From b1a6118e0ece5bd6f8a2a4b2978dbd0153c05235 Mon Sep 17 00:00:00 2001
From: aelmanaa <aelmanaa@users.noreply.github.com>
Date: Thu, 17 Sep 2026 09:10:19 +0100
Subject: [PATCH] feat: SiloedLockReleaseTokenPool support, lock box tooling
 and migration

---
 Makefile                                      |  22 +-
 docs/config-schema.md                         |   3 +
 docs/deployed-addresses.md                    |   8 +-
 docs/enabling-existing-token.md               |   9 +-
 docs/guides/index.md                          |   1 +
 docs/guides/migrate-pool-v1-to-v2.md          |   3 +
 docs/guides/migrate-siloed-pool.md            |  44 ++++
 docs/guides/preflight-a-transfer.md           |   4 +-
 docs/operations/chains.md                     |   1 +
 docs/operations/liquidity.md                  |  59 +++++
 docs/operations/pools.md                      |  22 ++
 docs/pool-versions.md                         |  20 +-
 docs/primitives/catalog.json                  | 139 +++++++++-
 .../config-plane/ForgetDeployment.md          |  28 ++
 docs/primitives/deploy/DeployERC20LockBox.md  |   1 +
 .../DeploySiloedLockReleaseTokenPool.md       |  31 +++
 docs/primitives/index.md                      |  11 +
 docs/primitives/siloed/ConfigureLockBoxes.md  |  30 +++
 docs/primitives/siloed/GetSiloedPoolState.md  |  28 ++
 .../siloed/ProvideSiloedLiquidity.md          |  31 +++
 docs/primitives/siloed/SetSiloRebalancer.md   |  31 +++
 .../siloed/UpdateSiloDesignations.md          |  32 +++
 .../siloed/WithdrawSiloedLiquidity.md         |  31 +++
 docs/production-checklist.md                  |   3 +
 docs/reference/ccip-api.md                    |   6 +
 docs/reference/pool-behavior-matrix.md        |  20 +-
 foundry.toml                                  |   8 +
 package-lock.json                             | 242 ++++++++++++++++++
 package.json                                  |   2 +
 remappings.txt                                |   4 +
 script/config/AdoptToken.s.sol                | 106 +++++++-
 script/config/ForgetDeployment.s.sol          | 138 ++++++++++
 script/config/VerifyChain.s.sol               | 144 +++++++++++
 script/config/discover-tokens.sh              |  37 ++-
 script/config/dotenv-get.sh                   |  19 +-
 script/config/preflight-transfer.sh           |  34 ++-
 script/config/test-tooling.sh                 |  64 +++++
 .../liquidity/WithdrawLiquidity.s.sol         |   7 +-
 .../configure/remote-chains/RemoveChain.s.sol |   4 +-
 .../configure/siloed/ConfigureLockBoxes.s.sol | 113 ++++++++
 .../configure/siloed/GetSiloedPoolState.s.sol | 156 +++++++++++
 .../siloed/ProvideSiloedLiquidity.s.sol       |  66 +++++
 .../configure/siloed/SetSiloRebalancer.s.sol  |  49 ++++
 script/configure/siloed/SiloedBase.s.sol      |  51 ++++
 .../siloed/UpdateSiloDesignations.s.sol       |  75 ++++++
 .../siloed/WithdrawSiloedLiquidity.s.sol      |  66 +++++
 script/deploy/DeployERC20LockBox.s.sol        |  29 ++-
 .../DeploySiloedLockReleaseTokenPool.s.sol    | 124 +++++++++
 script/docs/gen-primitives.mjs                |   2 +
 script/setup/ApplyChainUpdates.s.sol          |  38 ++-
 script/utils/DeploymentRecorder.s.sol         |  20 ++
 script/utils/PoolVersion.s.sol                |  60 ++++-
 src/PoolVersions.sol                          |  18 +-
 src/actions/CctActions.sol                    |  75 ++++++
 src/roles/RolesAuditor.sol                    |  84 +++++-
 src/roles/RolesProbes.sol                     |  37 +++
 src/roles/RolesSnapshot.sol                   |  23 ++
 src/utils/RegistryWriter.sol                  |  61 +++++
 test/actions/PoolVersionDispatch.t.sol        |  74 ++++--
 test/config/AdoptToken.t.sol                  |   2 +-
 test/config/AdoptTokenLockBoxes.t.sol         |  58 +++++
 test/config/ForgetDeployment.t.sol            | 155 +++++++++++
 test/config/VerifyChainSiloedLockBoxes.t.sol  | 198 ++++++++++++++
 test/configure/SiloedLockRelease.t.sol        | 177 +++++++++++++
 test/fixtures/legacy/DeployLegacyPool.s.sol   |  50 ++++
 test/fixtures/legacy/LegacyPools.sol          |  29 +++
 66 files changed, 3215 insertions(+), 102 deletions(-)
 create mode 100644 docs/guides/migrate-siloed-pool.md
 create mode 100644 docs/primitives/config-plane/ForgetDeployment.md
 create mode 100644 docs/primitives/deploy/DeploySiloedLockReleaseTokenPool.md
 create mode 100644 docs/primitives/siloed/ConfigureLockBoxes.md
 create mode 100644 docs/primitives/siloed/GetSiloedPoolState.md
 create mode 100644 docs/primitives/siloed/ProvideSiloedLiquidity.md
 create mode 100644 docs/primitives/siloed/SetSiloRebalancer.md
 create mode 100644 docs/primitives/siloed/UpdateSiloDesignations.md
 create mode 100644 docs/primitives/siloed/WithdrawSiloedLiquidity.md
 create mode 100644 script/config/ForgetDeployment.s.sol
 create mode 100644 script/configure/siloed/ConfigureLockBoxes.s.sol
 create mode 100644 script/configure/siloed/GetSiloedPoolState.s.sol
 create mode 100644 script/configure/siloed/ProvideSiloedLiquidity.s.sol
 create mode 100644 script/configure/siloed/SetSiloRebalancer.s.sol
 create mode 100644 script/configure/siloed/SiloedBase.s.sol
 create mode 100644 script/configure/siloed/UpdateSiloDesignations.s.sol
 create mode 100644 script/configure/siloed/WithdrawSiloedLiquidity.s.sol
 create mode 100644 script/deploy/DeploySiloedLockReleaseTokenPool.s.sol
 create mode 100644 test/config/AdoptTokenLockBoxes.t.sol
 create mode 100644 test/config/ForgetDeployment.t.sol
 create mode 100644 test/config/VerifyChainSiloedLockBoxes.t.sol
 create mode 100644 test/configure/SiloedLockRelease.t.sol
 create mode 100644 test/fixtures/legacy/DeployLegacyPool.s.sol
 create mode 100644 test/fixtures/legacy/LegacyPools.sol

diff --git a/Makefile b/Makefile
index 888163d..8188490 100644
--- a/Makefile
+++ b/Makefile
@@ -38,12 +38,12 @@ evm-version-flag = --evm-version $(call evm-version,$(1))
 # (project/<group>/<selectorName>.json); unset is the flat default (project/<selectorName>.json). It
 # threads to the scripts as PROJECT_GROUP; GROUP_DIR locates the same file for the jq repair steps here.
 # Honored by the project targets (add-lane, remove-lane, adopt-token, snapshot-chain, doctor,
-# roles-check) and the deploy targets (deploy-token/pool/lockbox/lockrelease-pool, deploy-new-chain); the
+# roles-check) and the deploy targets (deploy-token/pool/lockbox/lockrelease-pool/siloed-pool, deploy-new-chain); the
 # chain-facts targets (add-chain, sync*) ignore it (config/chains is group-independent).
 GROUP_DIR := $(if $(GROUP),$(GROUP)/,)
 
 .DEFAULT_GOAL := help
-.PHONY: probe-chain adopt-token help tools discover discover-tokens add-chain add-lane remove-lane sync sync-preview sync-all sync-check doctor fmt-config clean-scratch snapshot-chain roles-check roles-check-all deploy-token deploy-pool deploy-lockbox deploy-lockrelease-pool deploy-new-chain preflight verify verify-args verify-execution
+.PHONY: probe-chain adopt-token forget-deployment help tools discover discover-tokens add-chain add-lane remove-lane sync sync-preview sync-all sync-check doctor fmt-config clean-scratch snapshot-chain roles-check roles-check-all deploy-token deploy-pool deploy-lockbox deploy-lockrelease-pool deploy-siloed-pool deploy-new-chain preflight verify verify-args verify-execution
 
 # Deploy-time parameters are read by the forge scripts from the environment (vm.env*). Forward a value
 # passed on the make command line (make deploy-token TOKEN_NAME=...) to the forge subprocess; a value
@@ -57,7 +57,7 @@ GROUP_DIR := $(if $(GROUP),$(GROUP)/,)
 # still apply.
 DEPLOY_VARS := TOKEN_NAME TOKEN_SYMBOL TOKEN_DECIMALS TOKEN_MAX_SUPPLY TOKEN_PRE_MINT \
 	TOKEN_PRE_MINT_RECIPIENT CCIP_ADMIN_ADDRESS ROLES_RECIPIENT TOKEN TOKEN_POOL LOCK_BOX DECIMALS \
-	POOL_HOOKS AUTHORIZED_CALLERS FORCE_REDEPLOY REANCHOR
+	POOL_HOOKS AUTHORIZED_CALLERS FORCE_REDEPLOY REANCHOR SILO
 $(foreach v,$(DEPLOY_VARS),$(if $(strip $($(v))),$(eval export $(v))))
 
 # Recipe-time guard: the CHAIN's config file must exist (helpful list + add-chain hint on a miss).
@@ -131,8 +131,8 @@ tools: ## Check the required tools are installed (forge, curl, jq; CHAIN= adds t
 discover: tools ## List the CCIP API chain catalog vs local configs, both planes (FILTER=<term> narrows; ENVIRONMENT=<testnet|mainnet> narrows the plane)
 	@FILTER="$(FILTER)" ENVIRONMENT="$(ENVIRONMENT)" bash script/config/sync-discover.sh
 
-discover-tokens: tools ## List the CCIP API token catalog for an operator (ADMIN=, SYMBOL=, CHAIN_SELECTOR=, ENVIRONMENT= all narrow; unreviewed tokens included)
-	@ADMIN="$(ADMIN)" SYMBOL="$(SYMBOL)" CHAIN_SELECTOR="$(CHAIN_SELECTOR)" ENVIRONMENT="$(ENVIRONMENT)" bash script/config/discover-tokens.sh
+discover-tokens: tools ## List the CCIP API token catalog for an operator (ADMIN=, SYMBOL=, CHAIN_SELECTOR=, ENVIRONMENT= all narrow; unreviewed tokens included; POOL=1 adds the pool, its API type and version, one request per row)
+	@ADMIN="$(ADMIN)" SYMBOL="$(SYMBOL)" CHAIN_SELECTOR="$(CHAIN_SELECTOR)" ENVIRONMENT="$(ENVIRONMENT)" POOL="$(POOL)" bash script/config/discover-tokens.sh
 
 add-chain: tools ## Generate config/chains/<CHAIN>.json from the live API (CHAIN= and SELECTOR= required)
 	$(if $(CHAIN),,$(error CHAIN is required: make add-chain CHAIN=<selectorName> SELECTOR=<selector> - both from the make discover API NAME + SELECTOR columns))
@@ -203,6 +203,12 @@ else
 	@FOUNDRY_PROFILE=sync PROJECT_GROUP="$(GROUP)" bash script/config/forge-fork.sh "$(CHAIN)" -- forge script script/config/AdoptToken.s.sol $(call evm-version-flag,$(CHAIN)) --sig "run(string,address,address)" "$(CHAIN)" "$(TOKEN)" "$(or $(TOKEN_POOL),0x0000000000000000000000000000000000000000)"
 endif
 
+forget-deployment: tools ## Remove a retired entry from project/[<GROUP>/]<CHAIN>.json deployments{} (CHAIN= NAME=<deployments key> required; refuses an active, registered, still-laned or funded artifact; PREVIEW=1 changes nothing; local edit, nothing sent)
+	$(if $(CHAIN),,$(error CHAIN is required: make forget-deployment CHAIN=<name> NAME=<deployments key>))
+	$(if $(NAME),,$(error NAME is required - the addresses.deployments key to remove, e.g. WBTC_BurnMintTokenPool_1.5.1))
+	$(require-chain-config)
+	@FOUNDRY_PROFILE=sync PROJECT_GROUP="$(GROUP)" forge script script/config/ForgetDeployment.s.sol $(call evm-version-flag,$(CHAIN)) --sig "run(string,string,bool)" "$(CHAIN)" "$(NAME)" $(if $(PREVIEW),true,false)
+
 sync: tools ## Refresh <CHAIN>'s ccip{} block from the live API (CHAIN= required)
 	$(if $(CHAIN),,$(error CHAIN is required: make sync CHAIN=<name>))
 	$(require-chain-config)
@@ -347,6 +353,12 @@ deploy-lockrelease-pool: tools ## Deploy a LockRelease token pool on <CHAIN> (CH
 	$(call require-evm-chain,$(CHAIN),$(NON_EVM_DEPLOY_HINT))
 	$(call run-deploy,script/deploy/DeployLockReleaseTokenPool.s.sol)
 
+deploy-siloed-pool: tools ## Deploy a SiloedLockRelease token pool on <CHAIN>, no lock box (CHAIN= + KEYSTORE_NAME= required; token from the registry, else TOKEN=; opt POOL_HOOKS=; VERIFY=1; FORCE_REDEPLOY=1; GROUP=). Then deploy-lockbox SILO=<label> per silo and configure/siloed/ConfigureLockBoxes
+	$(if $(CHAIN),,$(error CHAIN is required: make deploy-siloed-pool CHAIN=<name>))
+	$(require-chain-config)
+	$(call require-evm-chain,$(CHAIN),$(NON_EVM_DEPLOY_HINT))
+	$(call run-deploy,script/deploy/DeploySiloedLockReleaseTokenPool.s.sol)
+
 deploy-new-chain: tools ## Guided deploy: add-chain -> deploy-token -> deploy-pool -> doctor (CHAIN= SELECTOR= + KEYSTORE_NAME= required; token params + VERIFY= via env). Register, set-pool, and wire-lane come next - see docs/workflows/greenfield-deploy.md; a green run means deployed, not yet cross-chain-live
 	$(if $(CHAIN),,$(error CHAIN is required: make deploy-new-chain CHAIN=<selectorName> SELECTOR=<selector> (token params via env)))
 	$(if $(SELECTOR),,$(error SELECTOR is required - find it with: make discover FILTER=<term>))
diff --git a/docs/config-schema.md b/docs/config-schema.md
index 4f71810..7fbc5c5 100644
--- a/docs/config-schema.md
+++ b/docs/config-schema.md
@@ -665,6 +665,9 @@ engine never assumes one:
     "address": "0xLockbox...", "owner": "0xGov...",
     "authorizedCallers": ["0xPool..."]       // enumerable → full two-sided set compare
   },
+  "lockboxes": {                             // Siloed 2.0 only: one entry per distinct box, keyed by address
+    "0xBoxA...": { "owner": "0xGov...", "authorizedCallers": ["0xPool..."] }
+  },                                         // two-sided: every declared box is mapped, every mapped box declared
   "hooks": {                                 // the CCV/allowlist authority (security-critical)
     "address": "0xHooks...", "owner": "0xGov...", "policyEngine": "0xPolicy...",
     "allowlistEnabled": false,               // immutable (set at deploy)
diff --git a/docs/deployed-addresses.md b/docs/deployed-addresses.md
index f86e1a4..f1942ed 100644
--- a/docs/deployed-addresses.md
+++ b/docs/deployed-addresses.md
@@ -35,7 +35,8 @@ Two terms, kept distinct throughout these docs:
 | Participant                            | Role                     | What it does                                                                                                                                                        |
 | -------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Deploy scripts (`--broadcast`)         | **Writer**               | Record each artifact via one `DeploymentRecorder` call → `history/` file + `addresses{}` entry                                                                      |
-| `make adopt-token`                     | **Writer / reconciler**  | Bring an externally deployed token/pool into `addresses{}` after on-chain validation; also the tool that repoints `active.<role>` to reconcile the store to reality |
+| `make adopt-token`                     | **Writer / reconciler**  | Bring an externally deployed token/pool into `addresses{}` after on-chain validation (a 2.0 pool's lock boxes too); also the tool that repoints `active.<role>` to reconcile the store to reality |
+| `make forget-deployment`               | **Remover**              | Drop one retired `deployments{}` entry (typically the old pool after a migration). Refuses an entry that is still `active`, still registered, still has lanes, or a lock box still holding tokens; `PREVIEW=1` changes nothing |
 | Env vars (`{CHAIN}_TOKEN`, `TOKEN`, …) | **Override (READ-ONLY)** | Win over `addresses.active.<role>` at resolution time only                                                                                                          |
 | Run-time divergence notice             | **Warner**               | When an env override differs from `active.<role>`, a broadcasting script prints both values + the exact `make adopt-token …` to reconcile                           |
 | `make doctor` TAR rung                 | **Warner**               | Compares `active.tokenPool` against the on-chain TokenAdminRegistry and WARNs on divergence                                                                         |
@@ -105,8 +106,13 @@ Per-artifact keys (`DeploymentRecorder`):
 | Token      | `{symbol}_Token`                         | `token`       |
 | Token pool | `{symbol}_{poolType}TokenPool_{version}` | `tokenPool`   |
 | LockBox    | `{symbol}_LockBox`                       | `lockBox`     |
+| Silo lock box (`SILO=<label>`) | `{symbol}_LockBox_{label}`  | none          |
 | Pool hooks | `{symbol}_{poolType}_PoolHooks`          | `poolHooks`   |
 
+A siloed pool has several boxes and none of them is "the" lock box, so silo boxes get a `deployments{}`
+entry only and every per-box script takes `LOCK_BOX=` explicitly. `adopt-token` names an adopted silo box
+after the first remote chain it serves (`{symbol}_LockBox_<chain>`).
+
 The pool key includes the pool's **type and version** so distinct artifacts never collide in storage. This
 is a mechanical keying property, not a migration workflow: the deploy scripts pin the version
 (`DeploymentRecorder.POOL_VERSION` = `"2.0.0"`), so `poolName()` only ever emits the `_2.0.0` key. Deploying
diff --git a/docs/enabling-existing-token.md b/docs/enabling-existing-token.md
index 50ddea3..6a22e83 100644
--- a/docs/enabling-existing-token.md
+++ b/docs/enabling-existing-token.md
@@ -43,14 +43,19 @@ single registry entry (see [what adopt-token validates](#what-adopt-token-valida
 ## Scenario 2: existing token and pool
 
 When another toolchain (or an earlier version of this repo) deployed both contracts, adopt them
-together:
+together. To find what is already registered, and which pool type and version each chain runs,
+`make discover-tokens SYMBOL=<sym> POOL=1` lists it from the CCIP API (the API's type and version, not the
+on-chain `typeAndVersion()` string, which adoption reads itself):
 
 ```bash
 make adopt-token CHAIN=ethereum-testnet-sepolia TOKEN=0xYourToken TOKEN_POOL=0xYourPool
 ```
 
 The pool is resolved through the [pool-version catalog](pool-versions.md) and cross-checked against
-the token before anything is written. After a successful adoption the day-2 scripts work with zero
+the token before anything is written. A 2.0 LockRelease pool's lock box is recorded too
+(`{symbol}_LockBox` + `active.lockBox`), and a Siloed 2.0 pool's boxes as `{symbol}_LockBox_<chain>`, named
+after the first remote chain each one serves. A 1.6.x Siloed pool holds its own liquidity, so there is no
+box to record. After a successful adoption the day-2 scripts work with zero
 exports, exactly as if this repo had deployed the contracts. The command prints the next steps that
 still apply to your token: registration (`ClaimAdmin` + `AcceptAdminRole`) if the token is not
 registered yet, `SetPool` if the TokenAdminRegistry does not point at this pool, lane wiring, and
diff --git a/docs/guides/index.md b/docs/guides/index.md
index 852abdf..19526d7 100644
--- a/docs/guides/index.md
+++ b/docs/guides/index.md
@@ -39,4 +39,5 @@ concept page, or a dedicated guide. Grouping is for navigation only.
 - [Health-check a deployment before mainnet](health-check.md).
 - [Preflight a transfer before sending](preflight-a-transfer.md).
 - [Migrate a pool from v1 to v2](migrate-pool-v1-to-v2.md).
+- [Migrate a Siloed LockRelease pool from 1.6 to 2.0](migrate-siloed-pool.md).
 - [Send, track, manually execute, and diagnose a transfer](send-track-diagnose.md).
diff --git a/docs/guides/migrate-pool-v1-to-v2.md b/docs/guides/migrate-pool-v1-to-v2.md
index dc85e2c..5acfb85 100644
--- a/docs/guides/migrate-pool-v1-to-v2.md
+++ b/docs/guides/migrate-pool-v1-to-v2.md
@@ -40,6 +40,9 @@ so step 3 below is not performable there and that pool must be migrated by a dir
    not clear. This step is optional, and deferring it indefinitely is a valid choice, because a pool that
    is out of the `TokenAdminRegistry` is already inert.
 
+Once the old pool is fully retired, `make forget-deployment CHAIN=<name> NAME=<old pool key>` drops its
+`deployments{}` entry, which also clears doctor's two-pools warning.
+
 The removal in step 6 is per peer, not per pool: every pool that registered this chain's old pool has to
 drop it too, so the blast radius grows with the number of remotes.
 
diff --git a/docs/guides/migrate-siloed-pool.md b/docs/guides/migrate-siloed-pool.md
new file mode 100644
index 0000000..f34c82b
--- /dev/null
+++ b/docs/guides/migrate-siloed-pool.md
@@ -0,0 +1,44 @@
+---
+type: guide
+---
+
+# Migrate a Siloed LockRelease pool from 1.6 to 2.0
+
+A 1.6.0 or 1.6.1 `SiloedLockReleaseTokenPool` holds its liquidity on the pool, one balance per siloed chain
+plus a shared balance. A 2.0.0 pool holds none: each remote chain maps to an `ERC20LockBox`. Nothing can be
+re-pointed, so the migration moves the tokens. The remote BurnMint pools follow
+[migrate a pool from v1 to v2](migrate-pool-v1-to-v2.md).
+
+## The workflow
+
+1. **Deploy the 2.0 side.** `make deploy-siloed-pool`, one `make deploy-lockbox SILO=<label>` per silo and
+   one for the shared chains, and the remote 2.0 pools with their mint and burn roles. Authorize the new
+   pool, and the account that will move liquidity, on every box (`UpdateAuthorizedCallers`).
+2. **Wire it.** `ConfigureLockBoxes` first, then `ApplyChainUpdates` for each lane of the new pools. Keep
+   both generations reachable: `AddRemotePool` the old peer on every new pool and the new peer on every old
+   pool, so a message committed against either side still releases.
+3. **Move the liquidity**, as the pool owner and rebalancers:
+   - Silo: `SetSiloRebalancer` (a mainnet silo may hold a placeholder rebalancer such as `0x…01`),
+     `WithdrawSiloedLiquidity`, then `DepositToLockBox` into that silo's box.
+   - Shared: `SetRebalancer`, `WithdrawLiquidity`, then `DepositToLockBox` into the shared box.
+   - Leave a buffer on the old pool that covers inbound messages still in flight: they release from the old
+     pool, and fail until refunded if it is empty.
+4. **Cut over.** `SetPool` on every chain.
+5. **Validate and sweep.** One transfer per directed lane on the new pools, then, after the drain window,
+   move the old pool's buffer into the boxes.
+6. **Retire the old generation.** `RemoveRemotePool` the old peer from every new pool, `RemoveChain` every
+   lane of the old pools, and `RevokeTokenRole` the old burn-mint pools' minter and burner roles. Then
+   `make forget-deployment NAME=<old pool key>` on each chain: doctor warns while two pools are recorded,
+   and the command refuses a pool that is still registered, still has lanes, or is still `active`.
+
+`GetSiloedPoolState` reads either generation's layout; run it before and after each step. Every write
+above supports `MODE=safe`. A timelock-owned pool needs the same calls scheduled through its timelock.
+
+## Checks that catch real mistakes
+
+- Box balances per chain after step 3 equal the old per-chain balances minus the buffer.
+- A 2.0 pool keeps its transfer fee on the pool; reconcile liquidity from the boxes only.
+- The ccip-sdk reads a LockRelease destination's balance through `getLockBox()`, which a Siloed 2.0 pool
+  does not have, so any balance figure it reports for one is not the box balance. With ccip-cli 1.13.0,
+  sends and `make preflight` into a Siloed 2.0 pool still went through on the v2 staging plane; read the
+  boxes with `GetSiloedPoolState` rather than trusting a reported balance.
diff --git a/docs/guides/preflight-a-transfer.md b/docs/guides/preflight-a-transfer.md
index a435a41..20e1e11 100644
--- a/docs/guides/preflight-a-transfer.md
+++ b/docs/guides/preflight-a-transfer.md
@@ -65,7 +65,9 @@ counterpart to the static [health check](health-check.md).
    So a project that already keeps a key in `.env` gets a sender-scoped estimate with no extra flag. To
    scope it to a keystore account instead, set `WALLET=foundry:<account>` together with
    `FOUNDRY_KEYSTORE_PASSWORD` (the wrapper requires the password up front, because `--no-interactive`
-   makes `ccip-cli` swallow the failure and quietly estimate with no sender at all). With none of them the
+   makes `ccip-cli` swallow the failure and quietly estimate with no sender at all). A passwordless keystore
+is `FOUNDRY_KEYSTORE_PASSWORD=` (empty); ccip-cli 1.13.0 and earlier cannot open one without a terminal,
+so the wrapper refuses it on those versions - use the `.env` key there. With none of them the
    estimate still runs, unscoped, and the wrapper says so. There is no way to scope it to an address you
    hold no key for: `--wallet` takes a wallet, not an address.
 
diff --git a/docs/operations/chains.md b/docs/operations/chains.md
index c249016..bcc02d2 100644
--- a/docs/operations/chains.md
+++ b/docs/operations/chains.md
@@ -73,6 +73,7 @@ reference: [Config architecture](../config-architecture.md).
 | I want to                                                                    | Run                                                                                            |
 | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
 | See which chains exist / find a selector                                     | `make discover FILTER=<term>`                                                                  |
+| See which tokens exist, and each one's pool type and version                 | `make discover-tokens SYMBOL=<sym> POOL=1` (also `ADMIN=`, `CHAIN_SELECTOR=`, `ENVIRONMENT=`)  |
 | Onboard a new chain                                                          | `make add-chain CHAIN=<name> SELECTOR=<sel>`, then `make doctor CHAIN=<name>`                  |
 | Check whether any config drifted from the API (routine; what CI runs weekly) | `make sync-check` (CI/automation: `bash script/config/sync-check.sh` for the 0/1/2 exit codes) |
 | Inspect what the API currently has for one chain before changing anything    | `make sync-preview CHAIN=<name>`                                                               |
diff --git a/docs/operations/liquidity.md b/docs/operations/liquidity.md
index 3940f0f..c6d8767 100644
--- a/docs/operations/liquidity.md
+++ b/docs/operations/liquidity.md
@@ -10,6 +10,7 @@ Manage the liquidity a LockRelease pool draws on to release tokens. The model di
   rebalancer.
 - Version 2.0.0 holds no liquidity on the pool; an external `ERC20LockBox` does, so deposit and withdraw
   through the lock box.
+- A `SiloedLockReleaseTokenPool` keeps liquidity per remote chain. See [Siloed pools](#siloed-pools).
 
 Burn and mint pools have no liquidity to manage; they mint and burn. Scripts under
 `script/configure/liquidity/` and `script/operations/`. Primitive pages:
@@ -127,3 +128,61 @@ LOCK_BOX=0x... \
 By default this withdraws the entire lock box balance. Set `AMOUNT` to withdraw a specific amount
 instead. Set `RECIPIENT=0x...` to send withdrawn tokens to a different address (defaults to the
 broadcaster).
+
+<a id="siloed-pools"></a>
+
+## Siloed pools
+
+A `SiloedLockReleaseTokenPool` isolates liquidity per remote chain, so one chain's releases cannot drain
+tokens locked for another. Scripts under `script/configure/siloed/`. Read the layout first:
+
+```bash
+forge script script/configure/siloed/GetSiloedPoolState.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL
+```
+
+### 1.6.0 and 1.6.1: silos on the pool
+
+The pool holds the tokens. A siloed chain has its own balance and rebalancer; every other chain draws on
+one shared balance managed by the pool rebalancer (`SetRebalancer`, `ProvideLiquidity`,
+`WithdrawLiquidity`).
+
+| Script | Caller | Env |
+| --- | --- | --- |
+| `UpdateSiloDesignations` | owner | `SILO_CHAINS`, `SILO_REBALANCER`, `UNSILO_CHAINS` |
+| `SetSiloRebalancer` | owner | `DEST_CHAIN`, `REBALANCER` |
+| `ProvideSiloedLiquidity` | silo rebalancer | `DEST_CHAIN`, `AMOUNT` |
+| `WithdrawSiloedLiquidity` | silo rebalancer | `DEST_CHAIN`, `AMOUNT` (default: all) |
+
+- A new silo starts empty: shared liquidity is not moved into it. Unsiloing moves the silo's balance into
+  the shared bucket.
+- Inbound messages from a siloed chain release from that silo only. Withdrawing it while messages are in
+  flight makes them fail until it is refunded.
+- 1.6.0 validates rate limits like 1.5.x (`rate < capacity`, `rate > 0` when enabled); 1.6.1 does not.
+  See the [behavior matrix](../reference/pool-behavior-matrix.md).
+
+### 2.0.0: one lock box per silo
+
+The pool holds nothing. `configureLockBoxes` maps each remote chain to an `ERC20LockBox`; chains that share
+a box share liquidity. Build it in this order, before wiring any lane:
+
+```bash
+make deploy-siloed-pool CHAIN=ethereum-testnet-sepolia KEYSTORE_NAME=<ks>
+make deploy-lockbox CHAIN=ethereum-testnet-sepolia KEYSTORE_NAME=<ks> SILO=fuji    # once per silo
+LOCK_BOX=<box> ADD_ADDRESSES=<pool> forge script script/configure/authorized-callers/UpdateAuthorizedCallers.s.sol ...
+LOCK_BOXES=AVALANCHE_TESTNET_FUJI=<box>,ETHEREUM_TESTNET_SEPOLIA_BASE_1=<box2> \
+  forge script script/configure/siloed/ConfigureLockBoxes.s.sol ...
+```
+
+- `SILO=<label>` records the box as `{symbol}_LockBox_{label}` and leaves `active.lockBox` alone, so
+  per-box scripts need `LOCK_BOX=` explicitly.
+- A supported chain without a box reverts every transfer. `ApplyChainUpdates` refuses to add such a lane
+  (Safe mode warns instead, since the batch may map it).
+- `configureLockBoxes` never removes an entry, and does not check that the pool may use the box;
+  `ConfigureLockBoxes` refuses when it may not.
+- `make doctor` fails a supported chain with no box, a box that does not authorize the pool, or a box for
+  another token, and warns about a box still mapped to a removed chain. `snapshot-chain` records the boxes
+  under `roles.lockboxes`, and `roles-check` audits each one.
+- Every authorized caller on a box can withdraw its whole balance. Authorize operators, not users.
+- The v2 transfer fee stays on the pool, not in the box (`WithdrawFeeTokens`).
+- A 1.6.x pool cannot be pointed at a 2.0 box, and 1.6.2+ lock boxes have a different interface.
+  Migrating from 1.6.x moves the tokens: see [migrate a Siloed pool](../guides/migrate-siloed-pool.md).
diff --git a/docs/operations/pools.md b/docs/operations/pools.md
index 04b18a0..e7c50d8 100644
--- a/docs/operations/pools.md
+++ b/docs/operations/pools.md
@@ -13,6 +13,7 @@ Deploy the token pool that CCIP burns, mints, locks, or releases through. Script
 [`DeployBurnMintTokenPool`](../primitives/deploy/DeployBurnMintTokenPool.md),
 [`DeployLockReleaseTokenPool`](../primitives/deploy/DeployLockReleaseTokenPool.md),
 [`DeployERC20LockBox`](../primitives/deploy/DeployERC20LockBox.md),
+[`DeploySiloedLockReleaseTokenPool`](../primitives/deploy/DeploySiloedLockReleaseTokenPool.md),
 [`GetLockBox`](../primitives/configure/GetLockBox.md). For the per-version support matrix see
 [Pool versions](../pool-versions.md).
 
