utils/vault/governor-verification.test.ts
+++ b/tests/utils/vault/governor-verification.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect } from 'vitest'
 import { encodeAbiParameters, getAddress, type Address, zeroAddress } from 'viem'
 import {
   isVaultGovernorVerified,
+  getHostedEntityKeys,
   isEarnVaultOwnerVerified,
   resolveGoverningEntityKeys,
   resolveEarnGoverningEntityKeys,
@@ -436,3 +437,17 @@ describe('hasResolvedGovernorAdmin', () => {
     expect(hasResolvedGovernorAdmin({ governorAdmin: GOV_A })).toBe(false)
   })
 })
+
+describe('hosted standalone Earn authority', () => {
+  it('requires the V3 manager and a matching on-chain owner even without a product', () => {
+    const vault = { address: VAULT_ADDR, verified: true, governance: { owner: GOV_A } } as EarnVault
+    const make = (entity?: string): VerificationLabels => ({
+      getDeclaredEntityKeys: address => getHostedEntityKeys({ source: 'v3', managingEntityByVault: entity ? { [VAULT_ADDR.toLowerCase()]: entity } : {} }, address),
+      hasEntityAddress: (key, address) => key === 'manager' && address === GOV_A,
+    })
+    expect(isEarnVaultOwnerVerified(vault, make())).toBe(false)
+    expect(isEarnVaultOwnerVerified(vault, make('co-brand'))).toBe(false)
+    expect(isEarnVaultOwnerVerified(vault, make('manager'))).toBe(true)
+    expect(isEarnVaultOwnerVerified({ ...vault, governance: { ...vault.governance, owner: GOV_B } } as EarnVault, make('manager'))).toBe(false)
+  })
+})
diff --git a/utils/label-logo.ts b/utils/label-logo.ts
new file mode 100644
index 000000000..b3f830ef3
--- /dev/null
+++ b/utils/label-logo.ts
@@ -0,0 +1,14 @@
+/** Hosted labels use the dedicated image host. Static sources may serve their own images. */
+export const resolveLabelLogo = (value: string | undefined, staticBaseUrl?: string): string => {
+  if (!value) return ''
+  try {
+    const base = staticBaseUrl ? new URL(`${staticBaseUrl.replace(/\/+$/, '')}/logo/`) : undefined
+    if (!/^https?:\/\//i.test(value) && (!base || !/^[a-zA-Z0-9_-]+\.(svg|png|jpg|jpeg|webp|gif)$/i.test(value))) return ''
+    const url = new URL(value, base)
+    if (url.username || url.password) return ''
+    const hosted = url.protocol === 'https:' && url.hostname === 'token-images.euler.finance' && (!url.port || url.port === '443')
+    const authored = base && url.origin === base.origin && ['http:', 'https:'].includes(url.protocol)
+    return hosted || authored ? url.href : ''
+  }
+  catch { return '' }
+}
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index c6187802b..e2f966538 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -1,13 +1,12 @@
 import {
-  hasPublishedVaultLabelContent,
+  normalizeEulerLabelsFileData,
+  type EulerLabelsFileData,
   normalizePublicLabelsData as normalizeSdkPublicLabelsData,
-  type EulerLabelAssetPatternRule,
   type PublicEulerLabelsData as SdkPublicEulerLabelsData,
   type PublicLabelsSource,
 } from '@eulerxyz/euler-v2-sdk/public-labels'
 import type { HostedGeoContext } from '~/utils/geo-policies'
-import { getAddress } from 'viem'
-import type { EulerLabelAssetEntry, EulerLabelProduct } from '~/entities/euler/labels'
+import { resolveLabelLogo } from '~/utils/label-logo'
 
 export {
   PUBLIC_LABELS_RUNTIME_VERSION,
@@ -27,240 +26,64 @@ export type {
   PublicVaultLabel,
 } from '@eulerxyz/euler-v2-sdk/public-labels'
 
-export type PublicEulerLabelsData = SdkPublicEulerLabelsData & { geoContext?: HostedGeoContext }
+export type PublicEulerLabelsData = Omit<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>
+  & Partial<Pick<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>>
+  & { geoContext?: HostedGeoContext, source?: 'v3' | 'static', logoBaseUrl?: string }
 
 export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
 
-export interface EffectiveProductPolicy {
-  block?: string[]
-  restricted?: string[]
-  notExplorable?: boolean
-  vaults?: string[]
-  deprecatedVaults?: string[]
-  vaultOverrides?: Record<string, {
-    block?: string[]
-    restricted?: string[]
-    notExplorableLend?: boolean
-    notExplorableBorrow?: boolean
-  }>
-}
-
-export interface EffectiveEarnPolicy {
-  address: string
-  block?: string[]
-  restricted?: string[]
-  notExplorable?: boolean
-}
-
-/**
- * Compatibility geo rules and additional discovery restrictions. V3 visibility
- * is required independently; this source cannot override a negative verdict.
- */
-export interface EffectiveLabelsSource {
-  products: Record<string, EffectiveProductPolicy>
-  earnVaults: Array<string | EffectiveEarnPolicy>
-  assets: EulerLabelAssetEntry[]
-}
-
-export interface PublicLabelsBundle {
-  /** Metadata publication; geo, entity addresses, platform tags and visibility remain live. */
+export interface V3LabelsBundle {
+  source?: 'v3'
   version: string
   publicLabels: PublicLabelsSource
   geoFetchedAt?: number
-  effectivePolicy: EffectiveLabelsSource
 }
 
-const emptyEffectiveLabelsSource = (): EffectiveLabelsSource => ({
-  products: {},
-  earnVaults: [],
-  assets: [],
-})
-
-const uniqueStrings = (values: Iterable<string>): string[] => [...new Set(values)]
-
-const tryAddress = (value: string): string | undefined => {
-  try {
-    return getAddress(value)
-  }
-  catch {
-    return undefined
-  }
-}
-
-const getEffectiveVaultSets = (effective: EffectiveLabelsSource) => {
-  const verified = new Set<string>()
-  for (const product of Object.values(effective.products)) {
-    for (const address of [...(product.vaults ?? []), ...(product.deprecatedVaults ?? [])]) {
-      verified.add(address.toLowerCase())
-    }
-  }
-  const earn = new Set(effective.earnVaults.map(entry =>
-    (typeof entry === 'string' ? entry : entry.address).toLowerCase(),
-  ))
-  return { verified, earn }
-}
-
-const normalizeEffectiveEarnPolicy = (effective: EffectiveLabelsSource) => {
-  const blocks: Record<string, string[]> = {}
-  const restrictions: Record<string, string[]> = {}
-  const notExplorable = new Set<string>()
-  for (const raw of effective.earnVaults) {
-    if (typeof raw === 'string') continue
-    const address = tryAddress(raw.address)
-    if (!address) continue
-    const key = address.toLowerCase()
-    if (raw.block?.length) blocks[key] = [...raw.block]
-    if (raw.restricted?.length) restrictions[key] = [...raw.restricted]
-    if (raw.notExplorable) notExplorable.add(key)
-  }
-  return { blocks, restrictions, notExplorable }
+export interface StaticLabelsBundle {
+  source: 'static'
+  version: string
+  files: EulerLabelsFileData
+  logoBaseUrl: string
+  fetchedAt: number
 }
 
-const normalizeEffectiveAssets = (entries: EulerLabelAssetEntry[]) => {
-  const blocks: Record<string, string[]> = {}
-  const restrictions: Record<string, string[]> = {}
-  const patternRules: EulerLabelAssetPatternRule[] = []
+export type PublicLabelsBundle = V3LabelsBundle | StaticLabelsBundle
 
-  for (const entry of entries) {
-    if (entry.address) {
-      const address = tryAddress(entry.address)
-      if (address) {
-        const key = address.toLowerCase()
-        if (entry.block?.length) blocks[key] = [...entry.block]
-        if (entry.restricted?.length) restrictions[key] = [...entry.restricted]
-      }
-    }
-
-    const rule: EulerLabelAssetPatternRule = {
-      ...(entry.block?.length && { block: [...entry.block] }),
-      ...(entry.restricted?.length && { restricted: [...entry.restricted] }),
-    }
-    if (!rule.block && !rule.restricted) continue
-    if (entry.symbols?.length) rule.symbolsLower = new Set(entry.symbols.map(value => value.toLowerCase()))
-    if (entry.names?.length) rule.namesLower = new Set(entry.names.map(value => value.toLowerCase()))
-    if (entry.symbolRegex) rule.symbolRegex = new RegExp(entry.symbolRegex, 'i')
-    if (entry.nameRegex) rule.nameRegex = new RegExp(entry.nameRegex, 'i')
-    if (rule.symbolsLower || rule.symbolRegex || rule.namesLower || rule.nameRegex) {
-      patternRules.push(rule)
-    }
-  }
-
-  return { blocks, restrictions, patternRules }
-}
-
-/**
- * Adds Lite's temporary effective-policy compatibility layer to the canonical
- * Public Labels content normalized by the SDK.
- */
-export const normalizePublicLabelsData = (
-  chainId: number,
-  source: PublicLabelsSource,
-  effectivePolicy: EffectiveLabelsSource = emptyEffectiveLabelsSource(),
-): PublicEulerLabelsData => {
+/** V3 owns hosted membership, published content and per-side visibility. */
+export const normalizePublicLabelsData = (chainId: number, source: PublicLabelsSource): PublicEulerLabelsData => {
   const data = normalizeSdkPublicLabelsData(chainId, source)
-  const inventoryRows = source.vaults.filter((vault) => {
-    const verdict = source.visibility[vault.address.toLowerCase()]
-    return vault.chainId === chainId && (verdict?.status === 'visible' || verdict?.status === 'warning')
-  })
-  const { verified: compatibilityVerified, earn: compatibilityEarn } = getEffectiveVaultSets(effectivePolicy)
-
-  // Plain-address labels and assessment-only rows have the same empty content
-  // shape in the inventory. Retain an empty row only when the compatibility
-  // snapshot already classifies that exact published inventory address.
-  const compatibilityEarnRows = inventoryRows.filter(vault =>
-    !hasPublishedVaultLabelContent(vault)
-    && vault.vaultType === 'earn'
-    && compatibilityEarn.has(vault.address.toLowerCase()),
-  )
-  const compatibilityVerifiedRows = inventoryRows.filter(vault =>
-    !hasPublishedVaultLabelContent(vault)
-    && vault.vaultType !== 'earn'
-    && vault.vaultType !== 'escrow'
-    && compatibilityVerified.has(vault.address.toLowerCase()),
-  )
-
-  const verifiedVaultAddresses = [
-    ...data.verifiedVaultAddresses,
-    ...compatibilityVerifiedRows.map(vault => getAddress(vault.address)),
-  ]
-  const earnVaults = [...data.earnVaults]
-  const earnVaultEntries = { ...data.earnVaultEntries }
-  for (const vault of compatibilityEarnRows) {
-    const address = getAddress(vault.address)
-    earnVaults.push(address)
-    earnVaultEntries[address.toLowerCase()] ??= { address }
-  }
-
-  const products = data.products as Record<string, EulerLabelProduct>
-  const effectiveEarn = normalizeEffectiveEarnPolicy(effectivePolicy)
-  const effectiveAssets = normalizeEffectiveAssets(effectivePolicy.assets)
-
-  // Compatibility fields support static consumers. Hosted enforcement exclusively
-  // uses geoContext, including assignments outside the discovery allowlist.
-  for (const [productKey, product] of Object.entries(products)) {
-    const effectiveProduct = effectivePolicy.products[productKey]
-    if (!effectiveProduct) continue
-    product.block = effectiveProduct.block
-    product.restricted = effectiveProduct.restricted
-    product.notExplorable = effectiveProduct.notExplorable
-    const effectiveOverrides = new Map(
-      Object.entries(effectiveProduct.vaultOverrides ?? {}).map(([address, override]) => [
-        address.toLowerCase(),
-        override,
-      ]),
-    )
-    for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
-      const target = product.vaultOverrides?.[address]
-      const previous = effectiveOverrides.get(address.toLowerCase())
-      if (!target || !previous) continue
-      target.block = previous.block
-      target.restricted = previous.restricted
-      target.notExplorableLend = previous.notExplorableLend
-      target.notExplorableBorrow = previous.notExplorableBorrow
-    }
-  }
-
-  for (const [address, entry] of Object.entries(earnVaultEntries)) {
-    entry.block = effectiveEarn.blocks[address]
-    entry.restricted = effectiveEarn.restrictions[address]
-    entry.notExplorable = effectiveEarn.notExplorable.has(address)
-  }
-
-  // V3 flags are final per-side listing decisions. Compatibility restrictions
-  // may hide more, but cannot make a hidden or pending vault explorable.
-  for (const product of Object.values(products)) {
+  for (const product of Object.values(data.products)) {
     for (const address of [...product.vaults, ...(product.deprecatedVaults ?? [])]) {
       const verdict = source.visibility[address.toLowerCase()]
       const override = product.vaultOverrides?.[address]
       if (!override) continue
-      override.notExplorableLend = override.notExplorableLend || verdict?.explorableLend !== true
-      override.notExplorableBorrow = override.notExplorableBorrow || verdict?.explorableBorrow !== true
+      override.notExplorableLend = verdict?.explorableLend !== true
+      override.notExplorableBorrow = verdict?.explorableBorrow !== true
     }
   }
-  for (const [address, entry] of Object.entries(earnVaultEntries)) {
-    if (source.visibility[address]?.explorableLend !== true) {
-      entry.notExplorable = true
-      effectiveEarn.notExplorable.add(address)
-    }
+  for (const [address, entry] of Object.entries(data.earnVaultEntries)) {
+    entry.notExplorable = source.visibility[address]?.explorableLend !== true
+    if (entry.notExplorable) data.notExplorableEarnVaults.add(address)
   }
-
   return {
     ...data,
+    source: 'v3',
     geoContext: {
       chainId,
       policies: data.rawGeoPolicies,
       productByVault: Object.fromEntries(source.vaults.filter(vault => vault.chainId === chainId)
         .map(vault => [vault.address.toLowerCase(), vault.productId])),
     },
-    products,
-    verifiedVaultAddresses: uniqueStrings(verifiedVaultAddresses),
-    earnVaults: uniqueStrings(earnVaults),
-    earnVaultEntries,
-    earnVaultBlocks: effectiveEarn.blocks,
-    earnVaultRestrictions: effectiveEarn.restrictions,
-    notExplorableEarnVaults: effectiveEarn.notExplorable,
-    assetBlocks: effectiveAssets.blocks,
-    assetRestrictions: effectiveAssets.restrictions,
-    assetPatternRules: effectiveAssets.patternRules,
   }
 }
+
+export const normalizeLabelsBundle = (chainId: number, bundle: PublicLabelsBundle): PublicEulerLabelsData => {
+  if (bundle.source !== 'static') return normalizePublicLabelsData(chainId, bundle.publicLabels)
+  const data = normalizeEulerLabelsFileData(structuredClone(bundle.files))
+  // Static authoring uses filenames; resolve them only against the operator's source.
+  const logo = (value: string | undefined) => resolveLabelLogo(value, bundle.logoBaseUrl)
+  for (const entity of Object.values(data.entities)) entity.logo = logo(entity.logo)
+  for (const product of Object.values(data.products)) if (product.logo) product.logo = logo(product.logo)
+  for (const points of Object.values(data.points)) for (const point of points) point.logo = logo(point.logo)
+  return { ...data, source: 'static', logoBaseUrl: bundle.logoBaseUrl, rawGeoPolicies: [] }
+}
diff --git a/utils/vault/governor-verification.ts b/utils/vault/governor-verification.ts
index deb64859c..7a719364a 100644
--- a/utils/vault/governor-verification.ts
+++ b/utils/vault/governor-verification.ts
@@ -1,3 +1,4 @@
+import type { PublicEulerLabelsData } from '~/utils/public-labels'
 import { getAddress, zeroAddress, type Address } from 'viem'
 import { isEVault, type EulerEarn, type EVault, type OracleDetailedInfo } from '@eulerxyz/euler-v2-sdk'
 import { getEulerRouterGovernor } from '~/entities/oracle'
@@ -57,6 +58,13 @@ export interface VerificationLabels {
   hasEntityAddress: (entityKey: string, address: Address) => boolean
 }
 
