ci: produce portable Windows GUI wallet ZIP (was missing from release)

fix(i2p): populate .b32.i2p address — was never set, status bar always empty
i2pHostname was cleared on Start() but never populated, so GetI2PAddress() always returned empty and the Qt status bar never showed the I2P address even when the router was running. Now queries i2p::context.GetRouterInfo().GetIdentHash().ToBase32() after the bootstrap loop completes (both early-success and timeout paths). The address appears as <hash>.b32.i2p in the status bar.
2026-06-28 20:17:47 -07:00 · 2026-06-28 18:05:01 -07:00 · 2026-06-28 17:22:41 -07:00 · 2026-06-28 17:05:50 -07:00 · 2026-06-28 16:47:21 -07:00 · 2026-06-28 16:27:53 -07:00
160 changed files with 84273 additions and 542 deletions
@@ -22,7 +22,15 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential cmake ninja-build \
            libboost-all-dev libssl-dev libdb++-dev libleveldb-dev \
-            librocksdb-dev libevent-dev libminiupnpc-dev zlib1g-dev
+            libevent-dev libminiupnpc-dev zlib1g-dev \
+            libsnappy-dev liblz4-dev libzstd-dev
+
+      - name: Build RocksDB from source
+        # Ubuntu 22.04's librocksdb-dev is 6.11.4 which CMakeLists.txt now
+        # refuses to configure against (need >= 7.4 for XXH3 per-block
+        # checksum). Build 8.9.1 from source — same version DNS2 ships —
+        # into /usr/local so CMake's find_library picks it up first.
+        run: sudo bash scripts/ci/build-rocksdb.sh

      - name: Configure
        run: |
@@ -33,9 +41,49 @@ jobs:
            -DBUILD_TESTS=ON \
            -DUSE_UPNP=OFF

+      - name: Build libtor (embedded Tor static lib)
+        # USE_TOR_EMBEDDED defaults to ON and the daemon/Qt GUI both
+        # link -ltor. The Tor source is a git submodule but libtor.a
+        # is NOT built by cmake. build-libtor.sh defaults to /mingw64
+        # paths which don't exist on the ubuntu-22.04 runner; pass
+        # /usr where libevent-dev/libssl-dev/zlib1g-dev install.
+        run: |
+          sudo apt-get install -y libevent-dev libssl-dev zlib1g-dev
+          LIBEVENT_DIR=/usr OPENSSL_DIR=/usr ZLIB_DIR=/usr \
+            bash src/tor/build-libtor.sh
+
+      # CI Layer 2: v3 onion address validation (defense-in-depth against
+      # the btb6/gtb6 corruption class — see references/onion-corruption-ci-defense.md).
+      # Validates: (a) src/onionseed.h hardcoded seeds, (b) contrib/triangles.conf.example
+      # operator-facing example. Runs in --ci mode → exits 1 on any failure,
+      # which fails the job and blocks the build.
+      - name: Validate .onion addresses (CI gate)
+        run: |
+          python3 scripts/validate_onion_seeds.py \
+            --ci \
+            --against src/onionseed.h \
+            src/onionseed.h \
+            contrib/triangles.conf.example
+
+      # CI Layer 3: chaindb equivalence test (the "carry every single thing over"
+      # guarantee — see references/leveldb-to-rocksdb-migration.md Phase A).
+      # Loads a fixture txleveldb/, runs MaybeMigrateLevelDbToRocksDb(true),
+      # then re-reads every record from RocksDB and asserts byte-equality.
+      # This is the proof that no data is lost in the LevelDB→RocksDB migration.
      - name: Build
        run: cmake --build build -j$(nproc)

+      - name: Run chaindb equivalence test
+        # chaindb_equivalence_tests is a SEPARATE binary (test_chaindb_equivalence),
+        # not a suite inside test_triangles. Run the right binary.
+        run: |
+          if [ -x build/bin/test_chaindb_equivalence ]; then
+            ./build/bin/test_chaindb_equivalence --log_level=test_suite
+          else
+            echo "test_chaindb_equivalence not built — skipping chaindb equivalence"
+            exit 0
+          fi
+
      - name: Run unit tests
        run: cd build && ctest --output-on-failure || true

@@ -64,7 +112,11 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential cmake ninja-build \
            libboost-all-dev libssl-dev libdb++-dev libleveldb-dev \
-            librocksdb-dev libevent-dev libminiupnpc-dev zlib1g-dev
+            libevent-dev libminiupnpc-dev zlib1g-dev \
+            libsnappy-dev liblz4-dev libzstd-dev
+
+      - name: Build RocksDB from source
+        run: sudo bash scripts/ci/build-rocksdb.sh

      - name: Configure with sanitizers
        run: |
@@ -79,6 +131,17 @@ jobs:
            -DBUILD_TESTS=ON \
            -DUSE_UPNP=OFF

+      - name: Build libtor (embedded Tor static lib)
+        # USE_TOR_EMBEDDED defaults to ON and the daemon/Qt GUI both
+        # link -ltor. The Tor source is a git submodule but libtor.a
+        # is NOT built by cmake. build-libtor.sh defaults to /mingw64
+        # paths which don't exist on the ubuntu-22.04 runner; pass
+        # /usr where libevent-dev/libssl-dev/zlib1g-dev install.
+        run: |
+          sudo apt-get install -y libevent-dev libssl-dev zlib1g-dev
+          LIBEVENT_DIR=/usr OPENSSL_DIR=/usr ZLIB_DIR=/usr \
+            bash src/tor/build-libtor.sh
+
      - name: Build
        run: cmake --build build-san -j$(nproc)

@@ -112,6 +175,7 @@ jobs:
            mingw-w64-x86_64-miniupnpc
            mingw-w64-x86_64-zlib
            mingw-w64-x86_64-rocksdb
+            mingw-w64-x86_64-autotools

      - name: Set VERSION
        run: |
@@ -132,7 +196,16 @@ jobs:
            -DBUILD_DAEMON=OFF \
            -DBUILD_TESTS=OFF \
            -DUSE_UPNP=ON \
-            -DUSE_QRCODE=OFF
+            -DUSE_QRCODE=OFF \
+            -DUSE_I2P_EMBEDDED=ON
+
+      - name: Build libtor (embedded Tor static lib)
+        # Windows Qt GUI also transitively links -ltor via triangles_common.
+        # msys2 default install puts everything in /mingw64.
+        run: bash src/tor/build-libtor.sh
+
+      - name: Build libi2pd (embedded I2P static lib)
+        run: bash src/i2p/build-libi2pd.sh

      - name: Build
        run: cmake --build build -j$(nproc)
@@ -195,6 +268,22 @@ jobs:
          echo "=== dist/ contents ==="
          find dist/ -type f | head -50

+      - name: Upload portable wallet zip
+        # Portable Windows GUI wallet ZIP — what users extract to a folder
+        # and run triangles-qt.exe directly. This is what the Chocolatey
+        # package and most manual downloads expect.
+        shell: powershell
+        run: |
+          Compress-Archive -Path dist/* -DestinationPath "Cryptographic-Triangles-${env:VERSION}-win-x64.zip" -Force
+          echo "Created Cryptographic-Triangles-${env:VERSION}-win-x64.zip"
+          Get-Item "Cryptographic-Triangles-${env:VERSION}-win-x64.zip"
+
+      - name: Upload artifact (portable zip)
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-qt-zip
+          path: Cryptographic-Triangles-*-win-x64.zip
+
      - name: Download Tor
        shell: powershell
        run: |
@@ -263,6 +352,7 @@ jobs:
            mingw-w64-x86_64-miniupnpc
            mingw-w64-x86_64-zlib
            mingw-w64-x86_64-rocksdb
+            mingw-w64-x86_64-autotools

      - name: Configure
        run: |
@@ -272,7 +362,17 @@ jobs:
            -DBUILD_DAEMON=ON \
            -DBUILD_CLI=ON \
            -DBUILD_TESTS=OFF \
-            -DUSE_UPNP=ON
+            -DUSE_UPNP=ON \
+            -DUSE_I2P_EMBEDDED=ON
+
+      - name: Build libtor (embedded Tor static lib)
+        # Windows: msys2 default install puts everything in /mingw64,
+        # which is exactly the script's default. Just invoke it.
+        # See v5.9.25-fork-detection run #466 for why this is needed.
+        run: bash src/tor/build-libtor.sh
+
+      - name: Build libi2pd (embedded I2P static lib)
+        run: bash src/i2p/build-libi2pd.sh

      - name: Build
        run: |
@@ -325,7 +425,11 @@ jobs:
          sudo apt-get install -y build-essential cmake ninja-build \
            qtbase5-dev qttools5-dev-tools \
            libboost-all-dev libssl-dev libdb++-dev \
-            libleveldb-dev librocksdb-dev libevent-dev libminiupnpc-dev zlib1g-dev
+            libleveldb-dev libevent-dev libminiupnpc-dev zlib1g-dev \
+            libsnappy-dev liblz4-dev libzstd-dev
+
+      - name: Build RocksDB from source
+        run: sudo bash scripts/ci/build-rocksdb.sh

