fix: close two paths that can permanently strand a name

[re-gius]

Description

Two fixes from the internal audit, both cases where a name ends up immovable with no shipped call to recover it.

Unsolicited escrow deposits. The escrow refuses a deposit it did not initiate in onERC721Received, but that hook never runs on a plain transferFrom. A direct transfer to the escrow address therefore reached _update, which treats every escrow-touching move as zero-fee, and landed the name in custody with no release position. _update now rejects a transfer into the escrow unless the escrow is the caller. release records the position before it moves the name and is the only caller that transfers into custody, so the legitimate path is unaffected.

Poisoned recipient slots. _syncRecipientStore wrote through StoreUtils.writeLabel, which skips an occupied slot silently. A slot already holding a different string then survived the transfer, and _quoteTransferFeeFor reads that label back and reverts InvalidLabel on every onward transfer permanently, since storeLabel has no delete. It now uses writeNewLabel, the conflict-checked variant every registration path already uses, so a mismatch reverts the transfer and leaves the name with its sender. A matching entry stays a no-op, so a transfer back to a prior holder still passes. writeLabel is deleted with it: it had no caller left, and a skip-on-locked helper in a shared library keeps the same defect one call away. Every protocol write now goes through the conflict check because there is nothing else to call.

Also corrects README.md, which told readers that "transferring the name reassigns write access automatically". That holds for the node transferred and not for its subnames, whose registry owner a parent transfer does not change.

Type

• Bug fix
• Feature
• Breaking change
• Documentation
• Chore
• Refactor
• Security

Scope

• Registration
• Resolver
• Store
• Proof of Personhood
• Deployment scripts
• Tests

Related Issues

Internal security audit findings with low severity.

Fixes

Checklist

Code

• Follows project style
• forge build passes
• forge test passes
• No new compiler warnings

Testing

• New tests added for changed behavior
• Fuzz tests added where applicable
• Invariant tests verified

Security

• No new selfdestruct or delegatecall
• Access control reviewed
• No storage layout conflicts (for upgradeable contracts)

Documentation

• NatSpec updated on changed interfaces
• README updated if needed

Breaking Changes

• No breaking changes
• Breaking changes documented below

Breaking changes:

How to test

forge test --mt test_direct_transfer_into_escrow_is_rejected_on_both_spellings       
forge test --mt test_transfer_into_a_poisoned_recipient_slot_reverts
forge test --mt test_transfer_back_to_a_prior_holder_still_passes

Notes

[github-actions]

CI Summary

Check	Result
4naly3er Analysis	Found 37 issues: 5 medium, 8 low, 13 gas, 11 informational - View Report
Slither Analysis	Found 190 issues: 4 high, 40 medium, 89 low, 57 informational - View Report
Contract Tests (Unit + Fuzz)	All tests passed (657 total) - View Report
Contract Tests (Invariant)	All tests passed (58 total) - View Report
Gas Report	9 contracts analyzed - View Report
Coverage	Failed - Tests failed, cannot compute coverage
Documentation	Passed - 66 pages generated - View Docs
Format & Lint	Passed - Code formatted correctly
File Validation	Passed - All tracked files valid
Deploy Contracts	Failed - addresses differ from the committed manifest
PR Title	PR Title Valid
Labels	Unknown
Secret Scan	Passed - No secrets detected