+/** Hosted labels must explicitly declare a manager; absence cannot use static Earn trust. */
+export const getHostedEntityKeys = (labels: Pick<PublicEulerLabelsData, 'source' | 'managingEntityByVault'>, address: string): string[] | undefined => {
+  if (labels.source !== 'v3') return undefined
+  const entity = labels.managingEntityByVault?.[address.toLowerCase()]
+  return entity ? [entity] : []
+}
+
 const findDeclaredEntityFor = (
   address: Address,
   declaredKeys: string[],

From 82ed6be6bcffc65ba206ead21a1ff47a2bca37bf Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:53:48 +0100
Subject: [PATCH 10/13] fix: accept omitted static label files

Preserve legacy 403/404 empty collections while retaining snapshots on transient failures. Cover missing asset scopes and document static source behavior.
---
 docs/static-labels.md                     |  8 ++--
 server/utils/static-labels-source.ts      |  4 +-
 tests/server/static-labels-source.test.ts | 48 +++++++++++++++++++++--
 3 files changed, 52 insertions(+), 8 deletions(-)

diff --git a/docs/static-labels.md b/docs/static-labels.md
index a4500f4a6..d8ddc29f1 100644
--- a/docs/static-labels.md
+++ b/docs/static-labels.md
@@ -6,7 +6,7 @@ Forks select `LABELS_SOURCE=static` and set `STATIC_LABELS_BASE_URL` to their ow
 
 ## Directory contract
 
-For each enabled chain, serve these JSON documents:
+For each enabled chain, the loader reads these JSON documents:
 
 | Path | Shape and fields |
 |---|---|
@@ -18,13 +18,13 @@ For each enabled chain, serve these JSON documents:
 | `all/assets.json` | Global asset rules, combined with each chain's rules. |
 | `logo/{filename}` | Entity/product/points images on the same origin. |
 
-Use explicit `{}` or `[]` documents for empty collections, including both asset files. Missing files and HTTP errors are failures, not empty policy. A source missing optional files from older layouts must add those explicit empty documents. File syntax retains the five-file authoring format; no generated normalized snapshot needs editing. [`tests/fixtures/static-labels.json`](../tests/fixtures/static-labels.json) is an executable example of the file contents.
+Collections may be omitted: HTTP 404 and HTTP 403 (the missing-key response from some S3/CDN hosts) resolve to `{}` for products/entities and `[]` for points/Earn/assets. Missing chain asset rules do not remove global asset rules, and vice versa. Explicit empty documents are also supported. Other HTTP errors, network failures and malformed content fail the refresh. File syntax retains the five-file authoring format; no generated normalized snapshot needs editing. [`tests/fixtures/static-labels.json`](../tests/fixtures/static-labels.json) is an executable example of the file contents.
 
 Only HTTP(S) profile links and simple image filenames are accepted. Remote hosted label images must use `https://token-images.euler.finance`; static images may additionally use the configured source origin. Paths/credentials and lookalike hosts cannot bypass the image allowlist. The browser repeats the image check before rendering.
 
 ## Failure behavior
 
-All six JSON documents load together. A failed, malformed or partial refresh retains the complete last-known-good snapshot, including its rules. No snapshot is published on a cold start without a valid complete set. Checkpoints are source-and-chain-specific, content-hashed and timestamped. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for container replacements; the default `.data/geo-policies` only persists on the same filesystem. Stale fallback and failed checkpoint writes are logged for alerting.
+All six file reads resolve together, with absent files represented by empty collections. A failed or malformed refresh retains the complete last-known-good snapshot, including its rules. A cold start fails if any read has an error other than the supported absent-file responses. An absent-file response applies the empty collection on that refresh; there is no per-file stale grace period for 403/404. A source returning 403/404 for every file produces an empty snapshot, so configure a publicly readable source URL. Checkpoints are source-and-chain-specific, content-hashed and timestamped. Mount `GEO_POLICY_CACHE_DIR` on persistent storage for container replacements; the default `.data/geo-policies` only persists on the same filesystem. Stale fallback and failed checkpoint writes are logged for alerting.
 
 Authored geo retains static country-group expansion and override semantics. This differs deliberately from hosted V3's cumulative rules. The contract test covers discovery, entities/authority addresses, points, logos, per-side flags, asset patterns, Earn restrictions and restart recovery.
 
@@ -34,4 +34,4 @@ Static labels do not require running a V3 backend. A fork may use Euler's hosted
 
 ## Rollout boundary
 
-Before switching production, compare authored and V3 membership, explorability, display content, geo decisions and full verification across enabled chains. Resolve unexplained differences; preserve public API behavior and measure revocation latency. On-chain governor verification remains active in hosted mode during this bake. SDK release/dependency changes, persistent volumes, alerting, compliance canary and production cutover are deployment work.
+Before switching production, compare authored and V3 membership, explorability, display content, geo decisions and full verification across enabled chains. Resolve unexplained differences; preserve public API behavior and measure revocation latency. On-chain governor verification remains active in hosted mode during this bake. SDK release/dependency changes and production cutover are deployment work. Persistent volumes, dedicated geo alerts and a compliance canary are optional operational hardening; fresh containers may fetch their initial rules from the configured upstream, as in the existing deployment model.
diff --git a/server/utils/static-labels-source.ts b/server/utils/static-labels-source.ts
index cf748c2b5..1cb14e7a6 100644
--- a/server/utils/static-labels-source.ts
+++ b/server/utils/static-labels-source.ts
@@ -29,7 +29,7 @@ const validate = (bundle: StaticLabelsBundle, chainId: number): StaticLabelsBund
   return bundle
 }
 
-/** All six documents succeed together, or the entire last-known-good snapshot is retained. */
+/** Missing documents use empty collections; failed refreshes retain the entire last-known-good snapshot. */
 export const getStaticLabelsBundle = (chainId: number, force = false): Promise<StaticLabelsBundle> => {
   const base = resolveLabelsBaseUrl()
   const key = `${base}:${chainId}`
@@ -55,6 +55,8 @@ export const getStaticLabelsBundle = (chainId: number, force = false): Promise<S
       const bundle = await withWallClock(async () => {
         const read = async (scope: number | 'all', name: string) => {
           const response = await fetchWithTimeout(`${base}/${scope}/${name}.json`)
+          // Match the labels file contract, including S3/CDN missing-key 403 responses.
+          if (response.status === 404 || response.status === 403) return name === 'products' || name === 'entities' ? {} : []
           if (!response.ok) throw new Error(`Static labels ${scope}/${name}: HTTP ${response.status}`)
           return response.json()
         }
diff --git a/tests/server/static-labels-source.test.ts b/tests/server/static-labels-source.test.ts
index 545f19d3a..6851cf2a1 100644
--- a/tests/server/static-labels-source.test.ts
+++ b/tests/server/static-labels-source.test.ts
@@ -45,10 +45,52 @@ describe('static authoring source', () => {
     expect(data.assetPatternRules[0]?.nameRegex?.test('ondo')).toBe(true)
     expect(data.earnVaultRestrictions).toEqual({ ['0x' + '2'.repeat(40)]: ['GB'] })
   })
-  it('fails cold on an absent asset file instead of treating 404 as empty policy', async () => {
-    fetchMock.mockResolvedValue(Response.json({}, { status: 404 }))
+  it.each([403, 404])('accepts omitted files with HTTP %s while preserving global asset rules', async (status) => {
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => url.endsWith('/1/assets.json') || url.endsWith('/1/earn-vaults.json')
+      ? new Response(null, { status })
+      : defaultFetch(url))
     const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
-    await expect(getStaticLabelsBundle(1)).rejects.toThrow('HTTP 404')
+    const raw = await getStaticLabelsBundle(1)
+    const data = normalizeLabelsBundle(1, raw)
+    expect(raw.files.assets).toEqual([{ nameRegex: '^ond[o]', restricted: ['EEA'] }])
+    expect(data.verifiedVaultAddresses).toEqual(['0x' + '1'.repeat(40)])
+    expect(data.earnVaults).toEqual([])
+    expect(data.assetPatternRules[0]?.nameRegex?.test('ondo')).toBe(true)
+    expect(data.products.fork.block).toEqual(['US'])
+  })
+  it('preserves chain asset rules when the global file is omitted', async () => {
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => url.endsWith('/all/assets.json')
+      ? new Response(null, { status: 404 })
+      : defaultFetch(url))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const raw = await getStaticLabelsBundle(1)
+    expect(raw.files.assets).toEqual(files.assets)
+    expect(normalizeLabelsBundle(1, raw).assetBlocks).toEqual({ ['0x' + '4'.repeat(40)]: ['US'] })
+  })
+  it.each([403, 404])('uses the correct empty shapes when all files return HTTP %s', async (status) => {
+    fetchMock.mockImplementation(async () => new Response(null, { status }))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const raw = await getStaticLabelsBundle(1)
+    expect(raw.files).toEqual({ products: {}, entities: {}, points: [], earnVaults: [], assets: [] })
+    expect(normalizeLabelsBundle(1, raw).verifiedVaultAddresses).toEqual([])
+  })
+  it.each([401, 429, 500, 503])('fails cold on HTTP %s instead of treating it as an omitted file', async (status) => {
+    fetchMock.mockImplementation(async () => new Response(null, { status }))
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    await expect(getStaticLabelsBundle(1)).rejects.toThrow(`HTTP ${status}`)
+  })
+  it.each(['network', 'json', 'server'])('retains the whole snapshot when one asset file has a %s failure', async (failure) => {
+    const { getStaticLabelsBundle } = await import('~/server/utils/static-labels-source')
+    const first = await getStaticLabelsBundle(1)
+    const defaultFetch = fetchMock.getMockImplementation()!
+    fetchMock.mockImplementation(async (url: string) => {
+      if (!url.endsWith('/all/assets.json')) return defaultFetch(url)
+      if (failure === 'network') throw new Error('offline')
+      return failure === 'json' ? new Response('{') : new Response(null, { status: 503 })
+    })
+    expect(await getStaticLabelsBundle(1, true)).toEqual(first)
   })
   it('rejects malformed geo fields instead of silently dropping restrictions', async () => {
     fetchMock.mockImplementation(async (url: string) => Response.json(url.endsWith('/assets.json') ? [{ nameRegex: 42, block: ['US'] }] : url.endsWith('/products.json') || url.endsWith('/entities.json') ? {} : []))

From 02876b3fd2b31220332062a83375b68c7eecc93d Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:10:41 +0100
Subject: [PATCH 11/13] feat: configure v3 label selection from env

Apply deployment label-set and version defaults to shared server reads and isolate metadata caches by source and selection.
---
 .env.example                                |  4 ++
 docs/static-labels.md                       |  4 ++
 server/api/internal/public-labels.get.ts    |  6 +--
 server/utils/labels-base-url.ts             | 11 +++++
 server/utils/public-labels-source.ts        | 27 +++++++-----
 tests/server/public-labels-endpoint.test.ts | 11 ++++-
 tests/server/public-labels-source.test.ts   | 48 ++++++++++++++++++++-
 tests/server/static-labels-source.test.ts   |  2 +
 utils/public-labels.ts                      |  1 +
 9 files changed, 98 insertions(+), 16 deletions(-)

diff --git a/.env.example b/.env.example
index 37a12308f..56655596a 100644
--- a/.env.example
+++ b/.env.example
@@ -165,6 +165,10 @@ NUXT_PUBLIC_CONFIG_LOGO_URL=
 NUXT_PUBLIC_CONFIG_SOCIAL_IMAGE_URL=
 # Hosted mode reads V3 only. Forks can select their own static label files.
 LABELS_SOURCE=v3
+# V3 metadata dataset and default publication (latest or an immutable published version key).
+# Geo policies, visibility and governance addresses remain live and shared.
+LABELS_V3_SET=public
+LABELS_V3_VERSION=latest
 # Required only for LABELS_SOURCE=static: operator-owned five-file labels directory.
 STATIC_LABELS_BASE_URL=
 # Full URL for EulerChains.json (contract addresses). Takes precedence over
diff --git a/docs/static-labels.md b/docs/static-labels.md
index d8ddc29f1..105a9ddcd 100644
--- a/docs/static-labels.md
+++ b/docs/static-labels.md
@@ -2,6 +2,10 @@
 
 `LABELS_SOURCE=v3` is the default hosted mode. It reads published metadata, live visibility, governance addresses and geo policies from V3, without consulting any labels repository.
 