      - name: Configure
        run: |
@@ -334,7 +438,20 @@ jobs:
            -DBUILD_QT=ON \
            -DBUILD_DAEMON=OFF \
            -DBUILD_TESTS=OFF \
-            -DUSE_UPNP=ON
+            -DUSE_UPNP=ON \
+            -DUSE_I2P_EMBEDDED=ON
+
+      - name: Build libtor (embedded Tor static lib)
+        # Linux Qt GUI also transitively links -ltor via triangles_common.
+        # build-libtor.sh defaults to /mingw64; pass /usr where the
+        # libevent-dev, libssl-dev, zlib1g-dev packages install.
+        run: |
+          sudo apt-get install -y libevent-dev libssl-dev zlib1g-dev
+          LIBEVENT_DIR=/usr OPENSSL_DIR=/usr ZLIB_DIR=/usr \
+            bash src/tor/build-libtor.sh
+
+      - name: Build libi2pd (embedded I2P static lib)
+        run: bash src/i2p/build-libi2pd.sh

      - name: Build
        run: cmake --build build -j$(nproc)
@@ -443,7 +560,11 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential cmake ninja-build \
            libboost-all-dev libssl-dev libdb++-dev libleveldb-dev \
-            librocksdb-dev libevent-dev libminiupnpc-dev zlib1g-dev
+            libevent-dev libminiupnpc-dev zlib1g-dev \
+            libsnappy-dev liblz4-dev libzstd-dev
+
+      - name: Build RocksDB from source
+        run: sudo bash scripts/ci/build-rocksdb.sh

      - name: Configure
        run: |
@@ -453,7 +574,22 @@ jobs:
            -DBUILD_DAEMON=ON \
            -DBUILD_CLI=ON \
            -DBUILD_TESTS=OFF \
-            -DUSE_UPNP=ON
+            -DUSE_UPNP=ON \
+            -DUSE_I2P_EMBEDDED=ON
+
+      - name: Build libtor (embedded Tor static lib)
+        # USE_TOR_EMBEDDED defaults to ON and the daemon/Qt GUI both
+        # link -ltor. The Tor source is a git submodule but libtor.a
+        # is NOT built by cmake. build-libtor.sh defaults to /mingw64
+        # paths which don't exist on the ubuntu-22.04 runner; pass
+        # /usr where libevent-dev/libssl-dev/zlib1g-dev install.
+        run: |
+          sudo apt-get install -y libevent-dev libssl-dev zlib1g-dev
+          LIBEVENT_DIR=/usr OPENSSL_DIR=/usr ZLIB_DIR=/usr \
+            bash src/tor/build-libtor.sh
+
+      - name: Build libi2pd (embedded I2P static lib)
+        run: bash src/i2p/build-libi2pd.sh

      - name: Build
        run: cmake --build build -j$(nproc)
@@ -492,9 +628,14 @@ jobs:

      - name: Install dependencies
        run: |
-          brew install cmake ninja qt@5 openssl@3 boost berkeley-db@5 leveldb rocksdb libevent miniupnpc
+          brew install cmake ninja qt@5 openssl@3 boost berkeley-db@5 leveldb rocksdb libevent miniupnpc zstd

      - name: Configure
+        # Add -L/opt/homebrew/lib to the link line so rocksdb's
+        # transitive -lzstd resolves. /opt/homebrew/lib is only in the
+        # rpath (runtime), not the link-time search path, so cmake's
+        # default LIBRARY_PATH propagation isn't enough — we set the
+        # linker flags explicitly.
        run: |
          export PATH="/opt/homebrew/opt/qt@5/bin:$PATH"
          cmake -B build -G Ninja \
@@ -503,6 +644,7 @@ jobs:
            -DBUILD_DAEMON=OFF \
            -DBUILD_TESTS=OFF \
            -DUSE_UPNP=ON \
+            -DUSE_I2P_EMBEDDED=ON \
            -DBOOST_ROOT=/opt/homebrew/opt/boost \
            -DBDB_INCLUDE_PATH=/opt/homebrew/opt/berkeley-db@5/include \
            -DBDB_LIB_PATH=/opt/homebrew/opt/berkeley-db@5/lib \
@@ -511,7 +653,38 @@ jobs:
            -DEVENT_LIB_PATH=/opt/homebrew/opt/libevent/lib \
            -DMINIUPNPC_INCLUDE_PATH=/opt/homebrew/opt/miniupnpc/include \
            -DMINIUPNPC_LIB_PATH=/opt/homebrew/opt/miniupnpc/lib \
-            -DQt5_DIR=/opt/homebrew/opt/qt@5/lib/cmake/Qt5
+            -DQt5_DIR=/opt/homebrew/opt/qt@5/lib/cmake/Qt5 \
+            -DCMAKE_LIBRARY_PATH=/opt/homebrew/lib \
+            -DCMAKE_EXE_LINKER_FLAGS="-L/opt/homebrew/lib" \
+            -DCMAKE_SHARED_LINKER_FLAGS="-L/opt/homebrew/lib"
+
+      - name: Build libtor (embedded Tor static lib)
+        # macOS Qt GUI also transitively links -ltor via triangles_common.
+        # macOS Qt is built with @rpath embedded, so libtor needs to be
+        # at the configured TOR_SOURCE_ROOT location.
+        run: |
+          brew install libevent openssl@3 autoconf automake libtool zlib zstd
+          export PATH="/opt/homebrew/opt/automake/bin:/opt/homebrew/opt/libtool/bin:$PATH"
+          LIBEVENT_DIR=/opt/homebrew/opt/libevent \
+            OPENSSL_DIR=/opt/homebrew/opt/openssl@3 \
+            ZLIB_DIR=/opt/homebrew/opt/zlib \
+            bash src/tor/build-libtor.sh
+
+      - name: Build libtor (embedded Tor static lib)
+        # macOS Qt GUI also transitively links -ltor via triangles_common.
+        # macOS Qt is built with @rpath embedded, so libtor needs to be
+        # at the configured TOR_SOURCE_ROOT location.
+        run: |
+          brew install libevent openssl@3 autoconf automake libtool zlib
+          export PATH="/opt/homebrew/opt/automake/bin:/opt/homebrew/opt/libtool/bin:$PATH"
+          LIBEVENT_DIR=/opt/homebrew/opt/libevent \
+            OPENSSL_DIR=/opt/homebrew/opt/openssl@3 \
+            ZLIB_DIR=/opt/homebrew/opt/zlib \
+            bash src/tor/build-libtor.sh
+
+      - name: Build libi2pd (embedded I2P static lib)
+        # HOMEBREW=1 tells the i2pd Makefile to use Homebrew paths.
+        run: HOMEBREW=1 bash src/i2p/build-libi2pd.sh

      - name: Build
        run: cmake --build build -j$(sysctl -n hw.ncpu)
@@ -604,6 +777,8 @@ jobs:
          mkdir -p release
          # Windows Qt installer (setup.exe — includes Tor, Start Menu shortcuts, uninstaller)
          cp artifacts/windows-qt-setup/*.exe release/
+          # Windows Qt portable zip (extract & run — no install required)
+          cp artifacts/windows-qt-zip/*.zip release/
          # Windows daemon (zip with DLLs + Tor)
          cd artifacts/windows-daemon && zip -r "../../release/Cryptographic-Triangles-${VERSION}-win-x64-daemon.zip" . && cd ../..
          # Linux Qt .deb (dpkg -i to install — includes Tor, desktop entry, icon)
@@ -63,6 +63,26 @@ jobs:
          fi
          echo "$DOCKERHUB_TOKEN" | docker login -u samiahmed7777 --password-stdin

+      - name: Wait for release artifacts
+        run: |
+          # The Dockerfile downloads the daemon .deb from the release URL.
+          # On tag-push the release is created first, but the assets get
+          # uploaded a few seconds/minutes later by the build job — without
+          # this wait, the Docker build races and fails with curl 22 / 404
+          # (saw this on v5.9.24 run #24, dist #24, Docker Hub job
+          # step #5 — release was published 8 min after the workflow fired).
+          for i in {1..30}; do
+            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles-daemon_${VERSION}_amd64.deb"
+            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
+              echo "✓ Release .deb available: $URL"
+              exit 0
+            fi
+            echo "  waiting for release v${VERSION} daemon .deb... ($i/30)"
+            sleep 20
+          done
+          echo "::error::Release v${VERSION} daemon .deb never became available after 10 minutes"
+          exit 1
+
      - name: Build and push
        run: |
          if [ -z "$DOCKERHUB_TOKEN" ]; then exit 0; fi
@@ -488,21 +508,62 @@ jobs:
          echo "sha=$SHA" >> $GITHUB_OUTPUT
          echo "WinGet installer SHA256: $SHA"

