Decentralized DNS Monday — October 05 2026 Weekly Update

Weekly companion to Overview - Decentralized DNS, ENS, PKARR, GNS, Handshake, Namecoin, and related files. Covers Sep 29 – Oct 5. Key themes: the second week of October 2026 is the most institutionally-loaded week for the global DNS in years — ICANN confirms Reveal Day for Oct 7 2026 at 18:00 UTC (Sep 29 announcement), a full week earlier than the Sep 22 "early next week" upper-bound of Oct 14, with the Replacement Period running Oct 8 00:01 UTC – Oct 21 23:59 UTC and String Confirmation Day set for Nov 17; ENS Newsletter #121 (Oct 1) is the longest and most cross-organization edition of the year — 11 ENS Labs items (zk.money CCIP-Read, GDC 2026 recap, ENS App profile dashboard, ETHGlobal Tokyo 6 ENSv2 winners, ENS + GLEIF vLEI, Sibos Miami, ENSv2 at Tokyo, etc.), 6 DAO-Wide Headlines (MetaGov Safe executed $30K Nomentum Labs first SPP3 tranche + $15.5K Sept steward comp, ENS Labs takes over Durin L2 subname tool from NameStone, ENS Endowment reaches $93.12M end-Aug (up $15.78M, +$230K yield, 66.5% ETH > 60/40 target) + Sept NAV $98M / 3.228% APY, Blockful final delegation-incentive week, Namespace Mint Manager AI agent skill, ZK + private deposit-derivation pattern), 5 PRs (ens-app-v3 #1166 composite-resolver allowlist + ens-contracts #577 .transfer() → .call() for ERC-4337/SAFE refund + 4 ensjs PRs #385-388 incl Sepolia V1 public resolver restore), 8 Meta-Governance items (Nomentum Labs $30K paid, Unruggable 20K NFTs + AdapterScan, Digraphia cross-script names, Talha PhD research, Oct budget lines ~$50K discretionary + $100K conditional Governor Nexus audit, social-proposal-before-audit discussion), 4 Security items (Blockful review: kpk has NOT yet transferred ownership of the new Roles Modifier — do not yet schedule on the Endowment Timelock; v2.1.0 → v2.1.1 swap planned; Security Council retains 9-day cancel window; Governor Nexus quotes in, audit Q4 2026); the Pubky cluster ships TWO releases in the W41 window — pubky-homeserver v0.14.0 (Sep 28 11:43, 5 days after v0.13.0) ships data/files-tmp atomic-rename staging for upload hardening (PR #637 by 86667 — write-path resilient to client disconnects and late rejections) + content-hash directly from blob length (PR #645 — closes consistency window where blob and metadata could diverge) + data/files-tmp operator mount-migration note ("if you mount a volume at data/files directly, move the mount up to data (or ~/.pubky)"), 7 commits, 87 stars, signed a546dd6, GPG B5690EEEBB952194; pkarr v8.1.0 (Oct 2 09:02, 9 days after v8.0.2) separates DHT and relay request timeouts (PR #325 by andrei-21) — the first time PKARR lets a client treat the DHT lookup path and the pkarr-relay cache path as independently tunable — plus dep-update mainline 8.0.1 (PR #324), 3 commits, 458 stars (up from 457 Sep 23); KSK rollover T-6 days to Oct 11 2026 + APNIC podcast Oct 1 on the rollover history (Duane Wessels + Roy Arends); ICANN TSG Initial Report on gTLD × Alt Naming Systems now open for 2nd public comment (Oct 8) — per the TSG Charter v1.1 Aug 10 "edits of materials responding to comments 21-28 September 2026 → TSG members in-person meeting (tentative) 24-25 September 2026 → Report published for (2nd) Public Comment Mid-October 2026 → Public Comment Close Late November/early December 2026 → Final report published January 2027"; Handshake hsd unchanged (Aug 22 2025 >1y stale, no v3.x tag) but three PRs opened Jun 5-Jul 21 by Nathanwoodburn + denuoweb + shadstoneofficial are still live: #957 seeds update (Jun 5), #960 experimental HNS node rendezvous and relay (Jul 21), #959 experimental P2P ODoH relay stacked on #958 (Jul 21), #956 docs: propose resource v1 direct-resolution format (Jun 3) — the P2P ODoH stack is the Handshake-side privacy/DoH answer, mirroring the DNS-AID draft-02 strategy of bringing standard-DNS-anchor-amenable surface to non-ICANN identity; DNS-AID draft-02 expires Nov 28 2026 (T-54 days), no new draft; Namecoin Namecoin Core nc31.1 still latest (May 2025 tag, Bitcoin Core upstream sync continues), Encasha SSHFP off-chain work still in development; GNUnet 0.29.0 (Aug 20) still the GNS protocol-current release.

