@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Add an isolated Pudge Testnet Registry Sandbox. Its API, Postgres database,
+  object volume, signing origin, RPC identity, website build, wallet storage,
+  and deployment evidence are separate from production. Sandbox releases are
+  hidden 72 hours after admission; version JSON is deleted at expiry and source
+  objects are deleted after a 24-hour grace period, while minimal audit
+  tombstones remain. The API rejects a wrong-network RPC and cross-environment
+  deployment payloads. `cellc artifact record-deployment --network testnet`
+  defaults to the Pudge Registry API, and `cell-dep` revalidates liveness on the
+  network recorded in accepted evidence. Pudge chain history remains immutable:
+  expiry removes Registry indexing and off-chain objects, not on-chain Cells.
 - Complete the Registry's generalized artifact and chain-evidence path. Rust,
   C, JavaScript, and other CKB artifacts now keep explicit source, build,
   deployment, TCB, and copy-only identities instead of being presented as
@@ -53,8 +63,9 @@
   localized statuses and copyable audit values. Publisher authorisation now
   accepts both JoyID
   (`joyid_ckb`) and standard CKB secp256k1 (`ckb_secp256k1`) principals through
-  the CCC CKB-signer boundary on mainnet. The chooser no longer exposes a
-  testnet option or constructs a testnet client. The frontend never accepts
+  the CCC CKB-signer boundary. Production exposes only mainnet; the separately
+  built Pudge Sandbox constructs a testnet client without adding a network
+  selector to either environment. The frontend never accepts
   mnemonic words; traditional recovery phrases remain inside the wallet. CLI
   auth commands use `--wallet-signature`, with `--joyid-signature` retained as
   a visible compatibility alias, and the API adds the corresponding typed
 
@@ -11,8 +11,11 @@ CellScript path first, then the generic artifact path.
 ## 1. Connect a CKB wallet
 
 Open `https://cellscript.dev/registry/submit`. The page does not expose a
-network selector: Registry authorisation and deployment evidence are CKB
-mainnet-only.
+network selector. The production Registry is CKB mainnet-only. Pudge testing
+uses `https://testnet.cellscript.dev/registry`, with a different API origin,
+database, object store, wallet connection state, and testnet-only evidence.
+Sandbox records disappear from discovery after 72 hours and their source bytes
+are purged after a 24-hour grace period; this does not erase Pudge chain history.
 
 Choose a detected wallet from the modal. Wallets listed without an active
 connector link to their official installation page. The wallet signs only the
@@ -202,7 +205,7 @@ canonical SHA-256 and threshold in the accepted evidence. Only then does
 verification become `verified`; a reproducible executable cannot be recorded
 as deployed before this transition.
 
-## 5. Record a mainnet deployment
+## 5. Record a deployment on the Registry's fixed network
 