@@ -224,3 +225,24 @@ forge script script/configure/GetLockBox.s.sol --rpc-url $MANTLE_SEPOLIA_RPC_URL
 
 For managing LockRelease liquidity after deploy (the rebalancer model on v1.x pools versus the lockbox
 model on v2.0), see [LockRelease liquidity](liquidity.md).
+
+## Siloed lock and release pool
+
+A `SiloedLockReleaseTokenPool` keeps each remote chain's liquidity apart, so releases for one chain can
+never drain tokens locked for another. The 2.0.0 pool takes no lock box at deploy time; each remote chain
+maps to an `ERC20LockBox`, and chains that share liquidity share a box. The order is pool, one box per
+silo (each authorizing the pool), `ConfigureLockBoxes`, then the lanes:
+
+```bash
+make deploy-siloed-pool CHAIN=ethereum-testnet-sepolia
+make deploy-lockbox CHAIN=ethereum-testnet-sepolia SILO=fuji AUTHORIZED_CALLERS=<pool>
+make deploy-lockbox CHAIN=ethereum-testnet-sepolia SILO=base AUTHORIZED_CALLERS=<pool>
+LOCK_BOXES=AVALANCHE_TESTNET_FUJI=<fuji box>,ETHEREUM_TESTNET_SEPOLIA_BASE_1=<base box> \
+  forge script script/configure/siloed/ConfigureLockBoxes.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL \
+  --account <KEYSTORE_NAME> --broadcast
+```
+
+`ApplyChainUpdates` refuses a lane whose chain has no box yet, and `make doctor` fails a supported chain
+without one. Operating the silos, and the 1.6.x versions that keep liquidity on the pool itself, are
+covered in [liquidity](liquidity.md#siloed-pools); moving from 1.6.x to 2.0.0 is
+[migrate a Siloed pool](../guides/migrate-siloed-pool.md).
diff --git a/docs/pool-versions.md b/docs/pool-versions.md
index 0900594..841251d 100644
--- a/docs/pool-versions.md
+++ b/docs/pool-versions.md
@@ -31,11 +31,16 @@ the message distinguishes "no contract at" from "did not answer".
 ## The catalog
 
 ```
-UNKNOWN < 1.5.0 < 1.5.1 < 1.6.1 < 2.0.0
+UNKNOWN < 1.5.0 < 1.5.1 < 1.6.0 < 1.6.1 < 2.0.0
 ```
 
+- `1.6.0` is accepted only on `SiloedLockReleaseTokenPool`, the one type released with that stamp (npm
+  1.6.0 stamps its BurnMint pool `1.5.1`). It has 1.6.1's callable surface with 1.5.x rate-limit
+  validation.
+
 - `UNKNOWN` is the zero-value sentinel: a default-initialized version can never dispatch.
-- There is no `1.6.0` pool in the wild; the audited 1.6-generation stamp is `1.6.1`.
+- Apart from the Siloed pool, there is no `1.6.0` pool in the wild; the audited 1.6-generation stamp is
+  `1.6.1`.
 - The `1.6.2`-`1.6.4` source tags stamp `-dev` strings (`1.6.3-dev`, `1.6.x-dev`); they are
   unaudited development builds and are refused (see [dev builds](#dev-builds)).
 
@@ -64,11 +69,13 @@ exists on.
 | `setRouter` / `setRateLimitAdmin`    | `[1.5.0, 2.0.0)`     |
 | `setDynamicConfig`                   | `[2.0.0, infinity)`  |
 | `applyAllowListUpdates` (pool-level) | `[1.5.0, 2.0.0)`     |
+| Siloed silo surface (Siloed only)    | `[1.6.0, 2.0.0)`     |
+| `configureLockBoxes` (Siloed only)   | `[2.0.0, infinity)`  |
 
 The table in `src/PoolVersions.sol` is authoritative; this rendering mirrors it for reading.
 
 The catalog and ranges are validated live, not only against source: every cataloged version
-(1.5.0, 1.5.1, 1.6.1, 2.0.0) was exercised against real testnet pools of that version through the
+(1.5.0, 1.5.1, 1.6.1, 2.0.0; Siloed 1.6.0 and 1.6.1 on the v2 staging plane) was exercised against real testnet pools of that version through the
 repo scripts (adoption, lane updates including the 1.5.0 encoding, rate-limit updates, read-backs),
 including end-to-end cross-chain token transfers per version in both directions over the same lane.
 
@@ -175,7 +182,8 @@ If a genuinely new pool release appears, extend the catalog: see
 ## Foreign pool types
 
 Version tokens are only comparable within the standard TokenPool lineage: `BurnMintTokenPool`,
-`BurnFromMintTokenPool`, `BurnWithFromMintTokenPool`, `LockReleaseTokenPool`. Specialized pools
+`BurnFromMintTokenPool`, `BurnWithFromMintTokenPool`, `LockReleaseTokenPool`, and
+`SiloedLockReleaseTokenPool` (which subclasses the TokenPool of its release). Specialized pools
 (for example `USDCTokenPool`) version independently; their `1.5.1` is not TokenPool `1.5.1` and
 must not dispatch as such. The resolver refuses any type prefix outside the lineage with
 `UnsupportedPoolType`. If you have verified a foreign pool's ABI against a cataloged version, the
@@ -222,8 +230,8 @@ POOL_VERSION_OVERRIDE=0xPoolAddress=2.0.0
 
 ## What this doctrine does NOT cover
 
-- **The deploy-time equality guard.** `DeployBurnMintTokenPool` / `DeployLockReleaseTokenPool`
-  assert the deployed contract's `typeAndVersion()` equals the expected exact string. That is a
+- **The deploy-time equality guard.** `DeployBurnMintTokenPool` / `DeployLockReleaseTokenPool` /
+  `DeploySiloedLockReleaseTokenPool` assert the deployed contract's `typeAndVersion()` equals the expected exact string. That is a
   pinned-dependency check, not dispatch; converting it to a range comparison would destroy its
   point. It stays an exact string.
 - **Registry keying.** The address registry keys pool entries by the full on-chain
diff --git a/docs/primitives/catalog.json b/docs/primitives/catalog.json
index 34dab06..5445b6b 100644
--- a/docs/primitives/catalog.json
+++ b/docs/primitives/catalog.json
@@ -2,8 +2,8 @@
   "generatedBy": "script/docs/gen-primitives.mjs",
   "note": "Generated from the script/ tree and the Makefile. Do not edit by hand; run `npm run docs:catalog`.",
   "counts": {
-    "primitives": 61,
-    "makeTargets": 29
+    "primitives": 69,
+    "makeTargets": 31
   },
   "primitives": [
     {
@@ -19,6 +19,19 @@
       "destructive": false,
       "inputs": []
     },
+    {
+      "name": "ForgetDeployment",
+      "script": "script/config/ForgetDeployment.s.sol",
+      "group": "config-plane",
+      "description": "Removes one retired entry from `addresses.deployments` in the project store, typically the old pool after a migration.",
+      "modes": [
+        "eoa"
+      ],
+      "read_only": false,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": []
+    },
     {
       "name": "ProbeChain",
       "script": "script/config/ProbeChain.s.sol",
@@ -562,6 +575,99 @@
         "REMOTE_POOL_ADDRESS"
       ]
     },
+    {
+      "name": "ConfigureLockBoxes",
+      "script": "script/configure/siloed/ConfigureLockBoxes.s.sol",
+      "group": "siloed",
+      "description": "Maps remote chains to lock boxes on a SiloedLockReleaseTokenPool 2.0.0 (`configureLockBoxes`, onlyOwner).",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": [
+        "LOCK_BOXES"
+      ]
+    },
+    {
+      "name": "GetSiloedPoolState",
+      "script": "script/configure/siloed/GetSiloedPoolState.s.sol",
+      "group": "siloed",
+      "description": "Reads where a SiloedLockReleaseTokenPool keeps its liquidity, per remote chain.",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": []
+    },
+    {
+      "name": "ProvideSiloedLiquidity",
+      "script": "script/configure/siloed/ProvideSiloedLiquidity.s.sol",
+      "group": "siloed",
+      "description": "Adds liquidity to one silo of a SiloedLockReleaseTokenPool 1.6.x: `approve` then `provideSiloedLiquidity`, as the silo's rebalancer.",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": [
+        "AMOUNT",
+        "DEST_CHAIN"
+      ]
+    },
+    {
+      "name": "SetSiloRebalancer",
+      "script": "script/configure/siloed/SetSiloRebalancer.s.sol",
+      "group": "siloed",
+      "description": "Sets the rebalancer of one silo on a SiloedLockReleaseTokenPool 1.6.x (onlyOwner).",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": [
+        "DEST_CHAIN",
+        "REBALANCER"
+      ]
+    },
+    {
+      "name": "UpdateSiloDesignations",
+      "script": "script/configure/siloed/UpdateSiloDesignations.s.sol",
+      "group": "siloed",
+      "description": "Silos or unsilos remote chains on a SiloedLockReleaseTokenPool 1.6.x (`updateSiloDesignations`, onlyOwner).",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": false,
+      "inputs": [
+        "SILO_CHAINS",
+        "SILO_REBALANCER",
+        "UNSILO_CHAINS"
+      ]
+    },
+    {
+      "name": "WithdrawSiloedLiquidity",
+      "script": "script/configure/siloed/WithdrawSiloedLiquidity.s.sol",
+      "group": "siloed",
+      "description": "Withdraws liquidity from one silo of a SiloedLockReleaseTokenPool 1.6.x to the silo rebalancer.",
+      "modes": [
+        "read"
+      ],
+      "read_only": true,
+      "writes_onchain": false,
+      "destructive": true,
+      "inputs": [
+        "AMOUNT",
+        "DEST_CHAIN"
+      ]
+    },
     {
       "name": "DeployBurnMintTokenPool",
       "script": "script/deploy/DeployBurnMintTokenPool.s.sol",
@@ -590,7 +696,8 @@
       "writes_onchain": true,
       "destructive": false,
       "inputs": [
-        "AUTHORIZED_CALLERS"
+        "AUTHORIZED_CALLERS",
+        "SILO"
       ]
     },
     {
@@ -610,6 +717,22 @@
         "POOL_HOOKS"
       ]
     },
+    {
+      "name": "DeploySiloedLockReleaseTokenPool",
+      "script": "script/deploy/DeploySiloedLockReleaseTokenPool.s.sol",
+      "group": "deploy",
+      "description": "Deploys a SiloedLockRelease token pool and records it in the registry.",
+      "modes": [
+        "eoa"
+      ],
+      "read_only": false,
+      "writes_onchain": true,
+      "destructive": false,
+      "inputs": [
+        "DECIMALS",
+        "POOL_HOOKS"
+      ]
+    },
     {
       "name": "DeployToken",
       "script": "script/deploy/DeployToken.s.sol",
@@ -1027,7 +1150,7 @@
     },
     {
       "target": "discover-tokens",
-      "help": "List the CCIP API token catalog for an operator (ADMIN=, SYMBOL=, CHAIN_SELECTOR=, ENVIRONMENT= all narrow; unreviewed tokens included)"
+      "help": "List the CCIP API token catalog for an operator (ADMIN=, SYMBOL=, CHAIN_SELECTOR=, ENVIRONMENT= all narrow; unreviewed tokens included; POOL=1 adds the pool, its API type and version, one request per row)"
     },
     {
       "target": "add-chain",
@@ -1049,6 +1172,10 @@
       "target": "adopt-token",
       "help": "Adopt an externally deployed token into project/[<GROUP>/]<CHAIN>.json (EVM: CHAIN= TOKEN= [TOKEN_POOL=]; non-EVM: CHAIN= TOKEN_B58= [POOL_B58=]; GROUP= for a second token)"
     },
+    {
+      "target": "forget-deployment",
+      "help": "Remove a retired entry from project/[<GROUP>/]<CHAIN>.json deployments{} (CHAIN= NAME=<deployments key> required; refuses an active, registered, still-laned or funded artifact; PREVIEW=1 changes nothing; local edit, nothing sent)"
+    },
     {
       "target": "sync",
       "help": "Refresh <CHAIN>'s ccip{} block from the live API (CHAIN= required)"
@@ -1113,6 +1240,10 @@
       "target": "deploy-lockrelease-pool",
       "help": "Deploy a LockRelease token pool on <CHAIN> (CHAIN= + KEYSTORE_NAME= required; token + lock box from the registry, else TOKEN= LOCK_BOX=; opt POOL_HOOKS=; VERIFY=1; FORCE_REDEPLOY=1; GROUP= scopes to a token group)"
     },
+    {
+      "target": "deploy-siloed-pool",
+      "help": "Deploy a SiloedLockRelease token pool on <CHAIN>, no lock box (CHAIN= + KEYSTORE_NAME= required; token from the registry, else TOKEN=; opt POOL_HOOKS=; VERIFY=1; FORCE_REDEPLOY=1; GROUP=). Then deploy-lockbox SILO=<label> per silo and configure/siloed/ConfigureLockBoxes"
+    },
     {
       "target": "deploy-new-chain",
       "help": "Guided deploy: add-chain -> deploy-token -> deploy-pool -> doctor (CHAIN= SELECTOR= + KEYSTORE_NAME= required; token params + VERIFY= via env). Register, set-pool, and wire-lane come next - see docs/workflows/greenfield-deploy.md; a green run means deployed, not yet cross-chain-live"
diff --git a/docs/primitives/config-plane/ForgetDeployment.md b/docs/primitives/config-plane/ForgetDeployment.md
new file mode 100644
index 0000000..ef171c1
--- /dev/null
+++ b/docs/primitives/config-plane/ForgetDeployment.md
@@ -0,0 +1,28 @@
+---
+name: ForgetDeployment
+script: script/config/ForgetDeployment.s.sol
+group: config-plane
+type: reference
+modes: [eoa]
+read_only: false
+writes_onchain: false
+destructive: false
+---
+
+# ForgetDeployment
+
+Removes one retired entry from `addresses.deployments` in the project store, typically the old pool after a migration.
+
+## Inputs
+
+No environment inputs; resolves everything from the chain config and address registry.
+
+## Reference
+
+- Script: [`script/config/ForgetDeployment.s.sol`](../../../script/config/ForgetDeployment.s.sol)
+- Modes: eoa
+- Read-only: false | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/deploy/DeployERC20LockBox.md b/docs/primitives/deploy/DeployERC20LockBox.md
index edd2c55..76cc719 100644
--- a/docs/primitives/deploy/DeployERC20LockBox.md
+++ b/docs/primitives/deploy/DeployERC20LockBox.md
@@ -18,6 +18,7 @@ Script to deploy an ERC20LockBox for use with a LockReleaseTokenPool
 | Env var | Description |
 | --- | --- |
 | `AUTHORIZED_CALLERS` | See the script header. |
+| `SILO` | See the script header. |
 
 ## Reference
 
diff --git a/docs/primitives/deploy/DeploySiloedLockReleaseTokenPool.md b/docs/primitives/deploy/DeploySiloedLockReleaseTokenPool.md
new file mode 100644
index 0000000..5cc3fe7
--- /dev/null
+++ b/docs/primitives/deploy/DeploySiloedLockReleaseTokenPool.md
@@ -0,0 +1,31 @@
+---
+name: DeploySiloedLockReleaseTokenPool
+script: script/deploy/DeploySiloedLockReleaseTokenPool.s.sol
+group: deploy
+type: reference
+modes: [eoa]
+read_only: false
+writes_onchain: true
+destructive: false
+---
+
+# DeploySiloedLockReleaseTokenPool
+
+Deploys a SiloedLockRelease token pool and records it in the registry.
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `DECIMALS` | See the script header. |
+| `POOL_HOOKS` | See the script header. |
+
+## Reference
+
+- Script: [`script/deploy/DeploySiloedLockReleaseTokenPool.s.sol`](../../../script/deploy/DeploySiloedLockReleaseTokenPool.s.sol)
+- Modes: eoa
+- Read-only: false | Writes on-chain: true | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/index.md b/docs/primitives/index.md
index a5467e0..8b31442 100644
--- a/docs/primitives/index.md
+++ b/docs/primitives/index.md
@@ -31,6 +31,7 @@ at [`catalog.json`](catalog.json). These pages are generated from the scripts an
 ## config-plane
 
 - [AdoptToken](config-plane/AdoptToken.md) - Adopts an externally deployed token (and optionally its pool) into the address registry, so contracts this repo did NOT deploy resolve exactly like the ones it did (the zero-export `active.<role>` ladder). _(write)_
+- [ForgetDeployment](config-plane/ForgetDeployment.md) - Removes one retired entry from `addresses.deployments` in the project store, typically the old pool after a migration. _(write)_
 - [ProbeChain](config-plane/ProbeChain.md) - Read a chain's CCIP wiring over plain JSON-RPC, WITHOUT forking it. _(write)_
 - [RolesCheck](config-plane/RolesCheck.md) - **`make roles-check CHAIN=<name>` - READ-ONLY reconcile of the declared `roles{}` against the live chain.** It never writes a file and never broadcasts; the only outputs are the aligned [PASS]/[FAIL]/[WARN]/[SKIP] lines from `RolesAuditor` and the exit status. _(write)_
 - [SnapshotChain](config-plane/SnapshotChain.md) - **`make snapshot-chain CHAIN=<name>` - backfill the DECLARED authority state FROM chain.** Reads the live role surface (owner/defaultAdmin/getCCIPAdmin/hasRole/TAR getTokenConfig/ dual-generation pool admins/getAllAuthorizedCallers/getAllowList/...) through `RolesSnapshot` and writes the `roles{}` subtree of `project/<selectorName>.json` (preserve-and-replace, the same single-subtree pattern as the `ccip{}` sync). _(write)_
@@ -46,6 +47,7 @@ at [`catalog.json`](catalog.json). These pages are generated from the scripts an
 - [DeployBurnMintTokenPool](deploy/DeployBurnMintTokenPool.md) - Deploys a BurnMint token pool for a token and records it in the address registry. _(write)_
 - [DeployERC20LockBox](deploy/DeployERC20LockBox.md) - Script to deploy an ERC20LockBox for use with a LockReleaseTokenPool _(write)_
 - [DeployLockReleaseTokenPool](deploy/DeployLockReleaseTokenPool.md) - Deploys a LockRelease token pool (paired with an ERC20 LockBox) and records it in the registry. _(write)_
+- [DeploySiloedLockReleaseTokenPool](deploy/DeploySiloedLockReleaseTokenPool.md) - Deploys a SiloedLockRelease token pool and records it in the registry. _(write)_
 - [DeployToken](deploy/DeployToken.md) - Deploys a cross-chain ERC20 token (CrossChainToken) and records it in the address registry. _(write)_
 
 ## dynamic-config
@@ -105,6 +107,15 @@ at [`catalog.json`](catalog.json). These pages are generated from the scripts an
 - [GetRemoteToken](remote-pools/GetRemoteToken.md) - Reads and displays the remote token configured on a TokenPool for a given remote chain. _(read-only)_
 - [RemoveRemotePool](remote-pools/RemoveRemotePool.md) - Removes a remote pool address from a TokenPool for a given remote chain. _(write, destructive)_
 
+## siloed
+
+- [ConfigureLockBoxes](siloed/ConfigureLockBoxes.md) - Maps remote chains to lock boxes on a SiloedLockReleaseTokenPool 2.0.0 (`configureLockBoxes`, onlyOwner). _(read-only)_
+- [GetSiloedPoolState](siloed/GetSiloedPoolState.md) - Reads where a SiloedLockReleaseTokenPool keeps its liquidity, per remote chain. _(read-only)_
+- [ProvideSiloedLiquidity](siloed/ProvideSiloedLiquidity.md) - Adds liquidity to one silo of a SiloedLockReleaseTokenPool 1.6.x: `approve` then `provideSiloedLiquidity`, as the silo's rebalancer. _(read-only)_
+- [SetSiloRebalancer](siloed/SetSiloRebalancer.md) - Sets the rebalancer of one silo on a SiloedLockReleaseTokenPool 1.6.x (onlyOwner). _(read-only)_
+- [UpdateSiloDesignations](siloed/UpdateSiloDesignations.md) - Silos or unsilos remote chains on a SiloedLockReleaseTokenPool 1.6.x (`updateSiloDesignations`, onlyOwner). _(read-only)_
+- [WithdrawSiloedLiquidity](siloed/WithdrawSiloedLiquidity.md) - Withdraws liquidity from one silo of a SiloedLockReleaseTokenPool 1.6.x to the silo rebalancer. _(read-only)_
+
 ## token-admin-registry
 
 - [AcceptAdminRole](token-admin-registry/AcceptAdminRole.md) - Accepts the pending administrator role for a token in the TokenAdminRegistry (step 2 of the two-step claim; the signer must be the pending administrator set by ClaimAdmin). _(write)_
diff --git a/docs/primitives/siloed/ConfigureLockBoxes.md b/docs/primitives/siloed/ConfigureLockBoxes.md
new file mode 100644
index 0000000..a36cdcd
--- /dev/null
+++ b/docs/primitives/siloed/ConfigureLockBoxes.md
@@ -0,0 +1,30 @@
+---
+name: ConfigureLockBoxes
+script: script/configure/siloed/ConfigureLockBoxes.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: false
+---
+
+# ConfigureLockBoxes
+
+Maps remote chains to lock boxes on a SiloedLockReleaseTokenPool 2.0.0 (`configureLockBoxes`, onlyOwner).
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `LOCK_BOXES` | See the script header. |
+
+## Reference
+
+- Script: [`script/configure/siloed/ConfigureLockBoxes.s.sol`](../../../script/configure/siloed/ConfigureLockBoxes.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/siloed/GetSiloedPoolState.md b/docs/primitives/siloed/GetSiloedPoolState.md
new file mode 100644
index 0000000..09c284d
--- /dev/null
+++ b/docs/primitives/siloed/GetSiloedPoolState.md
@@ -0,0 +1,28 @@
+---
+name: GetSiloedPoolState
+script: script/configure/siloed/GetSiloedPoolState.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: false
+---
+
+# GetSiloedPoolState
+
+Reads where a SiloedLockReleaseTokenPool keeps its liquidity, per remote chain.
+
+## Inputs
+
+No environment inputs; resolves everything from the chain config and address registry.
+
+## Reference
+
+- Script: [`script/configure/siloed/GetSiloedPoolState.s.sol`](../../../script/configure/siloed/GetSiloedPoolState.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/siloed/ProvideSiloedLiquidity.md b/docs/primitives/siloed/ProvideSiloedLiquidity.md
new file mode 100644
index 0000000..8dcfc72
--- /dev/null
+++ b/docs/primitives/siloed/ProvideSiloedLiquidity.md
@@ -0,0 +1,31 @@
+---
+name: ProvideSiloedLiquidity
+script: script/configure/siloed/ProvideSiloedLiquidity.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: false
+---
+
+# ProvideSiloedLiquidity
+
+Adds liquidity to one silo of a SiloedLockReleaseTokenPool 1.6.x: `approve` then `provideSiloedLiquidity`, as the silo's rebalancer.
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `AMOUNT` | See the script header. |
+| `DEST_CHAIN` | See the script header. |
+
+## Reference
+
+- Script: [`script/configure/siloed/ProvideSiloedLiquidity.s.sol`](../../../script/configure/siloed/ProvideSiloedLiquidity.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/siloed/SetSiloRebalancer.md b/docs/primitives/siloed/SetSiloRebalancer.md
new file mode 100644
index 0000000..da66979
--- /dev/null
+++ b/docs/primitives/siloed/SetSiloRebalancer.md
@@ -0,0 +1,31 @@
+---
+name: SetSiloRebalancer
+script: script/configure/siloed/SetSiloRebalancer.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: false
+---
+
+# SetSiloRebalancer
+
+Sets the rebalancer of one silo on a SiloedLockReleaseTokenPool 1.6.x (onlyOwner).
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `DEST_CHAIN` | See the script header. |
+| `REBALANCER` | See the script header. |
+
+## Reference
+
+- Script: [`script/configure/siloed/SetSiloRebalancer.s.sol`](../../../script/configure/siloed/SetSiloRebalancer.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/siloed/UpdateSiloDesignations.md b/docs/primitives/siloed/UpdateSiloDesignations.md
new file mode 100644
index 0000000..c84921d
--- /dev/null
+++ b/docs/primitives/siloed/UpdateSiloDesignations.md
@@ -0,0 +1,32 @@
+---
+name: UpdateSiloDesignations
+script: script/configure/siloed/UpdateSiloDesignations.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: false
+---
+
+# UpdateSiloDesignations
+
+Silos or unsilos remote chains on a SiloedLockReleaseTokenPool 1.6.x (`updateSiloDesignations`, onlyOwner).
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `SILO_CHAINS` | See the script header. |
+| `SILO_REBALANCER` | See the script header. |
+| `UNSILO_CHAINS` | See the script header. |
+
+## Reference
+
+- Script: [`script/configure/siloed/UpdateSiloDesignations.s.sol`](../../../script/configure/siloed/UpdateSiloDesignations.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: false
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/primitives/siloed/WithdrawSiloedLiquidity.md b/docs/primitives/siloed/WithdrawSiloedLiquidity.md
new file mode 100644
index 0000000..cfa8ffa
--- /dev/null
+++ b/docs/primitives/siloed/WithdrawSiloedLiquidity.md
@@ -0,0 +1,31 @@
+---
+name: WithdrawSiloedLiquidity
+script: script/configure/siloed/WithdrawSiloedLiquidity.s.sol
+group: siloed
+type: reference
+modes: [read]
+read_only: true
+writes_onchain: false
+destructive: true
+---
+
+# WithdrawSiloedLiquidity
+
+Withdraws liquidity from one silo of a SiloedLockReleaseTokenPool 1.6.x to the silo rebalancer.
+
+## Inputs
+
+| Env var | Description |
+| --- | --- |
+| `AMOUNT` | See the script header. |
+| `DEST_CHAIN` | See the script header. |
+
+## Reference
+
+- Script: [`script/configure/siloed/WithdrawSiloedLiquidity.s.sol`](../../../script/configure/siloed/WithdrawSiloedLiquidity.s.sol)
+- Modes: read
+- Read-only: true | Writes on-chain: false | Destructive: true
+
+_This page is generated from the script by `script/docs/gen-primitives.mjs`. Edit the script's
+`@notice` for the description, or `docs/primitives/_meta.json` for the authored context; do not edit
+this file by hand._
diff --git a/docs/production-checklist.md b/docs/production-checklist.md
index 30342b3..5c24285 100644
--- a/docs/production-checklist.md
+++ b/docs/production-checklist.md
@@ -54,6 +54,9 @@ proves it. Do not skip the read-backs: a setting you did not read back is a sett
       and the balance is read back at or above your expected first-day release volume. An empty lockbox
       passes doctor, roles, and rate limits and even the outbound smoke send's source leg, then every
       inbound transfer sticks. See [liquidity](operations/liquidity.md).
+- [ ] **Siloed only:** every supported remote chain maps to a lock box that authorizes the pool
+      (`make doctor` fails otherwise), and each silo's box is funded on its own: liquidity in one silo does
+      not cover another. `GetSiloedPoolState` shows the balance per chain.
 
 ## 6. Migration and rollback plan
 
diff --git a/docs/reference/ccip-api.md b/docs/reference/ccip-api.md
index 56d9652..53ab861 100644
--- a/docs/reference/ccip-api.md
+++ b/docs/reference/ccip-api.md
@@ -44,6 +44,12 @@ finds a parameter you did not think to try. That is how `reviewedOnly` was misse
 | `GET /chains` | [`sync-discover.sh`](../../script/config/sync-discover.sh) | `environment` only (unset = both planes). No paging. |
 | `GET /chains/{selector}` | [`ccip-config-source.sh`](../../script/config/ccip-config-source.sh), [`ccip-chain-meta.sh`](../../script/config/ccip-chain-meta.sh) | none accepted. |
 | `GET /tokens` | [`discover-tokens.sh`](../../script/config/discover-tokens.sh) | `chainSelector`, `remoteChainSelector`, `groupId`, `symbol`, `address`, `admin`, `environment`, `reviewedOnly`, `expand`, `limit`, `cursor`. |
+| `GET /tokens/{chainSelector}/{tokenAddress}` | [`discover-tokens.sh`](../../script/config/discover-tokens.sh) with `POOL=1` | none accepted. |
+
+Only the token detail route describes the pool: `pool.type` is an API enum (`SILOED_LOCK_RELEASE`,
+`BURN_MINT`, ...) and `pool.version` a version number that is `null` for a dev build. No route returns the
+contract's own `typeAndVersion()`; read it on-chain when the exact string matters. The list route carries
+no pool fields even with `expand=true`, and the group route carries pool addresses only.
 