TL;DR — This Week

• ICANN confirms Reveal Day: October 7, 2026 at 18:00 UTC (the Sep 29 ICANN announcement) — a full week earlier than the Sep 22 "early next week" upper bound of Oct 14 estimated by ICANNWiki. The simultaneous Oct 7 Reveal + Oct 11 KSK rollover makes the second week of October 2026 the most institutionally-loaded week for the global DNS in years. Disclosed data: applicant identities, all primary strings + variant/replacement strings, contention sets, and public portions of the 1,616 paid applications (out of 1,663 submitted; 47 failed to pay). The Sep 29 announcement also locks the rest of the 2026 Round timeline: Replacement Period Oct 8 00:01 UTC – Oct 21 23:59 UTC (2-week window for eligible applicants with a pre-declared replacement string to switch), String Confirmation Day Nov 17 (final list of strings + updated contention sets, starts Community Input and Objections Period, opens 10-day withdrawal window for 65% refund), ICANN office closure Dec 19 00:00 UTC – Jan 4 16:00 UTC, Prioritization Draw in first half of 2027 (sets processing order post-String-Evaluation-Stage). CircleID's Sep 30 coverage: "ICANN Sets October 7 for 2026 New gTLD Reveal Day" confirms the date. No alt-naming-system strings (.eth, .bit, .crypto, etc.) are part of the 2026 Round because they aren't ICANN TLDs — but the TSG Initial Report (see §4) is the surface for the gTLD × alt-naming integration framework, and the Sep 22 ICANN TSG public-comment closure feeds into a 2nd public comment opening Oct 8. For this library: Oct 7 is the day ENS/Handshake/Namecoin observers get the first verified picture of which organizations are applying for which strings — the contention-set data + the application-public-portion PDFs (which often include intended-use statements and market-segment claims) is the first time the alt-naming-system advocates can map the institutional pressure on the legacy DNS. The Sep 22 ICANN gTLD 1,616 announcement → Sep 29 Reveal Day + milestones announcement is the ICANN-side closing of the W40 → W41 arc. See §1.
• pubky-homeserver v0.14.0 (Sep 28 11:43) — 5 days after v0.13.0 (not 9 like the W40 cadence prediction) — is the biggest missed signal of the W40 update. The Sep 28 GitHub release (github.com/pubky/pubky-homeserver/releases/tag/v0.14.0) has a last week (GitHub-relative) timestamp = the same day as v0.13.0's release Sep 23; the W40 weekly (Sep 28 era) called the cluster "stable" but v0.14.0 ships later the same day. The headline is a silent breaking change to operator volume-mount paths: uploads are now staged in data/files-tmp and atomic-renamed into data/files once complete; both directories must be on the same filesystem. The default Docker setup (mounts ~/.pubky) needs no change; data/files-tmp needs no backup. If you mount a volume at data/files directly, you must move the mount up to data (or ~/.pubky) — the home-server PR #637 hardened the write path so client disconnects and late rejections no longer leave partial files in data/files (the rename-after-completion pattern), and PR #645 changes content-hash calculation to use the blob length directly (closes a consistency window where blob and metadata could diverge). 7 commits, 87 stars, signed a546dd6, GPG B5690EEEBB952194, contributors @gcomte + @86667. The cadence pattern holds: pubky-homeserver released on Aug 19 (v0.11.0) → Sep 14 (v0.12.0) → Sep 23 (v0.13.0) → Sep 28 (v0.14.0) — four releases in 40 days, with the gap shrinking 26 → 9 → 5 days. If the cadence continues, v0.15.0 lands by Oct 8 (10-day window from v0.14.0). For this library: the write-path hardening + atomic-rename semantics is the correct architecture for a P2P storage layer that handles potentially-malicious clients — the W39 (Sep 21) sweep noted that the pubky-homeserver 0.11→0.12→0.13 arc was moving from "feature add" to "hardening", and v0.14.0 confirms the hardening direction. The breaking-mount-path note is the first operator-visible breaking change of the v0.10+ arc — operators running a manual mount setup need to act. See §2.
• pkarr v8.1.0 (Oct 2 09:02) — 9 days after v8.0.2 — is the first non-chore release of the v8 line. The headline feature: separate DHT and relay request timeouts (PR #325 by andrei-21, commit 7bc407f). Until now, PKARR treated the DHT lookup path and the pkarr-relay cache path as one combined timeout — meaning a slow DHT path would force a client to wait even when the relay had a fresh answer (and vice versa). With separate timeouts, a client can configure the relay path to fail fast (because the relay should always have a recent answer) while the DHT path gets the full budget (because the DHT can be slow under load). Plus deps: update mainline to 8.0.1 (PR #324, commit d8af833) — PKARR is now consuming the upstream mainline DHT library v8.0.1 (a separate library from the PKARR package, github.com/mainline-dht/mainline). Package versions: pkarr 8.1.0 / pkarr-relay 2.1.0 / @synonymdev/pkarr 8.1.0. 3 commits, 458 stars (up from 457 Sep 23), signed 900be53. No pubky-app v1.12 in the W41 window — the only pubky-app releases Sep 24-26 are Justin QA artifacts PR #2668/#2676/#2677 by @Orlandohub (ephemeral, safe to delete, attached to PR review cycles). For this library: PKARR's first non-chore v8 release is structurally significant because DHT-vs-relay path tuning is the operational surface that will define PKARR's reliability story as pubky-homeserver deployments scale — the W40 weekly noted that "PKARR is now treated as a stable dependency", but stable ≠ feature-complete. See §3.
• ENS DAO Newsletter #121 (Oct 1, 2026, estmcmxci) — the longest and most cross-organization edition of the year. 11 ENS Labs items (zk.money CCIP-Read privacy names, GDC 2026 recap "naming as onchain infrastructure", ENS App profile dashboard, ETHGlobal Tokyo 6 ENSv2 prize winners, ENS × GLEIF vLEI verifiable organizational identity, Sibos Miami, ENSv2 at Tokyo, etc.) + 6 DAO-Wide Headlines + 5 PRs + 8 Meta-Governance items + 4 Security items + 4 ENSIP items + 5 Ecosystem Highlights. Highest-leverage W41 items for this library: (1) zk.money is back with name.zk.money resolving through ENS CCIP-Read — each tag has a ZK proof deriving a new deposit address per transfer, so the public name stays consistent while balances and payment histories stay private. This is the first time a privacy-preserving payments protocol has used ENS CCIP-Read as the public-facing identity layer — the pattern is "ENS for the identity, ZK for the activity", and it's a template for every future privacy-coin / privacy-L2 integration. (2) ENS Labs takes over Durin, the ENS L2 subname tool from NameStone (NameStone shut down, domain/GitHub/infrastructure/smart-contract ownership all transferred). Durin becomes an ENS Labs-maintained product — a path for subname issuance on L2s that doesn't depend on a third-party host. (3) ENS Endowment reaches $93.12M end-August (up $15.78M as ETH rose 32.5%, generated $230,305 in yield, shifted funds into Aave and Compound, held 66.5% in ETH — above the 60/40 target). September figures: NAV $98M, 60/40 stablecoin-to-ETH allocation, 3.228% blended APY vs 2.286% benchmark, Sept result ~$231,000. The 66.5% ETH concentration is the most ENS Endowment has deviated from the 60/40 mandate target — options-research is "nearly finalized for a forthcoming forum discussion". (4) ens-contracts PR #577 (aeosproof) replaces Solidity's .transfer() with low-level .call() in ETHRegistrarController + BulkRenewal + StaticBulkRenewal — closes the post-EIP-1884 2300-gas-stipend refund/renewal revert for Gnosis Safe and ERC-4337 accounts. Foundry tests confirm no regressions. (5) ens-app-v3 PR #1166 (storywithoutend) restricts composite-resolver unwrapping to a chain-specific allowlist — fixes a trust-boundary issue where ENS Manager could unwrap resolver abstractions based on an untrusted composite resolver's self-report. Unknown composites now stay visible as repairable custom resolvers, with new spoof-resolver test fixtures. (6) ensjs PRs #385-388 land 4 fixups — #385 fixes the Sepolia public-resolver address, creates fresh salt per proxy deployment, sets a fixed gas limit for test registrations; #386 matches the registration log by labelHash not current token id (re-registered names); #387 adds the default reverse registrar and two HCA adapter addresses to L1 network config; #388 fixes a TypeScript type that was widening returned ENS roles to generic string. The single highest-leverage security item: Blockful's review of the revised KPK Update #10 execution found the switch should not yet be scheduled on the Endowment Timelock, since kpk has not transferred ownership of the new Roles Modifier contract — the Endowment Safe's two-call batch would swap v2.1.0 → v2.1.1 (same MANAGER perms + PUR #10 additions) once Foundation schedules, but Security Council retains a 9-day cancel window. For this library: the Newsletter is the canonical primary source for ENS-side W41 activity — every other ENS item in this update is cross-referenced. See §5.
• Root KSK rollover T-6 days to Oct 11 2026 + APNIC podcast Oct 1 (blog.apnic.net/2026/10/01/podcast-the-october-2026-root-ksk-roll) — Duane Wessels on the rollover history with Roy Arends (ICANN): the first rollover in 2017 completed successfully; the 2020 second rollover was delayed by unexpected circumstances (the trust-anchor rollback in 2017-2018 + the 2018-2019 invalid trust-anchor telemetry from multiple resolvers); the 2023 second-rollover attempt was delayed again (postponed from Mar 2020 → Sep 2020 → Q1 2021 → "indefinite"); on Oct 11 2026 the new KSK (KSK-2024) begins signing the root zone while KSK-2017 is retired from active signing operations (it stays visible in the root zone until Jan 2027 when it is marked revoked and removed per Infoblox's Oct 2026 preparation blog). DNSSEC-validating resolvers that don't update their trust-anchor configuration will fail DNSSEC validation on Oct 11. The simultaneous Oct 7 (Reveal Day) + Oct 11 (KSK rollover) = institutionally-loaded second week of October 2026, as the W40 update predicted. For this library: KSK rollover is a DNSSEC story, not a decentralized-DNS story — but the 4 SEP-2025 / 4 SEP-2026 anchors are the load-bearing trust assumption for Namecoin ncp11 HTTPS-in-stock-browsers (which chains through the conventional DNS root to validate the Namecoin chain's TLS cert), so the rollover is a Namecoin operational concern. Sepolia ENS Public Resolver restoration (see ENS Newsletter #121 / ensjs PR #385) is the equivalent event for ENS testnet — restoring the V1 public-resolver address on Sepolia was needed because the V2 deployment broke DNS imports and legacy wallet actions that need the V1 addr interface. For this library: DNSSEC trust-anchor + ENS testnet resolver address are both "load-bearing trust" events that the W41 sweep would miss if it only watched decentralized-DNS repos. See §6.
• ICANN TSG Initial Report on gTLD × Alt Naming Systems → 2nd public comment opens mid-Oct 2026 — per the TSG Charter v1.1 Aug 10: the 1st public comment closed Sep 21 (per the Sep 22 ICANN "comments closed" statement), TSG members in-person meeting was "tentative 24-25 September 2026", "edits of materials responding to comments 21-28 September 2026" → "Report published for (2nd) Public Comment Mid-October 2026" → "Public Comment Close Late November/early December 2026" → "Final report published January 2027". The Oct 8 public-comment opening is two days after the Oct 7 Reveal Day — the alt-naming-system advocates get the string-by-string contention map one day before the formal comment window opens. This is the highest-leverage signal in the W41 window for ENS, Handshake, Namecoin. The W40 update flagged the Sep 21 1st-comment closure as the Sep 22 "no further public TSG statement" — the W41 update confirms the timeline was on schedule. For this library: the Oct 8 public comment is the second bite at the apple for the alt-naming-system community. The W40 submission log (WIPO Arbitration + Avbenagha + .ART + Tucows, all Sep 18-21) will be the surface for review; the 2nd-comment window is where the new alt-naming-system submissions land. Watch for any ENS Labs / Handshake / Namecoin / Unstoppable Domains / Verisign / Identity Digital / Tucows submissions. See §7.
• Handshake hsd core still dormant (Aug 22 2025 last commit, >13 months stale) but four new PRs in the W41 observation window from the community contributors: #957 seeds update (Nathanwoodburn, Jun 5 — handshake-org member) updates the Nathan.Woodburn/ seeds file; #960 experimental HNS node rendezvous and relay (denuoweb, Jul 21); #959 experimental P2P ODoH relay stacked on #958 (denuoweb, Jul 21 — ODoH = Oblivious DNS-over-HTTPS, the IETF standard for resolver-hidden DNS lookups); #956 docs: propose resource v1 direct-resolution format (shadstoneofficial, Jun 3). The P2P ODoH stack (#958 → #959 → #960) is the Handshake-side privacy/DoH answer, mirroring the DNS-AID draft-02 strategy of bringing standard-DNS-anchor-amenable surface to non-ICANN identity. The Handshake Improvement Proposal (HIP) #955 HIP018 re-record: Add narrow Rerecord A and AAAA support (shadstoneofficial, May 12, 25 comments) is the most active HIP-anchored PR. hsd core development is effectively paused at v8.0.0 (Jul 1 2025) — the PRs are RFC/stack additions, not consensus-rule changes. For this library: the P2P ODoH + HIP018 Rerecord A/AAAA is the first material Handshake-ecosystem development since the airstop fork confirmed live (W40 update) — but the work is by the Handshake community (Nathanwoodburn + denuoweb + shadstoneofficial) not the core handshake-org team. The community-vs-core gap is now 13 months. See §8.
• GNUnet / GNS — no new release since 0.29.0 (Aug 20). No new release; experimental software. Namecoin — no Namecoin Core tag since nc31.1 (May 2025; Bitcoin Core upstream sync continues; the Ghost-Town note from Nostr is consistent with the lack of tagged releases since May). Encasha (off-chain SSHFP records) is "in development" per the Namecoin news page — the Namecoin at FOSDEM 2026 page lists Jan 31 - Feb 1 2026 in Brussels. Electrum-NMC v3.2.4b1 is still the recommended beta from 2018 — no new release since. The Namecoin / .bit story is structurally mature and structurally quiet — there's no shipping event in the W41 window. For this library: Namecoin's structural quiet is the right operational state for a project with stable HTTPS (ncp11 stack) and a long-standing track record; the value-add of a W41 sweep is confirming the silence. See §9.
• DNS-AID draft-02 expires Nov 28 2026 (T-54 days), no new draft, no public Linux Foundation / dns-aid repo commits in the W41 window per github.com/dns-aid. Cloudflare Agent-Readiness checker (Aug 24 baseline) still enforces draft-01 expectations. Watch for any cut before Nov 28 expiry. Stale but not dead. See §10.