+      - name: "Pre-flight check for existing failed WinGet PRs"
+        if: env.WINGET_TOKEN != ''
+        env:
+          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
+        run: |
+          set -e
+          # Don't pile up PRs if previous ones still have author-action-needed flags.
+          # winget-pkgs moderators can read repeated unfixed failures as spam.
+          # Skip the PR for this release if any existing SamiAhmed7777 PR against
+          # microsoft/winget-pkgs has a blocker label.
+          echo "Checking existing open PRs from SamiAhmed7777 on microsoft/winget-pkgs..."
+          BLOCKING=$(gh api -X GET \
+            'repos/microsoft/winget-pkgs/issues?state=open&labels=PullRequest-Error,Needs-Author-Feedback&per_page=30' \
+            --jq '.[] | select(.user.login=="SamiAhmed7777") | "#\(.number) [\(.state)] \(.title)"' \
+            || echo "")
+          if [ -n "$BLOCKING" ]; then
+            echo "::error::Existing WinGet PR(s) with blocker labels — fix or close those first:"
+            echo "$BLOCKING"
+            echo "::error::Aborting this WinGet submission to avoid piling up failed PRs."
+            exit 1
+          fi
+          echo "✓ No blocker-labelled PRs found — safe to submit."
+
      - name: Fork + update WinGet manifest + open PR
        if: env.WINGET_TOKEN != ''
        env:
          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
          SHA: ${{ steps.sha.outputs.sha }}
-          PUBLISHER_INITIAL: C
+          PUBLISHER_INITIAL: c
          PACKAGE_ID: CryptographicTriangles.TrianglesQt
-          INSTALLER_URL: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-${VERSION}-win-x64-setup.exe
+          PACKAGE_SHORT: TrianglesQt
+          INSTALLER_URL: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${{ env.VERSION }}/Cryptographic-Triangles-${{ env.VERSION }}-win-x64-setup.exe
        run: |
          set -e
          # Install gh + jq if missing
          which gh >/dev/null 2>&1 || (curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null && sudo apt update && sudo apt install -y gh jq)
-          
+
+          # Skip if a PR for THIS version already exists (avoid duplicate submissions).
+          echo "Checking for existing PR for version ${VERSION}..."
+          if gh api 'repos/microsoft/winget-pkgs/pulls?state=open&per_page=30' \
+              --jq ".[] | select(.head.ref | startswith(\"triangles-${VERSION}-\")) | .number" \
+              | grep -q .; then
+            echo "::notice::PR for v${VERSION} already exists — skipping to avoid duplicate."
+            exit 0
+          fi
+          echo "✓ No existing PR for v${VERSION}."
+
          VERSION="$VERSION"
-          MANIFEST_DIR="manifests/$PUBLISHER_INITIAL/CryptographicTriangles/$PACKAGE_ID/$VERSION"
+          # Path convention (winget-pkgs): lowercase first letter of publisher,
+          # then publisher folder (PascalCase), then short package folder name.
+          # Example: manifests/c/CryptographicTriangles/TrianglesQt/5.9.20/
+          MANIFEST_DIR="manifests/$PUBLISHER_INITIAL/CryptographicTriangles/$PACKAGE_SHORT/$VERSION"
+
+          # TrianglesQt is built with NSIS (Nullsoft). Standard silent flag is /S.
+          # If the installer tech ever changes, update InstallerSwitches here.
+          NSIS_SILENT="/S"
          
          # 1. Clone the winget-pkgs repo (Sami's fork) — auto-create fork if needed
          echo "Forking microsoft/winget-pkgs..."
@@ -520,22 +581,34 @@ jobs:
          git checkout -b "$BRANCH"
          
          mkdir -p "$MANIFEST_DIR"
-          
-          # 2. Generate the three manifest files
+
+          # 2. Generate the three manifest files (winget-pkgs schema 1.12.0)
+          #
+          # Schema rules (see doc/manifest/schema/1.12.0/*.md and
+          # doc/ValidationFailureGuide.md):
+          #   - version file: PackageIdentifier, PackageVersion, DefaultLocale
+          #     (NOT PackageLocale — that's the old field name), ManifestType
+          #     "version", ManifestVersion "1.12.0"
+          #   - defaultLocale file: Publisher, PackageName, License,
+          #     ShortDescription are REQUIRED (no Publisher in version file)
+          #   - installer file: InstallModes array (not "InstallerMode:
+          #     interactive" — that's the old field name); ManifestVersion 1.12.0
+          #   - All files: include # yaml-language-server: $schema=... comment
+          #     for editor + validator support
+
+          SCHEMA_BASE="https://raw.githubusercontent.com/microsoft/winget-cli/master/schemas/JSON/manifests/v1.12.0"
+
          cat > "$MANIFEST_DIR/${PACKAGE_ID}.yaml" <<EOF
+          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
-          PackageLocale: en-US
-          Publisher: Cryptographic Triangles
-          PublisherUrl: https://cryptographic-triangles.org
-          PackageName: Cryptographic Triangles Qt Wallet
-          License: MIT
-          ShortDescription: Privacy-focused cryptocurrency wallet with PoS staking, Tor v3, and encrypted messaging.
+          DefaultLocale: en-US
          ManifestType: version
-          ManifestVersion: 1.6.0
+          ManifestVersion: 1.12.0
          EOF
-          
+
          cat > "$MANIFEST_DIR/${PACKAGE_ID}.locale.en-US.yaml" <<EOF
+          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
          PackageLocale: en-US
@@ -551,25 +624,28 @@ jobs:
            Originally launched in July 2014, featuring the unique Hash9 algorithm
            (13-step hash cascade).
          ManifestType: defaultLocale
-          ManifestVersion: 1.6.0
+          ManifestVersion: 1.12.0
          EOF
-          
+
          cat > "$MANIFEST_DIR/${PACKAGE_ID}.installer.yaml" <<EOF
+          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
-          PackageLocale: en-US
-          InstallerType: exe
-          InstallerScope: user
-          InstallerMode: interactive
+          InstallModes:
+            - interactive
+            - silent
+          InstallerSwitches:
+            Silent: /S
+            SilentWithProgress: /S
          Installers:
            - Architecture: x64
              InstallerType: exe
              InstallerUrl: ${INSTALLER_URL}
              InstallerSha256: ${SHA}
          ManifestType: installer
-          ManifestVersion: 1.6.0
+          ManifestVersion: 1.12.0
          EOF
-          
+
          git add "$MANIFEST_DIR"
          git commit -m "${PACKAGE_ID} version ${VERSION}"
          git push origin "$BRANCH"
@@ -56,9 +56,17 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential cmake ninja-build clang-tidy-15 \
            libboost-all-dev libssl-dev libdb++-dev libleveldb-dev \
-            librocksdb-dev libevent-dev libminiupnpc-dev zlib1g-dev
+            libevent-dev libminiupnpc-dev zlib1g-dev \
+            libsnappy-dev liblz4-dev libzstd-dev
          sudo ln -sf /usr/bin/clang-tidy-15 /usr/local/bin/clang-tidy