+Hosted deployments select metadata with `LABELS_V3_SET` (default `public`) and `LABELS_V3_VERSION` (default `latest`, or an immutable publication key such as `v20260911011146353` or `test-2026-06-30`). The SDK resolves `latest` within the selected set and applies that set/version to vault, product and entity metadata. Server caches separate upstream, set, chain and version. Unknown sets or unavailable publications fail rather than falling back to public. The internal endpoint's explicit `version` query still overrides the deployment default for diagnostics; the label set is server-configured. Draft selectors are not supported. Restart the service after changing these variables.
+
+These settings select published metadata, not an isolated staging system: visibility, geo policies, governance addresses and live platform fields continue to use the configured V3 backend. Static mode ignores the V3 label selectors.
+
 Forks select `LABELS_SOURCE=static` and set `STATIC_LABELS_BASE_URL` to their own HTTP(S) directory. The server and browser consume the same normalized snapshot as hosted mode. Authored membership determines discovery; hosted curation/visibility is never consulted. The SDK provides the shared file derivation function, while Lite owns atomic fetching, validation, caching and logo policy.
 
 ## Directory contract
diff --git a/server/api/internal/public-labels.get.ts b/server/api/internal/public-labels.get.ts
index 995844c7b..cfc3eef47 100644
--- a/server/api/internal/public-labels.get.ts
+++ b/server/api/internal/public-labels.get.ts
@@ -4,7 +4,7 @@ import {
   getPublicLabelsBundle,
   refreshPublicLabelsBundle,
 } from '~/server/utils/public-labels-source'
-import { PUBLIC_LABELS_RUNTIME_VERSION } from '~/utils/public-labels'
+import { isV3LabelsVersionSelector } from '~/server/utils/labels-base-url'
 
 const rateLimiter = createRateLimiter({
   max: 1000,
@@ -22,8 +22,8 @@ export default defineEventHandler(async (event) => {
 
   const version = typeof query.version === 'string' && query.version.length > 0
     ? query.version
-    : PUBLIC_LABELS_RUNTIME_VERSION
-  if (version !== PUBLIC_LABELS_RUNTIME_VERSION && !/^v[0-9]{17}$/.test(version)) {
+    : undefined
+  if (version !== undefined && !isV3LabelsVersionSelector(version)) {
     throw createError({ statusCode: 400, statusMessage: 'Invalid labels version' })
   }
 
diff --git a/server/utils/labels-base-url.ts b/server/utils/labels-base-url.ts
index 33a4e5e46..1d7204403 100644
--- a/server/utils/labels-base-url.ts
+++ b/server/utils/labels-base-url.ts
@@ -13,3 +13,14 @@ export function resolveLabelsBaseUrl(): string {
   }
   return value
 }
+
+export const isV3LabelsVersionSelector = (value: string): boolean =>
+  /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(value) && !['draft', 'current', 'production'].includes(value)
+
+export const readV3LabelsSelection = () => {
+  const labelSet = process.env.LABELS_V3_SET?.trim() || 'public'
+  const version = process.env.LABELS_V3_VERSION?.trim() || 'latest'
+  if (!/^[A-Za-z0-9_-]{1,100}$/.test(labelSet)) throw new Error('LABELS_V3_SET must be a label set ID (letters, numbers, underscore or hyphen; max 100 characters)')
+  if (!isV3LabelsVersionSelector(version)) throw new Error('LABELS_V3_VERSION must be latest or a published version key (max 100 letters, numbers, dots, underscores or hyphens)')
+  return { labelSet, version }
+}
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index 5bd6142ee..96beef62c 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -2,13 +2,12 @@ import { createGeoPolicySource } from './geo-policy-source'
 import { createTtlCache } from './cache'
 import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
 import { createInFlightDedup } from './in-flight'
-import { readLabelsSource } from './labels-base-url'
+import { readLabelsSource, readV3LabelsSelection } from './labels-base-url'
 import { getStaticLabelsBundle } from './static-labels-source'
 import { logger } from './logger'
 import { PublicLabelsV3Adapter } from '@eulerxyz/euler-v2-sdk/public-labels'
 import {
   normalizeLabelsBundle,
-  PUBLIC_LABELS_RUNTIME_VERSION,
   type PublicEulerLabelsData,
   type PublicLabelsBundle,
   type V3LabelsBundle,
@@ -35,7 +34,8 @@ const getGeoSource = () => {
   return loader
 }
 
-const cacheKey = (chainId: number, version: string): string => `${chainId}:${version}`
+const cacheKey = (chainId: number, labelSet: string, version: string): string =>
+  JSON.stringify([readResolvedV3ApiUrl(), labelSet, chainId, version])
 
 const buildRequest = (): PublicLabelsRequest => async <T>(
   path: string,
@@ -61,10 +61,12 @@ const buildRequest = (): PublicLabelsRequest => async <T>(
 
 export function refreshPublicLabelsBundle(
   chainId: number,
-  version = PUBLIC_LABELS_RUNTIME_VERSION,
+  version?: string,
 ): Promise<PublicLabelsBundle> {
   if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId, true)
-  const key = cacheKey(chainId, version)
+  const selection = readV3LabelsSelection()
+  const selectedVersion = version ?? selection.version
+  const key = cacheKey(chainId, selection.labelSet, selectedVersion)
   return inFlight.run(key, async () => {
     try {
       const bundle = await withWallClock(
@@ -72,12 +74,15 @@ export function refreshPublicLabelsBundle(
           const request = buildRequest()
           const adapter = new PublicLabelsV3Adapter({
             endpoint: readResolvedV3ApiUrl(),
+            labelSet: selection.labelSet,
+            version: selectedVersion,
             request,
           })
           const geo = await getGeoSource()(request)
-          const snapshot = await adapter.fetchPublicLabelsSnapshot(chainId, version, geo.policies)
+          const snapshot = await adapter.fetchPublicLabelsSnapshot(chainId, selectedVersion, geo.policies)
           normalizeLabelsBundle(chainId, snapshot)
           return {
+            labelSet: selection.labelSet,
             version: snapshot.version,
             geoFetchedAt: geo.fetchedAt,
             publicLabels: snapshot.publicLabels,
@@ -100,16 +105,18 @@ export function refreshPublicLabelsBundle(
 
 export function getPublicLabelsBundle(
   chainId: number,
-  version = PUBLIC_LABELS_RUNTIME_VERSION,
+  version?: string,
 ): Promise<PublicLabelsBundle> {
   if (readLabelsSource() === 'static') return getStaticLabelsBundle(chainId)
-  const hit = cache.get(cacheKey(chainId, version))
-  return hit ? Promise.resolve(hit) : refreshPublicLabelsBundle(chainId, version)
+  const selection = readV3LabelsSelection()
+  const selectedVersion = version ?? selection.version
+  const hit = cache.get(cacheKey(chainId, selection.labelSet, selectedVersion))
+  return hit ? Promise.resolve(hit) : refreshPublicLabelsBundle(chainId, selectedVersion)
 }
 
 export async function getPublicEulerLabelsData(
   chainId: number,
-  version = PUBLIC_LABELS_RUNTIME_VERSION,
+  version?: string,
 ): Promise<PublicEulerLabelsData> {
   const bundle = await getPublicLabelsBundle(chainId, version)
   return normalizeLabelsBundle(chainId, bundle)
diff --git a/tests/server/public-labels-endpoint.test.ts b/tests/server/public-labels-endpoint.test.ts
index eb9d6dbda..609bf7b7f 100644
--- a/tests/server/public-labels-endpoint.test.ts
+++ b/tests/server/public-labels-endpoint.test.ts
@@ -50,11 +50,11 @@ describe('public labels aggregate endpoint', () => {
     vi.unstubAllGlobals()
   })
 
-  it('uses the cached latest bundle for a normal request', async () => {
+  it('leaves an omitted version to the server deployment default', async () => {
     const handler = await loadHandler()
 
     await expect(handler({})).resolves.toEqual({ source: 'cache' })
-    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, 'latest')
+    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, undefined)
     expect(mocks.refreshPublicLabelsBundle).not.toHaveBeenCalled()
   })
 
@@ -67,6 +67,13 @@ describe('public labels aggregate endpoint', () => {
     expect(mocks.refreshPublicLabelsBundle).toHaveBeenCalledWith(1, 'v20260804151305236')
   })
 
+  it('passes a named published version through to the selected server source', async () => {
+    mocks.query = { chainId: '1', version: 'test-2026-06-30' }
+    const handler = await loadHandler()
+    await handler({})
+    expect(mocks.getPublicLabelsBundle).toHaveBeenCalledWith(1, 'test-2026-06-30')
+  })
+
   it('rejects unsupported version shapes before fetching', async () => {
     mocks.query = { chainId: '1', version: 'draft' }
     const handler = await loadHandler()
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index 1cce842af..6ef56b1b9 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -50,9 +50,11 @@ describe('public labels server source', () => {
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
     vi.stubEnv('LABELS_SOURCE', 'v3')
+    vi.stubEnv('LABELS_V3_SET', '')
+    vi.stubEnv('LABELS_V3_VERSION', '')
     vi.stubEnv('V3_API_URL', 'https://v3.example.test')
     mocks.fetchWithTimeout.mockReset().mockImplementation(async (url: string) =>
-      new URL(url).pathname.endsWith('/labels/sets/public/versions')
+      new URL(url).pathname.endsWith('/versions')
         ? versionsResponse()
         : emptyListResponse(),
     )
@@ -104,6 +106,50 @@ describe('public labels server source', () => {
     )).toBe(true)
   })
 
+  it('uses configured set and version for server reads without resolving latest', async () => {
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    vi.stubEnv('LABELS_V3_VERSION', 'v20260804151305236')
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const bundle = await getPublicLabelsBundle(1)
+    expect(bundle).toMatchObject({ labelSet: 'test-instance', version: 'v20260804151305236' })
+    const urls = mocks.fetchWithTimeout.mock.calls.map(([url]) => new URL(url))
+    expect(urls.some(url => url.pathname.endsWith('/versions'))).toBe(false)
+    expect(urls.filter(url => url.pathname.startsWith('/v3/labels/')).every(url =>
+      url.searchParams.get('labelSet') === 'test-instance' && url.searchParams.get('version') === 'v20260804151305236',
+    )).toBe(true)
+    expect(urls.filter(url => !url.pathname.startsWith('/v3/labels/')).every(url => !url.searchParams.has('labelSet'))).toBe(true)
+  })
+
+  it('separates cached and stale snapshots by set, version and upstream', async () => {
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    const other = await getPublicLabelsBundle(1)
+    expect(other).not.toBe(first)
+    expect(other).toMatchObject({ labelSet: 'test-instance' })
+    expect(mocks.fetchWithTimeout.mock.calls.some(([url]) => new URL(url).pathname === '/v3/labels/sets/test-instance/versions')).toBe(true)
+    vi.stubEnv('LABELS_V3_VERSION', 'v20260911011146353')
+    const pinned = await getPublicLabelsBundle(1)
+    expect(pinned).not.toBe(other)
+    expect(pinned.version).toBe('v20260911011146353')
+    mocks.fetchWithTimeout.mockRejectedValue(new Error('unavailable'))
+    vi.stubEnv('LABELS_V3_SET', 'unavailable-set')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('unavailable')
+    vi.stubEnv('LABELS_V3_SET', 'test-instance')
+    vi.stubEnv('V3_API_URL', 'https://another-v3.test')
+    await expect(getPublicLabelsBundle(1)).rejects.toThrow('unavailable')
+  })
+
+  it.each([
+    ['LABELS_V3_SET', '../public'],
+    ['LABELS_V3_VERSION', 'draft'],
+  ])('rejects invalid %s before making requests', async (key, value) => {
+    vi.stubEnv(key, value)
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    expect(() => getPublicLabelsBundle(1)).toThrow(key)
+    expect(mocks.fetchWithTimeout).not.toHaveBeenCalled()
+  })
+
   it('serves a bounded stale bundle when a refresh fails', async () => {
     const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
     const first = await getPublicLabelsBundle(1)
diff --git a/tests/server/static-labels-source.test.ts b/tests/server/static-labels-source.test.ts
index 6851cf2a1..c8491bc06 100644
--- a/tests/server/static-labels-source.test.ts
+++ b/tests/server/static-labels-source.test.ts
@@ -17,6 +17,8 @@ describe('static authoring source', () => {
     vi.stubEnv('GEO_POLICY_CACHE_DIR', directory)
     vi.stubEnv('STATIC_LABELS_BASE_URL', 'https://fork.test/labels')
     vi.stubEnv('LABELS_SOURCE', 'static')
+    vi.stubEnv('LABELS_V3_SET', '../ignored-in-static-mode')
+    vi.stubEnv('LABELS_V3_VERSION', 'draft')
     fetchMock.mockReset().mockImplementation(async (url: string) => {
       const filename = url.split('/').pop()
       const key = filename === 'earn-vaults.json' ? 'earnVaults' : filename?.replace('.json', '')
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index e2f966538..76a5a79de 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -34,6 +34,7 @@ export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
 
 export interface V3LabelsBundle {
   source?: 'v3'
+  labelSet?: string
   version: string
   publicLabels: PublicLabelsSource
   geoFetchedAt?: number