Deep dives

1. ICANN Reveal Day: October 7, 2026 at 18:00 UTC — full week earlier than expected

Announcement: icann.org/en/announcements/details/icann-announces-date-for-reveal-day-and-other-2026-round-milestones-29-09-2026-en — Sep 29 2026. Coverage: circleid.com/posts/icann-sets-october-7-for-2026-new-gtld-reveal-day — Sep 30 2026.

The Sep 29 ICANN announcement is the institutional close of the 2026 Round submission phase. It confirms:

• Reveal Day: October 7, 2026 at 18:00 UTC — published on the 2026 Round Application Publication and Statistics (APS) website. Disclosed: applicant identities, all primary strings, applicable variant and replacement strings, contention sets, public portions of each application.
• Replacement Period: October 8 2026 00:01 UTC – October 21 2026 23:59 UTC — 2-week window. Eligible applicants that submitted an alternate replacement string may switch from their primary string. A replacement cannot be used if it is identical to another primary or replacement string, although a replacement could still enter contention later (e.g., singular/plural notifications, String Confusion Objections).
• String Confirmation Day: November 17, 2026 — final list of all applied-for gTLD strings + updated contention sets. Starts the Community Input and Objections Period + opens the 10-day withdrawal window for a 65% refund of the $227,000 evaluation fee.
• ICANN office closure 1:00 UTC 19 December 2026 – 16:00 UTC 4 January 2027 — pause factored into the Community Input and Objections Period.
• Prioritization Draw in first half of 2027 — virtual, public, sets the order that applications and contention sets are processed after the String Evaluation Stage (expected 180 days, starts after the Community Input + Objections Period).

Why Reveal Day matters for decentralized DNS (this library's lens):

1. The first verified picture of demand at the individual-string level. Until now, the public discussion has been about categories of applications (.web3, .wallet, etc.) and the 1,616 number (the 47 of 1,663 submitted apps that failed to pay the per-application fee). Reveal Day is the day when the actual entity → string mapping is published.
2. The contention-set data is the first institutional pressure test for the alt-naming-system advocates. If 5 different orgs apply for .wallet, the contention-set is the first time the alt-naming community can see the specific institutional pressure on a name that conflicts with an alt-naming-system convention. The TSG Initial Report (see §7) is the policy surface for this pressure; Reveal Day is the factual surface.
3. The simultaneous Oct 7 (Reveal Day) + Oct 11 (KSK rollover) window is the most institutionally-loaded second week of October 2026 in the history of the global DNS — as the W40 update predicted.
4. The Sep 29 announcement moves the date a full week earlier than ICANNWiki's upper bound of Oct 14 (per the "9 weeks after Aug 12 application-window-close" rule of thumb). ICANN has not published a reason for the acceleration; the most likely explanation is the simultaneous Oct 11 KSK rollover — putting Reveal Day in the same week concentrates institutional attention.

Per CircleID Sep 30: - "The date moves disclosure a week ahead of ICANN's previous outside estimate. ICANN said on September 22 that Reveal Day would occur no later than October 14, nine weeks after the application window closed." - "A two-week replacement period begins hours after the disclosure. From 00:01 UTC on October 8 through 23:59 UTC on October 21, eligible applicants that submitted an alternate replacement string may switch from their primary string." - "ICANN has also fixed November 17 as String Confirmation Day, when it will publish the final list of chosen strings and updated contention sets."

The Sep 22 ICANN release (icann.org/en/announcements/details/icann-confirms-number-of-applications-proceeding-in-the-2026-round-22-09-2026-en) — referenced in the W40 update — confirmed 1,616 paid applications + 47 unpaid. The Sep 29 announcement closes the upper-bound ambiguity by setting Oct 7 as the firm date.