 `GET /tokens` pages by **keyset, not offset**: `page` and `offset` are rejected with a 400. Follow
 `pagination.cursor` while `pagination.hasNextPage` is true. Filters may travel with the cursor only if
diff --git a/docs/reference/pool-behavior-matrix.md b/docs/reference/pool-behavior-matrix.md
index 1b710fc..dce6a7e 100644
--- a/docs/reference/pool-behavior-matrix.md
+++ b/docs/reference/pool-behavior-matrix.md
@@ -9,14 +9,14 @@ behaves differently from the template's v2.0 default. Every row below is backed
 exercises the real deployed bytecode of each version (a Sepolia fork), not a mock. Keyed off the pool's
 `typeAndVersion`.
 
-| Behavior | v1.5.0 | v1.5.1 | v1.6.x | v2.0 |
-| --- | --- | --- | --- | --- |
-| Mixed decimals | Not supported (mints the raw source amount 1:1) | Supported | Supported | Supported |
-| Inbound rate limit metered on | raw source amount | un-rescaled source amount | rescaled local amount | rescaled local amount |
-| Rate-limiter config validation (enabled) | `rate >= capacity` or `rate == 0` reverts | same as v1.5.0 | `rate > capacity` reverts (`rate == 0` allowed) | same as v1.6.x |
-| Pause via `capacity=1, rate=1` | reverts (`1 >= 1`) | reverts | valid | valid |
-| Fast-finality rate limiter | none | none | none | separate limiter; falls back to the standard bucket when disabled |
-| Dedicated pause function | none | none | none | none (pause is the rate-limit throttle) |
+| Behavior | v1.5.0 | v1.5.1 | v1.6.0 (Siloed only) | v1.6.1 | v2.0 |
+| --- | --- | --- | --- | --- | --- |
+| Mixed decimals | Not supported (mints the raw source amount 1:1) | Supported | Supported | Supported | Supported |
+| Inbound rate limit metered on | raw source amount | un-rescaled source amount | un-rescaled source amount | rescaled local amount | rescaled local amount |
+| Rate-limiter config validation (enabled) | `rate >= capacity` or `rate == 0` reverts | same as v1.5.0 | same as v1.5.0 | `rate > capacity` reverts (`rate == 0` allowed) | same as v1.6.1 |
+| Pause via `capacity=1, rate=1` | reverts (`1 >= 1`) | reverts | reverts | valid | valid |
+| Fast-finality rate limiter | none | none | none | none | separate limiter; falls back to the standard bucket when disabled |
+| Dedicated pause function | none | none | none | none | none (pause is the rate-limit throttle) |
 
 ## Pausing a pool, per version
 
@@ -24,10 +24,10 @@ A v2 pool has no dedicated pause or `Pausable` mechanism, so the reversible paus
 rate-limit throttle. The only hard stop is removing the chain, which tears the lane down rather than
 pausing it (and carries a stale-config re-add gotcha), so it is the wrong tool for a temporary pause.
 
-- On v1.6+ and v2.0, an enabled limiter with `capacity=0, rate=0` is a true zero-throughput block (every
+- On v1.6.1+ and v2.0, an enabled limiter with `capacity=0, rate=0` is a true zero-throughput block (every
   transfer reverts `TokenMaxCapacityExceeded`), cleaner than `capacity=1, rate=1`, which leaks one unit
   and refills.
-- On v1.5.x this is impossible: the validation rejects `rate == 0` when enabled, so v1.5.x can only
+- On v1.5.x and Siloed v1.6.0 this is impossible: the validation rejects `rate == 0` when enabled, so v1.5.x can only
   near-pause with `capacity > rate > 0` (for example `2/1`), which still leaks.
 
 **Footgun:** `isEnabled=true` with `capacity=0, rate=0` PAUSES (blocks everything), while `isEnabled=false`
diff --git a/foundry.toml b/foundry.toml
index 476026e..50665c6 100644
--- a/foundry.toml
+++ b/foundry.toml
@@ -37,6 +37,10 @@ ignored_error_codes = [
 remappings = [
   "forge-std/=node_modules/@chainlink/contracts/src/v0.8/vendor/forge-std/src/",
   "@chainlink/contracts-ccip/contracts/=node_modules/@chainlink/contracts-ccip/contracts/",
+  "@chainlink/contracts-ccip-1.6.0/=node_modules/@chainlink/contracts-ccip-1.6.0/",
+  "@chainlink/contracts-ccip-1.6.1/=node_modules/@chainlink/contracts-ccip-1.6.1/",
+  "node_modules/@chainlink/contracts-ccip-1.6.0/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@chainlink/contracts/",
+  "node_modules/@chainlink/contracts-ccip-1.6.1/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@chainlink/contracts/",
   "@chainlink/contracts@1.4.0/=node_modules/@chainlink/contracts/",
   "@chainlink/contracts/=node_modules/@chainlink/contracts/",
   "@chainlink/policy-management/=node_modules/@chainlink/ace/packages/policy-management/src/",
@@ -72,6 +76,10 @@ ffi = true
 remappings = [
   "forge-std/=node_modules/@chainlink/contracts/src/v0.8/vendor/forge-std/src/",
   "@chainlink/contracts-ccip/contracts/=node_modules/@chainlink/contracts-ccip/contracts/",
+  "@chainlink/contracts-ccip-1.6.0/=node_modules/@chainlink/contracts-ccip-1.6.0/",
+  "@chainlink/contracts-ccip-1.6.1/=node_modules/@chainlink/contracts-ccip-1.6.1/",
+  "node_modules/@chainlink/contracts-ccip-1.6.0/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@chainlink/contracts/",
+  "node_modules/@chainlink/contracts-ccip-1.6.1/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@chainlink/contracts/",
   "@chainlink/contracts@1.4.0/=node_modules/@chainlink/contracts/",
   "@chainlink/contracts/=node_modules/@chainlink/contracts/",
   "@chainlink/policy-management/=node_modules/@chainlink/ace/packages/policy-management/src/",
diff --git a/package-lock.json b/package-lock.json
index 24ffd55..8329dfe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,8 @@
         "@chainlink/ace": "1.0.0",
         "@chainlink/contracts": "1.5.0",
         "@chainlink/contracts-ccip": "2.0.0",
+        "@chainlink/contracts-ccip-1.6.0": "npm:@chainlink/contracts-ccip@1.6.0",
+        "@chainlink/contracts-ccip-1.6.1": "npm:@chainlink/contracts-ccip@1.6.1",
         "@openzeppelin/contracts-4.8.3": "npm:@openzeppelin/contracts@4.8.3",
         "@openzeppelin/contracts-5.3.0": "npm:@openzeppelin/contracts@5.3.0"
       },
@@ -121,6 +123,214 @@
         "pnpm": ">=10"
       }
     },
+    "node_modules/@chainlink/contracts-ccip-1.6.0": {
+      "name": "@chainlink/contracts-ccip",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@chainlink/contracts-ccip/-/contracts-ccip-1.6.0.tgz",
+      "integrity": "sha512-QVtd1DcSW8WoX2T0gI4+EKh9yKipocSejx/9neC7Vd5dbVffyV9kNPJgQ6BC8kgLZG3f+4S2+l3YCDD7y1b6bQ==",
+      "license": "BUSL-1.1",
+      "dependencies": {
+        "@chainlink/contracts": "1.4.0",
+        "@changesets/cli": "^2.29.3",
+        "@changesets/get-github-info": "^0.6.0",
+        "semver": "^7.6.3"
+      },
+      "engines": {
+        "node": ">=20",
+        "pnpm": ">=10"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@chainlink/contracts": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@chainlink/contracts/-/contracts-1.4.0.tgz",
+      "integrity": "sha512-SpNCJ0TPOI6pa2l702Wk4WIP8ccw5ARcRP1E/ZTqaFffXNoZeF03WhsVL8f3l3OTRFA9Z40O5KcZzmJmZQkoFA==",
+      "license": "BUSL-1.1",
+      "dependencies": {
+        "@arbitrum/nitro-contracts": "3.0.0",
+        "@changesets/cli": "~2.28.1",
+        "@changesets/get-github-info": "^0.6.0",
+        "@eth-optimism/contracts": "0.6.0",
+        "@openzeppelin/contracts": "4.9.6",
+        "@openzeppelin/contracts-upgradeable": "4.9.6",
+        "@scroll-tech/contracts": "0.1.0",
+        "@zksync/contracts": "github:matter-labs/era-contracts#446d391d34bdb48255d5f8fef8a8248925fc98b9",
+        "semver": "^7.7.1"
+      },
+      "engines": {
+        "node": ">=18",
+        "pnpm": ">=10"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@chainlink/contracts/node_modules/@changesets/cli": {
+      "version": "2.28.1",
+      "resolved": "https://registry.npmjs.org/@changesets/cli/-/cli-2.28.1.tgz",
+      "integrity": "sha512-PiIyGRmSc6JddQJe/W1hRPjiN4VrMvb2VfQ6Uydy2punBioQrsxppyG5WafinKcW1mT0jOe/wU4k9Zy5ff21AA==",
+      "license": "MIT",
+      "dependencies": {
+        "@changesets/apply-release-plan": "^7.0.10",
+        "@changesets/assemble-release-plan": "^6.0.6",
+        "@changesets/changelog-git": "^0.2.1",
+        "@changesets/config": "^3.1.1",
+        "@changesets/errors": "^0.2.0",
+        "@changesets/get-dependents-graph": "^2.1.3",
+        "@changesets/get-release-plan": "^4.0.8",
+        "@changesets/git": "^3.0.2",
+        "@changesets/logger": "^0.1.1",
+        "@changesets/pre": "^2.0.2",
+        "@changesets/read": "^0.6.3",
+        "@changesets/should-skip-package": "^0.1.2",
+        "@changesets/types": "^6.1.0",
+        "@changesets/write": "^0.4.0",
+        "@manypkg/get-packages": "^1.1.3",
+        "ansi-colors": "^4.1.3",
+        "ci-info": "^3.7.0",
+        "enquirer": "^2.4.1",
+        "external-editor": "^3.1.0",
+        "fs-extra": "^7.0.1",
+        "mri": "^1.2.0",
+        "p-limit": "^2.2.0",
+        "package-manager-detector": "^0.2.0",
+        "picocolors": "^1.1.0",
+        "resolve-from": "^5.0.0",
+        "semver": "^7.5.3",
+        "spawndamnit": "^3.0.1",
+        "term-size": "^2.1.0"
+      },
+      "bin": {
+        "changeset": "bin.js"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@openzeppelin/contracts": {
+      "version": "4.9.6",
+      "resolved": "https://registry.npmjs.org/@openzeppelin/contracts/-/contracts-4.9.6.tgz",
+      "integrity": "sha512-xSmezSupL+y9VkHZJGDoCBpmnB2ogM13ccaYDWqJTfS3dbuHkgjuwDFUmaFauBCboQMGB/S5UqUl2y54X99BmA==",
+      "license": "MIT"
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@scroll-tech/contracts": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@scroll-tech/contracts/-/contracts-0.1.0.tgz",
+      "integrity": "sha512-aBbDOc3WB/WveZdpJYcrfvMYMz7ZTEiW8M9XMJLba8p9FAR5KGYB/cV+8+EUsq3MKt7C1BfR+WnXoTVdvwIY6w==",
+      "license": "MIT"
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/ci-info": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
+      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1": {
+      "name": "@chainlink/contracts-ccip",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@chainlink/contracts-ccip/-/contracts-ccip-1.6.1.tgz",
+      "integrity": "sha512-2ainz7DhzSPyUTD01e0roRHQ4V895peJ6rlu+GgxOYCZVFVtuwXEbT27ByyaJSFsB9ZubAtu1zhAijuL0OwPzw==",
+      "license": "BUSL-1.1",
+      "dependencies": {
+        "@chainlink/contracts": "1.4.0",
+        "@changesets/cli": "^2.29.5",
+        "@changesets/get-github-info": "^0.6.0",
+        "semver": "^7.7.2"
+      },
+      "engines": {
+        "node": ">=20",
+        "pnpm": ">=10"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@chainlink/contracts": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@chainlink/contracts/-/contracts-1.4.0.tgz",
+      "integrity": "sha512-SpNCJ0TPOI6pa2l702Wk4WIP8ccw5ARcRP1E/ZTqaFffXNoZeF03WhsVL8f3l3OTRFA9Z40O5KcZzmJmZQkoFA==",
+      "license": "BUSL-1.1",
+      "dependencies": {
+        "@arbitrum/nitro-contracts": "3.0.0",
+        "@changesets/cli": "~2.28.1",
+        "@changesets/get-github-info": "^0.6.0",
+        "@eth-optimism/contracts": "0.6.0",
+        "@openzeppelin/contracts": "4.9.6",
+        "@openzeppelin/contracts-upgradeable": "4.9.6",
+        "@scroll-tech/contracts": "0.1.0",
+        "@zksync/contracts": "github:matter-labs/era-contracts#446d391d34bdb48255d5f8fef8a8248925fc98b9",
+        "semver": "^7.7.1"
+      },
+      "engines": {
+        "node": ">=18",
+        "pnpm": ">=10"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@chainlink/contracts/node_modules/@changesets/cli": {
+      "version": "2.28.1",
+      "resolved": "https://registry.npmjs.org/@changesets/cli/-/cli-2.28.1.tgz",
+      "integrity": "sha512-PiIyGRmSc6JddQJe/W1hRPjiN4VrMvb2VfQ6Uydy2punBioQrsxppyG5WafinKcW1mT0jOe/wU4k9Zy5ff21AA==",
+      "license": "MIT",
+      "dependencies": {
+        "@changesets/apply-release-plan": "^7.0.10",
+        "@changesets/assemble-release-plan": "^6.0.6",
+        "@changesets/changelog-git": "^0.2.1",
+        "@changesets/config": "^3.1.1",
+        "@changesets/errors": "^0.2.0",
+        "@changesets/get-dependents-graph": "^2.1.3",
+        "@changesets/get-release-plan": "^4.0.8",
+        "@changesets/git": "^3.0.2",
+        "@changesets/logger": "^0.1.1",
+        "@changesets/pre": "^2.0.2",
+        "@changesets/read": "^0.6.3",
+        "@changesets/should-skip-package": "^0.1.2",
+        "@changesets/types": "^6.1.0",
+        "@changesets/write": "^0.4.0",
+        "@manypkg/get-packages": "^1.1.3",
+        "ansi-colors": "^4.1.3",
+        "ci-info": "^3.7.0",
+        "enquirer": "^2.4.1",
+        "external-editor": "^3.1.0",
+        "fs-extra": "^7.0.1",
+        "mri": "^1.2.0",
+        "p-limit": "^2.2.0",
+        "package-manager-detector": "^0.2.0",
+        "picocolors": "^1.1.0",
+        "resolve-from": "^5.0.0",
+        "semver": "^7.5.3",
+        "spawndamnit": "^3.0.1",
+        "term-size": "^2.1.0"
+      },
+      "bin": {
+        "changeset": "bin.js"
+      }
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@openzeppelin/contracts": {
+      "version": "4.9.6",
+      "resolved": "https://registry.npmjs.org/@openzeppelin/contracts/-/contracts-4.9.6.tgz",
+      "integrity": "sha512-xSmezSupL+y9VkHZJGDoCBpmnB2ogM13ccaYDWqJTfS3dbuHkgjuwDFUmaFauBCboQMGB/S5UqUl2y54X99BmA==",
+      "license": "MIT"
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@scroll-tech/contracts": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@scroll-tech/contracts/-/contracts-0.1.0.tgz",
+      "integrity": "sha512-aBbDOc3WB/WveZdpJYcrfvMYMz7ZTEiW8M9XMJLba8p9FAR5KGYB/cV+8+EUsq3MKt7C1BfR+WnXoTVdvwIY6w==",
+      "license": "MIT"
+    },
+    "node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/ci-info": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
+      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/@changesets/apply-release-plan": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/@changesets/apply-release-plan/-/apply-release-plan-7.1.0.tgz",
@@ -2101,6 +2311,38 @@
       "integrity": "sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg==",
       "license": "MIT"
     },
+    "node_modules/external-editor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/external-editor/-/external-editor-3.1.0.tgz",
+      "integrity": "sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==",
+      "license": "MIT",
+      "dependencies": {
+        "chardet": "^0.7.0",
+        "iconv-lite": "^0.4.24",
+        "tmp": "^0.0.33"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/external-editor/node_modules/chardet": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/chardet/-/chardet-0.7.0.tgz",
+      "integrity": "sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==",
+      "license": "MIT"
+    },
+    "node_modules/external-editor/node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
diff --git a/package.json b/package.json
index 8d08182..74abfcc 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,8 @@
     "@chainlink/ace": "1.0.0",
     "@chainlink/contracts": "1.5.0",
     "@chainlink/contracts-ccip": "2.0.0",
+    "@chainlink/contracts-ccip-1.6.0": "npm:@chainlink/contracts-ccip@1.6.0",
+    "@chainlink/contracts-ccip-1.6.1": "npm:@chainlink/contracts-ccip@1.6.1",
     "@openzeppelin/contracts-4.8.3": "npm:@openzeppelin/contracts@4.8.3",
     "@openzeppelin/contracts-5.3.0": "npm:@openzeppelin/contracts@5.3.0"
   },
diff --git a/remappings.txt b/remappings.txt
index 3dc6d62..212632f 100644
--- a/remappings.txt
+++ b/remappings.txt
@@ -1,6 +1,10 @@
 forge-std/=node_modules/@chainlink/contracts/src/v0.8/vendor/forge-std/src/
 
 @chainlink/contracts-ccip/contracts/=node_modules/@chainlink/contracts-ccip/contracts/
+@chainlink/contracts-ccip-1.6.0/=node_modules/@chainlink/contracts-ccip-1.6.0/
+@chainlink/contracts-ccip-1.6.1/=node_modules/@chainlink/contracts-ccip-1.6.1/
+node_modules/@chainlink/contracts-ccip-1.6.0/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.0/node_modules/@chainlink/contracts/
+node_modules/@chainlink/contracts-ccip-1.6.1/:@chainlink/contracts/=node_modules/@chainlink/contracts-ccip-1.6.1/node_modules/@chainlink/contracts/
 @chainlink/contracts@1.4.0/=node_modules/@chainlink/contracts/
 @chainlink/contracts/=node_modules/@chainlink/contracts
 @chainlink/policy-management/=node_modules/@chainlink/ace/packages/policy-management/src/
diff --git a/script/config/AdoptToken.s.sol b/script/config/AdoptToken.s.sol
index 69c2981..8f95922 100644
--- a/script/config/AdoptToken.s.sol
+++ b/script/config/AdoptToken.s.sol
@@ -2,6 +2,7 @@
 pragma solidity 0.8.24;
 
 import {Script, console} from "forge-std/Script.sol";
+import {VmSafe} from "forge-std/Vm.sol";
 import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
 import {TokenAdminRegistry} from "@chainlink/contracts-ccip/contracts/tokenAdminRegistry/TokenAdminRegistry.sol";
 import {IGetCCIPAdmin} from "@chainlink/contracts-ccip/contracts/interfaces/IGetCCIPAdmin.sol";
@@ -10,6 +11,8 @@ import {PoolVersion} from "../utils/PoolVersion.s.sol";
 import {DeploymentUtils} from "../utils/DeploymentUtils.s.sol";
 import {RegistryWriter} from "../../src/utils/RegistryWriter.sol";
 import {ProjectStore} from "../../src/utils/ProjectStore.sol";
+import {TolerantCall} from "../../src/utils/TolerantCall.sol";
+import {PoolVersions} from "../../src/PoolVersions.sol";
 
 /// @notice Adopts an externally deployed token (and optionally its pool) into the address registry,
 /// so contracts this repo did NOT deploy resolve exactly like the ones it did (the zero-export
@@ -39,6 +42,13 @@ contract AdoptToken is Script {
         string tokenSymbol;
         string adminPath; // "getCCIPAdmin()", "owner()", or "" when self-registration is unavailable
         string poolTypeAndVersion; // full typeAndVersion() string; empty when no pool is adopted
+        address[] lockBoxes; // a 2.0 LockRelease pool's box, or a Siloed pool's distinct boxes
+        uint64[] lockBoxFirstChain; // Siloed: the first remote chain mapped to each box; empty otherwise
+    }
+
+    struct LockBoxConfigView {
+        uint64 remoteChainSelector;
+        address lockBox;
     }
 
     function run(string memory name, address token, address pool) external {
@@ -131,8 +141,11 @@ contract AdoptToken is Script {
             // foreign pool types, and uncataloged versions by name (POOL_VERSION_OVERRIDE is honored
             // with its cross-check; the registry always records the TRUE on-chain string below, and
             // an override used here shows only in the console output).
-            (, string memory full) = PoolVersion._resolve(pool);
+            (PoolVersions.Version version, string memory full) = PoolVersion._resolve(pool);
             plan.poolTypeAndVersion = full;
+            if (version >= PoolVersions.Version.V2_0_0) {
+                (plan.lockBoxes, plan.lockBoxFirstChain) = _lockBoxesOf(pool, PoolVersion._typePrefixOf(full));
+            }
             address poolToken = address(TokenPool(pool).getToken());
             require(
                 poolToken == token,
@@ -146,6 +159,9 @@ contract AdoptToken is Script {
                 )
             );
             console.log(string.concat("Pool:   ", vm.toString(pool), " (", plan.poolTypeAndVersion, ")"));
+            for (uint256 i = 0; i < plan.lockBoxes.length; i++) {
+                console.log(string.concat("LockBox: ", vm.toString(plan.lockBoxes[i])));
+            }
         }
 
         _reportRegistryState(json, token, pool);
@@ -167,6 +183,94 @@ contract AdoptToken is Script {
                 plan.pool
             );
         }
+        // The keys the deploy path writes: a single box is active.lockBox; siloed boxes are per-silo
+        // entries only, since no one of them is "the" lock box.
+        if (plan.lockBoxFirstChain.length == 0) {
+            if (plan.lockBoxes.length == 1) {
+                RegistryWriter._recordDeterministic(
+                    plan.selectorName, "lockBox", string.concat(plan.tokenSymbol, "_LockBox"), plan.lockBoxes[0]
+                );
+            }
+        } else {
+            for (uint256 i = 0; i < plan.lockBoxes.length; i++) {
+                RegistryWriter._setDeployment(
+                    plan.selectorName,
+                    string.concat(plan.tokenSymbol, "_LockBox_", _selectorLabel(plan.lockBoxFirstChain[i])),
+                    plan.lockBoxes[i]
+                );
+            }
+        }
+    }
+
+    /// @dev A 2.0 LockRelease pool's single box (`getLockBox()`), or a Siloed pool's distinct boxes with the
+    /// first chain each serves. Tolerant: a pool that does not answer yields no boxes. A 1.6.2-1.6.4
+    /// Siloed box has no getter at all, and those versions are not cataloged anyway.
+    function _lockBoxesOf(address pool, string memory typePrefix)
+        internal
+        view
+        returns (address[] memory boxes, uint64[] memory firstChain)
+    {
+        if (PoolVersion._isSiloed(typePrefix)) {
+            (bool s, bytes memory ret) = pool.staticcall(abi.encodeWithSignature("getAllLockBoxConfigs()"));
+            if (!s || !TolerantCall._decodesAsDynamic(ret, 64)) return (new address[](0), new uint64[](0));
+            LockBoxConfigView[] memory cfg = abi.decode(ret, (LockBoxConfigView[]));
+            address[] memory b = new address[](cfg.length);
+            uint64[] memory f = new uint64[](cfg.length);
+            uint256 n = 0;
+            for (uint256 i = 0; i < cfg.length; i++) {
+                bool seen = false;
+                for (uint256 j = 0; j < n; j++) {
+                    if (b[j] == cfg[i].lockBox) seen = true;
+                }
+                if (!seen) {
+                    b[n] = cfg[i].lockBox;
+                    f[n] = cfg[i].remoteChainSelector;
+                    n++;
+                }
+            }
+            boxes = new address[](n);
+            firstChain = new uint64[](n);
+            for (uint256 i = 0; i < n; i++) {
+                boxes[i] = b[i];
+                firstChain[i] = f[i];
+            }
+            return (boxes, firstChain);
+        }
+        if (keccak256(bytes(typePrefix)) == keccak256("LockReleaseTokenPool")) {
+            (bool s, bytes memory ret) = pool.staticcall(abi.encodeWithSignature("getLockBox()"));
+            if (s && ret.length >= 32) {
+                address box = abi.decode(ret, (address));
+                if (box != address(0)) {
+                    boxes = new address[](1);
+                    boxes[0] = box;
+                    return (boxes, new uint64[](0));
+                }
+            }
+        }
+        return (new address[](0), new uint64[](0));
+    }
+
+    /// @dev Test seam: `validateAdoption` reaches `_lockBoxesOf` only after a forked token/pool check.
+    function lockBoxesOfForTest(address pool, string memory typePrefix)
+        external
+        view
+        returns (address[] memory, uint64[] memory)
+    {
+        return _lockBoxesOf(pool, typePrefix);
+    }
+
+    /// @dev The config/chains name for a selector, or the selector itself.
+    function _selectorLabel(uint64 selector) internal view returns (string memory) {
+        VmSafe.DirEntry[] memory entries = vm.readDir(CONFIG_DIR);
+        string memory want = vm.toString(selector);
+        for (uint256 i = 0; i < entries.length; i++) {
+            string memory json = vm.readFile(entries[i].path);
+            if (!vm.keyExistsJson(json, ".chainSelector") || !vm.keyExistsJson(json, ".name")) continue;
+            if (keccak256(bytes(vm.parseJsonString(json, ".chainSelector"))) == keccak256(bytes(want))) {
+                return vm.parseJsonString(json, ".name");
+            }
+        }
+        return want;
     }
 
     /// @notice **Non-EVM (base58) adopt path** - declare a project's Solana-side (or other non-EVM)
diff --git a/script/config/ForgetDeployment.s.sol b/script/config/ForgetDeployment.s.sol
new file mode 100644
index 0000000..36cb9db
--- /dev/null
+++ b/script/config/ForgetDeployment.s.sol
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {Script, console} from "forge-std/Script.sol";
+import {TokenAdminRegistry} from "@chainlink/contracts-ccip/contracts/tokenAdminRegistry/TokenAdminRegistry.sol";
+import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
+import {RegistryWriter} from "../../src/utils/RegistryWriter.sol";
+import {ProjectStore} from "../../src/utils/ProjectStore.sol";
+import {TolerantCall} from "../../src/utils/TolerantCall.sol";
+
+/// @notice Removes one retired entry from `addresses.deployments` in the project store, typically the old
+/// pool after a migration. Local store edit only; nothing is sent. Refuses while the entry is still in use:
+///   - any `active` role points at it;
+///   - a pool the TokenAdminRegistry still routes to, or that still supports a remote chain;
+///   - a lock box that still holds the token.
+/// The address stays in `history/` if it was ever broadcast, and is printed here.
+///
+/// Usage (via the Makefile):
+///   make forget-deployment CHAIN=<name> NAME=<deployments key> [GROUP=<g>] [PREVIEW=1]
+contract ForgetDeployment is Script {
+    string internal constant CONFIG_DIR = "config/chains/";
+
+    function run(string memory name, string memory deploymentName, bool preview) external {
+        string memory path = string.concat(CONFIG_DIR, name, ".json");
+        require(vm.exists(path), string.concat("no ", path));
+        string memory json = vm.readFile(path);
+
+        string memory value = RegistryWriter._readDeploymentString(name, deploymentName);
+        require(
+            bytes(value).length != 0,
+            string.concat("no addresses.deployments.", deploymentName, " in ", ProjectStore._display(name))
+        );
+        string memory role = RegistryWriter._activeRoleFor(name, value);
+        require(
+            bytes(role).length == 0,
+            string.concat(deploymentName, " is active.", role, " - it is the live artifact, not a retired one")
+        );
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"🧹 Forget a retired deployment");
+        console.log("========================================");
+        console.log(string.concat("Store:   ", ProjectStore._display(name)));
+        console.log(string.concat("Entry:   ", deploymentName, " = ", value));
+
+        if (keccak256(bytes(vm.parseJsonString(json, ".chainFamily"))) == keccak256("evm")) {
+            _createFork(json);
+            address target = vm.parseAddress(value);
+            string memory refusal = liveUseReason(
+                deploymentName,
+                target,
+                RegistryWriter._read(name, "token"),
+                vm.parseJsonAddress(json, ".ccip.tokenAdminRegistry")
+            );
+            require(bytes(refusal).length == 0, refusal);
+            console.log("On-chain: not registered, no remote chains, no balance held - safe to forget.");
+        } else {
+            console.log("On-chain: not checked (non-EVM chain) - confirm the artifact is retired yourself.");
+        }
+
+        if (preview) {
+            console.log("PREVIEW: the store is unchanged. Re-run without PREVIEW=1 to remove the entry.");
+            return;
+        }
+        RegistryWriter._forgetDeployment(name, deploymentName);
+    }
+
+    /// @notice Why `target` is still in use, or "" when it is safe to forget. Pools: still the registered
+    /// pool, or still supporting a remote chain. Lock boxes: still holding the token.
+    function liveUseReason(string memory deploymentName, address target, address token, address tokenAdminRegistry)
+        public
+        view
+        returns (string memory)
+    {
+        if (_contains(deploymentName, "TokenPool_")) {
+            if (token != address(0) && tokenAdminRegistry.code.length > 0) {
+                try TokenAdminRegistry(tokenAdminRegistry).getPool(token) returns (address registered) {
+                    if (registered == target) {
+                        return string.concat(
+                            deploymentName,
+                            " is the pool the TokenAdminRegistry routes to - SetPool to its successor first"
+                        );
+                    }
+                } catch {}
+            }
+            uint256 chains = _supportedChainCount(target);
+            if (chains > 0) {
+                return string.concat(
+                    deploymentName,
+                    " still supports ",
+                    vm.toString(chains),
+                    " remote chain(s) - retire its lanes (RemoveChain) after the drain first"
+                );
+            }
+        } else if (_contains(deploymentName, "_LockBox") && token != address(0) && token.code.length > 0) {
+            uint256 held = IERC20(token).balanceOf(target);
+            if (held > 0) {
+                return string.concat(
+                    deploymentName, " still holds ", vm.toString(held), " of the token - move the liquidity first"
+                );
+            }
+        }
+        return "";
+    }
+
+    /// @dev 0 for a pool that does not answer: nothing to protect on an address that is not a live pool.
+    function _supportedChainCount(address pool) internal view returns (uint256) {
+        if (pool.code.length == 0) return 0;
+        (bool ok, bytes memory ret) = pool.staticcall(abi.encodeWithSignature("getSupportedChains()"));
+        if (!ok || !TolerantCall._decodesAsDynamic(ret, 32)) return 0;
+        return abi.decode(ret, (uint64[])).length;
+    }
+
+    function _createFork(string memory json) internal {
+        string memory url = vm.envOr(vm.parseJsonString(json, ".rpcEnv"), string(""));
+        require(bytes(url).length > 0, "chain RPC unset - the in-use checks read the chain");
+        // forge-lint: disable-next-line(unused-return) - nothing switches back to another fork
+        vm.createSelectFork(url);
+        require(block.chainid == vm.parseJsonUint(json, ".chainId"), "RPC chain id does not match the config");
+    }
+
+    function _contains(string memory haystack, string memory needle) internal pure returns (bool) {
+        bytes memory h = bytes(haystack);
+        bytes memory n = bytes(needle);
+        if (n.length > h.length) return false;
+        for (uint256 i = 0; i <= h.length - n.length; i++) {
+            bool hit = true;
+            for (uint256 j = 0; j < n.length; j++) {
+                if (h[i + j] != n[j]) {
+                    hit = false;
+                    break;
+                }
+            }
+            if (hit) return true;
+        }
+        return false;
+    }
+}
diff --git a/script/config/VerifyChain.s.sol b/script/config/VerifyChain.s.sol
index e651f23..eebbb11 100644
--- a/script/config/VerifyChain.s.sol
+++ b/script/config/VerifyChain.s.sol
@@ -16,6 +16,8 @@ import {RateLimiter} from "@chainlink/contracts-ccip/contracts/libraries/RateLim
 import {IPoolV2} from "@chainlink/contracts-ccip/contracts/interfaces/IPoolV2.sol";
 import {AdvancedPoolHooks} from "@chainlink/contracts-ccip/contracts/pools/AdvancedPoolHooks.sol";
 import {TokenAdminRegistry} from "@chainlink/contracts-ccip/contracts/tokenAdminRegistry/TokenAdminRegistry.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {ERC20LockBox} from "@chainlink/contracts-ccip/contracts/pools/ERC20LockBox.sol";
 import {RolesAuditor} from "../../src/roles/RolesAuditor.sol";
 import {FinalityConfigUtils} from "../utils/FinalityConfigUtils.s.sol";
 