From 59ee1096179aef5b01908817932accb09aec1e7d Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:02:27 +0100
Subject: [PATCH 12/13] test: cover direct labels visibility in lite

Verify SDK fallback verdicts preserve membership and listing decisions through the shared server source, with stale snapshot recovery and cold-start failure coverage.
---
 docs/vault-labels-and-verification.md     |  2 ++
 tests/server/public-labels-source.test.ts | 44 +++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index 21b30be50..f44720d54 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -28,6 +28,8 @@ Oracle adapter identity and health assessments come from Data V3 through the SDK
 
 **Caching and fallback**: The server bundle has a 5-minute chain/version cache, concurrent cold loads share one in-flight fetch, and failures can return a bounded stale bundle. The browser deduplicates chain-scoped loads and rejects superseded responses. Visible tabs check freshness every minute and on focus/visibility changes, requesting a fresh server bundle after five minutes. Same-chain refreshes retain display data; verification becomes unavailable after fifteen minutes without a successful response. Requests time out after 35 seconds. Current hosted membership overrides cached positive registry flags, so refreshed revocations also update verification guards and verified EVault lists. Escrow perspective trust remains independent. An initial failure leaves labels unavailable with a retry action. Retry requests a fresh bundle and reloads vault discovery after labels recover.
 
+**Inventory gaps**: The SDK reads direct V3 visibility for labelled vaults absent from the EVK/Earn inventories, with at most eight requests in flight. This covers Securitize labels without inventing a verdict. Effective lend/borrow listing decisions are preserved, so a visible collateral wrapper may remain hidden from lend discovery. Direct-verdict failures fail the aggregate refresh and use the same bounded stale-snapshot behavior described above. Hosted governor/owner verification still applies separately.
+
 **Address normalization**: All addresses from labels are checksummed via `getAddress()` before storage, ensuring consistent lookups regardless of input casing.
 
 ---
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index 6ef56b1b9..5aabf27ec 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -1,6 +1,8 @@
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { getAddress } from 'viem'
+import { KPK_VAULT, publicLabelsFixture } from '~/tests/fixtures/public-labels-v20260804151305236'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
@@ -94,6 +96,48 @@ describe('public labels server source', () => {
     )).toBe(true)
   })
 
+  it('loads missing inventory verdicts through the SDK and retains them on refresh failure', async () => {
+    const address = KPK_VAULT.toLowerCase()
+    let failVisibility = false
+    const json = (data: unknown, total?: number) => new Response(JSON.stringify({ data, meta: { total, timestamp: '2026-09-14T12:00:00Z' } }))
+    mocks.fetchWithTimeout.mockImplementation(async (input: string) => {
+      const url = new URL(input)
+      const path = url.pathname
+      if (path.endsWith('/versions')) return versionsResponse()
+      if (path === '/v3/labels/vaults') return json([{ ...publicLabelsFixture.vaults[0], vaultType: 'securitize' }], 1)
+      if (path === '/v3/labels/products') return json(publicLabelsFixture.products, publicLabelsFixture.products.length)
+      if (path === '/v3/labels/entities') return json(publicLabelsFixture.entities, publicLabelsFixture.entities.length)
+      if (path.startsWith('/v3/labels/entities/')) {
+        const entityId = path.split('/')[4]
+        if (path.endsWith('/addresses')) {
+          const addresses = publicLabelsFixture.entityAddresses.filter(row => row.entityId === entityId)
+          return json(addresses, addresses.length)
+        }
+        return json(publicLabelsFixture.entities.find(row => row.id === entityId))
+      }
+      if (path === `/v3/evk/vaults/1/${address}/visibility`) {
+        expect(url.search).toBe('')
+        if (failVisibility) return new Response('unavailable', { status: 503 })
+        return json({ chainId: 1, vaultAddress: address, status: 'visible', checks: {
+          decidedBy: 'verified', notExplorableLend: false,
+          listing: { lend: { hidden: true }, borrow: { hidden: false } },
+        } })
+      }
+      return emptyListResponse()
+    })
+    const { getPublicLabelsBundle, getPublicEulerLabelsData, refreshPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const first = await getPublicLabelsBundle(1)
+    const data = await getPublicEulerLabelsData(1)
+    expect(data.verifiedVaultAddresses).toContain(getAddress(KPK_VAULT))
+    expect(data.managingEntityByVault?.[address]).toBe('kpk')
+    expect(data.visibility?.[address]).toMatchObject({ status: 'visible', explorableLend: false, explorableBorrow: true })
+    failVisibility = true
+    await expect(refreshPublicLabelsBundle(1)).resolves.toBe(first)
+    vi.resetModules()
+    const cold = await import('~/server/utils/public-labels-source')
+    await expect(cold.getPublicLabelsBundle(1)).rejects.toThrow('503')
+  })
+
   it('uses deterministic fixture versions directly without resolving latest', async () => {
     const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
 

From af923555bf6c19639d4b1745941262b594354c80 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Tue, 15 Sep 2026 16:37:02 +0100
Subject: [PATCH 13/13] feat: retain labels on deprecated chains

Use metadata-only V3 labels for enabled deprecated chains with on-chain SDK reads. Preserve authored discovery settings and current governance verification; fix live refresh, batch labels fetching and public metadata projection.
---
 .env.example                                  |  2 +
 composables/useEulerLabels.ts                 | 14 +++++
 composables/useTxBatch.ts                     | 10 ++-
 composables/useVaultRegistry.ts               | 19 ++++++
 composables/useVaults.ts                      | 30 ++++-----
 docs/vault-labels-and-verification.md         | 12 ++++
 server/plugins/warm-cache.ts                  |  9 ++-
 server/utils/labels-base-url.ts               | 15 +++++
 server/utils/labels-view.ts                   | 13 ++--
 server/utils/public-labels-source.ts          | 19 +++---
 server/utils/vault-metadata.ts                | 18 +++---
 server/utils/vaults-cache.ts                  |  5 +-
 tests/composables/useEulerLabels.test.ts      | 29 ++++++++-
 tests/composables/useTxBatch.test.ts          | 15 +++--
 tests/composables/useVaultRegistry.test.ts    | 50 +++++++++++++++
 tests/composables/useVaults.test.ts           | 22 +++++++
 tests/server/labels-base-url.test.ts          | 27 +++++++-
 .../metadata-labels-verification.test.ts      | 38 ++++++++++++
 tests/server/public-labels-source.test.ts     | 19 ++++++
 tests/server/vault-metadata-content.test.ts   | 62 +++++++++++++++++++
 tests/utils/public-labels.test.ts             | 41 +++++++++++-
 utils/public-labels.ts                        | 37 ++++++++++-
 utils/vault/governor-verification.ts          |  2 +-
 23 files changed, 449 insertions(+), 59 deletions(-)
 create mode 100644 tests/server/metadata-labels-verification.test.ts
 create mode 100644 tests/server/vault-metadata-content.test.ts

diff --git a/.env.example b/.env.example
index 56655596a..6ecaea953 100644
--- a/.env.example
+++ b/.env.example
@@ -169,6 +169,8 @@ LABELS_SOURCE=v3
 # Geo policies, visibility and governance addresses remain live and shared.
 LABELS_V3_SET=public
 LABELS_V3_VERSION=latest
+# Enabled DEPRECATED_CHAINS use V3 metadata with Lite on-chain verification.
+# They must also be in ONCHAIN_SDK_CHAINS. Other enabled chains use V3 assessments.
 # Required only for LABELS_SOURCE=static: operator-owned five-file labels directory.
 STATIC_LABELS_BASE_URL=
 # Full URL for EulerChains.json (contract addresses). Takes precedence over
diff --git a/composables/useEulerLabels.ts b/composables/useEulerLabels.ts
index 0592f72ce..f7ee47771 100644
--- a/composables/useEulerLabels.ts
+++ b/composables/useEulerLabels.ts
@@ -21,6 +21,8 @@ import { buildBatchItem, evcBatchCall } from '~/utils/multicall'
 import { normalizeAddress } from '~/utils/normalizeAddress'
 import {
   normalizeLabelsBundle,
+  getLabelVaultCandidates,
+  getLabelsVaultLoadKey,
   type PublicEulerLabelsData,
   type PublicLabelsBundle,
 } from '~/utils/public-labels'
@@ -112,6 +114,8 @@ const entities = toReactive(computed(() => labelsData.value.entities as Record<s
 const points = toReactive(computed(() => labelsData.value.points as Record<string, EulerLabelPointReward[]>))
 const verifiedVaultAddresses = computed(() => labelsData.value.verifiedVaultAddresses)
 const earnVaults = computed(() => labelsData.value.earnVaults)
+const vaultCandidates = computed(() => getLabelVaultCandidates(labelsData.value).vaults)
+const earnCandidates = computed(() => getLabelVaultCandidates(labelsData.value).earn)
 const visibility = computed(() => labelsData.value.visibility)
 const geoPolicies = computed(() => labelsData.value.rawGeoPolicies)
 
@@ -202,7 +206,15 @@ const refreshLabelsIfStale = async () => {
     isReady.value = false
   }
   if (isLoading.value) return
+  const previous = labelsData.value
+  const previousChain = labelsChainId.value
+  const previousKey = getLabelsVaultLoadKey(previous)
   await loadLabels()
+  if (isReady.value && previousChain === labelsChainId.value && previous !== labelsData.value
+    && previousKey !== getLabelsVaultLoadKey(labelsData.value)) {
+    // Open forms may hold unlisted vaults which discovery does not reload.
+    await useVaults().loadVaults({ preserveRegistry: true })
+  }
 }
 