For this library: Oct 7 is the day the alt-naming-system community can map the institutional pressure on the legacy DNS. Watch the ENS / Handshake / Namecoin social channels Oct 6-8 for reactions to the application-public-portion disclosures (which often include intended-use statements, market-segment claims, and target-user definitions that the alt-naming-system community can use to position themselves). The W41 sweep's primary source for Oct 7+ is the APS website itself — newgtldprogram.icann.org.

2. pubky-homeserver v0.14.0 (Sep 28) — atomic-rename staging + content-hash consistency

Tag: v0.14.0 — Sep 28 11:43:14Z — commit a546dd6 — PR #646 (86667) GitHub release: github.com/pubky/pubky-homeserver/releases/tag/v0.14.0 Stars: 87. GPG: B5690EEEBB952194 (verified on Sep 28 07:13). 7 commits since v0.13.0 main.

5 days after v0.13.0 (Sep 23). The W40 update (Sep 28 era) called the W40 cluster "stable" but v0.14.0 ships the same day — the W40 sweep missed the v0.14.0 release by hours. The cadence pattern holds: pubky-homeserver released on Aug 19 (v0.11.0) → Sep 14 (v0.12.0) → Sep 23 (v0.13.0) → Sep 28 (v0.14.0) — four releases in 40 days, with the gap shrinking 26 → 9 → 5 days. If the cadence continues, v0.15.0 lands by Oct 8 (10-day window from v0.14.0).

Headline features:

The operator-facing breaking change (from the release notes):

Check your volume mounts before upgrading. Uploads are now staged in data/files-tmp and renamed into data/files once complete. Both directories must be on the same filesystem. If you mount a volume at data/files directly, move the mount up to data (or ~/.pubky). The default Docker setup, which mounts ~/.pubky, needs no change. data/files-tmp needs no backup.

The breaking change is silent for the default Docker setup — but operators running a manual mount setup (e.g., bind-mounting data/files to a dedicated volume for backup) need to act before upgrading. The W41 sweep would miss this breaking change if it only watched commit history — the release notes are the authoritative source.

Dependabot / chore commits (the v0.13.0 → v0.14.0 window): - Pre-release cluster: a546dd6 (release commit by 86667, the v0.14.0 tag itself).

For this library: v0.14.0 is the first operator-visible breaking change of the v0.10+ arc. The W39 sweep (Sep 21) noted that the 0.11→0.12→0.13 arc was moving from "feature add" to "hardening", and v0.14.0 confirms the hardening direction — the write-path hardening (PR #637) is the correct architecture for a P2P storage layer that handles potentially-malicious clients (a homeserver that stores content for a public key can be asked to store any blob, including oversized or malformed ones; the atomic-rename pattern means a partial upload is always recoverable). The content-hash consistency fix (PR #645) is a smaller but load-bearing correctness fix — without it, the homeserver could serve a data/files/<hash> URL with a different blob than the one the hash references.

3. pkarr v8.1.0 (Oct 2) — separate DHT and relay request timeouts + mainline 8.0.1 dep

Tag: v8.1.0 — Oct 2 09:02:30Z — commit 900be53 — PR #326 (andrei-21) GitHub release: github.com/pubky/pkarr/releases/tag/v8.1.0 Stars: 458 (up from 457 Sep 23). 3 commits since v8.0.2 main.

9 days after v8.0.2 (Sep 23). The W40 update called v8.0.2 "a marker, not a release" — and v8.1.0 is the first non-chore release of the v8 line. The headline feature is a separation of concerns that PKARR's API has been quietly deferring since the v3 / v4 line.

Headline features:

Package versions: - pkarr: 8.1.0 - pkarr-relay: 2.1.0 - @synonymdev/pkarr: 8.1.0

Why separate DHT/relay timeouts matter:

The PKARR lookup architecture (since v3 / v4) is: a client tries to resolve a public key → it queries the Mainline DHT for the public key's signed resource record → if the DHT is slow or unresponsive, the client also tries the pkarr-relay cache → if the relay has a fresh answer, the client gets it fast. The two paths were gated by a single timeout in the previous API — meaning the client had to choose between "wait long enough for the DHT" and "fail fast and fall through to the relay". With separate timeouts:

• The relay path can be set to fail fast (e.g., 1 second) — the relay should always have a recent answer; if it doesn't respond in 1 second, the relay is degraded and the client should fall through to the DHT.
• The DHT path can be set to wait longer (e.g., 10 seconds) — the DHT can be slow under load, but it's the source of truth for the public key's signed record.

The net effect is a faster, more reliable PKARR client — the relay fast-path succeeds quickly when healthy, and the DHT slow-path has enough time budget to actually succeed when needed.

For this library: PKARR's first non-chore v8 release is structurally significant because DHT-vs-relay path tuning is the operational surface that will define PKARR's reliability story as pubky-homeserver deployments scale. The W40 weekly noted that "PKARR is now treated as a stable dependency", but stable ≠ feature-complete. v8.1.0 is the first v8 release that adds a new client capability rather than a chore / lockfile bump.

No pubky-app v1.12 in the W41 window — the only pubky-app releases Sep 24-26 are Justin QA artifacts PR #2668 (Sep 25 19:10:21Z), PR #2676 (Sep 26 02:46:00Z), PR #2677 (Sep 26 03:01:40Z) by @Orlandohub (commit c44894c) — ephemeral preview screenshots for PR review cycles, safe to delete per the release names. The latest real pubky-app release is still v1.11.0 (Sep 23, 12 days ago).

4. [Reserved §4 placeholder — moved to §5 for ENS Newsletter #121 + §6 for KSK rollover + §7 for ICANN TSG]

5. ENS DAO Newsletter #121 (Oct 1, 2026) — longest, most cross-organization edition of the year

Source: discuss.ens.domains/t/ens-dao-newsletter-121-10-1-2026/22455 — estmcmxci (ENS delegate), 3 days ago at the time of W41 capture = Oct 1 2026.

Newsletter #121 is the longest, most cross-organization edition of the year. The W40 update flagged Newsletter #120 (Sep 15) as "the most DAO-content-rich of Q3" — #121 is a step beyond that, with material from ENS Labs + zk.money + GLEIF + Sibos + ETHGlobal + NameStone + Namespace + Unruggable + Blockful + Digraphia + Talha + HCA + MetaGov + 5 ensjs PRs + 2 ens-contracts PRs + 1 ens-app-v3 PR + Endowment monthly report. The W40 update's count of "13 posts" for ENSIP-28 → 12 → Newsletter #121 = 11 ENS Labs items + 4 Security items + 4 ENSIP items + 5 Ecosystem Highlights + 6 DAO-Wide Headlines + 5 PRs + 8 Meta-Governance items.

Highest-leverage W41 items for this library:

5.1 ENS-Powered zk.money Names Pair Payments With Privacy (ENS Labs)

zk.money's name.zk.money tags resolve through ENS CCIP-Read, giving users a shareable payment name. Behind each tag, a zero-knowledge proof derives a new deposit address for every transfer, so names stay consistent while balances and payment histories remain private. → zk.money Is Back, with ENS-Powered Names | ENS Blog

Significance: This is the first time a privacy-preserving payments protocol has used ENS CCIP-Read as the public-facing identity layer — the pattern is "ENS for the identity, ZK for the activity". The CCIP-Read gateway lets zk.money serve the name.zk.money resolution off-chain (because the deposit-address derivation is a ZK proof, not a static record), and the wallet looks up the deposit address through CCIP-Read on every transfer. For this library: this is a template for every future privacy-coin / privacy-L2 integration — the alt-naming-system + privacy-L2 stack is now a real production pattern, not a research project. The link between ENS CCIP-Read and the 13-Private-Information-Retrieval / 09-Zero-Knowledge sub-areas of this library is now an actively-shipped pattern, not a research direction.