@@ -27,6 +29,10 @@ interface ITokenPoolChainReader {
     function getSupportedChains() external view returns (uint64[] memory);
 }
 
+interface ITokenPoolTokenReader {
+    function getToken() external view returns (address);
+}
+
 /// @dev The 2.0.0 per-lane fee-config getter (`TokenPool.getTokenTransferFeeConfig`); the
 /// implementation keys only on `destChainSelector` (the other parameters are accepted and ignored).
 interface IPoolFeeConfigReader {
@@ -131,6 +137,28 @@ contract ChainProbe {
         return ITokenPoolChainReader(pool).getSupportedChains();
     }
 
+    /// @dev A Siloed 2.0 pool's chain -> lock box map. External: the struct array decodes here, so an
+    /// undecodable answer is catchable by the caller rather than reverting its frame.
+    function siloedLockBoxes(address pool) external view returns (SiloedLockReleaseTokenPool.LockBoxConfig[] memory) {
+        return SiloedLockReleaseTokenPool(pool).getAllLockBoxConfigs();
+    }
+
+    function lockBoxAuthorizes(address box, address caller) external view returns (bool) {
+        address[] memory callers = ERC20LockBox(box).getAllAuthorizedCallers();
+        for (uint256 i = 0; i < callers.length; i++) {
+            if (callers[i] == caller) return true;
+        }
+        return false;
+    }
+
+    function lockBoxSupports(address box, address token) external view returns (bool) {
+        return ERC20LockBox(box).isTokenSupported(token);
+    }
+
+    function poolToken(address pool) external view returns (address) {
+        return ITokenPoolTokenReader(pool).getToken();
+    }
+
     /// @dev The live rate-limit bucket for one lane and one direction, dispatched on the resolved
     /// pool contract version: the v2 getter `getCurrentRateLimiterState(selector, fastFinality)`
     /// from 2.0.0, the per-direction v1 getters before (`fastFinality` is only ever true on a v2
@@ -1748,6 +1776,12 @@ contract VerifyChain is Script {
         if (vm.keyExistsJson(projectJson, ".poolPolicy.finality")) {
             _reconcileFinalityConfig(projectJson, pool, version);
         }
+        if (
+            versionKnown && version >= PoolVersions.Version.V2_0_0
+                && PoolVersion._isSiloed(PoolVersion._typePrefixOf(typeAndVersion))
+        ) {
+            _reconcileSiloedLockBoxes(pool);
+        }
         uint64[] memory declaredSelectors = new uint64[](declared.length);
         for (uint256 i = 0; i < declared.length; i++) {
             declaredSelectors[i] = _checkDeclaredLaneOnChain(projectJson, pool, version, declared[i]);
@@ -2121,6 +2155,116 @@ contract VerifyChain is Script {
     /// 2.0.0 pool with an AdvancedPoolHooks wired: a cataloged pre-2.0.0 pool or an unwired 2.0.0
     /// pool can never satisfy the declaration, so both are FAILs naming the fix; an uncataloged
     /// version and any unanswered read stay WARN. Drift is a FAIL naming the field.
+    /// @dev A Siloed 2.0 pool holds no liquidity; each remote chain releases from its mapped lock box. A
+    /// supported chain with no box reverts every transfer, and a box that does not authorize the pool
+    /// reverts the first one. Neither is visible until traffic fails, so both FAIL here.
+    function _reconcileSiloedLockBoxes(address pool) private {
+        SiloedLockReleaseTokenPool.LockBoxConfig[] memory boxes;
+        try s_probe.siloedLockBoxes(pool) returns (SiloedLockReleaseTokenPool.LockBoxConfig[] memory b) {
+            boxes = b;
+        } catch {
+            _skipUnverified(
+                string.concat("lockboxes: siloed pool ", vm.toString(pool), " did not answer getAllLockBoxConfigs()")
+            );
+            return;
+        }
+        uint64[] memory chains;
+        try s_probe.poolSupportedChains(pool) returns (uint64[] memory c) {
+            chains = c;
+        } catch {
+            _skipUnverified(
+                string.concat("lockboxes: pool ", vm.toString(pool), " did not answer getSupportedChains()")
+            );
+            return;
+        }
+        address token = address(0); // stays zero when the pool does not answer getToken()
+        try s_probe.poolToken(pool) returns (address t) {
+            token = t;
+        } catch {}
+
+        uint256 failsBefore = s_fails;
+        uint256 warnsBefore = s_warns;
+        for (uint256 i = 0; i < chains.length; i++) {
+            if (!_hasLockBox(boxes, chains[i])) {
+                _fail(
+                    string.concat(
+                        "lockboxes: remote chain ",
+                        _selectorLabel(chains[i]),
+                        " is supported but has no lock box - every transfer on it reverts (configure/siloed/ConfigureLockBoxes.s.sol)"
+                    )
+                );
+            }
+        }
+        for (uint256 i = 0; i < boxes.length; i++) {
+            address box = boxes[i].lockBox;
+            string memory label =
+                string.concat(vm.toString(box), " (", _selectorLabel(boxes[i].remoteChainSelector), ")");
+            try s_probe.lockBoxAuthorizes(box, pool) returns (bool ok) {
+                if (!ok) {
+                    _fail(
+                        string.concat(
+                            "lockboxes: ",
+                            label,
+                            " does not authorize the pool - releases revert (UpdateAuthorizedCallers)"
+                        )
+                    );
+                }
+            } catch {
+                _fail(string.concat("lockboxes: ", label, " does not answer getAllAuthorizedCallers()"));
+            }
+            if (token != address(0)) {
+                try s_probe.lockBoxSupports(box, token) returns (bool ok) {
+                    if (!ok) _fail(string.concat("lockboxes: ", label, " does not hold the pool token"));
+                } catch {
+                    _fail(string.concat("lockboxes: ", label, " does not answer isTokenSupported()"));
+                }
+            }
+            if (!_containsSelector(chains, boxes[i].remoteChainSelector)) {
+                _warn(
+                    string.concat(
+                        "lockboxes: ",
+                        label,
+                        " is mapped to a chain the pool no longer supports (entries cannot be removed)"
+                    )
+                );
+            }
+        }
+        if (s_fails == failsBefore && s_warns == warnsBefore) {
+            _pass(
+                string.concat(
+                    "lockboxes: every one of ",
+                    vm.toString(chains.length),
+                    " supported chain(s) has a lock box that authorizes the pool (",
+                    vm.toString(boxes.length),
+                    " mapping(s))"
+                )
+            );
+        }
+    }
+
+    function _hasLockBox(SiloedLockReleaseTokenPool.LockBoxConfig[] memory boxes, uint64 selector)
+        private
+        pure
+        returns (bool)
+    {
+        for (uint256 i = 0; i < boxes.length; i++) {
+            if (boxes[i].remoteChainSelector == selector) return true;
+        }
+        return false;
+    }
+
+    function _containsSelector(uint64[] memory chains, uint64 selector) private pure returns (bool) {
+        for (uint256 i = 0; i < chains.length; i++) {
+            if (chains[i] == selector) return true;
+        }
+        return false;
+    }
+
+    function _selectorLabel(uint64 selector) private view returns (string memory) {
+        string memory n = _chainNameBySelector(selector);
+        return bytes(n).length > 0 ? n : vm.toString(selector);
+    }
+
     function _reconcileCcvThreshold(string memory json, address pool, PoolVersions.Version version) private {
         if (version < PoolVersions.Version.V2_0_0) {
             (,, string memory typeAndVersion) = PoolVersion._tryResolve(pool);
diff --git a/script/config/discover-tokens.sh b/script/config/discover-tokens.sh
index c143b70..0142104 100755
--- a/script/config/discover-tokens.sh
+++ b/script/config/discover-tokens.sh
@@ -12,6 +12,11 @@
 # CHAIN_SELECTOR (home chain), ENVIRONMENT (testnet|mainnet; unset lists both planes). There is no
 # flag interface: the script takes no arguments at all.
 #
+# POOL=1 adds POOL, POOL TYPE and POOL VERSION from the per-token detail endpoint, one extra request per
+# row, so narrow the listing first. These are the API's values: `type` is its enum (SILOED_LOCK_RELEASE),
+# not the contract name, and `version` is null for a dev build. The exact typeAndVersion() is on-chain only.
+# A detail request that fails shows `?` rather than aborting the listing.
+#
 # TWO PARAMETERS THIS SENDS EXPLICITLY, because their defaults are wrong for an operator:
 #   reviewedOnly=false  - defaults to TRUE, i.e. only Chainlink-Labs-reviewed projects. Measured:
 #                         ?environment=testnet returns 22 tokens, &reviewedOnly=false returns ~25,900,
@@ -61,6 +66,7 @@ ADMIN="${ADMIN:-}"
 SYMBOL="${SYMBOL:-}"
 CHAIN_SELECTOR="${CHAIN_SELECTOR:-}"
 ENVIRONMENT="${ENVIRONMENT:-}"
+POOL="${POOL:-}"
 
 uri() { jq -rn --arg v "$1" '$v | @uri'; }
 
@@ -151,6 +157,24 @@ done
 # Truncation must never be silent - that is the same failure as the reviewedOnly default.
 [ -z "$cursor" ] || err "WARNING: stopped at the ${pages}-page ceiling; the list below is INCOMPLETE - narrow it with ADMIN=/SYMBOL=/CHAIN_SELECTOR="
 
+if [ -n "$POOL" ]; then
+    detail_file="$(mktemp)"
+    enriched="$(mktemp)"
+    while IFS=$'\t' read -r sel addr sym grp lanes; do
+        pool='?' ptype='?' pver='?'
+        code="$(curl -sS --retry 2 --max-time 30 -o "$detail_file" -w '%{http_code}' \
+            "${BASE_URL}/tokens/${sel}/${addr}" 2> /dev/null)" || code=""
+        if [ "$code" = "200" ] && jq -e '.pool' "$detail_file" > /dev/null 2>&1; then
+            pool="$(jq -r '.pool.address // "?"' "$detail_file")"
+            ptype="$(jq -r '.pool.type // "?"' "$detail_file")"
+            pver="$(jq -r '.pool.version // "?"' "$detail_file")"
+        fi
+        printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$sel" "$addr" "$sym" "$grp" "$lanes" "$pool" "$ptype" "$pver"
+    done < "$rows_file" > "$enriched"
+    mv "$enriched" "$rows_file"
+    rm -f "$detail_file"
+fi
+
 rows="$(wc -l < "$rows_file" | tr -d ' ')"
 scope="$([ -n "$ENVIRONMENT" ] && echo "$ENVIRONMENT" || echo "both planes")"
 filters="$(printf '%s' "${ADMIN:+ADMIN=$ADMIN }${SYMBOL:+SYMBOL=$SYMBOL }${CHAIN_SELECTOR:+CHAIN_SELECTOR=$CHAIN_SELECTOR }")"
@@ -169,12 +193,19 @@ if [ "$rows" -eq 0 ]; then
 fi
 
 {
-    printf 'CHAIN SELECTOR\tCHAIN\tTOKEN\tSYMBOL\tGROUP\tLANES\tLOCAL CONFIG\n'
+    if [ -n "$POOL" ]; then
+        printf 'CHAIN SELECTOR\tCHAIN\tTOKEN\tSYMBOL\tGROUP\tLANES\tPOOL\tPOOL TYPE\tPOOL VERSION\tLOCAL CONFIG\n'
+    else
+        printf 'CHAIN SELECTOR\tCHAIN\tTOKEN\tSYMBOL\tGROUP\tLANES\tLOCAL CONFIG\n'
+    fi
     awk -F'\t' -v OFS='\t' -v names="$map_file" -v cfgs="$cfg_file" '
         FILENAME == names { nm[$1] = $2; next }
         FILENAME == cfgs  { cfg[$1] = $2; next }
-        { print $1, ($1 in nm ? nm[$1] : "?"), $2, $3, $4, $5,
-                ($1 in cfg ? "configured(" cfg[$1] ")" : "no local config") }
+        {
+            local_cfg = ($1 in cfg ? "configured(" cfg[$1] ")" : "no local config")
+            if (NF >= 8) print $1, ($1 in nm ? nm[$1] : "?"), $2, $3, $4, $5, $6, $7, $8, local_cfg
+            else print $1, ($1 in nm ? nm[$1] : "?"), $2, $3, $4, $5, local_cfg
+        }
     ' "$map_file" "$cfg_file" "$rows_file" | sort
 } | column -t -s "$(printf '\t')"
 
diff --git a/script/config/dotenv-get.sh b/script/config/dotenv-get.sh
index 982cc93..4b4895c 100755
--- a/script/config/dotenv-get.sh
+++ b/script/config/dotenv-get.sh
@@ -20,20 +20,28 @@
 # strings for exactly that reason, so honouring the distinction keeps the two consistent.
 set -uo pipefail
 
+# `--is-set <KEY>` prints nothing and exits 0 when the key is set (even to ""), 1 otherwise. The value form
+# cannot tell those apart, and a passwordless keystore is exactly an empty password that IS set.
+is_set=
+if [ "${1:-}" = "--is-set" ]; then
+    is_set=1
+    shift
+fi
+
 key="${1:-}"
 [ -n "$key" ] || {
-    echo "usage: dotenv-get.sh <KEY>" >&2
+    echo "usage: dotenv-get.sh [--is-set] <KEY>" >&2
     exit 2
 }
 
 # `${!key+x}` is set-ness, not non-emptiness: an exported empty value still wins over the file.
 if [ -n "${!key+x}" ]; then
-    printf '%s' "${!key}"
+    [ -n "$is_set" ] || printf '%s' "${!key}"
     exit 0
 fi
 
 env_file="${DOTENV_FILE:-$(dirname "$0")/../../.env}"
-[ -r "$env_file" ] || exit 0
+[ -r "$env_file" ] || exit ${is_set:+1}
 
 # `|| [ -n "$line" ]` so a final line with no trailing newline is still read.
 while IFS= read -r line || [ -n "$line" ]; do
@@ -58,6 +66,11 @@ while IFS= read -r line || [ -n "$line" ]; do
             ;;
     esac
     found="$value" # keep scanning: last assignment wins, as dotenv does
+    found_any=1
 done < "$env_file"
 
+if [ -n "$is_set" ]; then
+    [ -n "${found_any:-}" ]
+    exit
+fi
 printf '%s' "${found:-}"
diff --git a/script/config/preflight-transfer.sh b/script/config/preflight-transfer.sh
index 00d03c3..c622243 100755
--- a/script/config/preflight-transfer.sh
+++ b/script/config/preflight-transfer.sh
@@ -120,6 +120,14 @@ amount_human="$(cast to-unit "$AMOUNT_WEI" "$decimals" 2> /dev/null || true)"
     exit 2
 }
 
+ccip_cli_opens_passwordless() {
+    local v
+    # Without a TTY the CLI prints its version on stderr.
+    v="$(ccip-cli --version 2>&1 | tail -1)"
+    v="${v%%-*}"
+    [ -n "$v" ] && [ "$(printf '%s\n1.13.0\n' "$v" | sort -V | tail -1)" != "1.13.0" ]
+}
+
 sender_args=()
 if [ -n "${WALLET:-}" ]; then
     sender_args=(--wallet "$WALLET")
@@ -134,14 +142,32 @@ if [ -n "${WALLET:-}" ]; then
                 echo "no Foundry keystore '$ks_name' at $ks_path - list them: cast wallet list" >&2
                 exit 2
             }
-            ks_pw="$(bash script/config/dotenv-get.sh FOUNDRY_KEYSTORE_PASSWORD)"
-            [ -n "$ks_pw" ] || ks_pw="$(bash script/config/dotenv-get.sh USER_KEY_PASSWORD)"
-            [ -n "$ks_pw" ] || {
+            # Set-ness, not value: a passwordless keystore is FOUNDRY_KEYSTORE_PASSWORD= (empty).
+            if bash script/config/dotenv-get.sh --is-set FOUNDRY_KEYSTORE_PASSWORD; then
+                ks_pw="$(bash script/config/dotenv-get.sh FOUNDRY_KEYSTORE_PASSWORD)"
+            elif bash script/config/dotenv-get.sh --is-set USER_KEY_PASSWORD; then
+                ks_pw="$(bash script/config/dotenv-get.sh USER_KEY_PASSWORD)"
+            else
                 echo "keystore '$ks_name' needs its password to scope the estimate - set" >&2
-                echo "       FOUNDRY_KEYSTORE_PASSWORD (or USER_KEY_PASSWORD) in ./.env, or export it." >&2
+                echo "       FOUNDRY_KEYSTORE_PASSWORD (or USER_KEY_PASSWORD) in ./.env, or export it;" >&2
+                echo "       set it to the empty string for a passwordless keystore." >&2
                 echo "       Without WALLET the estimate still runs, just not scoped to a sender." >&2
                 exit 2
+            fi
+            # The CLI swallows an unlock failure into an unscoped estimate, so prove the unlock here.
+            cast wallet address --keystore "$ks_path" --password "$ks_pw" > /dev/null 2>&1 || {
+                echo "keystore '$ks_name' does not open with the configured password" \
+                    "(FOUNDRY_KEYSTORE_PASSWORD / USER_KEY_PASSWORD)." >&2
+                exit 2
             }
+            # ccip-cli <= 1.13.0 rejects an empty password whenever it is non-interactive, which it forces
+            # without a TTY, and then swallows the error into an unscoped estimate.
+            if [ -z "$ks_pw" ] && ! ccip_cli_opens_passwordless; then
+                echo "ccip-cli $(ccip-cli --version 2>&1 | tail -1) cannot open the passwordless keystore" \
+                    "'$ks_name' non-interactively (fixed after 1.13.0)." >&2
+                echo "       Upgrade ccip-cli, or leave WALLET unset to use PRIVATE_KEY from the environment." >&2
+                exit 2
+            fi
             # ccip-cli reads this from the environment only, so it has to be exported, not just set.
             export FOUNDRY_KEYSTORE_PASSWORD="$ks_pw"
             ;;
diff --git a/script/config/test-tooling.sh b/script/config/test-tooling.sh
index 7616f7c..9a56160 100755
--- a/script/config/test-tooling.sh
+++ b/script/config/test-tooling.sh
@@ -781,6 +781,7 @@ if offline_enabled; then
         printf 'ZZ_SUBST=$(touch zz-scratch-dotenv-pwned)\n'
         printf 'ZZ_CRLF=crlf\r\n'
         printf 'ZZ_CRLFQ="cq"\r\n'
+        printf 'ZZ_EMPTY=\n'
         printf 'ZZ_NOEOL=noeol'
     } > "$dotenv_fx"
 
@@ -820,6 +821,26 @@ if offline_enabled; then
     # as set (matching Foundry and the Makefile), so an intentional blank is not overwritten from .env.
     dg_case "dotenv-get: exported value beats .env"       "from-env"         ZZ_PLAIN ZZ_PLAIN=from-env
     dg_case "dotenv-get: exported empty value beats .env" ""                 ZZ_PLAIN ZZ_PLAIN=
+    # --is-set separates "set to empty" (a passwordless keystore) from "absent", which the value form cannot.
+    dg_isset_case() { # name expected-exit key [env-assignment...]
+        local name="$1" expected="$2" key="$3" rc
+        shift 3
+        env DOTENV_FILE="$dotenv_fx" "$@" bash script/config/dotenv-get.sh --is-set "$key" > /dev/null
+        rc=$?
+        if [ "$rc" = "$expected" ]; then
+            pass=$((pass + 1))
+            echo "[PASS] $name"
+        else
+            fail=$((fail + 1))
+            failures+=("$name")
+            echo "[FAIL] $name (exit $rc, want $expected)"
+        fi
+    }
+    dg_isset_case "dotenv-get --is-set: empty value in .env is set"  0 ZZ_EMPTY
+    dg_isset_case "dotenv-get --is-set: absent key is not set"       1 ZZ_ABSENT
+    dg_isset_case "dotenv-get --is-set: exported empty value is set" 0 ZZ_ABSENT ZZ_ABSENT=
+    dg_isset_case "dotenv-get --is-set: missing .env is not set"     1 ZZ_PLAIN DOTENV_FILE=/nonexistent
+
     # The file is data, never code: reading a value must not run what it contains.
     DOTENV_FILE="$dotenv_fx" bash script/config/dotenv-get.sh ZZ_SUBST > /dev/null 2>&1
     if [ -e zz-scratch-dotenv-pwned ]; then
@@ -838,6 +859,7 @@ if offline_enabled; then
 case "$*" in
     *"decimals()"*) echo 18 ;;
     "to-unit "*) echo 1 ;;
+    "wallet address "*) case "$*" in *"--password bad"*) exit 1 ;; *) echo 0x00000000000000000000000000000000000000A1 ;; esac ;;
     *) exit 1 ;;
 esac
 STUB
@@ -845,6 +867,7 @@ STUB
 #!/usr/bin/env bash
 # Mirrors the real stream split: the estimate object on stdout, diagnostics on stderr.
 printf '%s\n' "\$STUB_STDOUT"
+[ "\$1" = "--version" ] && { echo "\${STUB_CLI_VERSION:-1.13.0-stub}" >&2; exit 0; }
 printf '%s\n' "\$STUB_ERR" >&2
 exit \${STUB_RC:-1}
 STUB
@@ -958,6 +981,17 @@ STUB
     pf_sender_case "preflight: keystore + password proceeds to the estimate" 0 "GO:" \
         WALLET=foundry:zz-scratch-acct FOUNDRY_DIR="$(dirname "$ks_dir")" \
         FOUNDRY_KEYSTORE_PASSWORD=zz-scratch-pw
+    pf_sender_case "preflight: a password that does not open the keystore is refused" 2 \
+        "does not open with the configured password" WALLET=foundry:zz-scratch-acct \
+        FOUNDRY_DIR="$(dirname "$ks_dir")" FOUNDRY_KEYSTORE_PASSWORD=bad
+    # ccip-cli <= 1.13.0 rejects an empty password without a TTY and swallows the error into an
+    # unscoped estimate, so a passwordless keystore is refused there and accepted once fixed.
+    pf_sender_case "preflight: a passwordless keystore is refused on ccip-cli 1.13.0" 2 \
+        "cannot open the passwordless keystore" WALLET=foundry:zz-scratch-acct \
+        FOUNDRY_DIR="$(dirname "$ks_dir")" FOUNDRY_KEYSTORE_PASSWORD= STUB_CLI_VERSION=1.13.0-abc
+    pf_sender_case "preflight: a passwordless keystore proceeds on a fixed ccip-cli" 0 "GO:" \
+        WALLET=foundry:zz-scratch-acct FOUNDRY_DIR="$(dirname "$ks_dir")" FOUNDRY_KEYSTORE_PASSWORD= \
+        STUB_CLI_VERSION=1.13.1
     # With no wallet and no key anywhere, a GO must not imply a sender-scoped answer it did not give.
     pf_sender_case "preflight: an unscoped estimate says so" 0 "not scoped to a sender"
     rm -rf "$(dirname "$ks_dir")"
@@ -1131,6 +1165,12 @@ case "\$url" in
     *"/chains"*)
         body='{"chains":[{"name":"zz-dt-home","chainSelector":$dt_selector,"chainFamily":"EVM","environment":"testnet","chainId":1},{"name":"zz-dt-remote","chainSelector":$dt_selector_b,"chainFamily":"EVM","environment":"testnet","chainId":2}]}'
         ;;
+    *"/tokens/$dt_selector/"*)
+        body='{"chainSelector":"$dt_selector","pool":{"address":"0xDTPOOL000000000000000000000000000000000A","type":"SILOED_LOCK_RELEASE","version":"2.0.0"}}'
+        ;;
+    *"/tokens/$dt_selector_b/"*)
+        # A detail that fails must show as unknown, never abort the listing.
+        printf '' > "\$out"; printf '500'; exit 0 ;;
     *"/tokens"*)
         # reviewedOnly defaults to true -> the reviewed subset, which is EMPTY for this operator.
         case "\$url" in
@@ -1212,6 +1252,24 @@ STUB
         echo "[FAIL] discover-tokens exits 0 on a successful listing (exit=$dt_rc)"
     fi
 
+    dt_assert "discover-tokens leaves the pool columns out unless POOL is set" "LANES  *LOCAL CONFIG"
+    # POOL=1 adds the detail endpoint's pool, type and version; a failed detail reads as unknown.
+    dt_out="$(env -u ADMIN -u SYMBOL -u CHAIN_SELECTOR -u ENVIRONMENT PATH="$dt_bin:$PATH" POOL=1 \
+        bash script/config/discover-tokens.sh 2>&1)"
+    dt_rc=$?
+    dt_assert "discover-tokens POOL=1 adds the pool columns" "POOL TYPE  *POOL VERSION"
+    dt_assert "discover-tokens POOL=1 shows the API pool type and version" \
+        "0xDTPOOL000000000000000000000000000000000A  *SILOED_LOCK_RELEASE  *2.0.0"
+    dt_assert "discover-tokens POOL=1 marks a failed detail as unknown and keeps listing" "DTPAGE2TOKEN.*?  *?  *?"
+    if [ $dt_rc -eq 0 ]; then
+        pass=$((pass + 1))
+        echo "[PASS] discover-tokens POOL=1 exits 0"
+    else
+        fail=$((fail + 1))
+        failures+=("discover-tokens POOL=1 exits 0")
+        echo "[FAIL] discover-tokens POOL=1 exits 0 (exit=$dt_rc)"
+    fi
+
     # An empty result is a NORMAL answer (the API lists a token only once its mesh is fully wired),
     # so it must exit 0 and never imply the operator's setup is broken.
     dt_out="$(env -u ADMIN -u CHAIN_SELECTOR -u ENVIRONMENT PATH="$dt_bin:$PATH" \
@@ -2935,6 +2993,8 @@ fi
 # Offline cases only: the live GO/NO-GO needs two RPCs and a funded lane. What is checkable without a
 # network is the contract this script owns - argument validation, unknown chains, and the exit code 2
 # that means "I could not ask", which callers must not read as a verdict.
+run_case "forget-deployment without NAME names the key it needs" nonzero "NAME is required" -- \
+    make forget-deployment CHAIN=ethereum-testnet-sepolia
 run_case "preflight without args prints usage" nonzero "usage: preflight-transfer.sh" -- \
     ./script/config/preflight-transfer.sh
 
@@ -3159,6 +3219,10 @@ if offline_enabled; then
         "deploy-lockrelease-pool: $FAM_SVM is chainFamily 'svm' - this target is EVM-only" -- \
         env ZZ_SCRATCH_FAM_SVM_RPC_URL="http://127.0.0.1:1" KEYSTORE_NAME="zz-scratch-fam-none" \
         make deploy-lockrelease-pool CHAIN="$FAM_SVM"
+    run_case "deploy-siloed-pool refuses a non-EVM chain by family" nonzero \
+        "deploy-siloed-pool: $FAM_SVM is chainFamily 'svm' - this target is EVM-only" -- \
+        env ZZ_SCRATCH_FAM_SVM_RPC_URL="http://127.0.0.1:1" KEYSTORE_NAME="zz-scratch-fam-none" \
+        make deploy-siloed-pool CHAIN="$FAM_SVM"
     run_case "adopt-token TOKEN= on a non-EVM chain names the adopt path" nonzero \
         "TOKEN= is an EVM address - pass this family's own form" -- \
         env ZZ_SCRATCH_FAM_SVM_RPC_URL="http://127.0.0.1:1" KEYSTORE_NAME="zz-scratch-fam-none" \
diff --git a/script/configure/liquidity/WithdrawLiquidity.s.sol b/script/configure/liquidity/WithdrawLiquidity.s.sol
index bb710c0..03349e9 100644
--- a/script/configure/liquidity/WithdrawLiquidity.s.sol
+++ b/script/configure/liquidity/WithdrawLiquidity.s.sol
@@ -5,7 +5,7 @@ import {console} from "forge-std/Script.sol";
 import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
 import {HelperConfig} from "../../HelperConfig.s.sol";
 import {LiquidityBase} from "./LiquidityBase.s.sol";
-import {CctActions, ILockReleaseV1Liquidity} from "../../../src/actions/CctActions.sol";
+import {CctActions, ILockReleaseV1Liquidity, ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
 import {PoolVersion} from "../../utils/PoolVersion.s.sol";
 import {PoolVersions} from "../../../src/PoolVersions.sol";
 