 const retryLabels = async () => {
@@ -295,6 +307,8 @@ export const useEulerLabels = () => {
     isReady,
     loadError,
     verifiedVaultAddresses,
+    vaultCandidates,
+    earnCandidates,
     products,
     entities,
     points,
diff --git a/composables/useTxBatch.ts b/composables/useTxBatch.ts
index e4183d40a..a20e87e4e 100644
--- a/composables/useTxBatch.ts
+++ b/composables/useTxBatch.ts
@@ -1,3 +1,4 @@
+import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
 import { computed, effectScope, ref, shallowRef, watch, type EffectScope, type Ref } from 'vue'
 import { formatUnits, getAddress, type Address, type Hash, type StateOverride } from 'viem'
 import { Account, fetchErc20SlotHints, getEulerLabelProductByVault, mergeStateOverrides } from '@eulerxyz/euler-v2-sdk'
@@ -665,7 +666,10 @@ export const fetchBaseAccountSnapshot = async (
   owner: Address,
 ): Promise<Account<IHasVaultAddress>> => {
   const fetched = await sdk.accountService.fetchAccount(chainId, owner, {
-    populateAll: true,
+    populateVaults: true,
+    populateMarketPrices: true,
+    populateUserRewards: true,
+    vaultFetchOptions: liteVaultFetchOptions,
   })
   return fetched.result as Account<IHasVaultAddress>
 }
@@ -1525,7 +1529,7 @@ export const stitchAccount = (
 ): Account<IHasVaultAddress> => {
   // Reward + intrinsic-APY metadata is populated directly on the simulated
   // vaults by simulateTransactionPlan (vaultFetchOptions), matching the base
-  // account's populateAll. The simulated account only contains the touched
+  // account's explicit population options. The simulated account only contains the touched
   // slice, so we merge positions first and then recompute USD fields that depend
   // on the full sub-account context.
   const mergedSubs: Record<string, StitchSubAccount> = {}
@@ -1771,7 +1775,7 @@ export const useTxBatch = () => {
           stateOverrideOptions: { slotHints: batchSlotHints },
           extraStateOverrides,
           // Populate the simulated vaults with reward campaigns + intrinsic
-          // (e.g. staking) APY, exactly as the base account is via populateAll —
+          // (e.g. staking) APY, exactly as the base account is via its fetch options —
           // so the simulated portfolio's net APY / ROE and per-position
           // supply/borrow costs include them, including for vaults entered for
           // the first time in the batch (which the base account can't supply).
diff --git a/composables/useVaultRegistry.ts b/composables/useVaultRegistry.ts
index 68f3bab29..a8a9fcb5e 100644
--- a/composables/useVaultRegistry.ts
+++ b/composables/useVaultRegistry.ts
@@ -1,3 +1,6 @@
+import { getEulerLabelsSourceData } from '~/composables/useEulerLabels'
+import { getLabelVaultCandidates } from '~/utils/public-labels'
+import { getHostedEntityKeys, isVaultGovernorVerified, isEarnVaultOwnerVerified } from '~/utils/vault/governor-verification'
 import type { EulerEarn, SecuritizeCollateralVault, EVault, VaultEntity } from '@eulerxyz/euler-v2-sdk'
 import { fetchVaultCategory } from '~/utils/vault/categories'
 import { getAddress, type Address } from 'viem'
@@ -267,6 +270,22 @@ const isEVaultAddress = (address: string): boolean => getType(address) === 'evk'
 const isVerifiedVault = (address: string): boolean => {
   const { verifiedVaultAddresses, earnVaults, visibility } = useEulerLabels()
   const normalized = normalizeAddress(address)
+  const labels = getEulerLabelsSourceData()
+  if (labels.source === 'v3-metadata') {
+    if (isEscrowVault(normalized)) return true
+    const entry = get(normalized)
+    const candidates = getLabelVaultCandidates(labels)
+    if (!entry || ![...candidates.vaults, ...candidates.earn].some(addr => normalizeAddress(addr) === normalized)) return false
+    const verificationLabels = {
+      getDeclaredEntityKeys: (addr: string) => getHostedEntityKeys(labels, addr),
+      hasEntityAddress: (key: string, addr: Address) => Object.keys(labels.entities[key]?.addresses ?? {})
+        .some(candidate => normalizeAddress(candidate) === normalizeAddress(addr)),
+    }
+    // Re-evaluate against current membership and entity addresses, never the cached positive flag.
+    return entry.type === 'earn'
+      ? isEarnVaultOwnerVerified(Object.assign({}, entry.vault as EulerEarn, { verified: true }), verificationLabels)
+      : isVaultGovernorVerified(Object.assign({}, entry.vault as EVault | SecuritizeCollateralVault, { verified: true }), verificationLabels)
+  }
   // Registry metadata describes the fetch that created the entry. Current
   // labels must be able to revoke that earlier positive verification.
   return isEscrowVault(normalized)
diff --git a/composables/useVaults.ts b/composables/useVaults.ts
index a9a9d1207..cc2d9b76c 100644
--- a/composables/useVaults.ts
+++ b/composables/useVaults.ts
@@ -210,10 +210,10 @@ const borrowPairCache = new Map<string, AnyBorrowVaultPair>()
 
 const borrowList = computed((): AnyBorrowVaultPair[] => {
   const { getVerifiedEVaults, getVault: registryGetVault } = useVaultRegistry()
-  const { verifiedVaultAddresses } = useEulerLabels()
+  const { vaultCandidates } = useEulerLabels()
   const pairs: AnyBorrowVaultPair[] = []
   const vaultOrder = new Map(
-    verifiedVaultAddresses.value.map((address, index) => [address.toLowerCase(), index]),
+    vaultCandidates.value.map((address, index) => [address.toLowerCase(), index]),
   )
   const getVaultOrder = (address: string) => vaultOrder.get(address.toLowerCase()) ?? Number.MAX_SAFE_INTEGER
   const eVaults = [...getVerifiedEVaults(showAllLabelEntries.value)]
@@ -259,7 +259,7 @@ const borrowList = computed((): AnyBorrowVaultPair[] => {
   return pairs
 })
 
-const resetVaultsState = () => {
+const resetVaultsState = (options: { preserveRegistry?: boolean } = {}) => {
   const { clear } = useVaultRegistry()
 
   loadGeneration.value++
@@ -276,7 +276,7 @@ const resetVaultsState = () => {
   isEscrowUpdating.value = true
   isEscrowLoadedOnce.value = false
   loadedChainId.value = null
-  clear()
+  if (!options.preserveRegistry) clear()
   resetVaultCategoryCache()
 }
 
@@ -388,7 +388,7 @@ const updateEarnVaults = async (vaultAddresses: string[], generation?: number, s
     if (!isCurrentVaultLoad(gen, targetChainId)) return
     result.errors.forEach(issue => logWarn('useVaults/updateEarnVaults', issue))
 
-    const curatedAddresses = new Set(useEulerLabels().earnVaults.value.map(address => getAddress(address).toLowerCase()))
+    const curatedAddresses = new Set(useEulerLabels().earnCandidates.value.map(address => getAddress(address).toLowerCase()))
     registrySetMany((result.result.filter(Boolean) as EulerEarn[]).map(vault => ({
       address: vault.address,
       vault,
@@ -787,12 +787,12 @@ const hydrateFromServer = async (targetChainId: number, generation: number): Pro
   }
 }
 
-const loadVaults = async () => {
+const loadVaults = async (options: { preserveRegistry?: boolean } = {}) => {
   const { chainId } = useEulerAddresses()
-  const { verifiedVaultAddresses, earnVaults: earnVaultAddresses } = useEulerLabels()
+  const { vaultCandidates, earnCandidates: earnVaultAddresses } = useEulerLabels()
   const { setEscrowAddresses } = useVaultRegistry()
 
-  resetVaultsState()
+  resetVaultsState(options)
   const generation = loadGeneration.value
   const startChainId = chainId.value
 
@@ -809,8 +809,8 @@ const loadVaults = async () => {
 
   // Filter out non-explorable vaults before any on-chain work
   const explorableVaultAddresses = showAllLabelEntries.value
-    ? verifiedVaultAddresses.value
-    : verifiedVaultAddresses.value.filter(addr => !isVaultNotExplorable(addr))
+    ? vaultCandidates.value
+    : vaultCandidates.value.filter(addr => !isVaultNotExplorable(addr))
   const explorableEarnAddresses = showAllLabelEntries.value
     ? earnVaultAddresses.value
     : earnVaultAddresses.value.filter(addr => !isEarnVaultNotExplorable(addr))
@@ -940,7 +940,7 @@ const loadVaults = async () => {
   }
 }
 const getVault = async (address: string): Promise<EVault> => {
-  const { verifiedVaultAddresses } = useEulerLabels()
+  const { vaultCandidates } = useEulerLabels()
   const {
     getType,
     getVault: registryGetVault,
@@ -961,11 +961,11 @@ const getVault = async (address: string): Promise<EVault> => {
     return registryGetVault(normalizedAddress) as EVault
   }
 
-  // If still no type info and address is in verifiedVaultAddresses but not in registry,
+  // If still no type info and address is in vaultCandidates but not in registry,
   // do an async check to avoid infinite wait on securitize vaults
   if (
     !vaultType
-    && verifiedVaultAddresses.value.includes(normalizedAddress)
+    && vaultCandidates.value.includes(normalizedAddress)
     && !registryHas(normalizedAddress)
   ) {
     const isSecuritize = await isSecuritizeVault(normalizedAddress)
@@ -974,7 +974,7 @@ const getVault = async (address: string): Promise<EVault> => {
     }
   }
 
-  if (verifiedVaultAddresses.value.includes(normalizedAddress) && !isVaultNotExplorable(normalizedAddress)) {
+  if (vaultCandidates.value.includes(normalizedAddress) && !isVaultNotExplorable(normalizedAddress)) {
     await until(computed(() => Boolean(registryGetVault(normalizedAddress)))).toMatch(Boolean)
     return registryGetVault(normalizedAddress) as EVault
   }
@@ -996,7 +996,7 @@ const getVault = async (address: string): Promise<EVault> => {
 const getEarnVault = async (address: string): Promise<EulerEarn> => {
   const { getVault: registryGetVault, set: registrySet } = useVaultRegistry()
   const normalizedAddress = getAddress(address)
-  const { earnVaults } = useEulerLabels()
+  const { earnCandidates: earnVaults } = useEulerLabels()
   const targetChainId = resolveTargetChainId()
 
   const fetchAndStoreEarnVault = async () => {
diff --git a/docs/vault-labels-and-verification.md b/docs/vault-labels-and-verification.md
index f44720d54..bcc385aa2 100644
--- a/docs/vault-labels-and-verification.md
+++ b/docs/vault-labels-and-verification.md
@@ -265,3 +265,15 @@ Consumers that need display metadata (resolved name, description, governing enti
 
 
 Hosted full verification resolves the managing entity from the V3 vault row, including standalone Earn vaults. Missing manager data yields an empty authority set, so a visible/warning inventory entry alone cannot grant an owner-verification badge. Both client and public APIs apply this rule. Static Earn labels preserve their authored membership semantics. Hosted on-chain governor/owner checks remain in place until the verification bake justifies delegation to V3.
+
+## Archived chains: V3 metadata with on-chain verification
+
+Enabled `DEPRECATED_CHAINS` select the SDK's `PublicLabelsV3MetadataAdapter`. Each must also be in `ONCHAIN_SDK_CHAINS`; a missing entry is a configuration error. Chains without a configured RPC are ignored, and other enabled chains keep V3 assessments even if they use on-chain SDK reads. No separate labels chain variable is required. The archived-chain configuration is `DEPRECATED_CHAINS=146,239,60808,80094`; restart after configuration changes. Swellchain is not selected unless enabled and added to the deprecated/on-chain lists.
+
+The SDK shares metadata fetching and display mapping between its adapters. Metadata-only bundles carry `source: 'v3-metadata'` and contain no visibility verdicts. They use the same label set/publication selection, live entity addresses and live geo policies as the assessed path. Candidate addresses are separate from verified membership.
+
+Lite selects the adapter once in its shared server labels loader. The browser, vault snapshots and public APIs use that selection. The metadata-only path applies the existing governor/router/owner checks against the vault's explicit managing entity; an absent manager cannot inherit static Earn trust. Registry verification uses current candidates and entity addresses rather than a cached positive flag. Independent escrow-perspective verification remains applicable.
+
+Metadata-only discovery follows published product `notExplorable` and per-vault `notExplorableLend` / `notExplorableBorrow` flags and normal market filters. Explore product cards are label/market driven; governance checks separately control verified vault lists and verification badges. Deprecation alone does not hide a vault; Earn uses its lend-side flag and product hiding. Published deprecation and display information remains available to direct pages and existing positions. V3 assessment-based platform listing controls are not synthesized for these chains. Errors on normally assessed chains never switch them to metadata-only handling. Static fork mode remains independent.
+
+Live labels refreshes reload vault data when membership or discovery eligibility changes; text-only updates use the reactive labels store. This brings newly eligible vaults into the registry without requiring a page reload. Same-chain label refreshes retain already loaded vaults, including unlisted vaults used by open forms; current hosted membership still controls verification. Ordinary loads and chain changes clear the registry. Batch-review account reads request quantitative data explicitly and do not invoke the SDK's default file-based labels service through `populateAll`.
diff --git a/server/plugins/warm-cache.ts b/server/plugins/warm-cache.ts
index bf7591599..5c41881f4 100644
--- a/server/plugins/warm-cache.ts
+++ b/server/plugins/warm-cache.ts
@@ -1,7 +1,6 @@
 /**
  * Pre-populates the in-memory TTL caches for every proxy that serves
- * static/low-churn data (Public Labels, effective policy, token-list,
- * Euler Chains) and for the
+ * static/low-churn data (Public Labels, token-list, Euler Chains) and for the
  * per-chain vault snapshot served at /api/internal/vaults.
  *
  * Nitro's node-server preset calls `server.listen()` synchronously right
@@ -15,9 +14,9 @@
  *
  * Two timers, each with its own cadence:
  *
- *   • Global cycle (5 min): Euler Chains and runtime ABIs once, cross-chain effective asset
- *     policy once, then each chain's Public Labels bundle, effective policy,
- *     and token list, serialized across chains.
+ *   • Global cycle (5 min): Euler Chains and runtime ABIs once, then each
+ *     chain's labels bundle and token list, serialized across chains. Hosted
+ *     bundles share the live geo-policy cache.
  *   • Vaults cycle (1 min when V3 is configured, otherwise 5 min):
  *     /api/internal/vaults per chain, serialized.
  *
diff --git a/server/utils/labels-base-url.ts b/server/utils/labels-base-url.ts
index 1d7204403..89b4429ae 100644
--- a/server/utils/labels-base-url.ts
+++ b/server/utils/labels-base-url.ts
@@ -1,3 +1,6 @@
+import { getEnabledChainIds } from '~/utils/chain-env'
+import { parseChainIds } from '~/utils/parseChainIds'
+
 export const readLabelsSource = (): 'v3' | 'static' => {
   const source = process.env.LABELS_SOURCE?.trim() || 'v3'
   if (source !== 'v3' && source !== 'static') throw new Error('LABELS_SOURCE must be v3 or static')
@@ -24,3 +27,15 @@ export const readV3LabelsSelection = () => {
   if (!isV3LabelsVersionSelector(version)) throw new Error('LABELS_V3_VERSION must be latest or a published version key (max 100 letters, numbers, dots, underscores or hyphens)')
   return { labelSet, version }
 }
+
+/** Deprecated enabled chains retain metadata with on-chain verification. */
+export const readLabelsOnchainVerificationChains = (): number[] => {
+  const enabled = new Set(getEnabledChainIds())
+  const deprecated = [...new Set(parseChainIds(process.env.DEPRECATED_CHAINS, enabled))]
+  const onchain = new Set(parseChainIds(process.env.ONCHAIN_SDK_CHAINS))
+  const missing = deprecated.filter(id => !onchain.has(id))
+  if (missing.length) {
+    throw new Error(`Deprecated labels chains must be in ONCHAIN_SDK_CHAINS: ${missing.join(',')}`)
+  }
+  return deprecated
+}
diff --git a/server/utils/labels-view.ts b/server/utils/labels-view.ts
index 8ba050bfa..98d1a929f 100644
--- a/server/utils/labels-view.ts
+++ b/server/utils/labels-view.ts
@@ -1,3 +1,4 @@
+import { getLabelVaultCandidates, type PublicEulerLabelsData } from '~/utils/public-labels'
 /**
  * Per-chain "labels view" shared by /api/public/is-known and
  * /api/public/metadata. It keeps Lite's public API/cache policy in the app,
@@ -66,7 +67,7 @@ interface TokenListEntry {
 }
 