5.2 ENS Labs Takes Over Durin, an ENS L2 Subname Tool (DAO-Wide)

ENS Labs has taken over Durin, a tool for issuing ENS L2 subnames. Originally developed by NameStone through an ENS DAO grant, its domain, GitHub repo, infrastructure and smart-contract ownership were transferred after NameStone shut down. → durin.dev

Significance: NameStone (one of the early ENS L2 subname platforms) shut down, and the L2 subname tool's domain, GitHub repo, infrastructure, and smart-contract ownership all transferred to ENS Labs. Durin becomes an ENS Labs-maintained product — a path for subname issuance on L2s that doesn't depend on a third-party host. The L2 subname issuance model is one of the load-bearing scaling patterns for ENSv2 (per the W40 update's note on ENSv2 Role-Based Permissions May 19 2026 + stay-on-L1 decision Feb 2026), and having a Labs-maintained reference implementation is a real institutional move. For this library: this is the second "company-shutdown-asset-transfer" event in the ENS ecosystem in 2026 (SafeNotes shutdown in Q3, NameStone shutdown in Q4) — the asset-recovery pattern is becoming routine.

5.3 ENS Endowment: $93.12M end-Aug + $98M Sept NAV + Blockful review (Security)

The ENS Endowment ended August at $93.12M, up $15.78M as ETH rose 32.5%. It generated $230,305 in yield, shifted funds into Aave and Compound, and held 66.5% in ETH—above its 60/40 mandate target. The Endowment reported a $98 million net asset value, an approximately 60/40 stablecoin-to-ETH allocation, and a 3.228% blended APY against a 2.286% benchmark. September's reported result was approximately $231,000; options research was described as nearly finalized for a forthcoming forum discussion. Blockful's security review of the revised KPK Update #10 execution found the switch should not yet be scheduled on the Endowment Timelock, since kpk has not transferred ownership of the new Roles Modifier contract. The Endowment Safe's two-call batch would swap the current Roles Modifier (v2.1.0) for an updated one (v2.1.1) carrying the same MANAGER permissions plus the PUR #10 additions. Once the ENS Foundation schedules the batch, the Security Council retains a nine-day window to cancel it.

Significance: The 66.5% ETH concentration is the most ENS Endowment has deviated from the 60/40 mandate target — options-research is "nearly finalized for a forthcoming forum discussion". The 32.5% August ETH rise + the 60/40 mandate target = the Endowment is structurally long-ETH through the September window. The Sept NAV $98M is the first month-end above the $93.12M Aug baseline. For this library: the Blockful security review is the most important Security item of the W41 window — the v2.1.0 → v2.1.1 swap is a routine endowment permission update (adding PUR #10 RWA + Morpho + Aera) but the Security Council's 9-day cancel window is the load-bearing operational check. Watch the Endowment Monthly Reports thread for the September full report.

5.4 ens-contracts PR #577 (aeosproof) — .transfer() → .call() for ERC-4337/SAFE refund (PRs)

A pull request to the ens-contracts repository replaces Solidity's .transfer() with low-level .call() across ETHRegistrarController, BulkRenewal, and StaticBulkRenewal contracts. The change addresses reverts affecting refund and renewal transactions for smart contract wallets, such as Gnosis Safe and ERC-4337 accounts, caused by the 2300 gas stipend limit post-EIP-1884. Foundry tests confirm the fix resolves the issue without regressions. → PR #577

Significance: The .transfer() 2300-gas-stipend limit was a Solidity pre-Istanbul bug that EIP-1884 made exploitable in 2019 — transfer forwards only 2300 gas, which is enough for an event log emit but not enough for a smart-contract wallet's fallback function (which is what Gnosis Safe and ERC-4337 accounts use to receive ETH). The fix is a one-line pattern change: .call{value: amount}("") instead of .transfer(amount). For this library: this is the kind of boring-but-load-bearing fix that gets the ENSv2 release out the door. The W40 update noted that the ENS Labs × Immunefi audit competition "results frozen Sep 28" — the post-audit audit-competition triage is the source of fixes like this one.

5.5 ens-app-v3 PR #1166 (storywithoutend) — composite-resolver allowlist (PRs)

A PR to ens-app-v3 fixes a trust-boundary issue where ENS Manager could unwrap resolver abstractions based on an untrusted composite resolver's self-report. The fix adds a chain-specific allowlist, keeps unknown composites visible as repairable custom resolvers, and includes new spoof-resolver test fixtures with unit, component, and E2E coverage. → PR #1166

Significance: ENSv2's composite resolvers (introduced May 2026 per the W40 update's "Role-Based Permissions" note) are a powerful abstraction — but the v1 ENS Manager UI was unwrapping them based on the resolver's self-report, which is the wrong trust direction. The fix: a chain-specific allowlist of known-good composite resolvers, with unknown composites staying visible as repairable custom resolvers. For this library: this is a UX-vs-trust boundary fix — the right pattern is "show the user what's actually there, don't unwrap based on untrusted self-reports".

5.6 ensjs PRs #385-388 (v1rtl, Malak67) — Sepolia V1 public-resolver restore + 4 fixups (Commits)

ensjs PR 385 fixes the Sepolia public-resolver address, creates a fresh salt for each proxy deployment, and sets a fixed gas limit for test registrations. The changes address resolver failures, repeated-deployment collisions and intermittent CI seeding failures. ensjs now finds a name's registration date by its stable labelHash rather than its changing token ID. The old lookup returned null for re-registered names; the change also removes an extra chain call and adds a logic-only test. ensjs added the default reverse registrar and two HCA adapter addresses to its L1 network config, replacing Sepolia-specific copies in the apps monorepo. The addresses were verified on Sepolia; mainnet remains set to zeroAddress pending deployment. ensjs corrected a TypeScript type that reduced returned ENS roles to a generic string, forcing developers to cast them manually. The fix preserves role information using the pattern in getNameRolesForAccount; runtime behavior is unchanged.

Significance: The Sepolia V1 public-resolver restoration is operationally critical for ENSv2 mainnet migration — Sepolia is the ENSv2 staging testnet, and a V1 public-resolver address set to V2 would have broken DNS imports and legacy wallet actions (including DNSRegistrar.proveAndClaimWithResolver). The HCA adapter addresses being added to L1 config is the first code-path for ENSv2 Hot Configurable Authentication (HCA) in ensjs (the W40 update noted the ensforge SDK added HCA support Sep 15-22). For this library: the HCA adapter addresses are the canonical on-chain reference for ENSv2 HCA — once the mainnet deployment happens, the zeroAddress placeholder will be replaced.

5.7 ENS × GLEIF Verifiable Organizational Identity (ENS Labs)

ENS Labs and GLEIF are exploring a proposed standard that would link an organization's ENS name to its verifiable Legal Entity Identifier (vLEI). The aim is to let apps and counterparties verify the legal entity behind an onchain name; the work remains in development. → ENS and GLEIF Explore Verifiable Organizational Identity Onchain | ENS Blog

Significance: GLEIF (Global Legal Entity Identifier Foundation) operates the vLEI (verifiable LEI) standard, which is the institutional corporate-identity standard. Linking an ENS name to a vLEI means an ENS name becomes a verifiable organization-identity — apps can check the vLEI signature and confirm "this name is controlled by entity X". For this library: this is the institutional bridge between ENS and the corporate-identity world. The W40 update's "Evolved Foundation" blog (Sep 22) noted that the Foundation would "engage on policy with regulators/lawmakers" — the GLEIF partnership is a concrete instance of that engagement.