@@ -44,7 +44,10 @@ contract WithdrawLiquidity is LiquidityBase {
         _requireRebalancer(tokenPoolAddress, broadcasterAddr, "withdrawLiquidity");
 
         // Surface the InsufficientLiquidity precondition up front (the pool reverts it when balance < amount).
-        uint256 poolBalance = IERC20(tokenAddress).balanceOf(tokenPoolAddress);
+        // A Siloed pool only releases its shared bucket here; siloed balances sit on the same address.
+        uint256 poolBalance = PoolVersion._isSiloed(PoolVersion._typePrefixOf(typeAndVersion))
+            ? ISiloedLockReleaseV16(tokenPoolAddress).getUnsiloedLiquidity()
+            : IERC20(tokenAddress).balanceOf(tokenPoolAddress);
         _requireSufficientLiquidity(tokenPoolAddress, poolBalance, amount);
 
         console.log("");
diff --git a/script/configure/remote-chains/RemoveChain.s.sol b/script/configure/remote-chains/RemoveChain.s.sol
index bdf8768..5ad8eef 100644
--- a/script/configure/remote-chains/RemoveChain.s.sol
+++ b/script/configure/remote-chains/RemoveChain.s.sol
@@ -198,8 +198,8 @@ contract RemoveChain is EoaExecutor {
             return CctActions._applyChainUpdatesV150(poolAddress, removals);
         }
         if (
-            version == PoolVersions.Version.V1_5_1 || version == PoolVersions.Version.V1_6_1
-                || version == PoolVersions.Version.V2_0_0
+            version == PoolVersions.Version.V1_5_1 || version == PoolVersions.Version.V1_6_0
+                || version == PoolVersions.Version.V1_6_1 || version == PoolVersions.Version.V2_0_0
         ) {
             uint64[] memory removes = new uint64[](1);
             removes[0] = remoteChainSelector;
diff --git a/script/configure/siloed/ConfigureLockBoxes.s.sol b/script/configure/siloed/ConfigureLockBoxes.s.sol
new file mode 100644
index 0000000..29741e4
--- /dev/null
+++ b/script/configure/siloed/ConfigureLockBoxes.s.sol
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {CctActions} from "../../../src/actions/CctActions.sol";
+import {SafeMode} from "../../../src/base/SafeMode.sol";
+import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {ERC20LockBox} from "@chainlink/contracts-ccip/contracts/pools/ERC20LockBox.sol";
+
+/// @notice Maps remote chains to lock boxes on a SiloedLockReleaseTokenPool 2.0.0 (`configureLockBoxes`,
+///         onlyOwner). Chains mapped to the same box share liquidity; a box per chain isolates it. An entry
+///         can be overwritten but never removed. A supported chain with no box reverts every transfer.
+///
+/// The pool must be an authorized caller on each box (configure/authorized-callers). The pool does not
+/// check it; this script refuses in EOA mode and warns in Safe mode, where the authorization may be in
+/// the same batch.
+///
+/// Environment Variables (required):
+///   LOCK_BOXES  - Comma-separated `<chain>=<lockBox>` pairs, chain as a name (AVALANCHE_FUJI) or selector
+///
+/// Usage:
+///   LOCK_BOXES=AVALANCHE_FUJI=0xBoxA,ETHEREUM_TESTNET_SEPOLIA_BASE_1=0xBoxB \
+///   forge script script/configure/siloed/ConfigureLockBoxes.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract ConfigureLockBoxes is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        address pool = _resolvePool(block.chainid);
+        (, string memory full) = PoolVersion._requireSiloed(pool, PoolVersions.Op.CONFIGURE_LOCK_BOXES);
+        address token = address(TokenPool(pool).getToken());
+        bool safeMode = SafeMode._isSafeMode(_executionMode());
+
+        SiloedLockReleaseTokenPool.LockBoxConfig[] memory configs = _parse(vm.envString("LOCK_BOXES"));
+        SiloedLockReleaseTokenPool.LockBoxConfig[] memory current =
+            SiloedLockReleaseTokenPool(pool).getAllLockBoxConfigs();
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"📦 Configure Lock Boxes");
+        console.log("========================================");
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        for (uint256 i = 0; i < configs.length; i++) {
+            uint64 sel = configs[i].remoteChainSelector;
+            address box = configs[i].lockBox;
+            require(
+                box != address(0) && box.code.length > 0, string.concat("No contract at lock box ", vm.toString(box))
+            );
+            require(
+                ERC20LockBox(box).isTokenSupported(token),
+                string.concat("Lock box ", vm.toString(box), " does not hold the pool token ", vm.toString(token))
+            );
+            for (uint256 j = 0; j < i; j++) {
+                require(configs[j].remoteChainSelector != sel, string.concat("Chain listed twice: ", vm.toString(sel)));
+            }
+            if (!_isAuthorized(box, pool)) {
+                string memory msg_ = string.concat(
+                    "Pool ", vm.toString(pool), " is not an authorized caller on lock box ", vm.toString(box)
+                );
+                if (!safeMode) revert(string.concat(msg_, ". Authorize it first (UpdateAuthorizedCallers)."));
+                console.log(string.concat(unicode"⚠️  ", msg_, "; include the authorization in the batch."));
+            }
+            if (!TokenPool(pool).isSupportedChain(sel)) {
+                console.log(
+                    string.concat(unicode"ℹ️  Chain ", vm.toString(sel), " is not supported by the pool yet.")
+                );
+            }
+            console.log(
+                string.concat(
+                    "  ", vm.toString(sel), "  ", vm.toString(_currentBox(current, sel)), " -> ", vm.toString(box)
+                )
+            );
+        }
+        console.log("========================================");
+
+        _executeCalls(CctActions._configureLockBoxes(pool, configs));
+        _logOperationOutcome("configure lock boxes");
+    }
+
+    function _parse(string memory spec) internal view returns (SiloedLockReleaseTokenPool.LockBoxConfig[] memory out) {
+        string[] memory pairs = vm.split(spec, ",");
+        out = new SiloedLockReleaseTokenPool.LockBoxConfig[](pairs.length);
+        for (uint256 i = 0; i < pairs.length; i++) {
+            string[] memory kv = vm.split(vm.trim(pairs[i]), "=");
+            require(kv.length == 2, string.concat("LOCK_BOXES entry must be <chain>=<lockBox>: ", pairs[i]));
+            out[i] = SiloedLockReleaseTokenPool.LockBoxConfig({
+                remoteChainSelector: _selectorOf(vm.trim(kv[0])), lockBox: vm.parseAddress(vm.trim(kv[1]))
+            });
+        }
+    }
+
+    function _currentBox(SiloedLockReleaseTokenPool.LockBoxConfig[] memory current, uint64 sel)
+        internal
+        pure
+        returns (address)
+    {
+        for (uint256 i = 0; i < current.length; i++) {
+            if (current[i].remoteChainSelector == sel) return current[i].lockBox;
+        }
+        return address(0);
+    }
+
+    function _isAuthorized(address box, address pool) internal view returns (bool) {
+        address[] memory callers = ERC20LockBox(box).getAllAuthorizedCallers();
+        for (uint256 i = 0; i < callers.length; i++) {
+            if (callers[i] == pool) return true;
+        }
+        return false;
+    }
+}
diff --git a/script/configure/siloed/GetSiloedPoolState.s.sol b/script/configure/siloed/GetSiloedPoolState.s.sol
new file mode 100644
index 0000000..611e8ae
--- /dev/null
+++ b/script/configure/siloed/GetSiloedPoolState.s.sol
@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
+import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {ERC20LockBox} from "@chainlink/contracts-ccip/contracts/pools/ERC20LockBox.sol";
+import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
+
+/// @notice Reads where a SiloedLockReleaseTokenPool keeps its liquidity, per remote chain. On 1.6.x: each
+///         chain's silo (or the shared bucket), rebalancer and available amount, and whether the silo
+///         accounting adds up to the pool's token balance. On 2.0.0: each chain's lock box, its balance,
+///         and whether the pool is an authorized caller on it.
+///
+/// Usage:
+///   forge script script/configure/siloed/GetSiloedPoolState.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL
+contract GetSiloedPoolState is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        uint256 chainId = block.chainid;
+        address pool = _resolvePool(chainId);
+
+        (bool ok, PoolVersions.Version version, string memory full) = PoolVersion._tryResolve(pool);
+        require(
+            ok && PoolVersion._isSiloed(PoolVersion._typePrefixOf(full)),
+            string.concat("Not a cataloged SiloedLockReleaseTokenPool: ", vm.toString(pool), " reports \"", full, "\".")
+        );
+
+        address token = address(TokenPool(pool).getToken());
+        uint64[] memory chains = TokenPool(pool).getSupportedChains();
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"🏦 Siloed LockRelease Pool State");
+        console.log("========================================");
+        console.log(string.concat("Chain:        ", helperConfig.getChainName(chainId)));
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        console.log(string.concat("Token:        ", vm.toString(token)));
+        console.log(string.concat("Remote chains: ", vm.toString(chains.length)));
+        console.log("========================================");
+
+        if (version < PoolVersions.Version.V2_0_0) {
+            _reportSilos(pool, token, chains);
+        } else {
+            _reportLockBoxes(pool, token, chains);
+        }
+        console.log("========================================");
+        console.log("");
+    }
+
+    function _reportSilos(address pool, address token, uint64[] memory chains) internal view {
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+        uint256 unsiloed = p.getUnsiloedLiquidity();
+        uint256 accounted = unsiloed;
+        for (uint256 i = 0; i < chains.length; i++) {
+            bool siloed = p.isSiloed(chains[i]);
+            uint256 available = p.getAvailableTokens(chains[i]);
+            if (siloed) accounted += available;
+            console.log(
+                string.concat(
+                    "  ",
+                    _chainLabel(chains[i]),
+                    siloed ? "  SILOED  available=" : "  shared  available=",
+                    vm.toString(available),
+                    "  rebalancer=",
+                    vm.toString(p.getChainRebalancer(chains[i]))
+                )
+            );
+        }
+        uint256 balance = IERC20(token).balanceOf(pool);
+        console.log(string.concat("Shared bucket:  ", vm.toString(unsiloed)));
+        console.log(string.concat("Pool balance:   ", vm.toString(balance)));
+        // Silos of chains removed from the pool keep their balance but no longer show above.
+        if (balance != accounted) {
+            console.log(
+                string.concat(
+                    unicode"⚠️  Pool balance differs from shared + listed silos by ",
+                    vm.toString(balance > accounted ? balance - accounted : accounted - balance),
+                    " (direct transfers, or silos of removed chains)."
+                )
+            );
+        }
+    }
+
+    function _reportLockBoxes(address pool, address token, uint64[] memory chains) internal view {
+        SiloedLockReleaseTokenPool p = SiloedLockReleaseTokenPool(pool);
+        SiloedLockReleaseTokenPool.LockBoxConfig[] memory configs = p.getAllLockBoxConfigs();
+        for (uint256 i = 0; i < configs.length; i++) {
+            address box = configs[i].lockBox;
+            console.log(
+                string.concat(
+                    "  ",
+                    _chainLabel(configs[i].remoteChainSelector),
+                    "  lockBox=",
+                    vm.toString(box),
+                    "  balance=",
+                    vm.toString(IERC20(token).balanceOf(box)),
+                    _isAuthorized(box, pool) ? "  pool authorized" : unicode"  ⚠️ POOL NOT AUTHORIZED",
+                    _isSupported(chains, configs[i].remoteChainSelector) ? "" : "  (chain no longer supported)"
+                )
+            );
+        }
+        for (uint256 i = 0; i < chains.length; i++) {
+            if (!_hasBox(configs, chains[i])) {
+                console.log(
+                    string.concat(
+                        unicode"  ⚠️ ",
+                        _chainLabel(chains[i]),
+                        " is supported but has no lock box: transfers revert"
+                    )
+                );
+            }
+        }
+        console.log(string.concat("Fees held on pool: ", vm.toString(IERC20(token).balanceOf(pool))));
+    }
+
+    function _isAuthorized(address box, address pool) internal view returns (bool) {
+        address[] memory callers = ERC20LockBox(box).getAllAuthorizedCallers();
+        for (uint256 i = 0; i < callers.length; i++) {
+            if (callers[i] == pool) return true;
+        }
+        return false;
+    }
+
+    function _hasBox(SiloedLockReleaseTokenPool.LockBoxConfig[] memory configs, uint64 selector)
+        internal
+        pure
+        returns (bool)
+    {
+        for (uint256 i = 0; i < configs.length; i++) {
+            if (configs[i].remoteChainSelector == selector) return true;
+        }
+        return false;
+    }
+
+    function _isSupported(uint64[] memory chains, uint64 selector) internal pure returns (bool) {
+        for (uint256 i = 0; i < chains.length; i++) {
+            if (chains[i] == selector) return true;
+        }
+        return false;
+    }
+
+    function _chainLabel(uint64 selector) internal view returns (string memory) {
+        try helperConfig.getDestChainConfigBySelector(selector) returns (HelperConfig.NetworkConfig memory c) {
+            if (bytes(c.chainNameIdentifier).length > 0) {
+                return string.concat(c.chainNameIdentifier, " (", vm.toString(selector), ")");
+            }
+        } catch {}
+        return vm.toString(selector);
+    }
+}
diff --git a/script/configure/siloed/ProvideSiloedLiquidity.s.sol b/script/configure/siloed/ProvideSiloedLiquidity.s.sol
new file mode 100644
index 0000000..5566c76
--- /dev/null
+++ b/script/configure/siloed/ProvideSiloedLiquidity.s.sol
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {CctActions, ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
+import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
+
+/// @notice Adds liquidity to one silo of a SiloedLockReleaseTokenPool 1.6.x: `approve` then
+///         `provideSiloedLiquidity`, as the silo's rebalancer.
+///
+/// Environment Variables (required):
+///   DEST_CHAIN  - The siloed remote chain (name or selector)
+///   AMOUNT      - Amount in the token's smallest unit
+///
+/// Usage:
+///   DEST_CHAIN=AVALANCHE_FUJI AMOUNT=100000000 \
+///   forge script script/configure/siloed/ProvideSiloedLiquidity.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract ProvideSiloedLiquidity is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        address pool = _resolvePool(block.chainid);
+        (, string memory full) = PoolVersion._requireSiloed(pool, PoolVersions.Op.SILOED_LIQUIDITY);
+        uint64 selector = _selectorOf(vm.envString("DEST_CHAIN"));
+        uint256 amount = vm.envUint("AMOUNT");
+        require(amount > 0, "AMOUNT must be non-zero.");
+
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+        require(p.isSiloed(selector), string.concat("Chain ", vm.toString(selector), " is not siloed."));
+        address token = address(TokenPool(pool).getToken());
+        address actor = _executingAccount();
+        address rebalancer = p.getChainRebalancer(selector);
+        require(
+            rebalancer == actor,
+            string.concat(
+                "NotRebalancer: the silo rebalancer is ",
+                vm.toString(rebalancer),
+                ", the executing account is ",
+                vm.toString(actor),
+                ". Set it with SetSiloRebalancer.s.sol."
+            )
+        );
+        uint256 held = IERC20(token).balanceOf(actor);
+        require(
+            held >= amount,
+            string.concat("Insufficient token balance: ", vm.toString(held), " < AMOUNT ", vm.toString(amount))
+        );
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"💧 Provide Siloed Liquidity");
+        console.log("========================================");
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        console.log(string.concat("Silo:         ", vm.toString(selector)));
+        console.log(string.concat("Available:    ", vm.toString(p.getAvailableTokens(selector))));
+        console.log(string.concat("Amount:       ", vm.toString(amount)));
+        console.log("========================================");
+
+        _executeCalls(CctActions._provideSiloedLiquidity(pool, token, selector, amount));
+        _logOperationOutcome(string.concat("provide ", vm.toString(amount), " to silo ", vm.toString(selector)));
+    }
+}
diff --git a/script/configure/siloed/SetSiloRebalancer.s.sol b/script/configure/siloed/SetSiloRebalancer.s.sol
new file mode 100644
index 0000000..8a6ba8f
--- /dev/null
+++ b/script/configure/siloed/SetSiloRebalancer.s.sol
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {CctActions, ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
+
+/// @notice Sets the rebalancer of one silo on a SiloedLockReleaseTokenPool 1.6.x (onlyOwner). Only that
+///         account can provide or withdraw the silo's liquidity. For the shared bucket use
+///         configure/liquidity/SetRebalancer.s.sol.
+///
+/// Environment Variables (required):
+///   DEST_CHAIN  - The siloed remote chain (name or selector)
+///   REBALANCER  - The new silo rebalancer
+///
+/// Usage:
+///   DEST_CHAIN=AVALANCHE_FUJI REBALANCER=0x... \
+///   forge script script/configure/siloed/SetSiloRebalancer.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract SetSiloRebalancer is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        address pool = _resolvePool(block.chainid);
+        (, string memory full) = PoolVersion._requireSiloed(pool, PoolVersions.Op.SILOED_LIQUIDITY);
+        uint64 selector = _selectorOf(vm.envString("DEST_CHAIN"));
+        address rebalancer = vm.envAddress("REBALANCER");
+
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+        require(
+            p.isSiloed(selector),
+            string.concat("Chain ", vm.toString(selector), " is not siloed; its rebalancer is the pool rebalancer.")
+        );
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"⚖️  Set Silo Rebalancer");
+        console.log("========================================");
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        console.log(string.concat("Silo:         ", vm.toString(selector)));
+        console.log(string.concat("Current:      ", vm.toString(p.getChainRebalancer(selector))));
+        console.log(string.concat("New:          ", vm.toString(rebalancer)));
+        console.log("========================================");
+
+        _executeCalls(CctActions._setSiloRebalancer(pool, selector, rebalancer));
+        _logOperationOutcome(string.concat("set the silo rebalancer to ", vm.toString(rebalancer)));
+    }
+}
diff --git a/script/configure/siloed/SiloedBase.s.sol b/script/configure/siloed/SiloedBase.s.sol
new file mode 100644
index 0000000..954c5ff
--- /dev/null
+++ b/script/configure/siloed/SiloedBase.s.sol
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {EoaExecutor} from "../../../src/base/EoaExecutor.s.sol";
+
+/// @title SiloedBase
+/// @notice Shared pool and remote-chain resolution for the SiloedLockRelease scripts.
+abstract contract SiloedBase is EoaExecutor {
+    HelperConfig public helperConfig;
+
+    function _resolvePool(uint256 chainId) internal view returns (address pool) {
+        pool = helperConfig.getDeployedTokenPool(chainId);
+        require(
+            pool != address(0),
+            string.concat(
+                "Token pool not deployed. Set the ",
+                helperConfig.getNetworkConfig(chainId).chainNameIdentifier,
+                "_TOKEN_POOL environment variable. Alternatively, use the inline alias TOKEN_POOL=0x..."
+            )
+        );
+    }
+
+    /// @dev A chain name as `DEST_CHAIN` takes it (`AVALANCHE_FUJI`) or a numeric selector.
+    function _selectorOf(string memory chain) internal view returns (uint64 selector) {
+        (bool numeric, uint256 n) = _tryParseUint(chain);
+        if (numeric) return uint64(n);
+        selector = helperConfig.getDestChainConfig(chain).chainSelector;
+        require(selector != 0, string.concat("Unknown chain '", chain, "': use a config/chains name or a selector."));
+    }
+
+    /// @dev Comma-separated list; empty input yields an empty array.
+    function _selectorsOf(string memory csv) internal view returns (uint64[] memory selectors) {
+        if (bytes(csv).length == 0) return new uint64[](0);
+        string[] memory parts = vm.split(csv, ",");
+        selectors = new uint64[](parts.length);
+        for (uint256 i = 0; i < parts.length; i++) {
+            selectors[i] = _selectorOf(vm.trim(parts[i]));
+        }
+    }
+
+    function _tryParseUint(string memory s) internal pure returns (bool, uint256 n) {
+        bytes memory b = bytes(s);
+        if (b.length == 0) return (false, 0);
+        for (uint256 i = 0; i < b.length; i++) {
+            if (b[i] < "0" || b[i] > "9") return (false, 0);
+            n = n * 10 + (uint8(b[i]) - 48);
+        }
+        return (true, n);
+    }
+}
diff --git a/script/configure/siloed/UpdateSiloDesignations.s.sol b/script/configure/siloed/UpdateSiloDesignations.s.sol
new file mode 100644
index 0000000..805b9d6
--- /dev/null
+++ b/script/configure/siloed/UpdateSiloDesignations.s.sol
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {CctActions, ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
+import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+
+/// @notice Silos or unsilos remote chains on a SiloedLockReleaseTokenPool 1.6.x (`updateSiloDesignations`,
+///         onlyOwner). Unsiloing moves the chain's balance into the shared bucket. A new silo starts at zero:
+///         shared liquidity is not carried over, so fund it before inbound traffic from that chain arrives.
+///
+/// Environment Variables (at least one of the first two):
+///   SILO_CHAINS      - Chains to silo, comma-separated names (AVALANCHE_FUJI) or selectors
+///   UNSILO_CHAINS    - Chains to return to the shared bucket
+///   SILO_REBALANCER  - Rebalancer for every newly siloed chain (required with SILO_CHAINS)
+///
+/// Usage:
+///   SILO_CHAINS=AVALANCHE_FUJI SILO_REBALANCER=0x... \
+///   forge script script/configure/siloed/UpdateSiloDesignations.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract UpdateSiloDesignations is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        uint256 chainId = block.chainid;
+        address pool = _resolvePool(chainId);
+        (, string memory full) = PoolVersion._requireSiloed(pool, PoolVersions.Op.SILOED_LIQUIDITY);
+
+        uint64[] memory silo = _selectorsOf(vm.envOr("SILO_CHAINS", string("")));
+        uint64[] memory unsilo = _selectorsOf(vm.envOr("UNSILO_CHAINS", string("")));
+        require(silo.length + unsilo.length > 0, "Set SILO_CHAINS and/or UNSILO_CHAINS.");
+        address rebalancer = silo.length > 0 ? vm.envAddress("SILO_REBALANCER") : address(0);
+
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+        // The pool's own reverts (InvalidChainSelector, ChainNotSiloed) do not say which rule failed.
+        for (uint256 i = 0; i < unsilo.length; i++) {
+            require(p.isSiloed(unsilo[i]), string.concat("Chain ", vm.toString(unsilo[i]), " is not siloed."));
+        }
+        ISiloedLockReleaseV16.SiloConfigUpdate[] memory adds = new ISiloedLockReleaseV16.SiloConfigUpdate[](silo.length);
+        for (uint256 i = 0; i < silo.length; i++) {
+            require(
+                TokenPool(pool).isSupportedChain(silo[i]),
+                string.concat("Chain ", vm.toString(silo[i]), " is not supported by the pool; add the lane first.")
+            );
+            require(!p.isSiloed(silo[i]), string.concat("Chain ", vm.toString(silo[i]), " is already siloed."));
+            adds[i] = ISiloedLockReleaseV16.SiloConfigUpdate({remoteChainSelector: silo[i], rebalancer: rebalancer});
+        }
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"🧱 Update Silo Designations");
+        console.log("========================================");
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        for (uint256 i = 0; i < silo.length; i++) {
+            console.log(string.concat("  silo   ", vm.toString(silo[i]), "  rebalancer=", vm.toString(rebalancer)));
+        }
+        for (uint256 i = 0; i < unsilo.length; i++) {
+            console.log(
+                string.concat(
+                    "  unsilo ",
+                    vm.toString(unsilo[i]),
+                    "  moves ",
+                    vm.toString(p.getAvailableTokens(unsilo[i])),
+                    " to shared"
+                )
+            );
+        }
+        console.log("========================================");
+
+        _executeCalls(CctActions._updateSiloDesignations(pool, unsilo, adds));
+        _logOperationOutcome("update silo designations");
+    }
+}
diff --git a/script/configure/siloed/WithdrawSiloedLiquidity.s.sol b/script/configure/siloed/WithdrawSiloedLiquidity.s.sol
new file mode 100644
index 0000000..0ac5d78
--- /dev/null
+++ b/script/configure/siloed/WithdrawSiloedLiquidity.s.sol
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../HelperConfig.s.sol";
+import {SiloedBase} from "./SiloedBase.s.sol";
+import {PoolVersion} from "../../utils/PoolVersion.s.sol";
+import {PoolVersions} from "../../../src/PoolVersions.sol";
+import {CctActions, ISiloedLockReleaseV16} from "../../../src/actions/CctActions.sol";
+
+/// @notice Withdraws liquidity from one silo of a SiloedLockReleaseTokenPool 1.6.x to the silo rebalancer.
+///         Inbound messages from that chain need this liquidity to release; draining it while messages are
+///         in flight makes them fail until the silo is refunded.
+///
+/// Environment Variables:
+///   DEST_CHAIN  - The siloed remote chain (name or selector), required
+///   AMOUNT      - Amount in the token's smallest unit; defaults to everything available
+///
+/// Usage:
+///   DEST_CHAIN=AVALANCHE_FUJI \
+///   forge script script/configure/siloed/WithdrawSiloedLiquidity.s.sol --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract WithdrawSiloedLiquidity is SiloedBase {
+    function run() external {
+        helperConfig = new HelperConfig();
+        address pool = _resolvePool(block.chainid);
+        (, string memory full) = PoolVersion._requireSiloed(pool, PoolVersions.Op.SILOED_LIQUIDITY);
+        uint64 selector = _selectorOf(vm.envString("DEST_CHAIN"));
+
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+        require(p.isSiloed(selector), string.concat("Chain ", vm.toString(selector), " is not siloed."));
+        uint256 available = p.getAvailableTokens(selector);
+        uint256 amount = vm.envOr("AMOUNT", available);
+        require(amount > 0, "Nothing to withdraw: the silo is empty.");
+        require(
+            amount <= available,
+            string.concat(
+                "InsufficientLiquidity: silo holds ", vm.toString(available), ", AMOUNT is ", vm.toString(amount)
+            )
+        );
+        address actor = _executingAccount();
+        address rebalancer = p.getChainRebalancer(selector);
+        require(
+            rebalancer == actor,
+            string.concat(
+                "NotRebalancer: the silo rebalancer is ",
+                vm.toString(rebalancer),
+                ", the executing account is ",
+                vm.toString(actor),
+                ". Set it with SetSiloRebalancer.s.sol."
+            )
+        );
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"🏧 Withdraw Siloed Liquidity");
+        console.log("========================================");
+        console.log(string.concat("Token Pool:   ", vm.toString(pool), " (", full, ")"));
+        console.log(string.concat("Silo:         ", vm.toString(selector)));
+        console.log(string.concat("Available:    ", vm.toString(available)));
+        console.log(string.concat("Amount:       ", vm.toString(amount), " -> ", vm.toString(actor)));
+        console.log("========================================");
+
+        _executeCalls(CctActions._withdrawSiloedLiquidity(pool, selector, amount));
+        _logOperationOutcome(string.concat("withdraw ", vm.toString(amount), " from silo ", vm.toString(selector)));
+    }
+}
diff --git a/script/deploy/DeployERC20LockBox.s.sol b/script/deploy/DeployERC20LockBox.s.sol
index 54ba6cb..c3dd54e 100644
--- a/script/deploy/DeployERC20LockBox.s.sol
+++ b/script/deploy/DeployERC20LockBox.s.sol
@@ -23,6 +23,8 @@ import {OutcomeLog} from "../../src/base/OutcomeLog.sol";
  * Environment variables:
  *   AUTHORIZED_CALLERS   - (optional) CSV or JSON array of addresses to authorize immediately
  *                          (e.g. deployer/token issuer for initial liquidity management)
+ *   SILO                 - (optional) label for one of a siloed pool's boxes (e.g. fuji). Recorded as
+ *                          {symbol}_LockBox_{SILO} without repointing active.lockBox, so several coexist.
  */
 contract DeployERC20LockBox is Script {
     HelperConfig public helperConfig;
@@ -67,8 +69,9 @@ contract DeployERC20LockBox is Script {
 