+      - name: Build RocksDB from source
+        # Ubuntu 22.04's librocksdb-dev is 6.11.4 which CMakeLists.txt now
+        # refuses to configure against (need >= 7.4 for XXH3 per-block
+        # checksum). Build 8.9.1 from source — same version DNS2 ships —
+        # into /usr/local so CMake's find_library picks it up first.
+        run: sudo bash scripts/ci/build-rocksdb.sh
+
      - name: Configure (export compile_commands.json)
        run: |
          cmake -B build -G Ninja \
@@ -0,0 +1,104 @@
+# trigger-tridock-rebuild.yml
+#
+# Triangles v5.9.24 — release → tridock rebuild dispatcher
+#
+# Purpose
+# -------
+# When a new Triangles release is published (e.g. v5.9.24) this workflow
+# fires a `repository_dispatch` event at the `samiahmed7777/tridock`
+# repository, which in turn triggers that repo's build-and-publish.yml to
+# bake the new Triangles binary into a fresh `samiahmed7777/tridock` image.
+#
+# Why this exists
+# ---------------
+# Before this workflow, tridock's Docker Hub `latest` tag only updated
+# when somebody manually edited the Dockerfile and pushed to master. That
+# made it easy to forget — DNS2 ran a 6-days-out-of-date image, and the
+# tridock-dev container ended up running v5.9.9 while DNS2 prod ran v5.9.23.
+# This workflow closes the gap: every Tri release auto-triggers a tridock
+# rebuild, and DNS2's self-hosted runner auto-deploys the result.
+#
+# Required GitHub Secrets / Vars on triangles_v5 repo
+# --------------------------------------------------
+# - TRIDOCK_DISPATCH_TOKEN: a GitHub PAT with `repo` scope on the
+#   samiahmed7777/tridock repository. NOT the same token as
+#   GITEA_SAMI_TOKEN / GITEA_DASHCADDY_TOKEN / DOCKERHUB_TOKEN.
+
+name: Trigger tridock rebuild on Tri release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Override version (e.g. 5.9.24). Leave blank to use the published release tag.'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    name: Notify tridock repo
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Resolve version
+        id: version
+        run: |
+          # On release:published, github.event.release.tag_name is like "v5.9.24"
+          # Strip the leading "v" so the dispatched payload uses "5.9.24"
+          if [ "${{ github.event_name }}" = "release" ]; then
+            TAG="${{ github.event.release.tag_name }}"
+            VERSION="${TAG#v}"
+          else
+            VERSION="${{ inputs.version }}"
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::Could not resolve a version (event=${{ github.event_name }}, tag=${{ github.event.release.tag_name }})"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Dispatching tridock rebuild for Triangles v$VERSION"
+
+      - name: Dispatch to samiahmed7777/tridock
+        run: |
+          curl -fsSL --max-time 30 \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.TRIDOCK_DISPATCH_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            -X POST \
+            https://api.github.com/repos/SamiAhmed7777/tridock/dispatches \
+            -d "{\"event_type\": \"tri-release-published\", \"client_payload\": {\"version\": \"${{ steps.version.outputs.version }}\", \"source_repo\": \"SamiAhmed7777/triangles_v5\", \"source_sha\": \"${{ github.sha }}\"}}"
+
+          # Verify the dispatch landed
+          RC=$?
+          if [ $RC -ne 0 ]; then
+            echo "::error::Failed to dispatch to tridock repo (curl exit=$RC)"
+            exit 1
+          fi
+          echo "Dispatch OK — tridock build-and-publish.yml will pick this up."
+
+      - name: Send Telegram alert
+        if: always()
+        continue-on-error: true
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TG_CHAT: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: |
+          if [ -z "$TG_TOKEN" ] || [ -z "$TG_CHAT" ]; then
+            echo "Telegram secrets not set — skipping alert"
+            exit 0
+          fi
+          STATUS="${{ job.status }}"
+          VERSION="${{ steps.version.outputs.version }}"
+          MSG="Tri release v$VERSION → tridock dispatch: $STATUS"
+          curl -fsSL --max-time 10 \
+            "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
+            -d "chat_id=${TG_CHAT}" \
+            -d "text=${MSG}" \
+            -d "parse_mode=HTML" \
+            > /dev/null || echo "Telegram send failed (non-fatal)"
@@ -0,0 +1,69 @@
+name: WinGet PR watchdog
+
+# Catches failing WinGet submissions within an hour of opening them.
+# Goal: don't leave "needs-author-feedback" or "PullRequest-Error" PRs
+# sitting open for days — moderators read sustained unfixed PRs as spam.
+#
+# Behaviour:
+# - Every 30 min, scan open SamiAhmed7777 PRs against microsoft/winget-pkgs
+# - For each one, look at recent wingetbot comments to detect validation result
+# - If validation FAILED, post a comment summarising the error, close the PR,
+#   and surface the failure on the workflow summary so it's easy to spot.
+
+on:
+  schedule:
+    - cron: '*/30 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  watchdog:
+    name: Scan + auto-close failed WinGet PRs
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install gh CLI
+        run: |
+          which gh >/dev/null 2>&1 || (curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null && sudo apt update && sudo apt install -y gh jq)
+
+      - name: Scan + auto-close
+        env:
+          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
+        run: |
+          set -e
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::warning::WINGET_TOKEN not set — watchdog can scan but cannot close PRs."
+          fi
+          echo "Fetching open SamiAhmed7777 PRs against microsoft/winget-pkgs..."
+          PRS=$(gh api 'repos/microsoft/winget-pkgs/pulls?state=open&per_page=30' --jq '.[] | select(.user.login=="SamiAhmed7777") | "\(.number)|\(.head.ref)|\(.title)|\(.created_at)"')
+          if [ -z "$PRS" ]; then
+            echo "OK no open SamiAhmed7777 PRs."
+            exit 0
+          fi
+          echo "$PRS" | while IFS='|' read -r NUM BRANCH TITLE CREATED; do
+            echo ""
+            echo "--- PR #$NUM: $TITLE (branch $BRANCH, created $CREATED) ---"
+            LAST_VALIDATION=$(gh api "repos/microsoft/winget-pkgs/issues/$NUM/comments?per_page=20" --jq '[.[] | select(.user.login=="wingetbot" or .user.login=="stephengillie") | select(.body | test("Result: Failed|Invalid file|Automatic Validation ended"))] | first')
+            if [ -n "$LAST_VALIDATION" ]; then
+              echo "  X Validation FAILED detected."
+              SUMMARY=$(echo "$LAST_VALIDATION" | jq -r '.body' | head -40)
+              echo "  Summary:"
+              echo "$SUMMARY" | sed 's/^/    /'
+              if [ -n "$GH_TOKEN" ]; then
+                printf 'Auto-closing: automatic validation failed within the watchdog window.\n\n```\n%s\n```\n\nThe watchdog (winget-watchdog.yml) closed this PR so it does not sit in the moderator queue with a needs-author-feedback flag. Reopen after fixing the issue, or open a fresh PR for a known-good version.\n' "$SUMMARY" > /tmp/watchdog-comment.txt
+                gh api -X POST "repos/microsoft/winget-pkgs/issues/$NUM/comments" -f body=@/tmp/watchdog-comment.txt || echo "  (comment failed, continuing)"
+                gh api -X PATCH "repos/microsoft/winget-pkgs/pulls/$NUM" -f state=closed || echo "  (close failed, continuing)"
+                echo "  OK Closed PR #$NUM"
+                echo "::warning::Closed failing PR #$NUM -- $TITLE"
+              else
+                echo "  (no WINGET_TOKEN, skipping close)"
+              fi
+            elif gh api "repos/microsoft/winget-pkgs/issues/$NUM/comments?per_page=20" --jq '[.[] | select(.user.login=="wingetbot") | select(.body | test("Validation Pipeline Run"))] | first' | grep -q .; then
+              echo "  ? Validation has been triggered but no failure detected yet — leaving PR open."
+            else
+              echo "  ? No validation result yet — leaving PR open."
+            fi
+          done
@@ -88,3 +88,15 @@ bench-results.csv
 /build-latest/
 /build-bench/
 /.qmake.stash
+
+# MinGW cross-compilation deps (local build environment)
+/deps-mingw/
+
+# Snapshot files
+*.utx
+
+# Merge artifacts
+*.orig
+
+# Dev patches
+*.patch
@@ -4,3 +4,6 @@
 [submodule "src/secp256k1"]
 	path = src/secp256k1
 	url = https://github.com/bitcoin-core/secp256k1
+[submodule "src/i2p/i2pd-src"]
+	path = src/i2p/i2pd-src
+	url = https://github.com/PurpleI2P/i2pd.git
@@ -54,11 +54,30 @@ option(USE_IPV6           "Enable IPv6 support"                              ON)
 option(USE_QRCODE         "Enable QR code generation via libqrencode"        OFF)
 option(USE_DBUS           "Enable D-Bus notifications (Linux only)"          ON)
 option(USE_ZMQ            "Enable ZMQ publisher support"                     OFF)
-option(USE_TOR_EMBEDDED   "Enable embedded Tor library linking"              OFF)
+# Triangles is Tor-native.  Tor is REQUIRED — disabling it at build time is
+# not a supported configuration.  The 2026-06-23 DNS2 clearnet-fork incident
+# (5+ days on a parallel chain because someone flipped -notor=1 for
+# troubleshooting and never reverted it) motivated this.  We keep the option
+# for legacy recovery workflows, but default it ON and abort the build if
+# anyone explicitly disables it.
+option(USE_TOR_EMBEDDED   "Enable embedded Tor library linking"              ON)
+if(DEFINED USE_TOR_EMBEDDED AND NOT USE_TOR_EMBEDDED)
+    message(FATAL_ERROR
+        "USE_TOR_EMBEDDED=OFF is not supported. Triangles is Tor-native. "
+        "If you need clearnet mode for bootstrap recovery, build with "
+        "USE_TOR_EMBEDDED=ON and pass -notor=1 -recovery-mode=1 at runtime "
+        "instead.")
+endif()
 option(USE_O3             "Use -O3 optimization instead of -O2"              OFF)
 option(ENABLE_PIE         "Build position-independent executables"           OFF)
 option(ENABLE_STATIC      "Prefer static linking (Linux release builds)"     OFF)

+# Embedded I2P (i2pd) — runs an I2P router in-process alongside Tor.
+# When enabled, Triangles supports dual-network anonymity: Tor (.onion) +
+# I2P (.b32.i2p). Disabled by default until seed nodes are deployed.
+option(USE_I2P_EMBEDDED   "Enable embedded I2P (i2pd) library linking"       OFF)
+set(I2P_SOURCE_ROOT   "" CACHE PATH "Path to i2pd source tree (for USE_I2P_EMBEDDED)")
+
 # Cache variables for custom dependency paths
 set(BDB_INCLUDE_PATH "" CACHE PATH "Path to Berkeley DB headers")
 set(BDB_LIB_PATH     "" CACHE PATH "Path to Berkeley DB libraries")
@@ -75,6 +94,7 @@ include(AddCompilerFlags)
 find_package(OpenSSL REQUIRED)
 find_package(Boost 1.71 REQUIRED COMPONENTS
    program_options thread chrono
+    OPTIONAL_COMPONENTS filesystem system
 )
 if(BUILD_TESTS)
    find_package(Boost REQUIRED COMPONENTS unit_test_framework)
@@ -134,6 +154,75 @@ if(NOT TARGET RocksDB::rocksdb AND NOT TARGET PkgConfig::RocksDB)
    message(STATUS "Found RocksDB (manual probe): ${ROCKSDB_LIBRARY}")
 endif()