 export interface ProductDescriptor {
-  slug: string
+  slug: string | null
   name: string
   description: string | null
   portfolioNotice: string | null
@@ -161,7 +162,7 @@ export function buildProductDescriptors(products: Record<string, ProductEntryFul
       }
     }
     const desc: ProductDescriptor = {
-      slug,
+      slug: product.isStandalone ? null : slug,
       name: strOrEmpty(product.name),
       description: strOrNull(product.description),
       portfolioNotice: strOrNull(product.portfolioNotice),
@@ -230,21 +231,21 @@ function withVaultMetadata<T extends object>(
 async function buildSnapshot(
   chainId: number,
   sdk: EulerSDK,
-  labels: EulerLabelsData,
+  labels: PublicEulerLabelsData,
 ): Promise<{ snapshot: ChainVaultsSnapshot, escrowAddresses: Set<Address> }> {
   const escrowAddresses = new Set<Address>(
     uniqueAddresses(await sdk.eVaultService.fetchVerifiedVaultAddresses(chainId, [StandardEVaultPerspectives.ESCROW])),
   )
   const candidates = uniqueAddresses([
-    ...labels.verifiedVaultAddresses,
-    ...labels.earnVaults,
+    ...getLabelVaultCandidates(labels).vaults,
+    ...getLabelVaultCandidates(labels).earn,
   ])
 
   const types = candidates.length > 0
     ? await sdk.vaultMetaService.fetchVaultTypes(chainId, candidates)
     : {}
 
-  const earnSet = new Set(uniqueAddresses(labels.earnVaults).map(addr => addr.toLowerCase()))
+  const earnSet = new Set(uniqueAddresses(getLabelVaultCandidates(labels).earn).map(addr => addr.toLowerCase()))
   const evkAddresses: Address[] = []
   const securitizeAddresses: Address[] = []
   const earnAddresses: Address[] = []
diff --git a/server/utils/public-labels-source.ts b/server/utils/public-labels-source.ts
index 96beef62c..1c86bf5b7 100644
--- a/server/utils/public-labels-source.ts
+++ b/server/utils/public-labels-source.ts
@@ -2,15 +2,15 @@ import { createGeoPolicySource } from './geo-policy-source'
 import { createTtlCache } from './cache'
 import { fetchWithTimeout, withWallClock } from './fetchWithTimeout'
 import { createInFlightDedup } from './in-flight'
-import { readLabelsSource, readV3LabelsSelection } from './labels-base-url'
+import { readLabelsSource, readV3LabelsSelection, readLabelsOnchainVerificationChains } from './labels-base-url'
 import { getStaticLabelsBundle } from './static-labels-source'
 import { logger } from './logger'
-import { PublicLabelsV3Adapter } from '@eulerxyz/euler-v2-sdk/public-labels'
+import { PublicLabelsV3Adapter, PublicLabelsV3MetadataAdapter } from '@eulerxyz/euler-v2-sdk/public-labels'
 import {
   normalizeLabelsBundle,
   type PublicEulerLabelsData,
   type PublicLabelsBundle,
-  type V3LabelsBundle,
+  type HostedLabelsBundle,
   type PublicLabelsQuery,
   type PublicLabelsRequest,
   type PublicLabelsResponse,
@@ -20,8 +20,8 @@ import { readResolvedV3ApiUrl, readV3ApiKey } from '~/utils/api-url-env'
 const CACHE_TTL_MS = 300_000
 const REFRESH_BUDGET_MS = 30_000
 
-const cache = createTtlCache<V3LabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
-const inFlight = createInFlightDedup<string, V3LabelsBundle>()
+const cache = createTtlCache<HostedLabelsBundle>({ ttlMs: CACHE_TTL_MS, maxEntries: 64 })
+const inFlight = createInFlightDedup<string, HostedLabelsBundle>()
 
 const geoSources = new Map<string, ReturnType<typeof createGeoPolicySource>>()
 const getGeoSource = () => {
@@ -35,7 +35,7 @@ const getGeoSource = () => {
 }
 
 const cacheKey = (chainId: number, labelSet: string, version: string): string =>
-  JSON.stringify([readResolvedV3ApiUrl(), labelSet, chainId, version])
+  JSON.stringify([readResolvedV3ApiUrl(), labelSet, chainId, version, readLabelsOnchainVerificationChains().includes(chainId)])
 
 const buildRequest = (): PublicLabelsRequest => async <T>(
   path: string,
@@ -72,7 +72,8 @@ export function refreshPublicLabelsBundle(
       const bundle = await withWallClock(
         async () => {
           const request = buildRequest()
-          const adapter = new PublicLabelsV3Adapter({
+          const Adapter = readLabelsOnchainVerificationChains().includes(chainId) ? PublicLabelsV3MetadataAdapter : PublicLabelsV3Adapter
+          const adapter = new Adapter({
             endpoint: readResolvedV3ApiUrl(),
             labelSet: selection.labelSet,
             version: selectedVersion,
@@ -82,10 +83,8 @@ export function refreshPublicLabelsBundle(
           const snapshot = await adapter.fetchPublicLabelsSnapshot(chainId, selectedVersion, geo.policies)
           normalizeLabelsBundle(chainId, snapshot)
           return {
-            labelSet: selection.labelSet,
-            version: snapshot.version,
+            ...snapshot,
             geoFetchedAt: geo.fetchedAt,
-            publicLabels: snapshot.publicLabels,
           }
         },
         REFRESH_BUDGET_MS,
diff --git a/server/utils/vault-metadata.ts b/server/utils/vault-metadata.ts
index a39efc5cf..851a4ebc2 100644
--- a/server/utils/vault-metadata.ts
+++ b/server/utils/vault-metadata.ts
@@ -136,10 +136,11 @@ function buildEvkMetadata(
   // the vault. On-chain ERC-20 name is only a fallback when labels carry
   // no name. Verification (governor match) only gates `entities` resolution
   // below, which is the security-sensitive "who manages this vault" claim.
-  const labelName = strOrNull(override?.name) ?? (product?.name || null)
-  const description = strOrNull(override?.description) ?? product?.description ?? null
-  const portfolioNotice = strOrNull(override?.portfolioNotice) ?? product?.portfolioNotice ?? null
-  const deprecationReason = strOrNull(override?.deprecationReason) ?? product?.deprecationReason ?? null
+  // Resolved empty strings clear inherited product content.
+  const labelName = strOrNull(override?.name ?? product?.name)
+  const description = strOrNull(override?.description ?? product?.description)
+  const portfolioNotice = strOrNull(override?.portfolioNotice ?? product?.portfolioNotice)
+  const deprecationReason = strOrNull(override?.deprecationReason ?? product?.deprecationReason)
 
   const entityKeys = verified ? resolveGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
@@ -173,10 +174,11 @@ function buildEarnMetadata(vault: EulerEarn, ctx: BuildContext): VaultMetadata |
 
   // Same rationale as buildEvkMetadata: label fields are authoritative
   // content. `verified` only gates `entities` resolution.
-  const labelName = product?.name || null
-  const description = strOrNull(earnEntry?.description) ?? product?.description ?? null
-  const portfolioNotice = strOrNull(earnEntry?.portfolioNotice) ?? product?.portfolioNotice ?? null
-  const deprecationReason = strOrNull(earnEntry?.deprecationReason) ?? product?.deprecationReason ?? null
+  const override = product?.vaultOverrides[addr]
+  const labelName = strOrNull(override?.name ?? product?.name)
+  const description = strOrNull(override?.description ?? earnEntry?.description ?? product?.description)
+  const portfolioNotice = strOrNull(override?.portfolioNotice ?? earnEntry?.portfolioNotice ?? product?.portfolioNotice)
+  const deprecationReason = strOrNull(override?.deprecationReason ?? earnEntry?.deprecationReason ?? product?.deprecationReason)
 
   const entityKeys = verified ? resolveEarnGoverningEntityKeys(vault, ctx.view.verificationLabels) : []
   const entities = entityKeys
diff --git a/server/utils/vaults-cache.ts b/server/utils/vaults-cache.ts
index c215a0e64..f19101d0b 100644
--- a/server/utils/vaults-cache.ts
+++ b/server/utils/vaults-cache.ts
@@ -1,3 +1,4 @@
+import { getLabelVaultCandidates } from '~/utils/public-labels'
 /**
  * Per-chain vault snapshot cache.
  *
@@ -190,8 +191,8 @@ export const refreshChainVaults = (chainId: number): Promise<SerialisedSnapshot>
     const { evkAddrs, securitizeAddrs, earnAddrs } = await partitionVerified(
       sdk,
       chainId,
-      uniqueAddresses(labels.verifiedVaultAddresses),
-      uniqueAddresses(labels.earnVaults),
+      uniqueAddresses(getLabelVaultCandidates(labels).vaults),
+      uniqueAddresses(getLabelVaultCandidates(labels).earn),
     )
 
     // populateCollaterals / populateStrategyVaults DISABLED — deferred to
diff --git a/tests/composables/useEulerLabels.test.ts b/tests/composables/useEulerLabels.test.ts
index ebd49df9b..f4ec513a7 100644
--- a/tests/composables/useEulerLabels.test.ts
+++ b/tests/composables/useEulerLabels.test.ts
@@ -33,6 +33,7 @@ const mocks = vi.hoisted(() => ({
   fetchPublicLabelsBundle: vi.fn(),
   normalizePublicLabelsData: vi.fn(),
   getProvider: vi.fn(),
+  loadVaults: vi.fn(),
   vaults: [] as Array<{ asset: { address: string } }>,
 }))
 
@@ -44,7 +45,8 @@ vi.mock('~/composables/useEulerSdk', () => ({
   })),
 }))
 
-vi.mock('~/utils/public-labels', () => ({
+vi.mock('~/utils/public-labels', async importOriginal => ({
+  ...await importOriginal<typeof import('~/utils/public-labels')>(),
   normalizeLabelsBundle: (_chainId: number, bundle: { publicLabels: unknown }) => mocks.normalizePublicLabelsData(_chainId, bundle.publicLabels),
 }))
 
@@ -106,6 +108,8 @@ describe('useEulerLabels chain-scoped loading', () => {
     mocks.normalizePublicLabelsData.mockReset().mockImplementation(
       (_chainId: number, labels: EulerLabelsData) => labels,
     )
+    mocks.loadVaults.mockReset().mockResolvedValue(undefined)
+    vi.stubGlobal('useVaults', () => ({ loadVaults: mocks.loadVaults }))
     mocks.getProvider.mockReset().mockReturnValue({})
     mocks.vaults.length = 0
     vi.stubGlobal('$fetch', mocks.fetchPublicLabelsBundle)
@@ -120,6 +124,29 @@ describe('useEulerLabels chain-scoped loading', () => {
     vi.unstubAllGlobals()
   })
 
+  it('loads newly eligible vaults after a live refresh but leaves unchanged data alone', async () => {
+    vi.useFakeTimers()
+    try {
+      const address = '0x0000000000000000000000000000000000000001'
+      const base = { ...getCurrentEulerLabelsData(), products: {}, verifiedVaultAddresses: [] }
+      const added = { ...base, verifiedVaultAddresses: [address] }
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(base))
+      const labels = useEulerLabels()
+      await labels.loadLabels()
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(added))
+      await vi.advanceTimersByTimeAsync(5 * 60_000)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.loadVaults).toHaveBeenCalledTimes(1)
+      expect(mocks.loadVaults).toHaveBeenCalledWith({ preserveRegistry: true })
+      mocks.fetchPublicLabelsBundle.mockResolvedValueOnce(bundleFor(structuredClone(added)))
+      await vi.advanceTimersByTimeAsync(5 * 60_000)
+      await labels.refreshLabelsIfStale()
+      expect(mocks.loadVaults).toHaveBeenCalledTimes(1)
+      expect(mocks.loadVaults).toHaveBeenCalledWith({ preserveRegistry: true })
+    }
+    finally { vi.useRealTimers() }
+  })
+
   it('keeps a failed initial load unavailable and retries the same chain', async () => {
     mocks.fetchPublicLabelsBundle.mockRejectedValueOnce(new Error('temporary outage'))
     const labels = useEulerLabels()
diff --git a/tests/composables/useTxBatch.test.ts b/tests/composables/useTxBatch.test.ts
index afe50616d..87610cd70 100644
--- a/tests/composables/useTxBatch.test.ts
+++ b/tests/composables/useTxBatch.test.ts
@@ -1,3 +1,4 @@
+import { liteVaultFetchOptions } from '~/utils/sdk-fetch-options'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
 import { Account, Portfolio, type EVCBatchItem, type IAccountPosition, type IHasVaultAddress, type IAccountLiquidity, type TransactionPlan } from '@eulerxyz/euler-v2-sdk'
@@ -712,7 +713,7 @@ describe('stitchAccount', () => {
 })
 
 describe('fetchBaseAccountSnapshot', () => {
-  it('uses the same full population path as the normal portfolio read', async () => {
+  it('populates review data explicitly without invoking SDK legacy labels', async () => {
     const expected = accountWithPosition(subAccount, subAccount, 1n)
     const fetchAccount = vi.fn(async () => ({ result: expected, errors: [] }))
     const sdk = {
@@ -722,7 +723,7 @@ describe('fetchBaseAccountSnapshot', () => {
     const result = await fetchBaseAccountSnapshot(sdk, 1, owner)
 
     expect(result).toBe(expected)
-    expect(fetchAccount).toHaveBeenCalledWith(1, owner, { populateAll: true })
+    expect(fetchAccount).toHaveBeenCalledWith(1, owner, { populateVaults: true, populateMarketPrices: true, populateUserRewards: true, vaultFetchOptions: liteVaultFetchOptions })
   })
 })
 