         // Refuse to redeploy over a live registry entry (FORCE_REDEPLOY=true overrides). Keyed on the
         // unique per-symbol deployment name so distinct tokens on one chain never collide.
+        string memory silo = vm.envOr("SILO", string(""));
         RegistryWriter._guard(
-            selectorName, DeploymentRecorder._lockBoxName(DeploymentUtils._getSymbol(vm, tokenAddress))
+            selectorName, DeploymentRecorder._lockBoxName(DeploymentUtils._getSymbol(vm, tokenAddress), silo)
         );
 
         vm.startBroadcast();
@@ -99,9 +102,13 @@ contract DeployERC20LockBox is Script {
         console.log(string.concat("ERC20LockBox Address: ", vm.toString(lockBoxAddress)));
         console.log(helperConfig.getExplorerUrl(chainId, "/address/", lockBoxAddress));
         console.log("");
-        // Single writer: one call emits the detailed ledger file AND records the address in the
-        // registry (deployments[{symbol}_LockBox] + active.lockBox).
-        DeploymentRecorder._recordLockBox(vm, selectorName, chainNameId, lockBoxAddress, tokenAddress);
+        // Single writer: ledger file + deployments[{symbol}_LockBox] + active.lockBox, or for a silo box
+        // deployments[{symbol}_LockBox_{silo}] alone.
+        if (bytes(silo).length == 0) {
+            DeploymentRecorder._recordLockBox(vm, selectorName, chainNameId, lockBoxAddress, tokenAddress);
+        } else {
+            DeploymentRecorder._recordSiloLockBox(vm, selectorName, chainNameId, lockBoxAddress, tokenAddress, silo);
+        }
         console.log("");
         if (!DeploymentRecorder._recorded()) {
             DeploymentRecorder._logNothingRecorded();
@@ -115,7 +122,19 @@ contract DeployERC20LockBox is Script {
         if (DeploymentRecorder._recorded() && authorizedCallers.length == 0) {
             console.log("");
             console.log("Next Steps:");
-            console.log(string.concat("  1. Deploy a LockReleaseTokenPool with LOCK_BOX=", vm.toString(lockBoxAddress)));
+            if (bytes(silo).length == 0) {
+                console.log(
+                    string.concat("  1. Deploy a LockReleaseTokenPool with LOCK_BOX=", vm.toString(lockBoxAddress))
+                );
+            } else {
+                console.log(
+                    string.concat(
+                        "  1. Map it on the siloed pool: LOCK_BOXES=<chain>=",
+                        vm.toString(lockBoxAddress),
+                        " configure/siloed/ConfigureLockBoxes.s.sol"
+                    )
+                );
+            }
             console.log("  2. Authorize the pool on the lockbox:");
             console.log(
                 string.concat(
diff --git a/script/deploy/DeploySiloedLockReleaseTokenPool.s.sol b/script/deploy/DeploySiloedLockReleaseTokenPool.s.sol
new file mode 100644
index 0000000..3a7c932
--- /dev/null
+++ b/script/deploy/DeploySiloedLockReleaseTokenPool.s.sol
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {Script, console} from "forge-std/Script.sol";
+import {HelperConfig} from "../HelperConfig.s.sol"; // Network configuration helper
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {DeploymentUtils} from "../utils/DeploymentUtils.s.sol";
+import {DeploymentRecorder} from "../utils/DeploymentRecorder.s.sol";
+import {RegistryWriter} from "../../src/utils/RegistryWriter.sol";
+import {OutcomeLog} from "../../src/base/OutcomeLog.sol";
+
+/// @notice Deploys a SiloedLockRelease token pool and records it in the registry. It takes no lock box: map
+/// remote chains to ERC20LockBoxes afterwards with configure/siloed/ConfigureLockBoxes.s.sol, before wiring
+/// lanes. DECIMALS=<n> is required only when the token does not answer decimals(), and must agree with it
+/// when both exist; the resolved value is the pool's immutable scaling factor.
+contract DeploySiloedLockReleaseTokenPool is Script {
+    HelperConfig public helperConfig;
+
+    function run() external {
+        // Initialize HelperConfig
+        helperConfig = new HelperConfig();
+
+        uint256 chainId = block.chainid;
+        string memory chainName = helperConfig.getChainName(chainId);
+        HelperConfig.NetworkConfig memory config = helperConfig.getNetworkConfig(chainId);
+        string memory selectorName = helperConfig.getSelectorName(chainId);
+
+        console.log("");
+        console.log("========================================");
+        console.log(unicode"🔐 Deploy Siloed Lock & Release Token Pool");
+        console.log("========================================");
+        console.log(string.concat("Chain:        ", chainName));
+        console.log(string.concat("Action:       ", "Deploy siloed lock & release token pool"));
+        console.log("========================================");
+        console.log("");
+
+        // Get deployed token address - TOKEN env var takes priority, then {CHAIN}_TOKEN
+        address tokenAddress = helperConfig.getDeployedToken(chainId);
+        require(
+            tokenAddress != address(0),
+            string.concat(
+                "Token not deployed. Set TOKEN or ", config.chainNameIdentifier, "_TOKEN environment variable."
+            )
+        );
+
+        // Validate router and RMN proxy addresses
+        require(config.router != address(0), "Router not defined for this network");
+        require(config.rmnProxy != address(0), "RMN Proxy not defined for this network");
+
+        // decimals() when the token answers, an explicit DECIMALS when it does not (the getter is
+        // optional in ERC20 and the pool takes the value as a constructor argument by design), a
+        // mismatch or a missing-on-both-sides refusal otherwise. Never a guess: the value is immutable
+        // and scales every amount the pool moves.
+        uint8 decimals = DeploymentUtils._resolveTokenDecimals(
+            vm, tokenAddress, vm.envOr("DECIMALS", DeploymentUtils.DECIMALS_UNSET)
+        );
+        // POOL_HOOKS alias > {CHAIN}_POOL_HOOKS > registry active.poolHooks. Optional (0x0 = no hooks).
+        address poolHooks = vm.envOr("POOL_HOOKS", helperConfig.getDeployedPoolHooks(chainId));
+
+        console.log("Token Pool Parameters:");
+        console.log(string.concat("  Token:                        ", vm.toString(tokenAddress)));
+        console.log(string.concat("  Decimals:                     ", vm.toString(decimals)));
+        console.log(string.concat("  Router:                       ", vm.toString(config.router)));
+        console.log(string.concat("  RMN Proxy:                    ", vm.toString(config.rmnProxy)));
+        console.log(
+            string.concat(
+                "  AdvancedPoolHooks:            ", poolHooks != address(0) ? vm.toString(poolHooks) : "None (0x0)"
+            )
+        );
+        console.log("");
+
+        // Refuse to redeploy over a live registry entry (FORCE_REDEPLOY=true overrides). Keyed on the
+        // unique per-symbol/per-pool-type/per-version deployment name so a BurnMint and a LockRelease
+        // pool (or an old and a new version) for the same token never collide.
+        string memory symbol = DeploymentUtils._getSymbol(vm, tokenAddress);
+        RegistryWriter._guard(selectorName, DeploymentRecorder._poolName(symbol, "SiloedLockRelease"));
+
+        vm.startBroadcast();
+
+        console.log(string.concat("\n[Step 1] Deploying SiloedLockReleaseTokenPool on ", chainName));
+        SiloedLockReleaseTokenPool tokenPool =
+            new SiloedLockReleaseTokenPool(IERC20(tokenAddress), decimals, poolHooks, config.rmnProxy, config.router);
+        address tokenPoolAddress = address(tokenPool);
+        console.log(string.concat("Token Pool deployed at: ", vm.toString(tokenPoolAddress)));
+        console.log(helperConfig.getExplorerUrl(chainId, "/address/", tokenPoolAddress));
+        OutcomeLog._sending("deploy the SiloedLockRelease token pool");
+
+        vm.stopBroadcast();
+
+        // Assert the on-chain typeAndVersion matches the version composed into the registry key - a
+        // cheap guard against a pinned-dependency mismatch (recording a 2.0.0 key for a stale pool).
+        string memory expectedTypeAndVersion =
+            string.concat("SiloedLockReleaseTokenPool ", DeploymentRecorder.POOL_VERSION);
+        require(
+            keccak256(bytes(tokenPool.typeAndVersion())) == keccak256(bytes(expectedTypeAndVersion)),
+            string.concat(
+                "typeAndVersion mismatch: on-chain '",
+                tokenPool.typeAndVersion(),
+                "' != key '",
+                expectedTypeAndVersion,
+                "'"
+            )
+        );
+
+        console.log("");
+        console.log("========================================");
+        OutcomeLog._sending(string.concat("deploy the SiloedLockRelease token pool on ", chainName));
+        console.log("========================================");
+        console.log(string.concat("Token Pool Address: ", vm.toString(tokenPoolAddress)));
+        console.log(helperConfig.getExplorerUrl(chainId, "/address/", tokenPoolAddress));
+        console.log("");
+        // Single writer: ledger file + deployments[{symbol}_SiloedLockReleaseTokenPool_{version}] + active.tokenPool.
+        DeploymentRecorder._recordTokenPool(
+            vm, selectorName, config.chainNameIdentifier, tokenPoolAddress, tokenAddress, "SiloedLockRelease"
+        );
+        console.log("");
+        DeploymentRecorder._logResolution(
+            vm, string.concat(config.chainNameIdentifier, "_TOKEN_POOL"), tokenPoolAddress
+        );
+        console.log("========================================");
+        console.log("");
+    }
+}
diff --git a/script/docs/gen-primitives.mjs b/script/docs/gen-primitives.mjs
index 5f30b65..f857551 100644
--- a/script/docs/gen-primitives.mjs
+++ b/script/docs/gen-primitives.mjs
@@ -36,6 +36,7 @@ const CATALOG_FILE = join(OUT_DIR, "catalog.json");
 const INTERNAL = new Set([
   "script/HelperConfig.s.sol",
   "script/configure/liquidity/LiquidityBase.s.sol",
+  "script/configure/siloed/SiloedBase.s.sol",
   "script/setup/token-roles/TokenRoleScript.s.sol",
   "script/setup/ClaimPathDetector.sol",
   "script/utils/ChainHandlers.s.sol",
@@ -65,6 +66,7 @@ const GROUPS = [
   ["script/configure/rate-limiter", "rate-limiter"],
   ["script/configure/remote-chains", "remote-chains"],
   ["script/configure/remote-pools", "remote-pools"],
+  ["script/configure/siloed", "siloed"],
   ["script/configure", "configure"],
   ["script/operations", "operations"],
   ["script/governance", "governance"],
diff --git a/script/setup/ApplyChainUpdates.s.sol b/script/setup/ApplyChainUpdates.s.sol
index 1c658f3..6cfa114 100644
--- a/script/setup/ApplyChainUpdates.s.sol
+++ b/script/setup/ApplyChainUpdates.s.sol
@@ -4,6 +4,9 @@ pragma solidity 0.8.24;
 import {console} from "forge-std/Script.sol";
 import {HelperConfig} from "../HelperConfig.s.sol"; // Network configuration helper
 import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+import {SafeMode} from "../../src/base/SafeMode.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {ILockBox} from "@chainlink/contracts-ccip/contracts/interfaces/ILockBox.sol";
 import {RateLimiter} from "@chainlink/contracts-ccip/contracts/libraries/RateLimiter.sol";
 import {ChainHandlers} from "../utils/ChainHandlers.s.sol";
 import {ChainConfig} from "../../src/config/ChainConfig.sol";
@@ -226,6 +229,7 @@ contract ApplyChainUpdates is EoaExecutor {
         );
         (PoolVersions.Version poolVersion, string memory poolTypeAndVersion) = PoolVersion._resolve(poolAddress);
         console.log(string.concat("Pool contract: ", poolTypeAndVersion));
+        _requireLockBoxes(poolAddress, poolVersion, poolTypeAndVersion, chainUpdates);
         _executeCalls(
             _buildLaneUpdateCalls(poolVersion, poolAddress, chainSelectorRemovals, chainUpdates, shouldRemove)
         );
@@ -781,6 +785,7 @@ contract ApplyChainUpdates is EoaExecutor {
         // Apply the chain updates through the shared action layer.
         (PoolVersions.Version poolVersion, string memory poolTypeAndVersion) = PoolVersion._resolve(poolAddress);
         console.log(string.concat("Pool contract: ", poolTypeAndVersion));
+        _requireLockBoxes(poolAddress, poolVersion, poolTypeAndVersion, chainUpdates);
         bool[] memory replaceExisting = new bool[](1);
         replaceExisting[0] = chainAlreadyConfigured;
         _executeCalls(
@@ -789,6 +794,35 @@ contract ApplyChainUpdates is EoaExecutor {
         _logOperationOutcome("apply the chain updates to the pool");
     }
 
+    /// @dev A Siloed 2.0 pool reverts every transfer on a lane with no lock box, so the box comes first
+    ///      (upstream tooling enforces the same order). Safe mode only warns: the batch may map it.
+    function _requireLockBoxes(
+        address pool,
+        PoolVersions.Version version,
+        string memory typeAndVersion,
+        TokenPool.ChainUpdate[] memory updates
+    ) internal view {
+        if (version < PoolVersions.Version.V2_0_0 || !PoolVersion._isSiloed(PoolVersion._typePrefixOf(typeAndVersion)))
+        {
+            return;
+        }
+        for (uint256 i = 0; i < updates.length; i++) {
+            uint64 sel = updates[i].remoteChainSelector;
+            try SiloedLockReleaseTokenPool(pool).getLockBox(sel) returns (ILockBox) {}
+            catch {
+                string memory reason = string.concat(
+                    "LockBoxNotConfigured: siloed pool ",
+                    vm.toString(pool),
+                    " has no lock box for chain ",
+                    vm.toString(sel),
+                    "; run configure/siloed/ConfigureLockBoxes.s.sol first"
+                );
+                if (!SafeMode._isSafeMode(_executionMode())) revert(reason);
+                console.log(string.concat(unicode"⚠️  ", reason, " (or in the same batch)."));
+            }
+        }
+    }
+
     /// @dev The exhaustive version switch of the lane-update dispatch: 1.5.0 takes the
     ///      single-argument encoding, every later cataloged version takes the modern
     ///      (removes[], adds[]) encoding. `PoolVersion._resolve` refuses uncataloged versions before
@@ -806,8 +840,8 @@ contract ApplyChainUpdates is EoaExecutor {
             return CctActions._applyChainUpdatesV150(poolAddress, _toV150Updates(chainUpdates, replaceExisting));
         }
         if (
-            version == PoolVersions.Version.V1_5_1 || version == PoolVersions.Version.V1_6_1
-                || version == PoolVersions.Version.V2_0_0
+            version == PoolVersions.Version.V1_5_1 || version == PoolVersions.Version.V1_6_0
+                || version == PoolVersions.Version.V1_6_1 || version == PoolVersions.Version.V2_0_0
         ) {
             return CctActions._applyChainUpdates(poolAddress, chainSelectorRemovals, chainUpdates);
         }
diff --git a/script/utils/DeploymentRecorder.s.sol b/script/utils/DeploymentRecorder.s.sol
index 982abe7..2282ba6 100644
--- a/script/utils/DeploymentRecorder.s.sol
+++ b/script/utils/DeploymentRecorder.s.sol
@@ -110,6 +110,22 @@ library DeploymentRecorder {
         RegistryWriter._record(selectorName, "lockBox", _lockBoxName(symbol), lockBoxAddress);
     }
 
+    /// @notice Records one silo's lock box as `deployments[{symbol}_LockBox_{silo}]` only. `active.lockBox`
+    /// is left alone: a siloed pool has several boxes, so there is no single one to resolve implicitly.
+    function _recordSiloLockBox(
+        Vm vm,
+        string memory selectorName,
+        string memory chainNameIdentifier,
+        address lockBoxAddress,
+        address tokenAddress,
+        string memory silo
+    ) internal {
+        if (ForgeContext._sendsNothing()) return;
+        DeploymentUtils._saveLockBoxDeployment(vm, selectorName, chainNameIdentifier, lockBoxAddress, tokenAddress);
+        string memory symbol = DeploymentUtils._getSymbol(vm, tokenAddress);
+        RegistryWriter._setDeployment(selectorName, _lockBoxName(symbol, silo), lockBoxAddress);
+    }
+
     /// @notice Records pool hooks: ledger file + `deployments[{symbol}_{poolType}_PoolHooks]` +
     /// `active.poolHooks`. Hooks belong to a token's pool, so the key carries the token symbol (resolved
     /// from `tokenAddress`, `address(0)` → env `TOKEN_SYMBOL` / "unknown") and the pool type.
@@ -175,6 +191,10 @@ library DeploymentRecorder {
         return string.concat(symbol, "_LockBox");
     }
 
+    function _lockBoxName(string memory symbol, string memory silo) internal pure returns (string memory) {
+        return bytes(silo).length == 0 ? _lockBoxName(symbol) : string.concat(symbol, "_LockBox_", silo);
+    }
+
     function _hooksName(string memory symbol, string memory poolType) internal pure returns (string memory) {
         return string.concat(symbol, "_", poolType, "_PoolHooks");
     }
diff --git a/script/utils/PoolVersion.s.sol b/script/utils/PoolVersion.s.sol
index 9dc1905..02908d7 100644
--- a/script/utils/PoolVersion.s.sol
+++ b/script/utils/PoolVersion.s.sol
@@ -85,7 +85,7 @@ library PoolVersion {
         _requireKnownTypePrefix(pool, full, typePrefix);
         _requireNoDevBuild(pool, full, token);
 
-        version = PoolVersions._fromVersionToken(token);
+        version = _versionFor(typePrefix, token);
         if (version == PoolVersions.Version.UNKNOWN) {
             revert(
                 string.concat(
@@ -147,7 +147,7 @@ library PoolVersion {
         }
 
         if (!_isKnownTypePrefix(typePrefix)) return (false, PoolVersions.Version.UNKNOWN, full);
-        version = PoolVersions._fromVersionToken(token);
+        version = _versionFor(typePrefix, token);
         if (version == PoolVersions.Version.UNKNOWN) return (false, PoolVersions.Version.UNKNOWN, full);
         return (true, version, full);
     }
@@ -160,6 +160,7 @@ library PoolVersion {
     ///      liquidity to manage, and specialized pools version independently, so the fence is scoped to
     ///      the standard LockRelease lineage.
     string internal constant LOCK_RELEASE_TYPE = "LockReleaseTokenPool";
+    string internal constant SILOED_LOCK_RELEASE_TYPE = "SiloedLockReleaseTokenPool";
 
     /// @notice Fences a MUTATING v1.x LockRelease liquidity operation on both axes and returns the
     ///         resolved version (< 2.0.0) so the caller can build the write. The check is two-dimensional:
@@ -180,7 +181,7 @@ library PoolVersion {
         (version, full) = _resolve(pool);
         (string memory typePrefix,) = _splitTypeAndVersion(full);
 
-        if (keccak256(bytes(typePrefix)) != keccak256(bytes(LOCK_RELEASE_TYPE))) {
+        if (!_isLockReleaseFamily(typePrefix)) {
             revert(
                 string.concat(
                     "UnsupportedPoolTypeForLiquidity: liquidity management is only on LockRelease pools; this is a ",
@@ -200,6 +201,9 @@ library PoolVersion {
             revert(
                 string.concat(
                     "LiquidityManagedByLockBox: on 2.0.0 LockRelease pools, liquidity is managed via the external lock box",
+                    _isSiloed(typePrefix)
+                        ? " (one per remote chain on a Siloed pool - read them with configure/GetLockBox.s.sol)"
+                        : "",
                     " - use operations/DepositToLockBox.s.sol / WithdrawFromLockBox.s.sol (pool ",
                     VM.toString(pool),
                     ", on-chain \"",
@@ -212,6 +216,39 @@ library PoolVersion {
         PoolVersions._requireSupports(PoolVersions.Op.PROVIDE_LIQUIDITY, version, pool);
     }
 
+    /// @notice Fences a Siloed-only operation: the pool must be a `SiloedLockReleaseTokenPool` and its
+    ///         version inside `op`'s range. Returns the resolved version.
+    function _requireSiloed(address pool, PoolVersions.Op op)
+        internal
+        view
+        returns (PoolVersions.Version version, string memory full)
+    {
+        (version, full) = _resolve(pool);
+        (string memory typePrefix,) = _splitTypeAndVersion(full);
+        if (!_isSiloed(typePrefix)) {
+            revert(
+                string.concat(
+                    "NotASiloedPool: ",
+                    PoolVersions._opName(op),
+                    " exists only on SiloedLockReleaseTokenPool; pool ",
+                    VM.toString(pool),
+                    " reports \"",
+                    full,
+                    "\"."
+                )
+            );
+        }
+        PoolVersions._requireSupports(op, version, pool);
+    }
+
+    function _isSiloed(string memory typePrefix) internal pure returns (bool) {
+        return keccak256(bytes(typePrefix)) == keccak256(bytes(SILOED_LOCK_RELEASE_TYPE));
+    }
+
+    function _isLockReleaseFamily(string memory typePrefix) internal pure returns (bool) {
+        return keccak256(bytes(typePrefix)) == keccak256(bytes(LOCK_RELEASE_TYPE)) || _isSiloed(typePrefix);
+    }
+
     /// @notice The type prefix of a raw `typeAndVersion()` string (everything before the last space), for
     ///         read-path scripts that branch on the pool type without a mutating fence. An empty string in
     ///         (a non-pool) yields an empty prefix.
@@ -323,13 +360,21 @@ library PoolVersion {
         return string(out);
     }
 
-    /// @dev The standard TokenPool lineage whose version tokens are comparable in the catalog.
-    ///      Specialized pools (USDCTokenPool, siloed or hybrid variants, forks with renamed types)
+    /// @dev The TokenPool lineage whose version tokens are comparable in the catalog. Siloed
+    ///      LockRelease subclasses the TokenPool of the same release, so its token compares too.
+    ///      Other specialized pools (USDCTokenPool, hybrid variants, forks with renamed types)
     ///      version independently and must not dispatch as TokenPool versions.
     function _isKnownTypePrefix(string memory typePrefix) private pure returns (bool) {
         bytes32 h = keccak256(bytes(typePrefix));
         return h == keccak256(bytes("BurnMintTokenPool")) || h == keccak256(bytes("BurnFromMintTokenPool"))
-            || h == keccak256(bytes("BurnWithFromMintTokenPool")) || h == keccak256(bytes("LockReleaseTokenPool"));
+            || h == keccak256(bytes("BurnWithFromMintTokenPool")) || h == keccak256(bytes(LOCK_RELEASE_TYPE))
+            || h == keccak256(bytes(SILOED_LOCK_RELEASE_TYPE));
+    }
+
+    /// @dev 1.6.0 was only ever stamped on the Siloed pool; any other type claiming it is not a release.
+    function _versionFor(string memory typePrefix, string memory token) private pure returns (PoolVersions.Version v) {
+        v = PoolVersions._fromVersionToken(token);
+        if (v == PoolVersions.Version.V1_6_0 && !_isSiloed(typePrefix)) return PoolVersions.Version.UNKNOWN;
     }
 
     function _requireKnownTypePrefix(address pool, string memory full, string memory typePrefix) private pure {
@@ -341,7 +386,8 @@ library PoolVersion {
                 " reports \"",
                 full,
                 "\". Version tokens are only comparable within the standard TokenPool lineage ",
-                "(BurnMintTokenPool, BurnFromMintTokenPool, BurnWithFromMintTokenPool, LockReleaseTokenPool); \"",
+                "(BurnMintTokenPool, BurnFromMintTokenPool, BurnWithFromMintTokenPool, LockReleaseTokenPool, ",
+                "SiloedLockReleaseTokenPool); \"",
                 typePrefix,
                 "\" versions independently, so its version token must not dispatch as a TokenPool version. ",
                 "If you have verified this pool's ABI matches a cataloged version, set ",
diff --git a/src/PoolVersions.sol b/src/PoolVersions.sol
index 6e467d2..fd861d0 100644
--- a/src/PoolVersions.sol
+++ b/src/PoolVersions.sol
@@ -40,6 +40,9 @@ library PoolVersions {
         UNKNOWN,
         V1_5_0,
         V1_5_1,
+        // Only SiloedLockReleaseTokenPool ships a 1.6.0 stamp (npm 1.6.0 stamps its BurnMint 1.5.1).
+        // Same callable surface as 1.6.1, but 1.5.x rate-limit validation; see pool-behavior-matrix.
+        V1_6_0,
         V1_6_1,
         V2_0_0
     }
@@ -65,10 +68,12 @@ library PoolVersions {
         GET_REBALANCER, // v1.x LockRelease read: getRebalancer; removed in 2.0.0 (lockbox model)
         SET_REBALANCER, // v1.x LockRelease: setRebalancer (onlyOwner); removed in 2.0.0
         PROVIDE_LIQUIDITY, // v1.x LockRelease: provideLiquidity (only rebalancer); removed in 2.0.0
-        WITHDRAW_LIQUIDITY // v1.x LockRelease: withdrawLiquidity (only rebalancer); removed in 2.0.0
+        WITHDRAW_LIQUIDITY, // v1.x LockRelease: withdrawLiquidity (only rebalancer); removed in 2.0.0
+        SILOED_LIQUIDITY, // Siloed 1.6.x: updateSiloDesignations/setSiloRebalancer/(provide|withdraw)SiloedLiquidity
+        CONFIGURE_LOCK_BOXES // Siloed 2.0: configureLockBoxes/getLockBox(uint64)/getAllLockBoxConfigs
     }
 
-    string internal constant SUPPORTED_VERSIONS = "1.5.0, 1.5.1, 1.6.1, 2.0.0";
+    string internal constant SUPPORTED_VERSIONS = "1.5.0, 1.5.1, 1.6.0 (SiloedLockReleaseTokenPool only), 1.6.1, 2.0.0";
     string internal constant DOCS = "docs/pool-versions.md";
     string internal constant CATALOG = "src/PoolVersions.sol";
 
@@ -98,6 +103,9 @@ library PoolVersions {
         if (op == Op.SET_REBALANCER) return (Version.V1_5_0, Version.V2_0_0);
         if (op == Op.PROVIDE_LIQUIDITY) return (Version.V1_5_0, Version.V2_0_0);
         if (op == Op.WITHDRAW_LIQUIDITY) return (Version.V1_5_0, Version.V2_0_0);
+        // Siloed-only surfaces. The range gates the version; the caller also checks the type prefix.
+        if (op == Op.SILOED_LIQUIDITY) return (Version.V1_6_0, Version.V2_0_0);
+        if (op == Op.CONFIGURE_LOCK_BOXES) return (Version.V2_0_0, Version.UNKNOWN);
         revert("PoolVersions: operation missing from the capability-range table");
     }
 
@@ -145,6 +153,7 @@ library PoolVersions {
         }
         if (h == keccak256(bytes("1.5.0"))) return Version.V1_5_0;
         if (h == keccak256(bytes("1.5.1"))) return Version.V1_5_1;
+        if (h == keccak256(bytes("1.6.0"))) return Version.V1_6_0;
         if (h == keccak256(bytes("1.6.1"))) return Version.V1_6_1;
         if (h == keccak256(bytes("2.0.0"))) return Version.V2_0_0;
         return Version.UNKNOWN;
@@ -154,6 +163,7 @@ library PoolVersions {
     function _toString(Version version) internal pure returns (string memory) {
         if (version == Version.V1_5_0) return "1.5.0";
         if (version == Version.V1_5_1) return "1.5.1";
+        if (version == Version.V1_6_0) return "1.6.0";
         if (version == Version.V1_6_1) return "1.6.1";
         if (version == Version.V2_0_0) return "2.0.0";
         return "unknown";
@@ -187,6 +197,10 @@ library PoolVersions {
         if (op == Op.SET_REBALANCER) return "setRebalancer";
         if (op == Op.PROVIDE_LIQUIDITY) return "provideLiquidity";
         if (op == Op.WITHDRAW_LIQUIDITY) return "withdrawLiquidity";
+        if (op == Op.SILOED_LIQUIDITY) {
+            return "siloed liquidity (updateSiloDesignations/setSiloRebalancer/provide|withdrawSiloedLiquidity)";
+        }
+        if (op == Op.CONFIGURE_LOCK_BOXES) return "configureLockBoxes";
         revert("PoolVersions: operation missing from the name table");
     }
 }
diff --git a/src/actions/CctActions.sol b/src/actions/CctActions.sol
index 3bb7dc4..40a4f3d 100644
--- a/src/actions/CctActions.sol
+++ b/src/actions/CctActions.sol
@@ -15,6 +15,7 @@ import {RateLimiter} from "@chainlink/contracts-ccip/contracts/libraries/RateLim
 import {IAdvancedPoolHooks} from "@chainlink/contracts-ccip/contracts/interfaces/IAdvancedPoolHooks.sol";
 import {AdvancedPoolHooks} from "@chainlink/contracts-ccip/contracts/pools/AdvancedPoolHooks.sol";
 import {ERC20LockBox} from "@chainlink/contracts-ccip/contracts/pools/ERC20LockBox.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
 import {AuthorizedCallers} from "@chainlink/contracts/src/v0.8/shared/access/AuthorizedCallers.sol";
 import {IBurnMintERC20} from "@chainlink/contracts-ccip/contracts/interfaces/IBurnMintERC20.sol";
 import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
@@ -68,6 +69,26 @@ interface ILockReleaseV1Liquidity {
     function getToken() external view returns (IERC20);
 }
 
+/// @notice Minimal view of the SiloedLockReleaseTokenPool 1.6.0/1.6.1 silo surface (identical in both). Liquidity
+///         lives on the pool, accounted per siloed chain plus one shared bucket for unsiloed chains; the
+///         rebalancer of a chain is its silo's rebalancer when siloed, the pool rebalancer otherwise. 2.0.0
+///         replaced all of it with per-chain lock boxes, so the vendored package does not declare it.
+interface ISiloedLockReleaseV16 {
+    struct SiloConfigUpdate {
+        uint64 remoteChainSelector;
+        address rebalancer;
+    }
+
+    function updateSiloDesignations(uint64[] calldata removes, SiloConfigUpdate[] calldata adds) external;
+    function setSiloRebalancer(uint64 remoteChainSelector, address newRebalancer) external;
+    function provideSiloedLiquidity(uint64 remoteChainSelector, uint256 amount) external;
+    function withdrawSiloedLiquidity(uint64 remoteChainSelector, uint256 amount) external;
+    function isSiloed(uint64 remoteChainSelector) external view returns (bool);
+    function getChainRebalancer(uint64 remoteChainSelector) external view returns (address);
+    function getAvailableTokens(uint64 remoteChainSelector) external view returns (uint256);
+    function getUnsiloedLiquidity() external view returns (uint256);
+}
+
 /// @notice Minimal view of the CCIP-admin setter (`setCCIPAdmin`). Present on `CrossChainToken`
 ///         (DEFAULT_ADMIN_ROLE-gated) and the `BurnMintERC20` family (admin/owner-gated); no vendored
 ///         interface exposes the setter (`IGetCCIPAdmin` is getter-only), so it is declared here as a
@@ -551,6 +572,60 @@ library CctActions {
         return _one(pool, abi.encodeCall(ILockReleaseV1Liquidity.withdrawLiquidity, (amount)));
     }
 