 The deployment request is a signed
 `cellscript-registry-deployment` / `record_deployment` payload sent to:
@@ -212,11 +215,12 @@ POST /v1/artifacts/acme/vault-lock/releases/1.0.0/deployments
 ```
 
 It includes the published `artifact_hash`, equal `data_hash`, `code_hash`,
-`hash_type`, `dep_type`, and the mainnet OutPoint. The API requires the same
+`hash_type`, `dep_type`, and the environment's OutPoint. The API requires the same
 namespace capability used for publishing and prior verified-build evidence.
 
-The API calls mainnet `get_live_cell`. It rejects a dead or missing Cell, a
-data-hash mismatch, a Type Script hash mismatch, a non-mainnet network, or an
+The API first verifies the configured RPC chain identity, then calls
+`get_live_cell`. It rejects a dead or missing Cell, a data-hash mismatch, a
+Type Script hash mismatch, a network mismatch, or an
 OutPoint that is not bound to the published executable. A successful request
 appends deployment evidence and changes only `deployment_status` to
 `chain_verified`.
@@ -252,7 +256,7 @@ cellc artifact fetch acme/vault-lock@1.0.0 --output vault-lock.bundle.json
 cellc artifact verify --bundle vault-lock.bundle.json --receipt vault-lock.bundle.json.receipt.json
 cellc artifact pin acme/vault-lock@1.0.0 --output Artifacts.lock --accept-hash-bound
 cellc artifact reproduction-evidence acme/vault-lock@1.0.0 --report builder-a.json --report builder-b.json --output reproduced-build-promotion.json
-cellc artifact record-deployment acme/vault-lock@1.0.0 --code-hash <hash> --hash-type data1 --dep-type code --tx-hash <tx_hash> --index 0 --capability-key-id <key_id>
+cellc artifact record-deployment acme/vault-lock@1.0.0 --network mainnet --code-hash <hash> --hash-type data1 --dep-type code --tx-hash <tx_hash> --index 0 --capability-key-id <key_id>
 cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound --rpc-url https://mainnet.ckb.dev/rpc
 cellc artifact set-availability acme/vault-lock@1.0.0 --status yanked --reason "security advisory" --capability-key-id <key_id>
 cellc artifact commitment acme/vault-lock@1.0.0 --output RegistryCommitment.json
@@ -278,6 +282,20 @@ The transaction-intent and scanner code is implemented, but production does
 not claim a chain commitment until operators deploy and configure the canonical
 mainnet Registry Type Script, commitment custody Lock, and both code CellDeps.
 
+For the isolated Pudge flow, use:
+
+```bash
+cellc publish --api-url https://api.testnet.registry.cellscript.dev
+cellc artifact record-deployment acme/vault-lock@1.0.0 \
+  --network testnet \
+  --api-url https://api.testnet.registry.cellscript.dev \
+  --code-hash <hash> --hash-type data1 --dep-type code \
+  --tx-hash <testnet_tx_hash> --index 0 --capability-key-id <key_id>
+```
+
+`cell-dep` reads the accepted evidence network and defaults to the matching
+official RPC; an explicit `--rpc-url` still has to report the same chain.
+
 ## 7. Other artifact kinds
 
 - `runtime_verifier`: `ckb_executable` bundle with source, executable, and ABI;
 
@@ -9,6 +9,18 @@ adapter.
 - `https://registry.cellscript.dev` serves immutable bundles and static release
   JSON independently from the write database.
 
+The Pudge test environment is a separate, ephemeral service:
+
+- `https://api.testnet.registry.cellscript.dev` is the sandbox API;
+- `https://objects.testnet.registry.cellscript.dev` is its object origin;
+- `https://testnet.cellscript.dev/registry` is its `noindex` UI.
+
+It uses a different Postgres volume, object volume, signing origin, wallet
+storage key, RPC identity, and Compose project. Do not put a network selector in
+the production Registry. `REGISTRY_ENVIRONMENT=testnet-sandbox` requires the
+dedicated origins and accepts only a Pudge/Testnet RPC. Unknown environments
+fail closed.
+
 Postgres is authoritative for publisher capabilities, namespace ownership,
 artifact releases, orthogonal release states, evidence, jobs, idempotency, and
 audit events. R2 or the filesystem adapter stores immutable content and static
@@ -155,8 +167,29 @@ The browser wallet directory lists Neuron, JoyID, imToken, CKBull, SafePal,
 Ledger, imKey, OneKey, UTXO Global, Rei Wallet, Gate, and QuantumPurse. Runtime
 connectivity is determined by CCC discovery. Directory entries without a live
 connector use the external signed-payload handoff and never bypass backend
-signature verification. The service accepts no testnet authorisation or
-deployment mode.
+signature verification. Production accepts only mainnet authorisation and
+deployment evidence. The isolated Pudge Sandbox accepts only testnet evidence;
+the two origins make wallet challenges and capability signatures non-replayable
+across environments.
+
+## Pudge Sandbox Retention
+
+Every sandbox release stores `registry_environment = testnet-sandbox`,
+`network = testnet`, `expires_at = created_at + 72h`, and
+`purge_after = expires_at + 24h`. Public SQL and in-memory reads filter by
+`expires_at` even if maintenance is delayed. At expiry, the version-addressed
+static JSON is deleted; after the grace period, a source object is deleted only
+when no non-expired release references its snapshot hash. Database identity and
+audit rows remain as tombstones so abuse and replay investigations are not
+erased. Reads never extend TTL.
+
+The sandbox additionally limits a wallet principal to 20 accepted publish
+attempts per 24 hours and one package coordinate to five; the ordinary IP,
+capability, namespace-cooldown, request-size, and snapshot-size controls still
+apply.
+
+This policy cannot delete Pudge chain history or consume a deployed code Cell.
+It only removes the Registry index and its off-chain object bytes.
 
 ## Release Admission
 
@@ -198,7 +231,7 @@ cellc publish --artifact-manifest Artifact.toml
 `CELLSCRIPT_CAPABILITY_PRIVATE_KEY_PKCS8_B64` supplies the delegated key in CI.
 `CELLSCRIPT_REGISTRY_IDEMPOTENCY_KEY` pins the exact retry key.
 
-## Mainnet Deployment Evidence
+## Network-Bound Deployment Evidence
 
 Executable publication begins at `deployment_status = undeployed`. A publisher
 records a deployment by signing canonical JSON for:
@@ -207,19 +240,21 @@ records a deployment by signing canonical JSON for:
 cellscript-registry-deployment / record_deployment
 ```
 