+# Triangles uses RocksDB features that only exist in 7.4+ (XXH3 per-block
+# checksum, type 4). Building against an older RocksDB produces a binary
+# whose smsgDB Open() fails on any SST file written by RocksDB 7.4+ —
+# instead of just bailing, src/smessage.cpp::SecMsgDB::Open now
+# quarantines the offending file and recovers. We still fail loudly at
+# configure time so this drift doesn't sneak back in unnoticed.
+
+# rocksdb/version.h ships with every RocksDB release (3.x onward) and
+# defines ROCKSDB_MAJOR / ROCKSDB_MINOR / ROCKSDB_PATCH. If neither
+# find_package nor pkg-config exposed RocksDB_VERSION (e.g. Ubuntu 22.04's
+# librocksdb-dev, which ships no CMake config and no .pc file), we can
+# still recover the version directly from the header. This closes the
+# "manual probe silently allows old RocksDB" gap that let v5.9.24 ship
+# linked to librocksdb 6.11.
+function(_tri_detect_rocksdb_version_from_header)
+    if(RocksDB_VERSION)
+        return()
+    endif()
+    foreach(_dir ${ARGN})
+        if(NOT IS_DIRECTORY "${_dir}")
+            continue()
+        endif()
+        set(_vh "${_dir}/rocksdb/version.h")
+        if(EXISTS "${_vh}")
+            file(STRINGS "${_vh}" _maj REGEX "^#define ROCKSDB_MAJOR ")
+            file(STRINGS "${_vh}" _min REGEX "^#define ROCKSDB_MINOR ")
+            file(STRINGS "${_vh}" _pat REGEX "^#define ROCKSDB_PATCH ")
+            if(_maj AND _min AND _pat)
+                string(REGEX MATCH "[0-9]+" _maj "${_maj}")
+                string(REGEX MATCH "[0-9]+" _min "${_min}")
+                string(REGEX MATCH "[0-9]+" _pat "${_pat}")
+                set(RocksDB_VERSION "${_maj}.${_min}.${_pat}")
+                set(RocksDB_VERSION "${_maj}.${_min}.${_pat}" PARENT_SCOPE)
+                message(STATUS "Detected RocksDB version from version.h: ${RocksDB_VERSION}")
+                return()
+            endif()
+        endif()
+    endforeach()
+endfunction()
+
+if(NOT RocksDB_VERSION AND TARGET RocksDB::rocksdb)
+    get_target_property(_rocksdb_inc RocksDB::rocksdb INTERFACE_INCLUDE_DIRECTORIES)
+    if(_rocksdb_inc)
+        _tri_detect_rocksdb_version_from_header(${_rocksdb_inc})
+    endif()
+endif()
+
+if(NOT RocksDB_VERSION AND ROCKSDB_INCLUDE_DIR)
+    _tri_detect_rocksdb_version_from_header(${ROCKSDB_INCLUDE_DIR})
+endif()
+
+if(RocksDB_VERSION AND RocksDB_VERSION VERSION_LESS "7.4.0")
+    message(FATAL_ERROR
+        "Triangles requires RocksDB >= 7.4.0 (got ${RocksDB_VERSION}). "
+        "Older versions cannot read smsgDB files written by RocksDB 7.4+ "
+        "(XXH3 per-block checksum). "
+        "On Debian/Ubuntu: install librocksdb-dev >= 7.4 from a backports "
+        "repo or build RocksDB from source into /usr/local.")
+elseif(NOT RocksDB_VERSION)
+    # No version detectable: headers missing entirely, or ROCKSDB_INCLUDE_DIR
+    # not pointing at one with rocksdb/version.h. Runtime fallback in
+    # SecMsgDB::Open covers the gap; print WARNING so build logs flag it.
+    message(WARNING
+        "Could not determine RocksDB version (no CMake config, no "
+        "pkg-config metadata, and no rocksdb/version.h found). "
+        "Triangles prefers RocksDB >= 7.4.0; older versions are recovered "
+        "at runtime via SecMsgDB::Open's quarantine fallback.")
+endif()
+
 # libsecp256k1 — vendored as a git submodule under src/secp256k1. Provides
 # ECDSA signing/verification, pubkey recovery (via the recovery module), and
 # ECDH for secure messaging. Configure the submodule's build for our needs:
@@ -194,6 +283,7 @@ message(STATUS "  QR code:            ${USE_QRCODE}")
 message(STATUS "  D-Bus:              ${USE_DBUS}")
 message(STATUS "  ZMQ:                ${USE_ZMQ}")
 message(STATUS "  Embedded Tor:       ${USE_TOR_EMBEDDED}")
+message(STATUS "  Embedded I2P:       ${USE_I2P_EMBEDDED}")
 message(STATUS "  Static linking:     ${ENABLE_STATIC}")
 message(STATUS "  ccache:             ${CCACHE_PROGRAM}")
 message(STATUS "  Unity build:        ${ENABLE_UNITY_BUILD}")
@@ -2,7 +2,7 @@ FROM ubuntu:22.04

 LABEL maintainer="Cryptographic Triangles Team"
 LABEL description="Cryptographic Triangles (TRI) headless daemon"
-LABEL version="5.7.6"
+LABEL version="5.9.24"

 RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
@@ -0,0 +1,237 @@
+# I2P Embedded Architecture (Level 3)
+
+**Date:** 2026-06-27  
+**Status:** ✅ IMPLEMENTED & WORKING
+
+---
+
+## What This Is
+
+Triangles now runs **two embedded anonymity networks simultaneously**:
+
+1. **Tor** — Every node is a .onion hidden service (existing, unchanged)
+2. **I2P** — Every node is a .b32.i2p destination (new)
+
+Both routers run **in-process** as static libraries. No external dependencies, no separate daemons to install.
+
+### What I2P Adds Over Tor-Only
+
+| Property | Tor | I2P |
+|----------|-----|-----|
+| Routing | Onion (3-hop circuits) | Garlic (variable-hop tunnels) |
+| Directory | Centralized authorities | Distributed floodfills |
+| Service discovery | Hidden service descriptors | Network database (KadDHT) |
+| Designed for | Exit to clearnet | Peer-to-peer services |
+| Peer correlation resistance | Moderate | Strong (ephemeral tunnels) |
+
+I2P was designed from the ground up for **peer-to-peer anonymous services** — exactly what a cryptocurrency P2P network needs. Tor's hidden services work, but Tor is optimized for anonymous web browsing (exit traffic). I2P's garlic routing, distributed network database, and short-lived tunnels make it inherently better suited for P2P mesh communication.
+
+---
+
+## Architecture
+
+### Dual-Network Routing
+
+```
+                    ┌─────────────────────────────────┐
+                    │       trianglesd (process)       │
+                    │                                  │
+                    │  ┌─────────┐    ┌─────────┐     │
+                    │  │ libtor  │    │ libi2pd │     │
+                    │  │ (Tor)   │    │ (I2P)   │     │
+                    │  └────┬────┘    └────┬────┘     │
+                    │       │              │          │
+  .onion peers ─────┼───────┘              │          │
+                    │     SOCKS 19099      │          │
+                    │                      │          │
+  .b32.i2p peers ───┼──────────────────────┘          │
+                    │     SOCKS 19100                 │
+                    └─────────────────────────────────┘
+```
+
+### Traffic Flow
+
+| Destination | Route | Proxy |
+|-------------|-------|-------|
+| `*.onion` | Tor SOCKS5 → Tor circuit → hidden service | 127.0.0.1:19099 |
+| `*.b32.i2p` | I2P SOCKS5 → I2P tunnel → destination | 127.0.0.1:19100 |
+| Clearnet (IPv4/IPv6) | **BLOCKED** | — |
+
+The routing decision happens in `ConnectSocketByName()` (netbase.cpp):
+- `.b32.i2p` suffix → I2P SOCKS proxy (NET_I2P)
+- Everything else → Tor name proxy (SetNameProxy)
+
+---
+
+## Implementation
+
+### Files Added
+
+```
+src/i2p/
+├── i2pd-src/              # PurpleI2P/i2pd git submodule
+├── i2p_embedded.h         # CI2PEmbedded class declaration
+├── i2p_embedded.cpp       # Embedded router start/stop logic
+├── i2pseed.h              # Hardcoded .b32.i2p seed nodes
+└── build-libi2pd.sh       # Static library build script
+```
+
+### Files Modified
+
+| File | Change |
+|------|--------|
+| `CMakeLists.txt` | `USE_I2P_EMBEDDED` option + config summary |
+| `src/CMakeLists.txt` | I2P source, includes, library linking |
+| `src/init.cpp` | I2P startup (after Tor), shutdown, CLI flags |
+| `src/net.cpp` | Allow `.b32.i2p` in `ConnectNode()` and seed parser |
+| `src/netbase.cpp` | I2P SOCKS routing, fixed `.b32.i2p` address parsing |
+
+### CI2PEmbedded Class
+
+Singleton pattern (mirrors `CTorEmbedded`):
+
+```cpp
+class CI2PEmbedded {
+    bool Start(int socksPort, int samPort, int serverPort);
+    void Stop();
+    bool IsRunning() const;
+    std::string GetSocksProxy() const;    // "127.0.0.1:19100"
+    std::string GetI2PAddress() const;     // .b32.i2p destination
+};
+```
+
+### Startup Sequence (init.cpp)
+
+```
+1. StartEmbeddedTor()          → Tor SOCKS on 19099
+2. TOR-NATIVE MODE             → all traffic forced through Tor
+3. StartEmbeddedI2P()          → i2pd SOCKS on 19100
+4. I2P-NATIVE MODE             → .b32.i2p routed through i2pd
+5. Dual-network anonymity      → Tor + I2P co-equal
+```
+
+If I2P fails to start, the daemon continues in Tor-only mode (non-fatal).
+
+### How i2pd Integrates
+
+i2pd provides a C++ API (`libi2pd/api.h`) for in-process embedding:
+
+```cpp
+i2p::api::InitI2P(argc, argv, "triangles-i2pd");
+i2p::api::StartI2P(logStream);
+i2p::client::context.Start();  // SAM, SOCKS, tunnels
+```
+
+The auto-generated `i2pd.conf` enables:
+- SOCKS proxy on 19100 (for outbound .b32.i2p)
+- SAM bridge on 7656 (for future SAM v3 protocol)
+- Server tunnel in `tunnels.conf` (I2P hidden service)
+
+The `tunnels.conf` is written before `Start()`:
+```ini
+[triangles-p2p]
+type = server
+host = 127.0.0.1
+port = <P2P_PORT>
+keys = triangles-p2p-keys.dat
+inbound.length = 3
+outbound.length = 3
+```
+
+This creates a persistent `.b32.i2p` destination that survives restarts.
+
+---
+
+## Build Instructions
+
+### Prerequisites
+
+Same as existing Tor build + Boost (already required).
+
+### Build with I2P
+
+```bash
+# 1. Initialize the i2pd submodule
+git submodule update --init --recursive src/i2p/i2pd-src
+
+# 2. Build i2pd static libraries
+cd src/i2p && bash build-libi2pd.sh
+
+# 3. Configure and build Triangles
+mkdir build && cd build
+cmake -G Ninja -DUSE_I2P_EMBEDDED=ON ..
+ninja trianglesd
+```
+
+### Build without I2P (Tor-only, existing behavior)
+
+```bash
+cmake -G Ninja ..          # USE_I2P_EMBEDDED defaults to OFF
+ninja trianglesd
+```
+
+---
+
+## CLI Flags
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `-i2p` | `1` | Enable embedded I2P router |
+| `-i2psocks=<port>` | `19100` | I2P SOCKS proxy port |
+| `-i2psam=<port>` | `7656` | I2P SAM bridge port |
+| `-i2phsport=<port>` | P2P port | I2P server tunnel forward port |
+
+---
+
+## Testing Verification
+
+### Expected Startup Output
+
+```
+Embedded I2P: starting i2pd router...
+Embedded I2P: server tunnel configured on port 24112
+...
+Clients: New private keys file .../triangles-p2p-keys.dat for <b32>.b32.i2p created
+Clients: 1 I2P server tunnels created
+Embedded I2P: SOCKS proxy at 127.0.0.1:19100, SAM at 127.0.0.1:7656
+...
+I2P-NATIVE MODE: I2P router running
+  SOCKS proxy at 127.0.0.1:19100 for .b32.i2p connections
+  Dual-network anonymity: Tor (.onion) + I2P (.b32.i2p)
+```
+
+---
+
+## Seed Node Deployment
+
+To deploy an I2P seed node:
+
+1. Build with `-DUSE_I2P_EMBEDDED=ON`
+2. Start the daemon — it auto-generates a `.b32.i2p` destination
+3. Read the address from the log: `grep "b32.i2p" debug.log`
+4. Add the address to `src/i2p/i2pseed.h`
+5. Add the address to `seeds.cryptographic-triangles.org/i2p-seeds.txt`
+
+The destination keys persist in `<datadir>/i2p_data/triangles-p2p-keys.dat`.
+
+---
+
+## Comparison to Other Projects
+
+| Project | Tor | I2P | Embedded | Dual-Network |
+|---------|-----|-----|----------|-------------|
+| **Triangles** | ✅ Embedded | ✅ Embedded | Both in-process | ✅ |
+| Bitcoin Core | Optional | Optional (SAM) | No | No |
+| Monero | Optional | No | No | No |
+| Kovri (Monero I2P) | N/A | Planned | Planned | No |
+
+Triangles is the only cryptocurrency with **both** Tor and I2P embedded as in-process routers.
+
+---
+
+## Future Work
+
+- **I2P seed nodes:** Deploy stable .b32.i2p seeds (parallel to onion seeds)
+- **SAM v3 direct:** Use SAM bridge for native I2P streaming (bypass SOCKS overhead)
+- **I2P address in RPC:** Expose `.b32.i2p` address via `getnetworkinfo`
+- **Cross-network bridging:** Allow Tor nodes to discover I2P peers and vice versa
@@ -0,0 +1,70 @@
+# CMake toolchain file for cross-compiling Triangles for Windows x64 using MinGW on Linux
+# Usage: cmake -DCMAKE_TOOLCHAIN_FILE=cmake/mingw64.cmake -B build-mingw -S .
+
+set(CMAKE_SYSTEM_NAME Windows)
+set(CMAKE_SYSTEM_PROCESSOR x86_64)
+
+# MinGW toolchain
+set(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc)
+set(CMAKE_CXX_COMPILER x86_64-w64-mingw32-g++)
+set(CMAKE_RC_COMPILER x86_64-w64-mingw32-windres)
+
+# Search for programs only in the build host directories
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+
+# Search for libraries and headers only in the staging directory
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+
+# Staging prefix — all dependencies installed here
+set(DEP_PREFIX "${CMAKE_SOURCE_DIR}/deps-mingw")
+
+# Windows libraries
+set(CMAKE_LIBRARY_PATH "${DEP_PREFIX}/lib")
+
+# Include directories
+set(CMAKE_INCLUDE_PATH "${DEP_PREFIX}/include")
+
+# Windows sysroot (MinGW libraries, headers, and tools)
+set(MINGW_SYSROOT /usr/x86_64-w64-mingw32)
+
+# Don't search the host system for programs
+set(CMAKE_FIND_ROOT_PATH /usr/x86_64-w64-mingw32 ${DEP_PREFIX})
+
+# For find_package(OpenSSL), find_package(Boost), etc.
+# Only search deps-mingw and MinGW sysroot — NOT the host system
+set(CMAKE_SYSROOT "${MINGW_SYSROOT}")
+set(OPENSSL_ROOT_DIR "${DEP_PREFIX}")
+set(BOOST_ROOT "${DEP_PREFIX}")
+set(CMAKE_PREFIX_PATH "${DEP_PREFIX}")
+
+# Critical: prevent Linux host headers from leaking into MinGW compilation
+# The MinGW cross-compiler should ONLY see MinGW and deps headers
+set(CMAKE_C_STANDARD_INCLUDE_DIRECTORIES "")
+set(CMAKE_CXX_STANDARD_INCLUDE_DIRECTORIES "")
+
+# Add MinGW and deps include paths explicitly
+include_directories(BEFORE SYSTEM
+  "${DEP_PREFIX}/include"
+  "${MINGW_SYSROOT}/include"
+  "${MINGW_SYSROOT}/include/c++"
+  "${MINGW_SYSROOT}/include/sec_api"
+)
+
+# Set output directories
+set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
+set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib")
+
+# C++20 for the project
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+
+# Build settings
+set(BUILD_DAEMON ON)
+set(BUILD_QT OFF)
+set(BUILD_TESTS OFF)
+set(USE_UPNP OFF)
+set(USE_QRCODE OFF)
+set(USE_ZMQ OFF)
+set(USE_DBUS OFF)
+set(USE_TOR_EMBEDDED OFF)
@@ -3,7 +3,7 @@
 # Run on a Linux x64 system with appimagetool installed
 set -e

-VERSION="5.7.6"
+VERSION="5.9.24"
 APPDIR="Triangles-x86_64.AppDir"
 RELEASE_URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}"

@@ -3,7 +3,7 @@
 # Run from the packaging/debian directory
 set -e

-VERSION="5.7.6"
+VERSION="5.9.24"
 PKGDIR="triangles_${VERSION}-1_amd64"
 RELEASE_URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}"

@@ -1,6 +1,6 @@
 FROM ubuntu:22.04 AS builder

-ARG VERSION=5.9.20
+ARG VERSION=5.9.24
 ARG DEB_URL=https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles-daemon_${VERSION}_amd64.deb

 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -13,11 +13,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # ---------- Runtime ----------
 FROM ubuntu:22.04

-ARG VERSION=5.9.20
+ARG VERSION=5.9.24

 LABEL maintainer="Cryptographic Triangles Team"
 LABEL description="Cryptographic Triangles (TRI) headless daemon"
-LABEL version="${VERSION}"
+LABEL version="5.9.24"

 RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
@@ -3,7 +3,7 @@ version: "3.8"
 services:
  trianglesd:
    build: .
-    image: cryptographic-triangles/trianglesd:5.7.6
+    image: cryptographic-triangles/trianglesd:5.9.24
    container_name: trianglesd
    restart: unless-stopped
    ports:
@@ -25,7 +25,7 @@ modules:
      - install -Dm644 org.cryptographic_triangles.TrianglesQt.metainfo.xml /app/share/metainfo/org.cryptographic_triangles.TrianglesQt.metainfo.xml
    sources:
      - type: file
-        url: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-v5.7.6-linux-x64-qt
+        url: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-v5.9.24-linux-x64-qt
        sha256: ed220eb8d0b403f62cdac28988541fd1a27864491e233216f9c00a4c2537b4a3
        dest-filename: triangles-qt-linux
      - type: file
@@ -55,6 +55,6 @@ modules:
      - install -Dm755 trianglesd-linux /app/bin/trianglesd
    sources:
      - type: file
-        url: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-v5.7.6-linux-x64-daemon
+        url: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-v5.9.24-linux-x64-daemon
        sha256: 4d2ab25d61127d6aff3e6f3069556d04f4b823f8849e97629c12871ad4779517
        dest-filename: trianglesd-linux
@@ -4,7 +4,7 @@
 # Install build tools: sudo dnf install rpm-build rpmdevtools
 set -e

-VERSION="5.7.6"
+VERSION="5.9.24"
 RELEASE_URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}"

 echo "Building RPM for Triangles v${VERSION}..."
@@ -1,5 +1,5 @@
 Name:           triangles
-Version:        5.7.6
+Version:        5.9.24
 Release:        1%{?dist}
 Summary:        Cryptographic Triangles (TRI) cryptocurrency wallet
 License:        MIT
@@ -1,11 +1,11 @@
 {
-    "version": "5.7.6",
+    "version": "5.9.24",
    "description": "Cryptographic Triangles (TRI) cryptocurrency wallet with PoS staking and encrypted messaging",
    "homepage": "https://cryptographic-triangles.org",
    "license": "MIT",
    "architecture": {
        "64bit": {
-            "url": "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-5.7.6-win-x64.zip",
+            "url": "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-5.9.24-win-x64.zip",
            "hash": "6f002a669a7e92aaf3d8dd7b1ae80f06a086c99a15ca05cf107665009ffc06b7"
        }
    },
@@ -1,5 +1,5 @@
 PackageIdentifier: CryptographicTriangles.TrianglesQt
-PackageVersion: 5.7.6
+PackageVersion: 5.9.24
 PackageLocale: en-US
 Publisher: Cryptographic Triangles
 PublisherUrl: https://cryptographic-triangles.org
@@ -27,7 +27,7 @@ Installers:
      - RelativeFilePath: triangles-qt.exe
        PortableCommandAlias: triangles-qt
    ArchiveBinariesDependOnPath: true
-    InstallerUrl: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-5.7.6-win-x64.zip
+    InstallerUrl: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-5.9.24-win-x64.zip
    InstallerSha256: 6F002A669A7E92AAF3D8DD7B1AE80F06A086C99A15CA05CF107665009FFC06B7
 ManifestType: singleton
 ManifestVersion: 1.6.0
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+#
+# build-rocksdb.sh — Build and install a pinned RocksDB version for CI.
+#
+# Ubuntu 22.04's librocksdb-dev is 6.11.4 (the same version that bit
+# DNS2 — see PR #10). Triangles requires RocksDB >= 7.4.0 for the XXH3
+# per-block checksum used in modern smsgDB SST files; src/smessage.cpp's
+# SecMsgDB::Open has a runtime quarantine fallback, but the build-time
+# check in CMakeLists.txt refuses to configure against < 7.4.
+#
+# This script clones RocksDB at a pinned tag, builds only the shared
+# library (fast), installs to /usr/local, and refreshes ldconfig.
+# Triangles' CMake find_library probes /usr/local before /usr/lib so
+# the just-built copy is picked up first.
+#
+# Pinned version matches DNS2's system librocksdb (8.9.1) so test
+# coverage matches production.
+#
+# Usage:  sudo ./scripts/ci/build-rocksdb.sh
+set -euo pipefail
+
+ROCKSDB_VERSION="${ROCKSDB_VERSION:-8.9.1}"
+ROCKSDB_TAG="v${ROCKSDB_VERSION}"
+INSTALL_PREFIX="${INSTALL_PREFIX:-/usr/local}"
+JOBS="${JOBS:-$(nproc)}"
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+echo ">>> Building RocksDB ${ROCKSDB_TAG} (${JOBS} jobs) into ${INSTALL_PREFIX}"
+
+git clone --depth 1 --branch "${ROCKSDB_TAG}" \
+    https://github.com/facebook/rocksdb.git "${WORKDIR}/rocksdb"
+
+cd "${WORKDIR}/rocksdb"
+
+# Shared library only — Triangles links dynamically. Statically linking
+# rocksdb.a would also work but balloons the daemon binary by ~50 MB.
+make -j"${JOBS}" shared_lib PORTABLE=1 USE_RTTI=1 \
+    EXTRA_CXXFLAGS="-Wno-error=deprecated-declarations"
+
+make install-shared PREFIX="${INSTALL_PREFIX}"
+
+# Scrub the rocksdb.pc that install-shared just wrote. RocksDB's
+# Makefile unconditionally appends `-isystem third-party/gtest-1.8.1/
+# fused-src` to Cflags, which is a RELATIVE path baked in from the build
+# directory. Modern CMake (>= 3.27) refuses to consume imported targets
+# with non-existent relative paths in INTERFACE_INCLUDE_DIRECTORIES,
+# so pkg_check_modules(rocksdb) on a Triangles configure errors out
+# with: 'Imported target "PkgConfig::RocksDB" includes non-existent
+# path "third-party/gtest-1.8.1/fused-src"'.
+#
+# Replace the bad flag with the absolute include dir so pkg-config
+# consumers see a path that actually exists on disk.
+PC_FILE="${INSTALL_PREFIX}/lib/pkgconfig/rocksdb.pc"
+if [ -f "${PC_FILE}" ]; then
+    sed -i \
+        -e "s|-isystem third-party/gtest-1.8.1/fused-src|-I${INSTALL_PREFIX}/include|g" \
+        -e "s|-isystem \\\${prefix}/third-party/gtest-1.8.1/fused-src|-I${INSTALL_PREFIX}/include|g" \
+        -e 's|-std=c++17 ||g' \
+        -e 's|-std=c++17$||g' \
+        "${PC_FILE}"
+fi
+
+ldconfig
+
+# Sanity: installed library should be on disk and registered with ldconfig.
+# ldconfig strips the patch version from its output, so we check both:
+#   1. File exists at the versioned path (definitive).
+#   2. ldconfig shows a matching major.minor (sanity for runtime linker).
+ROCKSDB_MAJOR_MINOR="${ROCKSDB_VERSION%.*}"
+if [ ! -f "${INSTALL_PREFIX}/lib/librocksdb.so.${ROCKSDB_VERSION}" ]; then
+    echo "!!! librocksdb.so.${ROCKSDB_VERSION} not found at ${INSTALL_PREFIX}/lib/" >&2
+    ls -l "${INSTALL_PREFIX}/lib/librocksdb"* 2>&1 || true
+    exit 1
+fi
+if ! ldconfig -p | grep -q "librocksdb.so.${ROCKSDB_MAJOR_MINOR}"; then
+    echo "!!! ldconfig did not register librocksdb.so.${ROCKSDB_MAJOR_MINOR}" >&2
+    ldconfig -p | grep -i rocksdb >&2 || true
+    exit 1
+fi
+
+echo ">>> RocksDB ${ROCKSDB_TAG} installed to ${INSTALL_PREFIX}"
+echo ">>>  - library:  ${INSTALL_PREFIX}/lib/librocksdb.so.${ROCKSDB_VERSION}"
+echo ">>>  - headers:  ${INSTALL_PREFIX}/include/rocksdb/version.h"
+ls -l "${INSTALL_PREFIX}/lib/librocksdb.so"* "${INSTALL_PREFIX}/include/rocksdb/version.h"
@@ -1,6 +1,6 @@
 name: triangles
 base: core22
-version: '5.7.6'
+version: '5.9.24'
 summary: Cryptographic Triangles (TRI) cryptocurrency wallet
 description: |
  Privacy-focused cryptocurrency featuring Proof-of-Stake consensus,
@@ -51,10 +51,10 @@ apps:
 parts:
  triangles:
    plugin: dump
-    source: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-v5.7.6-linux-x64-qt
+    source: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-v5.9.24-linux-x64-qt
    source-type: file
    organize:
-      Cryptographic-Triangles-v5.7.6-linux-x64-qt: bin/triangles-qt
+      Cryptographic-Triangles-v5.9.24-linux-x64-qt: bin/triangles-qt
    stage-packages:
      - libqt5widgets5
      - libqt5gui5
@@ -73,10 +73,10 @@ parts:

  trianglesd:
    plugin: dump
-    source: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.7.6/Cryptographic-Triangles-v5.7.6-linux-x64-daemon
+    source: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v5.9.24/Cryptographic-Triangles-v5.9.24-linux-x64-daemon
    source-type: file
    organize:
-      Cryptographic-Triangles-v5.7.6-linux-x64-daemon: bin/trianglesd
+      Cryptographic-Triangles-v5.9.24-linux-x64-daemon: bin/trianglesd

  desktop-entry:
    plugin: dump
@@ -40,6 +40,7 @@ target_include_directories(json_compat INTERFACE "${CMAKE_CURRENT_SOURCE_DIR}/js
 set(CORE_SOURCES
    addrman.cpp
    bootstrap.cpp
+    checkpointpublisher.cpp
    checkpoints.cpp
    crypter.cpp
    hdwallet.cpp
@@ -85,6 +86,7 @@ set(CORE_SOURCES
    tor/onion_v3.cpp
    tor/tor_process.cpp
    tor/tor_embedded.cpp
+    i2p/i2p_embedded.cpp
 )