+    // ─────────────────────────────────────────────────────────────────────────
+    // SiloedLockRelease: 1.6.x silos (pool-held) and 2.0.0 lock boxes
+    // ─────────────────────────────────────────────────────────────────────────
+
+    /// @notice Unsilo `removes` (their balance moves to the shared bucket) and silo `adds` (each starts at
+    ///         zero, so existing shared liquidity is NOT carried into a new silo). onlyOwner.
+    function _updateSiloDesignations(
+        address pool,
+        uint64[] memory removes,
+        ISiloedLockReleaseV16.SiloConfigUpdate[] memory adds
+    ) internal pure returns (Call[] memory) {
+        return _one(pool, abi.encodeCall(ISiloedLockReleaseV16.updateSiloDesignations, (removes, adds)));
+    }
+
+    /// @notice onlyOwner; the chain must already be siloed.
+    function _setSiloRebalancer(address pool, uint64 remoteChainSelector, address rebalancer)
+        internal
+        pure
+        returns (Call[] memory)
+    {
+        return _one(pool, abi.encodeCall(ISiloedLockReleaseV16.setSiloRebalancer, (remoteChainSelector, rebalancer)));
+    }
+
+    /// @notice `approve(pool, amount)` then `provideSiloedLiquidity`; the caller must be the silo's rebalancer.
+    function _provideSiloedLiquidity(address pool, address token, uint64 remoteChainSelector, uint256 amount)
+        internal
+        pure
+        returns (Call[] memory)
+    {
+        return _concat(
+            _approve(token, pool, amount),
+            _one(pool, abi.encodeCall(ISiloedLockReleaseV16.provideSiloedLiquidity, (remoteChainSelector, amount)))
+        );
+    }
+
+    /// @notice Tokens go to the caller, who must be the silo's rebalancer.
+    function _withdrawSiloedLiquidity(address pool, uint64 remoteChainSelector, uint256 amount)
+        internal
+        pure
+        returns (Call[] memory)
+    {
+        return _one(pool, abi.encodeCall(ISiloedLockReleaseV16.withdrawSiloedLiquidity, (remoteChainSelector, amount)));
+    }
+
+    /// @notice Set-only: an entry can be overwritten, never removed. onlyOwner. The pool must separately be an
+    ///         authorized caller on each lock box; `configureLockBoxes` does not check it.
+    function _configureLockBoxes(address pool, SiloedLockReleaseTokenPool.LockBoxConfig[] memory configs)
+        internal
+        pure
+        returns (Call[] memory)
+    {
+        return _one(pool, abi.encodeCall(SiloedLockReleaseTokenPool.configureLockBoxes, (configs)));
+    }
+
     // ─────────────────────────────────────────────────────────────────────────
     // Composition
     // ─────────────────────────────────────────────────────────────────────────
diff --git a/src/roles/RolesAuditor.sol b/src/roles/RolesAuditor.sol
index e2f21e8..bac9b10 100644
--- a/src/roles/RolesAuditor.sol
+++ b/src/roles/RolesAuditor.sol
@@ -603,51 +603,109 @@ contract RolesAuditor {
     // ---------------------------------------------------------------- lockbox / hooks / rebalancer
 
     function _auditLockbox(string memory json, address pool) private {
+        _auditSiloedLockboxes(json, pool);
         if (!VM.keyExistsJson(json, ".roles.lockbox")) {
-            _skip("lockbox", "no lockbox block declared (no v2 LockRelease lockbox on this chain)");
+            if (!VM.keyExistsJson(json, ".roles.lockboxes")) {
+                _skip("lockbox", "no lockbox block declared (no v2 LockRelease lockbox on this chain)");
+            }
             return;
         }
         address declared = VM.parseJsonAddress(json, ".roles.lockbox.address");
         (bool has, address live) = RolesProbes._tryAddress(pool, "getLockBox()");
+        (bool siloed, address[] memory boxes) = RolesProbes._trySiloedLockBoxes(pool);
         if (has) {
             _checkAddress("lockbox.address", declared, live);
+        } else if (siloed) {
+            // A Siloed pool has one box per chain and no zero-argument getLockBox().
+            if (_containsAddr(boxes, declared)) {
+                _pass(
+                    "lockbox.address", string.concat(VM.toString(declared), " is one of the siloed pool's lock boxes")
+                );
+            } else {
+                _fail(
+                    "lockbox.address",
+                    string.concat(VM.toString(declared), " is not one of the siloed pool's lock boxes")
+                );
+            }
         } else {
             _fail("lockbox.address", "declared, but the pool did not answer getLockBox(), so it was not confirmed");
         }
-        (bool okOwner, address owner_) = RolesProbes._tryAddress(declared, "owner()");
+        _auditOneLockbox(json, ".roles.lockbox", "lockbox", declared);
+    }
+
+    /// @dev `roles.lockboxes` is keyed by box address and declares a Siloed pool's boxes. Two-sided: every
+    /// declared box must be the pool's, and every box the pool maps must be declared.
+    function _auditSiloedLockboxes(string memory json, address pool) private {
+        if (!VM.keyExistsJson(json, ".roles.lockboxes")) return;
+        (bool siloed, address[] memory live) = RolesProbes._trySiloedLockBoxes(pool);
+        if (!siloed) {
+            _fail("lockboxes", "declared, but the pool is not a Siloed 2.0 pool (no getAllLockBoxConfigs())");
+            return;
+        }
+        string[] memory keys = VM.parseJsonKeys(json, ".roles.lockboxes");
+        address[] memory declared = new address[](keys.length);
+        for (uint256 i = 0; i < keys.length; i++) {
+            declared[i] = VM.parseAddress(keys[i]);
+            string memory label = string.concat("lockboxes.", keys[i]);
+            if (!_containsAddr(live, declared[i])) {
+                _fail(label, "declared, but the pool does not map any chain to it");
+                continue;
+            }
+            _auditOneLockbox(json, string.concat(".roles.lockboxes.", keys[i]), label, declared[i]);
+        }
+        for (uint256 i = 0; i < live.length; i++) {
+            if (!_containsAddr(declared, live[i])) {
+                _fail("lockboxes", string.concat(VM.toString(live[i]), " is mapped by the pool but not declared"));
+            }
+        }
+    }
+
+    function _auditOneLockbox(string memory json, string memory path, string memory label, address box) private {
+        (bool okOwner, address owner_) = RolesProbes._tryAddress(box, "owner()");
         (bool okCallers, address[] memory callers) =
-            RolesProbes._tryAddressArray(declared, abi.encodeWithSignature("getAllAuthorizedCallers()"));
+            RolesProbes._tryAddressArray(box, abi.encodeWithSignature("getAllAuthorizedCallers()"));
         // The surface gate: a declared lockbox that answers neither getter cannot be audited at all,
         // and per-field refusals below it would only repeat the same fact. One FAIL, then stop.
         if (!okOwner && !okCallers) {
             _fail(
-                "lockbox.address",
+                string.concat(label, ".address"),
                 string.concat(
-                    VM.toString(declared),
+                    VM.toString(box),
                     " answers neither owner() nor getAllAuthorizedCallers(), so it cannot be audited as an ERC20LockBox"
                 )
             );
             return;
         }
-        if (VM.keyExistsJson(json, ".roles.lockbox.owner")) {
+        if (VM.keyExistsJson(json, string.concat(path, ".owner"))) {
             _checkReadAddress(
-                "lockbox.owner", "owner()", okOwner, VM.parseJsonAddress(json, ".roles.lockbox.owner"), owner_
+                string.concat(label, ".owner"),
+                "owner()",
+                okOwner,
+                VM.parseJsonAddress(json, string.concat(path, ".owner")),
+                owner_
             );
         } else {
-            _skip("lockbox.owner", "not declared - run snapshot-chain to backfill it");
+            _skip(string.concat(label, ".owner"), "not declared - run snapshot-chain to backfill it");
         }
-        _auditPendingOwner("lockbox", declared);
-        if (VM.keyExistsJson(json, ".roles.lockbox.authorizedCallers")) {
+        _auditPendingOwner(label, box);
+        if (VM.keyExistsJson(json, string.concat(path, ".authorizedCallers"))) {
             _checkReadSet(
-                "lockbox.authorizedCallers",
+                string.concat(label, ".authorizedCallers"),
                 "getAllAuthorizedCallers()",
                 okCallers,
-                VM.parseJsonAddressArray(json, ".roles.lockbox.authorizedCallers"),
+                VM.parseJsonAddressArray(json, string.concat(path, ".authorizedCallers")),
                 callers
             );
         } else {
-            _skip("lockbox.authorizedCallers", "not declared - run snapshot-chain to backfill it");
+            _skip(string.concat(label, ".authorizedCallers"), "not declared - run snapshot-chain to backfill it");
+        }
+    }
+
+    function _containsAddr(address[] memory set, address a) private pure returns (bool) {
+        for (uint256 i = 0; i < set.length; i++) {
+            if (set[i] == a) return true;
         }
+        return false;
     }
 
     function _auditHooks(string memory json) private {
diff --git a/src/roles/RolesProbes.sol b/src/roles/RolesProbes.sol
index 26a023d..de0feb8 100644
--- a/src/roles/RolesProbes.sol
+++ b/src/roles/RolesProbes.sol
@@ -13,6 +13,11 @@ import {TolerantCall} from "../utils/TolerantCall.sol";
 /// `MINTER_ROLE()`/`BURNER_ROLE()`/`BURN_MINT_ADMIN_ROLE()` getters take precedence when exposed
 /// (`roleIdOrDefault`), so a token that renames its role ids still reconciles.
 library RolesProbes {
+    struct LockBoxConfigView {
+        uint64 remoteChainSelector;
+        address lockBox;
+    }
+
     /// @notice The four token templates the roles engine dispatches on (`roles.token.type`).
     /// The admin MODEL differs per template, so nothing is assumed from a single variant:
     ///   - `CrossChainToken` (`"crosschain"`): OZ `AccessControlDefaultAdminRules` - single-holder
@@ -86,6 +91,38 @@ library RolesProbes {
         return (false, new address[](0));
     }
 
+    /// @dev A Siloed 2.0 pool's distinct lock boxes, from `getAllLockBoxConfigs()` ((uint64,address)[],
+    /// 64 bytes per element). `ok` is false for any other pool.
+    function _trySiloedLockBoxes(address pool) internal view returns (bool ok, address[] memory boxes) {
+        (bool s, bytes memory ret) = pool.staticcall(abi.encodeWithSignature("getAllLockBoxConfigs()"));
+        if (!s || !TolerantCall._decodesAsDynamic(ret, 64)) return (false, new address[](0));
+        (, address[] memory raw) = _splitConfigs(ret);
+        address[] memory uniq = new address[](raw.length);
+        uint256 n = 0;
+        for (uint256 i = 0; i < raw.length; i++) {
+            bool seen = false;
+            for (uint256 j = 0; j < n; j++) {
+                if (uniq[j] == raw[i]) seen = true;
+            }
+            if (!seen) uniq[n++] = raw[i];
+        }
+        boxes = new address[](n);
+        for (uint256 i = 0; i < n; i++) {
+            boxes[i] = uniq[i];
+        }
+        return (true, boxes);
+    }
+
+    function _splitConfigs(bytes memory ret) private pure returns (uint64[] memory sels, address[] memory boxes) {
+        LockBoxConfigView[] memory cfg = abi.decode(ret, (LockBoxConfigView[]));
+        sels = new uint64[](cfg.length);
+        boxes = new address[](cfg.length);
+        for (uint256 i = 0; i < cfg.length; i++) {
+            sels[i] = cfg[i].remoteChainSelector;
+            boxes[i] = cfg[i].lockBox;
+        }
+    }
+
     // ---------------------------------------------------------------- token template dispatch
 
     /// @notice Detect the token's template from its ACTUAL surface (never from its name):
diff --git a/src/roles/RolesSnapshot.sol b/src/roles/RolesSnapshot.sol
index 204e00d..97ad7d2 100644
--- a/src/roles/RolesSnapshot.sol
+++ b/src/roles/RolesSnapshot.sol
@@ -293,6 +293,10 @@ contract RolesSnapshot {
         // forge-lint: disable-next-line(unused-return) - vm.serializeX accumulator; only the final return is used
         if (bytes(sub).length != 0) VM.serializeString(root, "lockbox", sub);
 
+        sub = _siloedLockboxesBlock(c.name, c.pool);
+        // forge-lint: disable-next-line(unused-return) - vm.serializeX accumulator; only the final return is used
+        if (bytes(sub).length != 0) VM.serializeString(root, "lockboxes", sub);
+
         sub = _hooksBlock(c.name, json, c.pool, c.isV2);
         // forge-lint: disable-next-line(unused-return) - vm.serializeX accumulator; only the final return is used
         if (bytes(sub).length != 0) VM.serializeString(root, "hooks", sub);
@@ -755,6 +759,25 @@ contract RolesSnapshot {
         return out;
     }
 
+    /// @dev A Siloed 2.0 pool's boxes, keyed by box address (one per silo, shared boxes once).
+    function _siloedLockboxesBlock(string memory name, address pool) private returns (string memory) {
+        (bool siloed, address[] memory boxes) = RolesProbes._trySiloedLockBoxes(pool);
+        if (!siloed || boxes.length == 0) return "";
+        string memory map = string.concat("roles-lockboxes-", name);
+        string memory out;
+        for (uint256 i = 0; i < boxes.length; i++) {
+            string memory key = VM.toString(boxes[i]);
+            string memory obj = string.concat("roles-lockboxes-", name, "-", key);
+            string memory entry = "{}";
+            entry = _putAddr(obj, string.concat("lockboxes.", key), "owner", entry, boxes[i], "owner()");
+            entry = _putAddrArray(
+                obj, string.concat("lockboxes.", key), "authorizedCallers", entry, boxes[i], "getAllAuthorizedCallers()"
+            );
+            out = VM.serializeString(map, key, entry);
+        }
+        return out;
+    }
+
     /// @dev Hooks resolution: the pool's live `getAdvancedPoolHooks()` (v2, when attached) > the
     /// previously declared `.roles.hooks.address` (a deployed-but-detached hooks contract).
     function _hooksBlock(string memory name, string memory json, address pool, bool isV2)
diff --git a/src/utils/RegistryWriter.sol b/src/utils/RegistryWriter.sol
index 9706a1d..1b836d9 100644
--- a/src/utils/RegistryWriter.sol
+++ b/src/utils/RegistryWriter.sol
@@ -383,6 +383,67 @@ library RegistryWriter {
         return string(trimmed);
     }
 
+    /// @notice The `active` role whose pointer holds `value` (case-insensitive), or "" when none does.
+    function _activeRoleFor(string memory selectorName, string memory value) internal view returns (string memory) {
+        (string[] memory aKeys, string[] memory aVals,,) = _loadMaps(selectorName);
+        bytes32 want = keccak256(bytes(_lower(value)));
+        for (uint256 i = 0; i < aVals.length; i++) {
+            if (keccak256(bytes(_lower(aVals[i]))) == want) return aKeys[i];
+        }
+        return "";
+    }
+
+    /// @notice Removes `deployments[deploymentName]` and nothing else; returns the removed value. Refuses
+    /// when the entry is absent or still named by an `active` pointer: forgetting the live artifact would
+    /// leave scripts resolving nothing. The value survives in `history/` if it was ever broadcast.
+    function _forgetDeployment(string memory selectorName, string memory deploymentName)
+        internal
+        returns (string memory removed)
+    {
+        (string[] memory aKeys, string[] memory aVals, string[] memory dKeys, string[] memory dVals) =
+            _loadMaps(selectorName);
+        for (uint256 i = 0; i < dKeys.length; i++) {
+            if (keccak256(bytes(dKeys[i])) == keccak256(bytes(deploymentName))) removed = dVals[i];
+        }
+        require(
+            bytes(removed).length != 0,
+            string.concat(
+                "RegistryWriter: no deployments entry '", deploymentName, "' in ", ProjectStore._display(selectorName)
+            )
+        );
+        string memory role = _activeRoleFor(selectorName, removed);
+        require(
+            bytes(role).length == 0,
+            string.concat(
+                "RegistryWriter: '",
+                deploymentName,
+                "' is active.",
+                role,
+                " - point that role elsewhere before forgetting it"
+            )
+        );
+        (dKeys, dVals) = _remove(dKeys, dVals, deploymentName);
+        _store(selectorName, aKeys, aVals, dKeys, dVals);
+        console.log(
+            string.concat(
+                "Store updated: ",
+                ProjectStore._display(selectorName),
+                " (removed addresses.deployments.",
+                deploymentName,
+                ")"
+            )
+        );
+    }
+
+    function _lower(string memory s) private pure returns (string memory) {
+        bytes memory b = bytes(s);
+        bytes memory out = new bytes(b.length);
+        for (uint256 i = 0; i < b.length; i++) {
+            out[i] = (b[i] >= "A" && b[i] <= "Z") ? bytes1(uint8(b[i]) + 32) : b[i];
+        }
+        return string(out);
+    }
+
     /// @notice Upserts a named `deployments[deploymentName]` entry, preserving every other entry. EVM
     /// convenience wrapper.
     function _setDeployment(string memory selectorName, string memory deploymentName, address addr) internal {
diff --git a/test/actions/PoolVersionDispatch.t.sol b/test/actions/PoolVersionDispatch.t.sol
index fed2dde..e66c571 100644
--- a/test/actions/PoolVersionDispatch.t.sol
+++ b/test/actions/PoolVersionDispatch.t.sol
@@ -314,36 +314,38 @@ contract PoolVersionDispatchTest is Test {
     ///      src/PoolVersions.sol fails here cell by cell. The two count assertions force this test
     ///      to be extended whenever a version or an operation is added.
     function test_CapabilityRangeTable_EveryCell() public pure {
-        assertEq(uint256(type(PoolVersions.Version).max), 4, "new version added; extend the expected rows");
-        assertEq(uint256(type(PoolVersions.Op).max), 19, "new operation added; extend the expected rows");
-
-        // Rows are [V1_5_0, V1_5_1, V1_6_1, V2_0_0].
-        _assertRow(PoolVersions.Op.APPLY_CHAIN_UPDATES, [false, true, true, true]);
-        _assertRow(PoolVersions.Op.APPLY_CHAIN_UPDATES_V150, [true, false, false, false]);
-        _assertRow(PoolVersions.Op.ADD_REMOTE_POOL, [false, true, true, true]);
-        _assertRow(PoolVersions.Op.REMOVE_REMOTE_POOL, [false, true, true, true]);
-        _assertRow(PoolVersions.Op.GET_REMOTE_POOLS, [false, true, true, true]);
-        _assertRow(PoolVersions.Op.GET_REMOTE_POOL, [true, false, false, false]);
-        _assertRow(PoolVersions.Op.SET_CHAIN_RATE_LIMITER_CONFIG, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.SET_RATE_LIMIT_CONFIG, [false, false, false, true]);
-        _assertRow(PoolVersions.Op.SET_ROUTER, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.SET_RATE_LIMIT_ADMIN, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.SET_DYNAMIC_CONFIG, [false, false, false, true]);
-        _assertRow(PoolVersions.Op.APPLY_ALLOW_LIST_UPDATES_POOL, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.SET_TOKEN_TRANSFER_FEE_CONFIG, [false, false, false, true]);
-        _assertRow(PoolVersions.Op.SET_ALLOWED_FINALITY_CONFIG, [false, false, false, true]);
-        _assertRow(PoolVersions.Op.APPLY_CCV_CONFIG, [false, false, false, true]);
-        _assertRow(PoolVersions.Op.SET_CCV_THRESHOLD, [false, false, false, true]);
+        assertEq(uint256(type(PoolVersions.Version).max), 5, "new version added; extend the expected rows");
+        assertEq(uint256(type(PoolVersions.Op).max), 21, "new operation added; extend the expected rows");
+
+        // Rows are [V1_5_0, V1_5_1, V1_6_0, V1_6_1, V2_0_0]. 1.6.0 shares 1.6.1's callable surface.
+        _assertRow(PoolVersions.Op.APPLY_CHAIN_UPDATES, [false, true, true, true, true]);
+        _assertRow(PoolVersions.Op.APPLY_CHAIN_UPDATES_V150, [true, false, false, false, false]);
+        _assertRow(PoolVersions.Op.ADD_REMOTE_POOL, [false, true, true, true, true]);
+        _assertRow(PoolVersions.Op.REMOVE_REMOTE_POOL, [false, true, true, true, true]);
+        _assertRow(PoolVersions.Op.GET_REMOTE_POOLS, [false, true, true, true, true]);
+        _assertRow(PoolVersions.Op.GET_REMOTE_POOL, [true, false, false, false, false]);
+        _assertRow(PoolVersions.Op.SET_CHAIN_RATE_LIMITER_CONFIG, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SET_RATE_LIMIT_CONFIG, [false, false, false, false, true]);
+        _assertRow(PoolVersions.Op.SET_ROUTER, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SET_RATE_LIMIT_ADMIN, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SET_DYNAMIC_CONFIG, [false, false, false, false, true]);
+        _assertRow(PoolVersions.Op.APPLY_ALLOW_LIST_UPDATES_POOL, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SET_TOKEN_TRANSFER_FEE_CONFIG, [false, false, false, false, true]);
+        _assertRow(PoolVersions.Op.SET_ALLOWED_FINALITY_CONFIG, [false, false, false, false, true]);
+        _assertRow(PoolVersions.Op.APPLY_CCV_CONFIG, [false, false, false, false, true]);
+        _assertRow(PoolVersions.Op.SET_CCV_THRESHOLD, [false, false, false, false, true]);
         // v1.x LockRelease rebalancer/liquidity surface: present 1.5.0/1.5.1/1.6.1, REMOVED in 2.0.0
         // (the external lock box replaced pool-held liquidity).
-        _assertRow(PoolVersions.Op.GET_REBALANCER, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.SET_REBALANCER, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.PROVIDE_LIQUIDITY, [true, true, true, false]);
-        _assertRow(PoolVersions.Op.WITHDRAW_LIQUIDITY, [true, true, true, false]);
+        _assertRow(PoolVersions.Op.GET_REBALANCER, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SET_REBALANCER, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.PROVIDE_LIQUIDITY, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.WITHDRAW_LIQUIDITY, [true, true, true, true, false]);
+        _assertRow(PoolVersions.Op.SILOED_LIQUIDITY, [false, false, true, true, false]);
+        _assertRow(PoolVersions.Op.CONFIGURE_LOCK_BOXES, [false, false, false, false, true]);
     }
 
-    function _assertRow(PoolVersions.Op op, bool[4] memory expected) internal pure {
-        for (uint256 i = 0; i < 4; i++) {
+    function _assertRow(PoolVersions.Op op, bool[5] memory expected) internal pure {
+        for (uint256 i = 0; i < 5; i++) {
             PoolVersions.Version v = PoolVersions.Version(i + 1);
             assertEq(
                 PoolVersions._isSupported(op, v),
@@ -358,7 +360,8 @@ contract PoolVersionDispatchTest is Test {
         assertEq(uint256(PoolVersions._fromVersionToken("1.5.1")), uint256(PoolVersions.Version.V1_5_1), "1.5.1");
         assertEq(uint256(PoolVersions._fromVersionToken("1.6.1")), uint256(PoolVersions.Version.V1_6_1), "1.6.1");
         assertEq(uint256(PoolVersions._fromVersionToken("2.0.0")), uint256(PoolVersions.Version.V2_0_0), "2.0.0");
-        assertEq(uint256(PoolVersions._fromVersionToken("1.6.0")), uint256(PoolVersions.Version.UNKNOWN), "1.6.0");
+        assertEq(uint256(PoolVersions._fromVersionToken("1.6.0")), uint256(PoolVersions.Version.V1_6_0), "1.6.0");
+        assertEq(uint256(PoolVersions._fromVersionToken("1.6.2")), uint256(PoolVersions.Version.UNKNOWN), "1.6.2");
         assertEq(uint256(PoolVersions._fromVersionToken("")), uint256(PoolVersions.Version.UNKNOWN), "empty");
         assertEq(PoolVersions._toString(PoolVersions.Version.V1_5_1), "1.5.1", "toString");
         assertEq(PoolVersions._toString(PoolVersions.Version.UNKNOWN), "unknown", "toString unknown");
@@ -481,7 +484,7 @@ contract PoolVersionDispatchTest is Test {
         _assertContains(reason, "UnsupportedPoolVersion");
         _assertContains(reason, vm.toString(unknown));
         _assertContains(reason, "BurnMintTokenPool 1.6.0");
-        _assertContains(reason, "1.5.0, 1.5.1, 1.6.1, 2.0.0");
+        _assertContains(reason, "1.6.0 (SiloedLockReleaseTokenPool only)");
         _assertContains(reason, "npm package versions are not pool versions");
         _assertContains(reason, "POOL_VERSION_OVERRIDE");
         _assertContains(reason, "docs/pool-versions.md#unknown-versions");
@@ -507,6 +510,21 @@ contract PoolVersionDispatchTest is Test {
         _assertContains(reason, "POOL_VERSION_OVERRIDE");
     }
 
+    function test_Siloed_ResolvesAcrossReleases() public {
+        (PoolVersions.Version v,) = shim.resolve(address(new MockTypeAndVersion("SiloedLockReleaseTokenPool 1.6.0")));
+        assertEq(uint256(v), uint256(PoolVersions.Version.V1_6_0), "Siloed 1.6.0");
+        (v,) = shim.resolve(address(new MockTypeAndVersion("SiloedLockReleaseTokenPool 1.6.1")));
+        assertEq(uint256(v), uint256(PoolVersions.Version.V1_6_1), "Siloed 1.6.1");
+        (v,) = shim.resolve(address(new MockTypeAndVersion("SiloedLockReleaseTokenPool 2.0.0")));
+        assertEq(uint256(v), uint256(PoolVersions.Version.V2_0_0), "Siloed 2.0.0");
+    }
+
+    function test_Refusal_Siloed164Uncataloged() public {
+        // 1.6.4 carries the 1.6-style lockbox constructor and its own liquidity path; not cataloged.
+        string memory reason = _catchResolve(address(new MockTypeAndVersion("SiloedLockReleaseTokenPool 1.6.4")));
+        _assertContains(reason, "UnsupportedPoolVersion");
+    }
+
     function test_Refusal_UnsupportedOperation() public {
         // The v1 rate-limit setter was REMOVED in 2.0.0: a floor check would wrongly pass here.
         try shim.requireSupports(PoolVersions.Op.SET_CHAIN_RATE_LIMITER_CONFIG, PoolVersions.Version.V2_0_0, POOL) {
diff --git a/test/config/AdoptToken.t.sol b/test/config/AdoptToken.t.sol
index 78847e1..dcc14f2 100644
--- a/test/config/AdoptToken.t.sol
+++ b/test/config/AdoptToken.t.sol
@@ -162,7 +162,7 @@ contract AdoptTokenForkTest is Test {
             revert("unknown-version pool unexpectedly adopted");
         } catch Error(string memory reason) {
             assertTrue(_contains(reason, "UnsupportedPoolVersion"), reason);
-            assertTrue(_contains(reason, "1.5.0, 1.5.1, 1.6.1, 2.0.0"), reason);
+            assertTrue(_contains(reason, "1.6.0 (SiloedLockReleaseTokenPool only), 1.6.1, 2.0.0"), reason);
         }
     }
 