-The request must identify `network = mainnet`, the published executable hash,
-equal Cell data hash, code hash, hash type, dep type, and OutPoint. Prior
-verified-build evidence is mandatory.
+The request must identify the network fixed by the Registry environment
+(`mainnet` in production, `testnet` in the Pudge Sandbox), the published
+executable hash, equal Cell data hash, code hash, hash type, dep type, and
+OutPoint. Prior verified-build evidence is mandatory.
 
-The API calls CKB mainnet `get_live_cell(out_point, true, false)` and fails
+The API confirms the configured RPC chain identity, calls
+`get_live_cell(out_point, true, false)`, and fails
 closed unless the Cell is live and its data hash equals the published
 executable. For `hash_type = type`, it serializes the returned Type Script with
 Molecule and verifies its CKB Script hash against `code_hash`. Data-hash modes
 require `code_hash` to equal the data hash. Success appends hash-addressed
 evidence and sets only `deployment_status = chain_verified`.
 
-`CKB_MAINNET_RPC_URL` may override the default official mainnet RPC endpoint.
-No testnet network value is accepted.
+`CKB_RPC_URL` configures the environment RPC. `CKB_MAINNET_RPC_URL` remains a
+production compatibility alias.
 
 ## Registry Chain Commitments
 
 
@@ -54,6 +54,7 @@ services:
       REGISTRY_ORIGIN: ${REGISTRY_ORIGIN:-https://api.registry.cellscript.dev}
       STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_ORIGIN:-https://registry.cellscript.dev}
       CKB_MAINNET_RPC_URL: ${CKB_MAINNET_RPC_URL:-https://mainnet.ckb.dev/rpc}
+      CKB_RPC_URL: ${CKB_RPC_URL:-https://mainnet.ckb.dev/rpc}
       REGISTRY_TYPE_SCRIPT_JSON: ${REGISTRY_TYPE_SCRIPT_JSON:-}
       REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON: ${REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON:-}
       REGISTRY_COMMITMENT_LOCK_SCRIPT_JSON: ${REGISTRY_COMMITMENT_LOCK_SCRIPT_JSON:-}
@@ -62,6 +63,7 @@ services:
       CKB_REGISTRY_SCAN_MAX_CELLS: ${CKB_REGISTRY_SCAN_MAX_CELLS:-1000}
       CKB_MIN_CONFIRMATIONS: ${CKB_MIN_CONFIRMATIONS:-24}
       ENVIRONMENT: production
+      REGISTRY_ENVIRONMENT: production
       MAX_INCOMING_BODY_BYTES: "7340032"
       MAX_JSON_BODY_BYTES: "6291456"
       MAX_SNAPSHOT_BYTES: "5242880"
 