5.8 HL Names .hl.hn (Ecosystem)

HL Names launched .hl.hn, allowing supported wallets and apps to resolve existing .hl names through ENS while the names remain on Hyperliquid. The integration uses ENSIP-10 wildcard resolution and ERC-3668 CCIP Read to fetch the associated address. → Tweet by @hlnames

Significance: HL Names is a Hyperliquid identity layer — the integration lets a Hyperliquid trader have a .hl name that resolves to an Ethereum address through ENS CCIP-Read. For this library: this is the same CCIP-Read pattern that zk.money uses (see §5.1) — the pattern is becoming the standard for "identity lives on chain A, name resolves through ENS". The Hyperliquid + ENS integration is a chain-to-chain identity bridge that doesn't require a custom resolver on every chain — the resolution happens through CCIP-Read on Ethereum, and the Hyperliquid name points to the CCIP-Read gateway.

5.9 Namespace Mint Manager Skill (DAO-Wide)

Namespace, an ENS DAO Service Provider, released a Mint Manager skill that lets AI tools issue ENS subnames on Ethereum, Base, and Optimism. The tool is described as offering customizable subname issuance and was shared via retweet on ENS DAO's X account.

Significance: The W40 update noted that ensforge SDK added HCA support — the Mint Manager skill is the first AI-agent-facing subname-issuance skill in the ENS ecosystem. The chain coverage (Ethereum, Base, Optimism) means an AI agent can issue subnames on three of the four major ENSv2 L2 targets with one skill invocation. For this library: this is the AI-agent × ENS integration surface that the W40 update's "ensforge HCA" note was building toward — the agent identity flow is now production.

5.10 Unruggable 20K NFTs + AdapterScan (Meta-Governance)

Unruggable described ENS and NFT identity standards, including support for multiple accounts associated with a name and an adapter that binds agent identities to collection NFTs. The team reported more than 20,000 NFT registrations and introduced AdapterScan, an explorer for data held in its adapter contract.

Significance: Unruggable's adapter contract lets a collection NFT act as a resolver for a name — a single ENS name can resolve to a different address per NFT in the collection. The 20,000 NFT registrations is a production-scale number. For this library: this is the NFT-as-resolver pattern — an alternative to the standard text-record pattern, where the resolution is gated on the holder of a specific NFT.

5.11 ENS Labs at Sibos Miami (ENS Labs)

Members of the ENS team are attending Sibos Miami this week, engaging in conversations about names, verifiable identity, and how financial systems connect with onchain infrastructure.

Significance: Sibos is the SWIFT annual conference — the institutional banking world's premier event. ENS Labs attending Sibos is the most institutional-facing event for the ENS ecosystem in 2026. The GLEIF partnership (see §5.7) is the corporate-identity leg; the Sibos attendance is the financial-infrastructure leg.

5.12 ETHGlobal Tokyo 6 ENSv2 winners (ENS Labs)

At ETHGlobal Tokyo, six teams shared $10K in ENS prizes for projects built on ENSv2. The winning entries spanned access control, DeFi, collectibles, and private messaging, reflecting a range of developer use cases for the protocol.

Significance: ETHGlobal Tokyo is the most recent ETHGlobal of 2026, and ENSv2 is the explicit base layer for the prize category. The 6 winning projects span access control + DeFi + collectibles + private messaging = the breadth of the ENSv2 developer ecosystem in 2026.

5.13 The remaining Newsletter #121 items (1-line each):

• MetaGov Safe executed Sep 30: $30,000 USDC to Nomentum Labs (first of three monthly installments under the $500,000 SPP3 Marketplace RFP award; remaining funds held against performance gates and ENSv2 readiness milestone) + $15,560 USDC September steward compensation + communications stipend (drawn from residual Term 6 funds).
• Blockful delegation-incentive final week: $ENS holders can earn rewards by delegating to an Active Delegate; the final round of the incentives program.
• Digraphia cross-script ENS names: Leon demonstrated a way to link ENS names written in different scripts using reciprocal text records and matching resolved addresses; described an ENSIP draft, plans to seek a small grant.
• Talha PhD research on DAO governance: comparing DAOs' democratic claims with how decisions and power operate in practice; reviewing governance documents and forum discussions, seeking conversations with DAO members.
• Working Group October budget lines: anticipated request includes steward compensation, DAO communications, approximately $50,000 for discretionary activities, and a conditional $100,000 contract-audit allocation. The discretionary line covers community and governance initiatives and travel, rather than grants or hackathons.
• Governor Nexus audit quotes received: feedback window closed Sep 2, quotes received from all three firms contacted. None required code changes. Audit proposal coming to DAO for approval, audit targeted for the quarter starting October.
• ENSIP-28 progress: still active feedback thread.
• ENSIP-31 progress: still active feedback thread (jkm.eth Sep 21 5:19pm pushback on multichain-token fungibility is the last substantive reply; see W40 update).
• CitizENS 001 profile of estmcmxci.eth: ENS's DNSSEC verification now uses Ethereum's native P-256 precompile (per the W40 update's "ENS DAO Sep 1 burst — P-256 Precompile Migration report"); for Algorithm 13 imports, signature verification fell from 1,340,706 to 10,493 gas — a 99.2% reduction. This is the load-bearing technical milestone for the W40 update's "ENS-GR-01 governance research" note.
• ENS Advisor (ensdesk.com) launch: non-custodial tool for expiring .eth names and sales data; registration flow and budget-based auto-register use a scoped MetaMask permission (ERC-7715); underlying registrar contract published as open source.

For this library: the Newsletter is the canonical primary source for ENS-side W41 activity — every other ENS item in this update is cross-referenced. The 11 ENS Labs items + 5 PRs + 4 Security items make Newsletter #121 the most operationally-rich weekly ENS surface in 2026.

6. Root KSK rollover T-6 days to Oct 11 2026 + APNIC podcast Oct 1

APNIC podcast (blog.apnic.net/2026/10/01/podcast-the-october-2026-root-ksk-roll) — Duane Wessels on the rollover history with Roy Arends (ICANN):

• The first KSK rollover in 2017 completed successfully.
• The 2020 second rollover was delayed by unexpected circumstances — the trust-anchor rollback in 2017-2018 + the 2018-2019 invalid trust-anchor telemetry from multiple resolvers (an entire ecosystem of DNSSEC-validating resolvers was reading the trust anchor as "revoked" when it was actually "standby", which caused a global DNSSEC outage for some networks).
• The 2023 second-rollover attempt was delayed again (postponed from Mar 2020 → Sep 2020 → Q1 2021 → "indefinite" by Oct 2018).
• On Oct 11 2026 the new KSK (KSK-2024) begins signing the root zone while KSK-2017 is retired from active signing operations (it stays visible in the root zone until Jan 2027 when it is marked revoked and removed per the Infoblox Oct 2026 preparation blog).
• DNSSEC-validating resolvers that don't update their trust-anchor configuration will fail DNSSEC validation on Oct 11. The fix for a BIND-based resolver is to update trusted-keys or managed-keys to include the new KSK-2024 trust anchor.

The ICANN-side KSK story:

• ICANN announced (Sep 24 per W40 + Aug 11 per icann.org/resources/press-material/release-2026-08-11-en) that the new root KSK (KSK-2024) will become the active key on Oct 11 2026.
• The ICANN Board LA workshop (Sep 4-6) approved the rollover.
• The LinkedIn post by comparethecloud-net on Oct 1 confirms the date.
• ICANN's @ICANN tweet Sep 24 reminds operators that the new trust anchor KSK-2024 is the one to configure for Oct 11.