@@ -981,7 +982,10 @@ describe('useTxBatch execution errors', () => {
     })
 
     expect(sdk.accountService.fetchAccount).toHaveBeenCalledWith(1, owner, {
-      populateAll: true,
+      populateVaults: true,
+      populateMarketPrices: true,
+      populateUserRewards: true,
+      vaultFetchOptions: liteVaultFetchOptions,
     })
     expect(executionMocks.compilePreview).toHaveBeenCalledWith(expect.any(Array), expect.not.objectContaining({ chainId: 8453 }))
   })
@@ -1003,7 +1007,10 @@ describe('useTxBatch execution errors', () => {
     })
 
     expect(sdk.accountService.fetchAccount).toHaveBeenCalledWith(1, owner, {
-      populateAll: true,
+      populateVaults: true,
+      populateMarketPrices: true,
+      populateUserRewards: true,
+      vaultFetchOptions: liteVaultFetchOptions,
     })
     expect(executionMocks.compilePreview).toHaveBeenCalledWith(expect.any(Array), expect.objectContaining({ owner }))
   })
diff --git a/tests/composables/useVaultRegistry.test.ts b/tests/composables/useVaultRegistry.test.ts
index 83405fe4b..27e73d254 100644
--- a/tests/composables/useVaultRegistry.test.ts
+++ b/tests/composables/useVaultRegistry.test.ts
@@ -1,3 +1,4 @@
+import { __setEulerLabelsDataForTest, useEulerLabels, getEulerLabelsSourceData } from '~/composables/useEulerLabels'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { ref } from 'vue'
 import { getAddress } from 'viem'
@@ -28,6 +29,8 @@ const vault = (asset: string) => ({
 describe('useVaultRegistry chain-scoped identity', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    __setEulerLabelsDataForTest()
+    vi.stubGlobal('useEulerLabels', useEulerLabels)
     vi.stubGlobal('useEulerAddresses', () => ({ chainId }))
     chainId.value = undefined
     useVaultRegistry().clear()
@@ -122,3 +125,50 @@ describe('useVaultRegistry chain-scoped identity', () => {
     expect(fetchVaultCategoryMock).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('metadata-only verification uses current governance and membership', () => {
+  beforeEach(() => {
+    vi.stubGlobal('useEulerAddresses', () => ({ chainId }))
+    vi.stubGlobal('useEulerLabels', useEulerLabels)
+    chainId.value = 146
+    useVaultRegistry().clear()
+    __setEulerLabelsDataForTest({ source: 'v3-metadata', candidateVaultAddresses: [VAULT],
+      managingEntityByVault: { [VAULT.toLowerCase()]: 'manager' },
+      entities: { manager: { name: 'Manager', addresses: { [ASSET_ONE]: 'Governor' } } } as never })
+  })
+  it('rejects mismatches and revokes cached positives when addresses or membership change', () => {
+    const registry = useVaultRegistry()
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_TWO } as never, 'evk', { verified: true })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE } as never, 'evk', { verified: true })
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    const labels = getEulerLabelsSourceData()
+    __setEulerLabelsDataForTest({ ...labels, entities: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    __setEulerLabelsDataForTest({ ...labels, candidateVaultAddresses: [] })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    __setEulerLabelsDataForTest({ ...labels, managingEntityByVault: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+  })
+  it('requires router governance and keeps independent escrow verification', () => {
+    const registry = useVaultRegistry()
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE, oracle: { name: 'EulerRouter' } } as never, 'evk')
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governorAdmin: ASSET_ONE, oracle: { name: 'EulerRouter' }, eulerRouterGovernor: ASSET_ONE } as never, 'evk')
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    __setEulerLabelsDataForTest({ source: 'v3-metadata' })
+    registry.set(VAULT, vault(ASSET_ONE) as never, 'evk', { vaultCategory: 'escrow' })
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+  })
+  it('checks Earn owners and rejects an absent manager', () => {
+    const registry = useVaultRegistry()
+    const labels = getEulerLabelsSourceData()
+    __setEulerLabelsDataForTest({ ...labels, candidateVaultAddresses: [], candidateEarnVaultAddresses: [VAULT] })
+    registry.set(VAULT, { ...vault(ASSET_ONE), governance: { owner: ASSET_TWO } } as never, 'earn')
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+    registry.set(VAULT, { ...vault(ASSET_ONE), governance: { owner: ASSET_ONE } } as never, 'earn')
+    expect(registry.isVerifiedVault(VAULT)).toBe(true)
+    __setEulerLabelsDataForTest({ ...getEulerLabelsSourceData(), managingEntityByVault: {} })
+    expect(registry.isVerifiedVault(VAULT)).toBe(false)
+  })
+})
diff --git a/tests/composables/useVaults.test.ts b/tests/composables/useVaults.test.ts
index 1c08ae5db..4f1586fe4 100644
--- a/tests/composables/useVaults.test.ts
+++ b/tests/composables/useVaults.test.ts
@@ -201,6 +201,28 @@ describe('useVaults EVault verification metadata', () => {
     ])
   })
 
+  it('retains an open unlisted vault during a same-chain labels reload', async () => {
+    await useVaults().updateEVaults([DYNAMIC_EVAULT], undefined, true)
+    const registry = useVaultRegistry()
+    const dynamic = registry.get(DYNAMIC_EVAULT)?.vault
+    await useVaults().updateEVaults([DEPRECATED_EVAULT], undefined, true, {
+      verifiedAddresses: new Set([getAddress(DEPRECATED_EVAULT).toLowerCase()]),
+    })
+    __setEulerLabelsDataForTest({
+      source: 'v3', visibility: {}, verifiedVaultAddresses: [getAddress(LABELED_EVAULT)],
+    })
+
+    await useVaults().loadVaults({ preserveRegistry: true })
+
+    expect(registry.get(DYNAMIC_EVAULT)?.vault).toBe(dynamic)
+    expect(registry.isVerifiedVault(DYNAMIC_EVAULT)).toBe(false)
+    expect(registry.get(LABELED_EVAULT)).toBeDefined()
+    expect(registry.isVerifiedVault(DEPRECATED_EVAULT)).toBe(false)
+
+    await useVaults().loadVaults()
+    expect(registry.get(DYNAMIC_EVAULT)).toBeUndefined()
+  })
+
   it('chunks EVault fetches for configured chunk chains', async () => {
     const addresses = Array.from(
       { length: 7 },
diff --git a/tests/server/labels-base-url.test.ts b/tests/server/labels-base-url.test.ts
index 57c4860a7..0a5b13e53 100644
--- a/tests/server/labels-base-url.test.ts
+++ b/tests/server/labels-base-url.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { readLabelsSource, resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
+import { readLabelsOnchainVerificationChains, readLabelsSource, resolveLabelsBaseUrl } from '~/server/utils/labels-base-url'
 
 describe('label source configuration', () => {
   afterEach(() => vi.unstubAllEnvs())
@@ -23,3 +23,28 @@ describe('label source configuration', () => {
     expect(resolveLabelsBaseUrl).toThrow()
   })
 })
+
+describe('deprecated-chain labels verification selection', () => {
+  afterEach(() => vi.unstubAllEnvs())
+  it('selects enabled deprecated chains without changing active on-chain chains', () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('RPC_URL_1', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '1,146')
+    vi.stubEnv('DEPRECATED_CHAINS', '146,146')
+    expect(readLabelsOnchainVerificationChains()).toEqual([146])
+    vi.stubEnv('DEPRECATED_CHAINS', '')
+    expect(readLabelsOnchainVerificationChains()).toEqual([])
+  })
+  it('ignores deprecated chains without an enabled RPC', () => {
+    vi.stubEnv('RPC_URL_1923', '')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '')
+    vi.stubEnv('DEPRECATED_CHAINS', '1923')
+    expect(readLabelsOnchainVerificationChains()).toEqual([])
+  })
+  it('rejects an enabled deprecated chain without on-chain SDK reads', () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '1')
+    vi.stubEnv('DEPRECATED_CHAINS', '146')
+    expect(() => readLabelsOnchainVerificationChains()).toThrow('ONCHAIN_SDK_CHAINS: 146')
+  })
+})
diff --git a/tests/server/metadata-labels-verification.test.ts b/tests/server/metadata-labels-verification.test.ts
new file mode 100644
index 000000000..f0268f2e4
--- /dev/null
+++ b/tests/server/metadata-labels-verification.test.ts
@@ -0,0 +1,38 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getAddress } from 'viem'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+import { publicLabelsFixture, KPK_VAULT } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+const mocks = vi.hoisted(() => ({ labels: vi.fn(), vaults: vi.fn(), types: vi.fn() }))
+vi.mock('~/server/utils/public-labels-source', () => ({ getPublicEulerLabelsData: mocks.labels }))
+vi.mock('~/server/utils/sdk-server', () => ({ getServerSdk: async () => ({
+  eVaultService: { fetchVerifiedVaultAddresses: async () => [], fetchVaults: mocks.vaults },
+  eulerEarnService: { fetchVaults: async () => ({ result: [], errors: [] }) },
+  securitizeVaultService: { fetchVaults: async () => ({ result: [], errors: [] }) },
+  vaultMetaService: { fetchVaultTypes: mocks.types },
+}) }))
+
+describe('public API metadata-only governance verification', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.stubGlobal('$fetch', vi.fn(async () => ({ tokens: [] })))
+    mocks.types.mockResolvedValue({})
+    mocks.labels.mockResolvedValue(normalizeLabelsBundle(1, {
+      source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: publicLabelsFixture,
+    }))
+  })
+  it('fetches candidates with empty verified membership, then rejects mismatches and refreshed claim removal', async () => {
+    const labels = await mocks.labels()
+    const governor = Object.keys(labels.entities.kpk.addresses)[0]
+    mocks.vaults.mockResolvedValue({ result: [{ address: getAddress(KPK_VAULT), governorAdmin: governor, collaterals: [] }], errors: [] })
+    const { refreshVerifiedAddressSet } = await import('~/server/utils/verified-vaults')
+    expect(labels.verifiedVaultAddresses).toEqual([])
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(true)
+    expect(mocks.vaults.mock.calls[0][1]).toContain(getAddress(KPK_VAULT))
+    mocks.labels.mockResolvedValue({ ...labels, managingEntityByVault: {} })
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(false)
+    mocks.labels.mockResolvedValue(labels)
+    mocks.vaults.mockResolvedValue({ result: [{ address: getAddress(KPK_VAULT), governorAdmin: '0x0000000000000000000000000000000000000001', collaterals: [] }], errors: [] })
+    expect((await refreshVerifiedAddressSet(1)).has(getAddress(KPK_VAULT))).toBe(false)
+  })
+})
diff --git a/tests/server/public-labels-source.test.ts b/tests/server/public-labels-source.test.ts
index 5aabf27ec..c5121d888 100644
--- a/tests/server/public-labels-source.test.ts
+++ b/tests/server/public-labels-source.test.ts
@@ -52,6 +52,7 @@ describe('public labels server source', () => {
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-08-05T10:00:00Z'))
     vi.stubEnv('LABELS_SOURCE', 'v3')
+    vi.stubEnv('DEPRECATED_CHAINS', '')
     vi.stubEnv('LABELS_V3_SET', '')
     vi.stubEnv('LABELS_V3_VERSION', '')
     vi.stubEnv('V3_API_URL', 'https://v3.example.test')
@@ -69,6 +70,24 @@ describe('public labels server source', () => {
     vi.unstubAllEnvs()
   })
 