@@ -0,0 +1,140 @@
+name: cellscript-registry-testnet
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: cellscript_registry_testnet
+      POSTGRES_USER: cellscript_registry_testnet
+      POSTGRES_PASSWORD: ${REGISTRY_TESTNET_DB_PASSWORD:?REGISTRY_TESTNET_DB_PASSWORD is required}
+    volumes:
+      - registry-testnet-postgres:/var/lib/postgresql/data
+    networks: [registry-testnet-internal]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U cellscript_registry_testnet -d cellscript_registry_testnet"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    security_opt: [no-new-privileges:true]
+
+  object-store-init:
+    image: alpine:3.22
+    command: ["sh", "-c", "chown -R 1000:101 /objects && find /objects -type d -exec chmod 2750 '{}' ';' && find /objects -type f -exec chmod 0640 '{}' ';'"]
+    volumes:
+      - registry-testnet-objects:/objects
+    restart: "no"
+    security_opt: [no-new-privileges:true]
+
+  api:
+    image: ${REGISTRY_API_IMAGE:-cellscript-registry-api:latest}
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    depends_on:
+      postgres: { condition: service_healthy }
+      object-store-init: { condition: service_completed_successfully }
+    environment:
+      PORT: "8787"
+      DATABASE_URL: postgresql://cellscript_registry_testnet:${REGISTRY_TESTNET_DB_PASSWORD}@postgres:5432/cellscript_registry_testnet
+      REGISTRY_OBJECTS_DIR: /objects
+      REGISTRY_ADMIN_TOKEN: ${REGISTRY_TESTNET_ADMIN_TOKEN:?REGISTRY_TESTNET_ADMIN_TOKEN is required}
+      REGISTRY_ORIGIN: ${REGISTRY_TESTNET_ORIGIN:-https://api.testnet.registry.cellscript.dev}
+      STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_TESTNET_ORIGIN:-https://objects.testnet.registry.cellscript.dev}
+      CKB_RPC_URL: ${CKB_TESTNET_RPC_URL:-https://testnet.ckb.dev/rpc}
+      CKB_MIN_CONFIRMATIONS: "4"
+      REGISTRY_TYPE_SCRIPT_JSON: ${REGISTRY_TESTNET_TYPE_SCRIPT_JSON:-}
+      REGISTRY_TYPE_SCRIPT_CELL_DEP_JSON: ${REGISTRY_TESTNET_TYPE_SCRIPT_CELL_DEP_JSON:-}
+      REGISTRY_COMMITMENT_LOCK_SCRIPT_JSON: ${REGISTRY_TESTNET_COMMITMENT_LOCK_SCRIPT_JSON:-}
+      REGISTRY_COMMITMENT_LOCK_CELL_DEP_JSON: ${REGISTRY_TESTNET_COMMITMENT_LOCK_CELL_DEP_JSON:-}
+      REGISTRY_REPRODUCER_POLICY_JSON: ${REGISTRY_REPRODUCER_POLICY_JSON:-}
+      CKB_REGISTRY_SCAN_MAX_CELLS: "1000"
+      ENVIRONMENT: testnet-sandbox
+      REGISTRY_ENVIRONMENT: testnet-sandbox
+      MAX_INCOMING_BODY_BYTES: "7340032"
+      MAX_JSON_BODY_BYTES: "6291456"
+      MAX_SNAPSHOT_BYTES: "5242880"
+      REQUIRE_REGISTRY_VERIFIER_READY: "true"
+      REGISTRY_VERIFIER_SHARED_HEARTBEAT: /objects/.health/verifier-ready
+      REGISTRY_VERIFIER_HEARTBEAT_MAX_AGE_SECONDS: "120"
+      VIRTUAL_HOST: ${REGISTRY_TESTNET_API_HOST:-api.testnet.registry.cellscript.dev}
+      VIRTUAL_PORT: "8787"
+    expose: ["8787"]
+    volumes:
+      - registry-testnet-objects:/objects
+    networks: [registry-testnet-internal, stack-network]
+    read_only: true
+    tmpfs: [/tmp:size=32m,mode=1777]
+    security_opt: [no-new-privileges:true]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8787/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
+  verifier:
+    image: ${REGISTRY_VERIFIER_IMAGE:-cellscript-registry-verifier:latest}
+    build:
+      context: ${CELLSCRIPT_REGISTRY_SOURCE_ROOT:-../../..}
+      dockerfile: services/registry-api/Dockerfile.verifier
+    restart: unless-stopped
+    init: true
+    depends_on:
+      api: { condition: service_started }