Why KSK rollover matters for this library:

1. Namecoin ncp11 HTTPS-in-stock-browsers chains through the conventional DNS root to validate the Namecoin chain's TLS cert. The Namecoin core team's recent work on Encasha (off-chain SSHFP records) and the ncp11 stack (DNSSEC chain for .bit HTTPS) is operationally affected by the KSK rollover — operators of Namecoin-anchored HTTPS sites need to ensure their DNSSEC-validating resolvers have the new KSK-2024 trust anchor configured by Oct 11.
2. The DNSSEC chain is the load-bearing trust assumption for ENS DNSSEC imports (the algorithm-13 imports that the W40 update tracked with estmcmxci.eth's P-256 precompile migration). A KSK rollover that breaks DNSSEC validation on a Namecoin-anchored chain would break ENS DNSSEC imports for any .bit name.
3. The simultaneous Oct 7 (Reveal Day) + Oct 11 (KSK rollover) = institutionally-loaded second week of October 2026, as the W40 update predicted.

For this library: DNSSEC trust-anchor + ENS testnet resolver address are both "load-bearing trust" events that the W41 sweep would miss if it only watched decentralized-DNS repos. The Sepolia ENS Public Resolver restoration (see ENS Newsletter #121 / ensjs PR #385) is the equivalent event for ENS testnet.

7. ICANN TSG Initial Report → 2nd public comment opens mid-Oct 2026

TSG Charter v1.1 (Aug 10, 2026): icann.org/en/system/files/files/alt-naming-systems-tsg-charter-10aug26-en.pdf.

The TSG timeline per the Charter:

The 1st public comment closed Sep 21 (per the Sep 22 ICANN "comments closed" statement that the W40 update flagged). The submissions in the icann.org/en/public-comment/proceeding/initial-report-of-the-tsg-on-gtld-integrations-with-alternative-naming-systems-10-08-2026/submissions page include: - WIPO Arbitration and Mediation Center (Sep 21) — flagged the intersection with ICANN Consensus Policies (e.g., Rights Protection Mechanisms such as Sunrise and UDRP) at 8.6 of the report. - Avbenagha, Onovughakpo Oghenebrorie (Sep 21) — supported the TSG report, emphasized the need for strict technical safeguards to preserve global DNS security, stability, and interoperability. - .ART Domain Registry (Sep 20) — proposed a common technical baseline guiding gTLD integrations with alternative naming systems to reduce repetitive review. - Tucows (Sep 18) — public comment from a major registrar.

The 2nd public comment opens mid-Oct 2026 (≈ Oct 8, per the Charter timeline). The Oct 8 date is one day after the Oct 7 Reveal Day — the alt-naming-system advocates get the string-by-string contention map one day before the formal comment window opens. This is the highest-leverage signal in the W41 window for ENS, Handshake, Namecoin.

For this library: the Oct 8 public comment is the second bite at the apple for the alt-naming-system community. Watch for any ENS Labs / Handshake / Namecoin / Unstoppable Domains / Verisign / Identity Digital / Tucows submissions. The W40 submission log (WIPO + Avbenagha + .ART + Tucows) will be the surface for review; the 2nd-comment window is where the new alt-naming-system submissions land.

8. Handshake hsd dormant but 4 PRs open + P2P ODoH stack + HIP018 Rerecord A/AAAA

hsd core repo (github.com/handshake-org/hsd): last commit Aug 22 2025, >13 months stale, no v3.x tag. The PRs in the W41 observation window (per the github.com/handshake-org/hsd/pulls page):

The P2P ODoH stack (#958 → #959 → #960) is the Handshake-side privacy/DoH answer:

• #958 (Jul 17): net: add experimental P2P DNS relay — base layer.
• #959 (Jul 21): net: add experimental P2P ODoH relay (stacked on #958) — adds Oblivious DoH (ODoH, IETF RFC 9230) on top of the P2P DNS relay. ODoH separates the client IP from the DNS query — the resolver sees the query but not the client IP, and a proxy sees the client IP but not the query.
• #960 (Jul 21): net: add experimental HNS node rendezvous and relay — the Handshake node discovery layer.

The P2P ODoH stack is the Handshake-side privacy/DoH answer, mirroring the DNS-AID draft-02 strategy of bringing standard-DNS-anchor-amenable surface to non-ICANN identity. ODoH is the IETF standard for resolver-hidden DNS lookups (RFC 9230, May 2022) — a Handshake node that runs an ODoH resolver can answer .hns queries without learning the client IP, which is a meaningful privacy upgrade over the existing Handshake resolver model.

HIP018 Rerecord A and AAAA support (#955, 25 comments, the most active HIP-anchored PR):

• The Handshake Improvement Proposal (HIP) #18 is about Rerecord — a re-record allows a Handshake name owner to update the resource record set (TLD records) for a name. The "Add narrow Rerecord A and AAAA support" PR is a narrow Rerecord implementation that only allows A and AAAA records (instead of all record types) — this is the smallest-increment Rerecord that adds practical value (lets a Handshake name point to an updated IP without burning a new name).

For this library: the P2P ODoH + HIP018 Rerecord A/AAAA is the first material Handshake-ecosystem development since the airstop fork confirmed live (W40 update) — but the work is by the Handshake community (Nathanwoodburn + denuoweb + shadstoneofficial) not the core handshake-org team. The community-vs-core gap is now 13 months. The Handshake story is structurally bifurcated: the supply side (airstop fork + ~890M HNS permanently burned) is settled and irreversible, but the protocol-development side is dependent on community PRs rather than core-team shipping.

9. Namecoin + GNUnet / GNS — release plateaus (GNUnet remains experimental)

Namecoin:

• No Namecoin Core tag since nc31.1 (May 2025; Bitcoin Core upstream sync continues; the Ghost-Town note from Nostr is consistent with the lack of tagged releases since May).
• Encasha (off-chain SSHFP records) is "in development" per the Namecoin news page. The Namecoin at FOSDEM 2026 page lists Jan 31 - Feb 1 2026 in Brussels. The Namecoin at 39C3 (Dec 27-30 2025) announcement is on the news page (assembly at the Critical Decentralization Cluster).
• Electrum-NMC v3.2.4b1 is still the recommended beta from 2018 — no new release since.
• The Namecoin / .bit story is structurally mature and structurally quiet — there's no shipping event in the W41 window. The value-add of a W41 sweep is confirming the silence.

GNUnet / GNS:

• No new release since 0.29.0 (Aug 20 2026). No new release; experimental software. The W40 update's GNUnet 0.29.0 → 0.28.x protocol-break note still holds.
• GNUnet is the only major P2P naming stack with a privacy-preserving lookup-privacy story (per the W40 update's "Strongest lookup-privacy story" note for GNS).

For this library: the Namecoin / GNUnet structural quiet is the right operational state for projects with stable HTTPS / privacy-preserving-lookup stories and long-standing track records. The W41 sweep confirms the silence.

10. DNS-AID draft-02 expires Nov 28 2026 (T-54 days) — no new draft, no public commits

DNS-AID draft-02 (datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid) — published May 27 2026, expires Nov 28 2026 (T-54 days from Oct 5). No new draft in the W41 window. Cloudflare Agent-Readiness checker (Aug 24 baseline) still enforces draft-01 expectations without acknowledging the breakage.

The dns-aid org (github.com/dns-aid): no public commits in the W41 window per the github.com/dns-aid page.

For this library: DNS-AID is the naming layer for the agentic web — the W40 update flagged it as "Not decentralized per se, but defines the naming layer for the agentic web". The T-54 days to expiry is the deadline pressure — if the IETF doesn't get a new draft before Nov 28, the existing draft-02 expires and the project loses its standards-track status. Watch for any cut before Nov 28 expiry. Stale but not dead.