+  it('selects metadata-only for deprecated chains, isolates its cache and never falls back after assessment failure', async () => {
+    vi.stubEnv('RPC_URL_146', 'https://rpc.example.test')
+    vi.stubEnv('ONCHAIN_SDK_CHAINS', '146')
+    vi.stubEnv('DEPRECATED_CHAINS', '146')
+    mocks.fetchWithTimeout.mockImplementation(async (input: string) => {
+      const path = new URL(input).pathname
+      if (path.startsWith('/v3/evk/') || path.startsWith('/v3/earn/')) return new Response('CHAIN_NOT_SUPPORTED', { status: 404 })
+      return path.endsWith('/versions') ? versionsResponse() : emptyListResponse()
+    })
+    const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
+    const bundle = await getPublicLabelsBundle(146)
+    expect(bundle.source).toBe('v3-metadata')
+    expect(bundle).not.toHaveProperty('publicLabels.visibility')
+    expect(mocks.fetchWithTimeout.mock.calls.some(([url]) => /\/(evk|earn)\//.test(new URL(url).pathname))).toBe(false)
+    vi.stubEnv('DEPRECATED_CHAINS', '')
+    await expect(getPublicLabelsBundle(146)).rejects.toThrow('404')
+  })
+
   it('deduplicates concurrent loads and serves the aggregate from cache', async () => {
     const { getPublicLabelsBundle } = await import('~/server/utils/public-labels-source')
 
diff --git a/tests/server/vault-metadata-content.test.ts b/tests/server/vault-metadata-content.test.ts
new file mode 100644
index 000000000..a6b08ef41
--- /dev/null
+++ b/tests/server/vault-metadata-content.test.ts
@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getAddress } from 'viem'
+import { normalizeLabelsBundle } from '~/utils/public-labels'
+import { buildProductDescriptors } from '~/server/utils/labels-view'
+import { publicLabelsFixture, KPK_VAULT } from '~/tests/fixtures/public-labels-v20260804151305236'
+
+const mocks = vi.hoisted(() => ({ view: vi.fn() }))
+vi.mock('~/server/utils/labels-view', async original => ({
+  ...await original<typeof import('~/server/utils/labels-view')>(),
+  buildLabelsView: mocks.view,
+}))
+vi.mock('~/server/utils/verified-vaults', () => ({ refreshVerifiedAddressSet: async () => new Set() }))
+
+const address = getAddress(KPK_VAULT)
+
+async function metadata(vaultType: 'evk' | 'earn', standalone = false, cleared = true) {
+  const source = structuredClone(publicLabelsFixture)
+  source.products[0].description = 'Product description'
+  source.products[0].portfolioNotice = 'Product notice'
+  source.products[0].deprecationReason = 'Product reason'
+  source.vaults = [{ ...source.vaults[0], vaultType,
+    productId: standalone ? null : source.products[0].id,
+    name: 'Vault-specific name',
+    description: cleared ? null : 'Vault description',
+    portfolioNotice: cleared ? null : 'Vault notice',
+    deprecationReason: cleared ? null : 'Vault reason',
+  }]
+  const labels = normalizeLabelsBundle(1, {
+    source: 'v3-metadata', labelSet: 'public', version: 'test', publicLabels: source,
+  })
+  const vault = { address, shares: { name: 'On-chain name' } }
+  mocks.view.mockResolvedValue({
+    ...buildProductDescriptors(labels.products),
+    snapshot: { evkVaults: vaultType === 'evk' ? [vault] : [], earnVaults: vaultType === 'earn' ? [vault] : [], securitizeVaults: [], escrowVaults: [] },
+    deprecatedEarnSet: new Set(), escrowAddresses: new Set(),
+    earnByAddr: new Map(Object.values(labels.earnVaultEntries).map(entry => [getAddress(entry.address), entry])),
+    tokenLogos: new Map(), entitiesRaw: {},
+  })
+  const { refreshChainVaultMetadata } = await import('~/server/utils/vault-metadata')
+  return (await refreshChainVaultMetadata(1)).get(address)
+}
+
+describe('public metadata resolved V3 content', () => {
+  beforeEach(() => vi.resetModules())
+
+  it.each(['evk', 'earn'] as const)('preserves cleared %s fields and the vault-specific name', async (type) => {
+    expect(await metadata(type)).toMatchObject({
+      name: 'Vault-specific name', description: null, portfolioNotice: null, deprecationReason: null,
+      productId: 'kpk-securitize',
+    })
+  })
+
+  it('keeps nonempty resolved vault text', async () => {
+    expect(await metadata('evk', false, false)).toMatchObject({
+      description: 'Vault description', portfolioNotice: 'Vault notice', deprecationReason: 'Vault reason',
+    })
+  })
+
+  it('does not expose synthetic display groups as V3 product IDs', async () => {
+    expect(await metadata('evk', true)).toMatchObject({ name: 'Vault-specific name', productId: null })
+  })
+})
diff --git a/tests/utils/public-labels.test.ts b/tests/utils/public-labels.test.ts
index 7cf86dbb9..390c9cb9a 100644
--- a/tests/utils/public-labels.test.ts
+++ b/tests/utils/public-labels.test.ts
@@ -1,7 +1,7 @@
 import { getAddress } from 'viem'
 import { describe, expect, it } from 'vitest'
 import { getEulerLabelProductBrandEntityKeys } from '@eulerxyz/euler-v2-sdk/public-labels'
-import { normalizePublicLabelsData } from '~/utils/public-labels'
+import { normalizeLabelsBundle, getLabelVaultCandidates, getLabelsVaultLoadKey, normalizePublicLabelsData } from '~/utils/public-labels'
 import { ASSESSMENT_ONLY_EARN, ASSESSMENT_ONLY_EVK, KPK_VAULT, NEUTRAL_ESCROW, VERIFICATION_ONLY_EVK, VERIFICATION_ONLY_EARN, publicLabelsFixture } from '~/tests/fixtures/public-labels-v20260804151305236'
 
 describe('V3-only label normalization', () => {
@@ -32,3 +32,42 @@ describe('V3-only label normalization', () => {
     expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: true, notExplorableBorrow: false })
   })
 })
+
+it('maps metadata-only labels for display without granting verification, preserving label listing flags', () => {
+  const data = normalizeLabelsBundle(1, { source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: publicLabelsFixture })
+  expect(data.source).toBe('v3-metadata')
+  expect(data.visibility).toBeUndefined()
+  expect(data.verifiedVaultAddresses).toEqual([])
+  expect(data.earnVaults).toEqual([])
+  expect(getLabelVaultCandidates(data).vaults).toContain(getAddress(KPK_VAULT))
+  expect(data.products['kpk-securitize'].notExplorable).toBe(false)
+  expect(data.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: false, notExplorableBorrow: false })
+  expect(data.geoContext?.policies).toEqual(publicLabelsFixture.geoPolicies)
+})
+
+it('detects eligibility changes without reloading for metadata-only text edits', () => {
+  const first = normalizePublicLabelsData(1, publicLabelsFixture)
+  const hidden = normalizePublicLabelsData(1, { ...publicLabelsFixture, visibility: {
+    ...publicLabelsFixture.visibility,
+    [KPK_VAULT.toLowerCase()]: { ...publicLabelsFixture.visibility[KPK_VAULT.toLowerCase()], explorableLend: false, explorableBorrow: false },
+  } })
+  expect(getLabelsVaultLoadKey(first)).not.toBe(getLabelsVaultLoadKey(hidden))
+  const renamed = { ...first, products: { ...first.products, 'kpk-securitize': { ...first.products['kpk-securitize'], name: 'New name' } } }
+  expect(getLabelsVaultLoadKey(first)).toBe(getLabelsVaultLoadKey(renamed))
+})
+
+it('honours product and per-side hiding on deprecated metadata-only vaults', () => {
+  const source = structuredClone(publicLabelsFixture)
+  source.vaults[0].deprecated = true
+  source.vaults[0].notExplorableLend = true
+  source.vaults[0].notExplorableBorrow = false
+  const normalize = () => normalizeLabelsBundle(1, { source: 'v3-metadata', labelSet: 'public', version: 'pinned', publicLabels: source })
+  const listed = normalize()
+  expect(listed.products['kpk-securitize'].notExplorable).toBe(false)
+  expect(listed.products['kpk-securitize'].vaultOverrides?.[getAddress(KPK_VAULT)]).toMatchObject({ notExplorableLend: true, notExplorableBorrow: false })
+  source.products[0].notExplorable = true
+  const hidden = normalize()
+  expect(hidden.products['kpk-securitize'].notExplorable).toBe(true)
+  expect(getLabelsVaultLoadKey(hidden)).not.toBe(getLabelsVaultLoadKey(listed))
+  expect(hidden.verifiedVaultAddresses).toEqual([])
+})
diff --git a/utils/public-labels.ts b/utils/public-labels.ts
index 76a5a79de..a59f9b19a 100644
--- a/utils/public-labels.ts
+++ b/utils/public-labels.ts
@@ -1,5 +1,8 @@
+import { isEulerLabelVaultNotExplorableLend, isEulerLabelVaultNotExplorableBorrow, isEulerLabelEarnVaultNotExplorable } from '@eulerxyz/euler-v2-sdk'
 import {
   normalizeEulerLabelsFileData,
+  normalizePublicLabelsMetadata,
+  type PublicLabelsMetadataSnapshot,
   type EulerLabelsFileData,
   normalizePublicLabelsData as normalizeSdkPublicLabelsData,
   type PublicEulerLabelsData as SdkPublicEulerLabelsData,
@@ -28,7 +31,7 @@ export type {
 
 export type PublicEulerLabelsData = Omit<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>
   & Partial<Pick<SdkPublicEulerLabelsData, 'visibility' | 'managingEntityByVault'>>
-  & { geoContext?: HostedGeoContext, source?: 'v3' | 'static', logoBaseUrl?: string }
+  & { geoContext?: HostedGeoContext, source?: 'v3' | 'v3-metadata' | 'static', logoBaseUrl?: string, candidateVaultAddresses?: string[], candidateEarnVaultAddresses?: string[] }
 
 export const PUBLIC_LABELS_FIXTURE_VERSION = 'v20260804151305236'
 
@@ -48,7 +51,9 @@ export interface StaticLabelsBundle {
   fetchedAt: number
 }
 
-export type PublicLabelsBundle = V3LabelsBundle | StaticLabelsBundle
+export type V3MetadataLabelsBundle = PublicLabelsMetadataSnapshot & { geoFetchedAt?: number }
+export type HostedLabelsBundle = V3LabelsBundle | V3MetadataLabelsBundle
+export type PublicLabelsBundle = HostedLabelsBundle | StaticLabelsBundle
 
 /** V3 owns hosted membership, published content and per-side visibility. */
 export const normalizePublicLabelsData = (chainId: number, source: PublicLabelsSource): PublicEulerLabelsData => {
@@ -79,6 +84,15 @@ export const normalizePublicLabelsData = (chainId: number, source: PublicLabelsS
 }
 
 export const normalizeLabelsBundle = (chainId: number, bundle: PublicLabelsBundle): PublicEulerLabelsData => {
+  if (bundle.source === 'v3-metadata') {
+    const data = normalizePublicLabelsMetadata(chainId, bundle.publicLabels)
+    return { ...data, source: 'v3-metadata', geoContext: {
+      chainId, policies: data.rawGeoPolicies,
+      productByVault: Object.fromEntries(bundle.publicLabels.vaults
+        .filter(vault => vault.chainId === chainId)
+        .map(vault => [vault.address.toLowerCase(), vault.productId])),
+    } }
+  }
   if (bundle.source !== 'static') return normalizePublicLabelsData(chainId, bundle.publicLabels)
   const data = normalizeEulerLabelsFileData(structuredClone(bundle.files))
   // Static authoring uses filenames; resolve them only against the operator's source.
@@ -88,3 +102,22 @@ export const normalizeLabelsBundle = (chainId: number, bundle: PublicLabelsBundl
   for (const points of Object.values(data.points)) for (const point of points) point.logo = logo(point.logo)
   return { ...data, source: 'static', logoBaseUrl: bundle.logoBaseUrl, rawGeoPolicies: [] }
 }
+
+/** Fetch candidates are not a governance verdict. */
+export const getLabelVaultCandidates = (labels: Pick<PublicEulerLabelsData,
+  'source' | 'candidateVaultAddresses' | 'candidateEarnVaultAddresses' | 'verifiedVaultAddresses' | 'earnVaults'>) => ({
+  vaults: labels.source === 'v3-metadata' ? labels.candidateVaultAddresses ?? [] : labels.verifiedVaultAddresses,
+  earn: labels.source === 'v3-metadata' ? labels.candidateEarnVaultAddresses ?? [] : labels.earnVaults,
+})
+
+/** Reload vault data only when labels change membership or discovery eligibility. */
+export const getLabelsVaultLoadKey = (labels: PublicEulerLabelsData): string => {
+  const candidates = getLabelVaultCandidates(labels)
+  return JSON.stringify([
+    labels.source,
+    (candidates.vaults ?? []).map(address => [address.toLowerCase(),
+      isEulerLabelVaultNotExplorableLend(labels, address),
+      isEulerLabelVaultNotExplorableBorrow(labels, address)]).sort(),
+    (candidates.earn ?? []).map(address => [address.toLowerCase(), isEulerLabelEarnVaultNotExplorable(labels, address)]).sort(),
+  ])
+}
diff --git a/utils/vault/governor-verification.ts b/utils/vault/governor-verification.ts
index 7a719364a..4a3c5ec40 100644
--- a/utils/vault/governor-verification.ts
+++ b/utils/vault/governor-verification.ts
@@ -60,7 +60,7 @@ export interface VerificationLabels {
 
 /** Hosted labels must explicitly declare a manager; absence cannot use static Earn trust. */
 export const getHostedEntityKeys = (labels: Pick<PublicEulerLabelsData, 'source' | 'managingEntityByVault'>, address: string): string[] | undefined => {
-  if (labels.source !== 'v3') return undefined
+  if (labels.source !== 'v3' && labels.source !== 'v3-metadata') return undefined
   const entity = labels.managingEntityByVault?.[address.toLowerCase()]
   return entity ? [entity] : []
 }