+      postgres: { condition: service_healthy }
+      object-store-init: { condition: service_completed_successfully }
+    environment:
+      DATABASE_URL: postgresql://cellscript_registry_testnet:${REGISTRY_TESTNET_DB_PASSWORD}@postgres:5432/cellscript_registry_testnet
+      REGISTRY_OBJECTS_DIR: /objects
+      STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_TESTNET_ORIGIN:-https://objects.testnet.registry.cellscript.dev}
+      CELLSCRIPT_REGISTRY_API_URL: ${REGISTRY_TESTNET_ORIGIN:-https://api.testnet.registry.cellscript.dev}
+      ENVIRONMENT: testnet-sandbox
+      REGISTRY_VERIFIER_POLL_INTERVAL_MS: "2000"
+      REGISTRY_VERIFIER_JOB_TIMEOUT_SECONDS: "240"
+      REGISTRY_VERIFIER_LEASE_SECONDS: "300"
+      REGISTRY_VERIFIER_HEALTH_FILE: /tmp/registry-verifier-ready
+      REGISTRY_VERIFIER_SHARED_HEARTBEAT: /objects/.health/verifier-ready
+    volumes:
+      - registry-testnet-objects:/objects
+    networks: [registry-testnet-internal, stack-network]
+    read_only: true
+    tmpfs: [/tmp:size=512m,mode=1777]
+    pids_limit: 128
+    mem_limit: 1g
+    cpus: 1.0
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+
+  static-registry:
+    image: nginx:1.27-alpine
+    restart: unless-stopped
+    depends_on:
+      object-store-init: { condition: service_completed_successfully }
+    environment:
+      VIRTUAL_HOST: ${STATIC_REGISTRY_TESTNET_HOST:-objects.testnet.registry.cellscript.dev}
+      VIRTUAL_PORT: "8080"
+    expose: ["8080"]
+    volumes:
+      - registry-testnet-objects:/srv/registry:ro
+      - ./registry-static.nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    networks: [stack-network]
+    read_only: true
+    tmpfs:
+      - /var/cache/nginx:size=16m
+      - /var/run:size=1m
+      - /tmp:size=4m
+    security_opt: [no-new-privileges:true]
+
+volumes:
+  registry-testnet-postgres:
+  registry-testnet-objects:
+
+networks:
+  registry-testnet-internal:
+    internal: true
+  stack-network:
+    external: true
+    name: stack-network
@@ -0,0 +1,30 @@
+alter table package_versions
+  add column if not exists registry_environment text not null default 'production',
+  add column if not exists chain_network text not null default 'mainnet',
+  add column if not exists expires_at timestamptz,
+  add column if not exists expired_at timestamptz,
+  add column if not exists purge_after timestamptz,
+  add column if not exists static_purged_at timestamptz,
+  add column if not exists source_purged_at timestamptz;
+
+alter table package_versions
+  add constraint package_versions_registry_environment_check
+    check (registry_environment in ('production', 'testnet-sandbox')),
+  add constraint package_versions_chain_network_check
+    check (chain_network in ('mainnet', 'testnet')),
+  add constraint package_versions_environment_network_check
+    check (
+      (registry_environment = 'production' and chain_network = 'mainnet'
+        and expires_at is null and purge_after is null)
+      or
+      (registry_environment = 'testnet-sandbox' and chain_network = 'testnet'
+        and expires_at is not null and purge_after is not null and purge_after > expires_at)
+    );
+
+create index if not exists package_versions_expiry_idx
+  on package_versions(expires_at)
+  where expires_at is not null;
+
+create index if not exists package_versions_object_purge_idx
+  on package_versions(purge_after, snapshot_hash)
+  where purge_after is not null and source_purged_at is null;