Summary table

When to watch next week (W42, Oct 12-18)

1. Mon Oct 13 → ICANN Replacement Period midpoint (Oct 8 - Oct 21). The first week of the 2-week replacement window.
2. ICANN TSG Initial Report → 2nd public comment opens Oct 8 (per Charter v1.1 "Mid-October 2026"). Watch for new submissions from ENS Labs / Handshake / Namecoin / Unstoppable Domains / Verisign / Identity Digital / Tucows.
3. Oct 11 KSK rollover — the DNSSEC trust anchor changes from KSK-2017 to KSK-2024. Watch for any DNSSEC-validating resolver outages in the 24 hours after the rollover.
4. Oct 17 APNIC blog follow-up (likely) on the KSK rollover post-mortem.
5. Oct 17 String Confirmation Day — wait, that's Nov 17, not Oct 17. Calendar note: Nov 17 is String Confirmation Day, not Oct 17.
6. Oct 26 ENS Labs × Immunefi audit competition publication — the public findings counter (306 reports / 20 confirmed / 56 under review) goes from internal to public on this date.
7. ENSv2 mainnet readiness narrative — the W40 update's "post-competition narrative for ENSv2 mainnet-readiness will likely be tied to the Oct 26 disclosure" prediction is on track.

Recent weekly updates in this section

• 2026-10-05: this entry — Decentralized DNS Monday — October 05 2026 Weekly Update — ICANN Reveal Day confirmed Oct 7 2026 18:00 UTC (Sep 29 announcement, a full week earlier than the Sep 22 "early next week" upper bound of Oct 14) + Replacement Period Oct 8-21 UTC + String Confirmation Day Nov 17 + Prioritization Draw 1H 2027; pubky-homeserver v0.14.0 Sep 28 11:43 (5 days after v0.13.0, atomic-rename staging in data/files-tmp + content-hash consistency + breaking operator mount-path note); pkarr v8.1.0 Oct 2 09:02 (9 days after v8.0.2, separate DHT and relay request timeouts PR #325 + mainline 8.0.1 dep PR #324); ENS DAO Newsletter #121 (Oct 1, estmcmxci) — longest, most cross-organization edition of the year with zk.money CCIP-Read privacy names + ENS Labs takes over Durin (NameStone shutdown) + Endowment Aug $93.12M / Sept $98M NAV + Blockful KPK review (do not yet schedule on Timelock) + ens-contracts PR #577 .transfer()→.call() for ERC-4337/SAFE + ens-app-v3 PR #1166 composite-resolver allowlist + 4 ensjs PRs #385-388 incl Sepolia V1 public-resolver restore + HCA adapter L1 config; KSK rollover T-6 days to Oct 11 + APNIC podcast Oct 1 on the 2017/2020/2023/2026 history; ICANN TSG Initial Report 2nd public comment opens Oct 8 (per Charter v1.1 timeline) — the day after Reveal Day; Handshake 4 new PRs (P2P ODoH stack #958/959/960 by denuoweb + HIP018 Rerecord A/AAAA #955 by shadstoneofficial + seeds #957 by Nathanwoodburn + docs #956); DNS-AID draft-02 T-54 days to Nov 28 expiry; Index+CHANGELOG updated.
• 2026-09-28: Decentralized DNS Monday — September 28 2026 Weekly Update — Pubky ecosystem 14-day release sweep (pubky-homeserver v0.13.0 Sep 23 + pubky-app v1.11.0 Sep 23 + pkarr v8.0.2 Sep 23) + ICANN 1,616 gTLD applications confirmed Sep 22 + Reveal Day "early next week" upper bound Oct 14 + airstop soft fork 99.80% signaling live (890M HNS burned) + Immunefi results frozen Sep 28 + ENSIP-28 published + ENSIP-31 jkm.eth reply + Nomentum Grails $500K voting + Endowment PUR #10 new Modifier + ENS Foundation "Evolved Foundation" + ensforge HCA + Pimlico/Rhinestone.
• 2026-09-21: Decentralized DNS Monday — September 21 2026 Weekly Update — Pubky ecosystem 7-day release sweep (pubky-app v1.10.0 + v1.9.0 + pubky-homeserver v0.12.0) + ENS Labs × Immunefi audit competition closed Sep 14 + ENS DAO Newsletter #120 (Sep 15) + ens-contracts PR #572 DNSSEC ancestor inceptions + PR #573 .eth resolver fix + Endowment NAV $93M + ENSIP-31: Payment Preferences first ENSIP of 2026.
• 2026-09-14: Decentralized DNS Monday — September 14 2026 Weekly Update — ENS Labs × Immunefi audit competition closes today (Sep 14) + hns-rs v0.4.1 Sep 1 (replaces v0.3.1) + pkarr v8.0.1 Aug 31 + ENSv2 L1 deployment plan + pubky-homeserver 30 commits since Aug 19 + ENS DAO Sep 8 burst (P-256 Precompile + ENSIP-28 + Stealth Address RFC + Text Record Attestations + Newsletter #119) + root KSK rollover T-27 days.
• 2026-09-07: Decentralized DNS Monday — September 07 2026 Weekly Update — ENS audit competition closes Sep 14 11:00 UTC + 306 reports / 20 confirmed / 56 under review + ICANN Board LA workshop Sep 4-6 + ENS DAO Sep 1 burst (P-256 Precompile + ENSIP-28 + Stealth Address RFC + Newsletter #119) + Pubky plateau extended 19 days + Handshake PR #952 still frozen + KSK rollover T-34 days.
• 2026-08-31: Decentralized DNS Monday — August 31 2026 Weekly Update — ENS Labs × Immunefi 4-week $70K audit competition (closes Sep 14) + ICANN Jul/Aug 27 blog restates Oct 11 KSK rollover + ICANNWiki 2026 Reveal Day schedule + Pubky shipping plateau + handshake-rs/hns-rs v0.3.1 19-crate cohort + hsd PR #952 hard-fork + ICANN Name Collision Observatory.
• 2026-08-24: Decentralized DNS Monday — August 24 2026 Weekly Update — ICANN 2026 round closed 1,600+ applications (Reveal Day ≈ Oct 13) + ENS post-Next-Era accountability + namechain→contracts-v2 rename + pubky-homeserver v0.11.0 + pubky-app 1.7.0 JSON-LD agent discoverability (Nexus-Scout) + GNUnet 0.29.0 breaks 0.28.x + hnsd community revival + Namecoin Core 31.1 + DNS-AID draft-02 + Cloudflare checker + KSK rollover T-48 days.
• 2026-08-10: Decentralized DNS Monday — August 10 2026 Weekly Update — ENS "Next Era" proposal PASSED (Foundation operating entity, 5-seat board) + ICANN gTLD window final days + pkarr v8.0.0 DHT decoupling + pubky-homeserver rename + v0.10.0 + GNUnet 0.28.0 + Namecoin upstream syncs + KSK rollover prep + DNS-AID.
• 2026-08-03: Decentralized DNS Monday — August 3 2026 Weekly Update — ENS Foundation governance overhaul + ICANN gTLD window closing (Aug 12) + blockchain domain market reckoning (Namecheap exit, UD CEO "craze") + HNS post-halving bounce + Pubky v0.10-alpha + GNUnet 0.28.0 + ICANN KSK rollover prep (Oct 11) + DNS-AID agent discovery standardization.
• 2026-07-13: Decentralized DNS Monday — July 13 2026 Weekly Update.
• 2026-07-27: Decentralized DNS Monday — July 27 2026 Weekly Update.
• 2026-06-22: New deep-dives for Overlay Naming - Tor .onion and I2P, Namecoin, Mesh & Off-Grid Naming, Slashtags, and Unstoppable Domains; updated evidence tables across the overview.
• 2026-06-15: Updated timeline with Handshake 2nd halving estimate, ViaBTC / Namebase closures, ENSv2 May 2026 milestones.
• 2026-05-04: Added Cardano DNS and Nomen deep-dives; updated ENSv2 + Handshake status.
• 2026-05-18: Added DNNS deep-dive; Lithosphere announcement tracked.
• 2026-04-17 / 2026-04-25: Initial seed of Overview - Decentralized DNS, ENS, Handshake, GNS, PKARR.

Primary sources

• GNUnet: early-alpha software status