diff --git a/test/config/AdoptTokenLockBoxes.t.sol b/test/config/AdoptTokenLockBoxes.t.sol
new file mode 100644
index 0000000..2b7209b
--- /dev/null
+++ b/test/config/AdoptTokenLockBoxes.t.sol
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {Test} from "forge-std/Test.sol";
+import {AdoptToken} from "../../script/config/AdoptToken.s.sol";
+import {MockSiloedPool} from "./VerifyChainSiloedLockBoxes.t.sol";
+
+contract MockLockReleaseV2 {
+    address public immutable box;
+
+    constructor(address box_) {
+        box = box_;
+    }
+
+    function getLockBox() external view returns (address) {
+        return box;
+    }
+}
+
+/// @notice adopt-token discovers the lock boxes of a 2.0 pool it did not deploy.
+contract AdoptTokenLockBoxesTest is Test {
+    AdoptToken internal adopt;
+
+    function setUp() public {
+        adopt = new AdoptToken();
+    }
+
+    function test_LockReleaseV2_SingleBox() public {
+        MockLockReleaseV2 pool = new MockLockReleaseV2(address(0xB0B));
+        (address[] memory boxes, uint64[] memory first) =
+            adopt.lockBoxesOfForTest(address(pool), "LockReleaseTokenPool");
+        assertEq(boxes.length, 1);
+        assertEq(boxes[0], address(0xB0B));
+        assertEq(first.length, 0, "a single box is the active one, not a silo");
+    }
+
+    function test_Siloed_DistinctBoxesWithFirstChain() public {
+        MockSiloedPool pool = new MockSiloedPool("SiloedLockReleaseTokenPool 2.0.0", address(1));
+        pool.mapBox(7, address(0xA));
+        pool.mapBox(8, address(0xB));
+        pool.mapBox(9, address(0xA));
+        (address[] memory boxes, uint64[] memory first) =
+            adopt.lockBoxesOfForTest(address(pool), "SiloedLockReleaseTokenPool");
+        assertEq(boxes.length, 2, "shared box listed once");
+        assertEq(boxes[0], address(0xA));
+        assertEq(first[0], 7, "named after the first chain it serves");
+        assertEq(boxes[1], address(0xB));
+        assertEq(first[1], 8);
+    }
+
+    function test_OtherPoolTypes_NoBoxes() public {
+        MockLockReleaseV2 pool = new MockLockReleaseV2(address(0xB0B));
+        (address[] memory boxes,) = adopt.lockBoxesOfForTest(address(pool), "BurnMintTokenPool");
+        assertEq(boxes.length, 0);
+        (boxes,) = adopt.lockBoxesOfForTest(address(0xDEAD), "LockReleaseTokenPool");
+        assertEq(boxes.length, 0, "a pool that does not answer yields nothing");
+    }
+}
diff --git a/test/config/ForgetDeployment.t.sol b/test/config/ForgetDeployment.t.sol
new file mode 100644
index 0000000..7a59123
--- /dev/null
+++ b/test/config/ForgetDeployment.t.sol
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {Test} from "forge-std/Test.sol";
+import {RegistryWriter} from "../../src/utils/RegistryWriter.sol";
+import {ProjectScratch} from "../utils/ProjectScratch.sol";
+import {ForgetDeployment} from "../../script/config/ForgetDeployment.s.sol";
+
+contract ForgetHarness {
+    function record(string memory sel, string memory role, string memory name, address addr) external {
+        RegistryWriter._recordDeterministic(sel, role, name, addr);
+    }
+
+    function setDeployment(string memory sel, string memory name, address addr) external {
+        RegistryWriter._setDeployment(sel, name, addr);
+    }
+
+    function forget(string memory sel, string memory name) external returns (string memory) {
+        return RegistryWriter._forgetDeployment(sel, name);
+    }
+
+    function readDeployment(string memory sel, string memory name) external view returns (address) {
+        return RegistryWriter._readDeployment(sel, name);
+    }
+
+    function read(string memory sel, string memory role) external view returns (address) {
+        return RegistryWriter._read(sel, role);
+    }
+}
+
+contract MockRegistry {
+    address public registered;
+
+    constructor(address pool) {
+        registered = pool;
+    }
+
+    function getPool(address) external view returns (address) {
+        return registered;
+    }
+}
+
+contract MockPool {
+    uint64[] internal s_chains;
+
+    constructor(uint256 n) {
+        for (uint256 i = 0; i < n; i++) {
+            s_chains.push(uint64(i + 1));
+        }
+    }
+
+    function getSupportedChains() external view returns (uint64[] memory) {
+        return s_chains;
+    }
+}
+
+contract MockBalanceToken {
+    uint256 public held;
+
+    constructor(uint256 amount) {
+        held = amount;
+    }
+
+    function balanceOf(address) external view returns (uint256) {
+        return held;
+    }
+}
+
+/// @notice `make forget-deployment`: removes one retired `deployments{}` entry and nothing else, and refuses
+/// anything still in use, in the store or on-chain.
+contract ForgetDeploymentTest is Test {
+    string internal constant SEL_REMOVE = "zz-scratch-forget-remove";
+    string internal constant SEL_ACTIVE = "zz-scratch-forget-active";
+    string internal constant SEL_ABSENT = "zz-scratch-forget-absent";
+    address internal constant TOKEN = address(0x1111111111111111111111111111111111111111);
+    address internal constant OLD_POOL = address(0x2222222222222222222222222222222222222222);
+    address internal constant NEW_POOL = address(0x3333333333333333333333333333333333333333);
+
+    ForgetHarness internal harness;
+    ForgetDeployment internal script;
+
+    function setUp() public {
+        harness = new ForgetHarness();
+        script = new ForgetDeployment();
+        ProjectScratch.clean(SEL_REMOVE);
+        ProjectScratch.clean(SEL_ACTIVE);
+        ProjectScratch.clean(SEL_ABSENT);
+    }
+
+    function test_RemovesOnlyTheRetiredEntry() public {
+        harness.record(SEL_REMOVE, "token", "WBTC_Token", TOKEN);
+        harness.setDeployment(SEL_REMOVE, "WBTC_BurnMintTokenPool_1.5.1", OLD_POOL);
+        harness.record(SEL_REMOVE, "tokenPool", "WBTC_BurnMintTokenPool_2.0.0", NEW_POOL);
+
+        harness.forget(SEL_REMOVE, "WBTC_BurnMintTokenPool_1.5.1");
+
+        assertEq(harness.readDeployment(SEL_REMOVE, "WBTC_BurnMintTokenPool_1.5.1"), address(0), "old entry gone");
+        assertEq(harness.readDeployment(SEL_REMOVE, "WBTC_BurnMintTokenPool_2.0.0"), NEW_POOL, "new entry kept");
+        assertEq(harness.read(SEL_REMOVE, "tokenPool"), NEW_POOL, "active pointer kept");
+        assertEq(harness.read(SEL_REMOVE, "token"), TOKEN, "token kept");
+        ProjectScratch.clean(SEL_REMOVE);
+    }
+
+    function test_RefusesTheActiveEntry() public {
+        harness.record(SEL_ACTIVE, "tokenPool", "WBTC_BurnMintTokenPool_2.0.0", NEW_POOL);
+        vm.expectRevert(
+            bytes(
+                "RegistryWriter: 'WBTC_BurnMintTokenPool_2.0.0' is active.tokenPool - point that role elsewhere before forgetting it"
+            )
+        );
+        harness.forget(SEL_ACTIVE, "WBTC_BurnMintTokenPool_2.0.0");
+        ProjectScratch.clean(SEL_ACTIVE);
+    }
+
+    function test_RefusesAnAbsentEntry() public {
+        harness.record(SEL_ABSENT, "token", "WBTC_Token", TOKEN);
+        vm.expectRevert();
+        harness.forget(SEL_ABSENT, "WBTC_BurnMintTokenPool_9.9.9");
+        ProjectScratch.clean(SEL_ABSENT);
+    }
+
+    function test_LiveUse_StillRegisteredPool() public {
+        MockPool pool = new MockPool(0);
+        MockRegistry tar = new MockRegistry(address(pool));
+        string memory reason = script.liveUseReason("WBTC_BurnMintTokenPool_1.5.1", address(pool), TOKEN, address(tar));
+        assertTrue(bytes(reason).length > 0, "registered pool refused");
+        assertTrue(vm.indexOf(reason, "TokenAdminRegistry routes to") != type(uint256).max, reason);
+    }
+
+    function test_LiveUse_PoolWithLanes() public {
+        MockPool pool = new MockPool(2);
+        MockRegistry tar = new MockRegistry(NEW_POOL);
+        string memory reason = script.liveUseReason("WBTC_BurnMintTokenPool_1.5.1", address(pool), TOKEN, address(tar));
+        assertTrue(vm.indexOf(reason, "still supports 2 remote chain(s)") != type(uint256).max, reason);
+    }
+
+    function test_LiveUse_RetiredPoolIsSafe() public {
+        MockPool pool = new MockPool(0);
+        MockRegistry tar = new MockRegistry(NEW_POOL);
+        assertEq(script.liveUseReason("WBTC_BurnMintTokenPool_1.5.1", address(pool), TOKEN, address(tar)), "");
+    }
+
+    function test_LiveUse_FundedLockBox() public {
+        MockBalanceToken token = new MockBalanceToken(5);
+        string memory reason = script.liveUseReason("WBTC_LockBox_fuji", address(0xB0B), address(token), address(0));
+        assertTrue(vm.indexOf(reason, "still holds 5") != type(uint256).max, reason);
+        MockBalanceToken empty = new MockBalanceToken(0);
+        assertEq(script.liveUseReason("WBTC_LockBox_fuji", address(0xB0B), address(empty), address(0)), "");
+    }
+
+    function test_LiveUse_NonPoolAnswersNothing() public view {
+        // An address with no code is not a live pool; nothing to protect.
+        assertEq(script.liveUseReason("WBTC_BurnMintTokenPool_1.5.1", address(0xDEAD), TOKEN, address(0)), "");
+    }
+}
diff --git a/test/config/VerifyChainSiloedLockBoxes.t.sol b/test/config/VerifyChainSiloedLockBoxes.t.sol
new file mode 100644
index 0000000..743f6be
--- /dev/null
+++ b/test/config/VerifyChainSiloedLockBoxes.t.sol
@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {VerifyChain} from "../../script/config/VerifyChain.s.sol";
+import {LaneReconcileScratch} from "./VerifyChainLaneReconcile.t.sol";
+import {RolesAuditor} from "../../src/roles/RolesAuditor.sol";
+
+contract MockSiloedLockBox {
+    address internal immutable i_token;
+    address[] internal s_callers;
+
+    constructor(address token, address caller) {
+        i_token = token;
+        if (caller != address(0)) s_callers.push(caller);
+    }
+
+    function isTokenSupported(address token) external view returns (bool) {
+        return token == i_token;
+    }
+
+    function getAllAuthorizedCallers() external view returns (address[] memory) {
+        return s_callers;
+    }
+
+    function owner() external pure returns (address) {
+        return address(0xA11CE);
+    }
+}
+
+contract MockSiloedPool {
+    struct LockBoxConfig {
+        uint64 remoteChainSelector;
+        address lockBox;
+    }
+
+    string internal s_version;
+    address public token;
+    uint64[] internal s_chains;
+    LockBoxConfig[] internal s_boxes;
+
+    constructor(string memory version, address token_) {
+        s_version = version;
+        token = token_;
+    }
+
+    function addChain(uint64 selector) external {
+        s_chains.push(selector);
+    }
+
+    function mapBox(uint64 selector, address box) external {
+        s_boxes.push(LockBoxConfig(selector, box));
+    }
+
+    function typeAndVersion() external view returns (string memory) {
+        return s_version;
+    }
+
+    function getToken() external view returns (address) {
+        return token;
+    }
+
+    function isSupportedChain(uint64 selector) external view returns (bool) {
+        for (uint256 i = 0; i < s_chains.length; i++) {
+            if (s_chains[i] == selector) return true;
+        }
+        return false;
+    }
+
+    function getSupportedChains() external view returns (uint64[] memory) {
+        return s_chains;
+    }
+
+    function getAllLockBoxConfigs() external view returns (LockBoxConfig[] memory) {
+        return s_boxes;
+    }
+}
+
+/// @notice doctor's Siloed 2.0 lock box rung: every supported chain needs a box, and every box must hold the
+/// pool token and authorize the pool. Supported chains are left undeclared, so each adds one lanes WARN.
+contract VerifyChainSiloedLockBoxesTest is LaneReconcileScratch {
+    address internal constant TOKEN = address(0x7070);
+    uint64 internal constant CHAIN_A = 1_111_111;
+    uint64 internal constant CHAIN_B = 2_222_222;
+
+    function setUp() public {
+        _cleanupScratchOne("zz-scratch-siloedbox");
+    }
+
+    function _pool(string memory version) internal returns (MockSiloedPool pool) {
+        pool = new MockSiloedPool(version, TOKEN);
+        pool.addChain(CHAIN_A);
+        pool.addChain(CHAIN_B);
+    }
+
+    function _run(MockSiloedPool pool) internal returns (uint256 fails, uint256 warns) {
+        _writeScratchChain("zz-scratch-siloedbox", 887_700_101, 8_877_001_010_000_000_001);
+        (fails, warns) = new VerifyChain().checkLanesOnChainForTest("zz-scratch-siloedbox", address(pool));
+        _cleanupScratchOne("zz-scratch-siloedbox");
+    }
+
+    function test_Pass_EveryChainMappedAndAuthorized() public {
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 2.0.0");
+        pool.mapBox(CHAIN_A, address(new MockSiloedLockBox(TOKEN, address(pool))));
+        pool.mapBox(CHAIN_B, address(new MockSiloedLockBox(TOKEN, address(pool))));
+        (uint256 fails, uint256 warns) = _run(pool);
+        assertEq(fails, 0, "no FAIL");
+        assertEq(warns, 2, "only the two undeclared-lane WARNs");
+    }
+
+    function test_Fail_ChainWithoutLockBox() public {
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 2.0.0");
+        pool.mapBox(CHAIN_A, address(new MockSiloedLockBox(TOKEN, address(pool))));
+        (uint256 fails,) = _run(pool);
+        assertEq(fails, 1, "chain B has no box");
+    }
+
+    function test_Fail_BoxDoesNotAuthorizePool() public {
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 2.0.0");
+        pool.mapBox(CHAIN_A, address(new MockSiloedLockBox(TOKEN, address(pool))));
+        pool.mapBox(CHAIN_B, address(new MockSiloedLockBox(TOKEN, address(0xBEEF))));
+        (uint256 fails,) = _run(pool);
+        assertEq(fails, 1, "box B does not authorize the pool");
+    }
+
+    function test_Fail_BoxHoldsAnotherToken() public {
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 2.0.0");
+        pool.mapBox(CHAIN_A, address(new MockSiloedLockBox(TOKEN, address(pool))));
+        pool.mapBox(CHAIN_B, address(new MockSiloedLockBox(address(0xD1FF), address(pool))));
+        (uint256 fails,) = _run(pool);
+        assertEq(fails, 1, "box B holds another token");
+    }
+
+    function test_Warn_BoxForUnsupportedChain() public {
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 2.0.0");
+        address box = address(new MockSiloedLockBox(TOKEN, address(pool)));
+        pool.mapBox(CHAIN_A, box);
+        pool.mapBox(CHAIN_B, box);
+        pool.mapBox(3_333_333, box);
+        (uint256 fails, uint256 warns) = _run(pool);
+        assertEq(fails, 0, "no FAIL");
+        assertEq(warns, 3, "two undeclared lanes plus the stale mapping");
+    }
+
+    function test_Skip_LegacySiloedPool() public {
+        // 1.6.x keeps liquidity on the pool; there are no lock boxes to reconcile.
+        MockSiloedPool pool = _pool("SiloedLockReleaseTokenPool 1.6.1");
+        (uint256 fails, uint256 warns) = _run(pool);
+        assertEq(fails, 0, "no lock box FAIL on 1.6.1");
+        assertEq(warns, 2, "only the undeclared-lane WARNs");
+    }
+}
+
+/// @notice roles{}: `lockboxes` is keyed by box address and checked two-sided against the pool's map.
+contract RolesSiloedLockBoxesTest is LaneReconcileScratch {
+    function _json(address pool, string memory lockboxes) internal pure returns (string memory) {
+        return string.concat('{"roles":{"pool":{"address":"', vm.toString(pool), '"},"lockboxes":', lockboxes, "}}");
+    }
+
+    function _contains(string memory haystack, string memory needle) internal pure returns (bool) {
+        return vm.indexOf(haystack, needle) != type(uint256).max;
+    }
+
+    function test_Pass_DeclaredMatchesPool() public {
+        MockSiloedPool pool = new MockSiloedPool("SiloedLockReleaseTokenPool 2.0.0", address(0x7070));
+        address box = address(new MockSiloedLockBox(address(0x7070), address(pool)));
+        pool.mapBox(1, box);
+        pool.mapBox(2, box);
+        string memory entry = string.concat(
+            '{"',
+            vm.toString(box),
+            '":{"owner":"',
+            vm.toString(address(0xA11CE)),
+            '","authorizedCallers":["',
+            vm.toString(address(pool)),
+            '"]}}'
+        );
+        RolesAuditor.Result memory r =
+            new RolesAuditor().auditJsonDeny("zz-scratch-roles-lb", _json(address(pool), entry), address(0));
+        assertFalse(_contains(r.failedFields, "lockboxes"), r.failedFields);
+    }
+
+    function test_Fail_UndeclaredAndForeignBoxes() public {
+        MockSiloedPool pool = new MockSiloedPool("SiloedLockReleaseTokenPool 2.0.0", address(0x7070));
+        pool.mapBox(1, address(new MockSiloedLockBox(address(0x7070), address(pool))));
+        string memory entry = '{"0x000000000000000000000000000000000000dEaD":{}}';
+        RolesAuditor.Result memory r =
+            new RolesAuditor().auditJsonDeny("zz-scratch-roles-lb", _json(address(pool), entry), address(0));
+        assertTrue(_contains(r.failedFields, "lockboxes.0x000000000000000000000000000000000000dEaD"), r.failedFields);
+        assertTrue(_contains(r.failedFields, "lockboxes"), r.failedFields);
+    }
+
+    function test_Fail_DeclaredOnNonSiloedPool() public {
+        MockSiloedPool notSiloed = MockSiloedPool(address(new MockSiloedLockBox(address(1), address(0))));
+        RolesAuditor.Result memory r =
+            new RolesAuditor().auditJsonDeny("zz-scratch-roles-lb", _json(address(notSiloed), "{}"), address(0));
+        assertTrue(_contains(r.failedFields, "lockboxes"), r.failedFields);
+    }
+}
diff --git a/test/configure/SiloedLockRelease.t.sol b/test/configure/SiloedLockRelease.t.sol
new file mode 100644
index 0000000..2ab9323
--- /dev/null
+++ b/test/configure/SiloedLockRelease.t.sol
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {TokenPool} from "@chainlink/contracts-ccip/contracts/pools/TokenPool.sol";
+import {SiloedLockReleaseTokenPool} from "@chainlink/contracts-ccip/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {ERC20LockBox} from "@chainlink/contracts-ccip/contracts/pools/ERC20LockBox.sol";
+import {RateLimiter} from "@chainlink/contracts-ccip/contracts/libraries/RateLimiter.sol";
+import {IERC20} from "@openzeppelin/contracts@5.3.0/token/ERC20/IERC20.sol";
+import {BaseForkTest} from "../BaseForkTest.t.sol";
+import {CctActions, ISiloedLockReleaseV16} from "../../src/actions/CctActions.sol";
+import {PoolVersions} from "../../src/PoolVersions.sol";
+import {PoolVersion} from "../../script/utils/PoolVersion.s.sol";
+import {DeployLegacyPool} from "../fixtures/legacy/DeployLegacyPool.s.sol";
+
+contract SiloedResolverShim {
+    function resolve(address pool) external view returns (PoolVersions.Version v, string memory full) {
+        return PoolVersion._resolve(pool);
+    }
+
+    function requireSiloed(address pool, PoolVersions.Op op) external view returns (PoolVersions.Version v) {
+        (v,) = PoolVersion._requireSiloed(pool, op);
+    }
+}
+
+/// @notice The legacy Siloed pools a partner runs today (1.6.0, 1.6.1) and the 2.0.0 target, driven through
+///         the repo's resolver and action layer on a Sepolia fork, with WBTC mainnet's rate limits.
+contract SiloedLockReleaseForkTest is BaseForkTest {
+    uint64 internal constant FUJI = 14767482510784806043;
+    uint64 internal constant BASE = 10344971235874465080;
+    // WBTC Ethereum -> Ronin on mainnet, 8 decimals.
+    uint128 internal constant OUT_CAPACITY = 3_780_000_000;
+    uint128 internal constant OUT_RATE = 43_750;
+    uint128 internal constant IN_CAPACITY = 4_200_000_000;
+    uint128 internal constant IN_RATE = 48_610;
+
+    SiloedResolverShim internal shim;
+    address internal token;
+    address internal owner;
+
+    function setUp() public override {
+        super.setUp();
+        shim = new SiloedResolverShim();
+        token = deployTokenFixture();
+        owner = _scriptBroadcaster();
+        _exec(owner, CctActions._mint(token, owner, 10e8));
+    }
+
+    function _legacy(string memory kind) internal returns (address) {
+        return new DeployLegacyPool().run(kind, token);
+    }
+
+    function _wire(address pool, PoolVersions.Version v, uint64 remote) internal {
+        TokenPool.ChainUpdate[] memory adds = new TokenPool.ChainUpdate[](1);
+        bytes[] memory remotePools = new bytes[](1);
+        remotePools[0] = abi.encode(address(0xBEEF));
+        adds[0] = TokenPool.ChainUpdate({
+            remoteChainSelector: remote,
+            remotePoolAddresses: remotePools,
+            remoteTokenAddress: abi.encode(address(0xCAFE)),
+            outboundRateLimiterConfig: RateLimiter.Config({isEnabled: true, capacity: OUT_CAPACITY, rate: OUT_RATE}),
+            inboundRateLimiterConfig: RateLimiter.Config({isEnabled: true, capacity: IN_CAPACITY, rate: IN_RATE})
+        });
+        PoolVersions._requireSupports(PoolVersions.Op.APPLY_CHAIN_UPDATES, v, pool);
+        _exec(owner, CctActions._applyChainUpdates(pool, new uint64[](0), adds));
+    }
+
+    function test_Legacy_ResolveAndWire() public {
+        string[2] memory kinds = ["siloed-1.6.0", "siloed-1.6.1"];
+        PoolVersions.Version[2] memory expected = [PoolVersions.Version.V1_6_0, PoolVersions.Version.V1_6_1];
+        for (uint256 i = 0; i < 2; i++) {
+            address pool = _legacy(kinds[i]);
+            (PoolVersions.Version v,) = shim.resolve(pool);
+            assertEq(uint256(v), uint256(expected[i]), kinds[i]);
+            _wire(pool, v, FUJI);
+            assertTrue(TokenPool(pool).isSupportedChain(FUJI), "lane added");
+
+            // A day-2 rate-limit change through the version-dispatched builder.
+            RateLimiter.Config memory out =
+                RateLimiter.Config({isEnabled: true, capacity: 2 * OUT_CAPACITY, rate: OUT_RATE});
+            RateLimiter.Config memory inb = RateLimiter.Config({isEnabled: true, capacity: IN_CAPACITY, rate: IN_RATE});
+            _exec(owner, CctActions._setRateLimits(pool, v, FUJI, false, out, inb));
+            (bool ok, bytes memory ret) =
+                pool.staticcall(abi.encodeWithSignature("getCurrentOutboundRateLimiterState(uint64)", FUJI));
+            assertTrue(ok, "v1 getter");
+            (,,, uint128 capacity,) = abi.decode(ret, (uint128, uint32, bool, uint128, uint128));
+            assertEq(capacity, 2 * OUT_CAPACITY, "outbound capacity updated");
+        }
+    }
+
+    /// @dev 1.6.0 kept the 1.5.x validation; 1.6.1 relaxed it. A `capacity=1, rate=1` pause is 1.6.1-only.
+    function test_Legacy_PauseThrottleDiffersBy160() public {
+        address p160 = _legacy("siloed-1.6.0");
+        address p161 = _legacy("siloed-1.6.1");
+        _wire(p160, PoolVersions.Version.V1_6_0, FUJI);
+        _wire(p161, PoolVersions.Version.V1_6_1, FUJI);
+        RateLimiter.Config memory pause = RateLimiter.Config({isEnabled: true, capacity: 1, rate: 1});
+
+        CctActions.Call[] memory c160 =
+            CctActions._setRateLimits(p160, PoolVersions.Version.V1_6_0, FUJI, false, pause, pause);
+        vm.prank(owner);
+        (bool ok,) = c160[0].target.call(c160[0].data);
+        assertFalse(ok, "1.6.0 rejects rate >= capacity");
+
+        _exec(owner, CctActions._setRateLimits(p161, PoolVersions.Version.V1_6_1, FUJI, false, pause, pause));
+    }
+
+    function test_Legacy_SiloLifecycle() public {
+        address pool = _legacy("siloed-1.6.0");
+        _wire(pool, PoolVersions.Version.V1_6_0, FUJI);
+        _wire(pool, PoolVersions.Version.V1_6_0, BASE);
+        shim.requireSiloed(pool, PoolVersions.Op.SILOED_LIQUIDITY);
+        ISiloedLockReleaseV16 p = ISiloedLockReleaseV16(pool);
+
+        ISiloedLockReleaseV16.SiloConfigUpdate[] memory adds = new ISiloedLockReleaseV16.SiloConfigUpdate[](1);
+        adds[0] = ISiloedLockReleaseV16.SiloConfigUpdate({remoteChainSelector: FUJI, rebalancer: owner});
+        _exec(owner, CctActions._updateSiloDesignations(pool, new uint64[](0), adds));
+        assertTrue(p.isSiloed(FUJI), "fuji siloed");
+        assertFalse(p.isSiloed(BASE), "base shared");
+
+        uint256 amount = 1e8;
+        _exec(owner, CctActions._provideSiloedLiquidity(pool, token, FUJI, amount));
+        assertEq(p.getAvailableTokens(FUJI), amount, "silo funded");
+        assertEq(p.getUnsiloedLiquidity(), 0, "shared untouched");
+        assertEq(p.getAvailableTokens(BASE), 0, "base reads the shared bucket");
+
+        // Mainnet parks the Ronin silo rebalancer at 0x1; taking it back is the first migration step.
+        _exec(owner, CctActions._setSiloRebalancer(pool, FUJI, address(1)));
+        vm.expectRevert();
+        vm.prank(owner);
+        p.withdrawSiloedLiquidity(FUJI, amount);
+        _exec(owner, CctActions._setSiloRebalancer(pool, FUJI, owner));
+
+        uint256 before = IERC20(token).balanceOf(owner);
+        _exec(owner, CctActions._withdrawSiloedLiquidity(pool, FUJI, amount));
+        assertEq(IERC20(token).balanceOf(owner) - before, amount, "silo drained to the rebalancer");
+        assertEq(p.getAvailableTokens(FUJI), 0, "silo empty");
+    }
+
+    function test_Siloed160_RefusesLockBoxOp() public {
+        address pool = _legacy("siloed-1.6.0");
+        vm.expectRevert();
+        shim.requireSiloed(pool, PoolVersions.Op.CONFIGURE_LOCK_BOXES);
+    }
+
+    function test_V2_LockBoxPerSilo() public {
+        vm.prank(owner);
+        SiloedLockReleaseTokenPool pool =
+            new SiloedLockReleaseTokenPool(IERC20(token), 18, address(0), networkConfig.rmnProxy, networkConfig.router);
+        _wire(address(pool), PoolVersions.Version.V2_0_0, FUJI);
+        _wire(address(pool), PoolVersions.Version.V2_0_0, BASE);
+        shim.requireSiloed(address(pool), PoolVersions.Op.CONFIGURE_LOCK_BOXES);
+        vm.expectRevert(abi.encodeWithSelector(SiloedLockReleaseTokenPool.LockBoxNotConfigured.selector, FUJI));
+        pool.getLockBox(FUJI);
+
+        ERC20LockBox fujiBox = new ERC20LockBox(token);
+        ERC20LockBox baseBox = new ERC20LockBox(token);
+        address[] memory callers = new address[](1);
+        callers[0] = address(pool);
+        _exec(address(this), CctActions._applyAuthorizedCallerUpdates(address(fujiBox), callers, new address[](0)));
+        _exec(address(this), CctActions._applyAuthorizedCallerUpdates(address(baseBox), callers, new address[](0)));
+
+        SiloedLockReleaseTokenPool.LockBoxConfig[] memory cfg = new SiloedLockReleaseTokenPool.LockBoxConfig[](2);
+        cfg[0] = SiloedLockReleaseTokenPool.LockBoxConfig({remoteChainSelector: FUJI, lockBox: address(fujiBox)});
+        cfg[1] = SiloedLockReleaseTokenPool.LockBoxConfig({remoteChainSelector: BASE, lockBox: address(baseBox)});
+        _exec(owner, CctActions._configureLockBoxes(address(pool), cfg));
+        assertEq(address(pool.getLockBox(FUJI)), address(fujiBox), "fuji box");
+        assertEq(address(pool.getLockBox(BASE)), address(baseBox), "base box");
+
+        // Migration target: silo liquidity withdrawn from 1.6 lands in the chain's box via deposit.
+        address[] memory op = new address[](1);
+        op[0] = owner;
+        _exec(address(this), CctActions._applyAuthorizedCallerUpdates(address(fujiBox), op, new address[](0)));
+        _exec(owner, CctActions._lockboxDeposit(address(fujiBox), token, 1e8));
+        assertEq(IERC20(token).balanceOf(address(fujiBox)), 1e8, "fuji box funded");
+        assertEq(IERC20(token).balanceOf(address(baseBox)), 0, "base box isolated");
+    }
+}
diff --git a/test/fixtures/legacy/DeployLegacyPool.s.sol b/test/fixtures/legacy/DeployLegacyPool.s.sol
new file mode 100644
index 0000000..ba2284b
--- /dev/null
+++ b/test/fixtures/legacy/DeployLegacyPool.s.sol
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+import {Script, console} from "forge-std/Script.sol";
+import {HelperConfig} from "../../../script/HelperConfig.s.sol";
+import {IERC20Metadata} from "@openzeppelin/contracts@5.3.0/token/ERC20/extensions/IERC20Metadata.sol";
+import {LegacyPools} from "./LegacyPools.sol";
+
+/// @notice Deploys a released legacy pool for a staging fixture that mirrors a partner deployment. It records
+///         nothing: `make adopt-token` takes the pool into the project store, which is the support check.
+///
+/// `kind` is one of siloed-1.6.0 | siloed-1.6.1 | burnmint-1.5.1 | burnmint-1.6.1.
+///
+/// Usage:
+///   forge script test/fixtures/legacy/DeployLegacyPool.s.sol --sig "run(string,address)" siloed-1.6.0 <token> \
+///     --rpc-url $ETHEREUM_SEPOLIA_RPC_URL --account <KEYSTORE_NAME> --broadcast
+contract DeployLegacyPool is Script, LegacyPools {
+    function run(string memory kind, address token) external returns (address pool) {
+        HelperConfig helperConfig = new HelperConfig();
+        HelperConfig.NetworkConfig memory config = helperConfig.getNetworkConfig(block.chainid);
+        require(config.router != address(0) && config.rmnProxy != address(0), "router/rmnProxy missing in chain config");
+
+        uint8 decimals = IERC20Metadata(token).decimals();
+        bytes memory args = abi.encode(token, decimals, new address[](0), config.rmnProxy, config.router);
+
+        vm.startBroadcast();
+        pool = _deploy(bytes.concat(_creationCode(kind), args));
+        vm.stopBroadcast();
+
+        console.log(string.concat("Legacy pool (", kind, "): ", vm.toString(pool)));
+        console.log(string.concat("  router ", vm.toString(config.router), "  rmnProxy ", vm.toString(config.rmnProxy)));
+    }
+
+    function _creationCode(string memory kind) internal pure returns (bytes memory) {
+        bytes[4] memory codes = _legacyPoolCreationCodes();
+        bytes32 k = keccak256(bytes(kind));
+        if (k == keccak256("siloed-1.6.0")) return codes[0];
+        if (k == keccak256("burnmint-1.5.1")) return codes[1];
+        if (k == keccak256("siloed-1.6.1")) return codes[2];
+        if (k == keccak256("burnmint-1.6.1")) return codes[3];
+        revert(string.concat("Unknown legacy pool kind '", kind, "'"));
+    }
+
+    function _deploy(bytes memory initCode) internal returns (address addr) {
+        assembly {
+            addr := create(0, add(initCode, 0x20), mload(initCode))
+        }
+        require(addr != address(0), "pool deployment reverted");
+    }
+}
diff --git a/test/fixtures/legacy/LegacyPools.sol b/test/fixtures/legacy/LegacyPools.sol
new file mode 100644
index 0000000..ebd62c3
--- /dev/null
+++ b/test/fixtures/legacy/LegacyPools.sol
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.24;
+
+// Pools as released, compiled from the npm tarballs of those releases, for fixtures that stand in for
+// partner deployments. npm 1.6.0 stamps its BurnMintTokenPool "1.5.1"; there is no BurnMint 1.6.0.
+import {
+    SiloedLockReleaseTokenPool as SiloedLockReleaseTokenPool_1_6_0
+} from "@chainlink/contracts-ccip-1.6.0/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {
+    BurnMintTokenPool as BurnMintTokenPool_1_5_1
+} from "@chainlink/contracts-ccip-1.6.0/contracts/pools/BurnMintTokenPool.sol";
+import {
+    SiloedLockReleaseTokenPool as SiloedLockReleaseTokenPool_1_6_1
+} from "@chainlink/contracts-ccip-1.6.1/contracts/pools/SiloedLockReleaseTokenPool.sol";
+import {
+    BurnMintTokenPool as BurnMintTokenPool_1_6_1
+} from "@chainlink/contracts-ccip-1.6.1/contracts/pools/BurnMintTokenPool.sol";
+
+// Referenced so the compiler emits all four artifacts.
+abstract contract LegacyPools {
+    function _legacyPoolCreationCodes() internal pure returns (bytes[4] memory) {
+        return [
+            type(SiloedLockReleaseTokenPool_1_6_0).creationCode,
+            type(BurnMintTokenPool_1_5_1).creationCode,
+            type(SiloedLockReleaseTokenPool_1_6_1).creationCode,
+            type(BurnMintTokenPool_1_6_1).creationCode
+        ];
+    }
+}