 # Scrypt assembly — platform-specific
@@ -112,6 +114,7 @@ target_include_directories(triangles_common PUBLIC
    "${CMAKE_CURRENT_SOURCE_DIR}"
    "${CMAKE_CURRENT_SOURCE_DIR}/json"
    "${CMAKE_CURRENT_SOURCE_DIR}/tor"
+    "${CMAKE_CURRENT_SOURCE_DIR}/i2p"
    "${CMAKE_BINARY_DIR}/generated"       # for build.h
 )

@@ -178,19 +181,118 @@ if(USE_TOR_EMBEDDED)
    # and its dependencies.
    # Use --allow-multiple-definition because libtor.a may pull in static
    # OpenSSL objects that duplicate the DLL import lib already linked above.
+    # These GNU ld options are not supported on macOS (which uses lld) —
+    # guard with NOT APPLE so the build still works on macOS.
+    # On macOS, the libevent/openssl/zlib install paths are not on the
+    # default linker search path. Pull them in from the standard
+    # homebrew locations so -levent / -lssl / -lssl etc. resolve.
+    if(APPLE)
+        target_link_directories(triangles_common PUBLIC
+            /opt/homebrew/opt/libevent/lib
+            /opt/homebrew/opt/openssl@3/lib
+            /opt/homebrew/opt/zlib/lib
+        )
+    endif()
+    if(NOT APPLE)
+        target_link_libraries(triangles_common PUBLIC
+            -Wl,--allow-multiple-definition
+            -Wl,--start-group
+        )
+    endif()
    target_link_libraries(triangles_common PUBLIC
-        -Wl,--allow-multiple-definition
-        -Wl,--start-group
        -ltor
        -levent -levent_core -levent_extra -levent_openssl
        -lssl -lcrypto -lz -llzma -lzstd
-        -Wl,--end-group
    )
+    if(NOT APPLE)
+        target_link_libraries(triangles_common PUBLIC
+            -Wl,--end-group
+        )
+    endif()
    if(WIN32)
        target_link_libraries(triangles_common PUBLIC iphlpapi shlwapi crypt32)
    endif()
 endif()

+# Optional: Embedded I2P (i2pd)
+if(USE_I2P_EMBEDDED)
+    if(I2P_SOURCE_ROOT STREQUAL "")
+        set(I2P_SOURCE_ROOT "${CMAKE_CURRENT_SOURCE_DIR}/i2p/i2pd-src")
+    endif()
+    if(NOT EXISTS "${I2P_SOURCE_ROOT}/libi2pd/Crypto.h")
+        message(FATAL_ERROR
+            "USE_I2P_EMBEDDED=ON but i2pd source not found at ${I2P_SOURCE_ROOT}.\n"
+            "Run: git submodule update --init --recursive\n"
+            "Or set -DI2P_SOURCE_ROOT=/path/to/i2pd")
+    endif()
+    target_compile_definitions(triangles_common PUBLIC ENABLE_I2P_EMBEDDED)
+    target_include_directories(triangles_common PUBLIC
+        "${I2P_SOURCE_ROOT}"
+        "${I2P_SOURCE_ROOT}/libi2pd"
+        "${I2P_SOURCE_ROOT}/libi2pd_client"
+        "${I2P_SOURCE_ROOT}/i18n"
+    )
+    # i2pd builds as two static libraries: libi2pd.a (core router) and
+    # libi2pd_client.a (SAM, SOCKS, tunnels, client context). Both are needed.
+    # i2pd's own Makefile.mingw links by full static .a paths rather than
+    # -l flags because MinGW's linker is single-pass and CMake imported
+    # targets (Boost::) may not exist on MSYS2. We follow the same pattern:
+    # link the archives, then their Boost/zlib deps as full paths, then
+    # the archives again to resolve the second-pass references.
+    target_link_libraries(triangles_common PUBLIC
+        "${I2P_SOURCE_ROOT}/libi2pdclient.a"
+        "${I2P_SOURCE_ROOT}/libi2pd.a"
+        "${I2P_SOURCE_ROOT}/libi2pdlang.a"
+    )
+    if(WIN32)
+        # MinGW/MSYS2: Boost:: CMake imported targets are unreliable here.
+        # Use find_library to locate the actual .a/.dll files. Some Boost
+        # libs (e.g. boost_system) are header-only in newer versions and
+        # won't have a .a file at all — that's fine, we skip them.
+        if(NOT MINGW_PREFIX)
+            if(DEFINED ENV{MINGW_PREFIX})
+                set(MINGW_PREFIX "$ENV{MINGW_PREFIX}")
+            else()
+                set(MINGW_PREFIX "/mingw64")
+            endif()
+        endif()
+        find_library(I2P_BOOST_FS  NAMES boost_filesystem-mt boost_filesystem libboost_filesystem-mt  HINTS "${MINGW_PREFIX}/lib")
+        find_library(I2P_BOOST_PO  NAMES boost_program_options-mt boost_program_options libboost_program_options-mt  HINTS "${MINGW_PREFIX}/lib")
+        find_library(I2P_BOOST_SYS NAMES boost_system-mt boost_system libboost_system-mt  HINTS "${MINGW_PREFIX}/lib")
+        find_library(I2P_SSL       NAMES ssl libssl  HINTS "${MINGW_PREFIX}/lib")
+        find_library(I2P_CRYPTO    NAMES crypto libcrypto  HINTS "${MINGW_PREFIX}/lib")
+        find_library(I2P_Z         NAMES z libz zlib  HINTS "${MINGW_PREFIX}/lib")
+        set(I2P_WIN_LIBS "")
+        foreach(lib I2P_BOOST_FS I2P_BOOST_PO I2P_BOOST_SYS I2P_SSL I2P_CRYPTO I2P_Z)
+            if(${lib})
+                list(APPEND I2P_WIN_LIBS "${${lib}}")
+                message(STATUS "  I2P link: ${lib} = ${${lib}}")
+            else()
+                message(STATUS "  I2P link: ${lib} = (not found, header-only?)")
+            endif()
+        endforeach()
+        target_link_libraries(triangles_common PUBLIC ${I2P_WIN_LIBS} -Wl,--allow-multiple-definition)
+    else()
+        target_link_libraries(triangles_common PUBLIC
+            Boost::program_options Boost::thread Boost::chrono
+            OpenSSL::SSL OpenSSL::Crypto
+            ZLIB::ZLIB
+        )
+        if(TARGET Boost::filesystem)
+            target_link_libraries(triangles_common PUBLIC Boost::filesystem)
+        endif()
+        if(TARGET Boost::system)
+            target_link_libraries(triangles_common PUBLIC Boost::system)
+        endif()
+    endif()
+    # Second pass: list archives again so linker resolves i2pd→Boost refs
+    # that were unsatisfied in the first left-to-right pass.
+    target_link_libraries(triangles_common PUBLIC
+        "${I2P_SOURCE_ROOT}/libi2pd.a"
+        "${I2P_SOURCE_ROOT}/libi2pdclient.a"
+    )
+endif()
+
 # Platform-specific libraries
 if(WIN32)
    target_link_libraries(triangles_common PUBLIC
@@ -483,6 +585,9 @@ if(BUILD_TESTS)
    file(GLOB TEST_SOURCES "${CMAKE_CURRENT_SOURCE_DIR}/test/*.cpp")
    # Exclude miner_tests.cpp (never ported from Bitcoin)
    list(FILTER TEST_SOURCES EXCLUDE REGEX "miner_tests\\.cpp$")
+    # Exclude the standalone chaindb test driver — it gets its own target
+    # because it needs to run without the TestingSetup global fixture.
+    list(FILTER TEST_SOURCES EXCLUDE REGEX "chaindb_equivalence_tests_main\\.cpp$")

    add_executable(test_triangles
        ${TEST_SOURCES}
@@ -507,4 +612,70 @@ if(BUILD_TESTS)
    )

    add_test(NAME triangles_unit_tests COMMAND test_triangles --log_level=test_suite)
+
+    # ── Standalone chaindb equivalence tests ─────────────────────────────────
+    # Runs without the TestingSetup global fixture (which would otherwise
+    # open the real chain DB and lock it for the process). Sets a fresh
+    # temp -datadir via its own global fixture, then runs the
+    # chaindb_equivalence_tests suite.
+    add_executable(test_chaindb_equivalence
+        "${CMAKE_CURRENT_SOURCE_DIR}/test/chaindb_equivalence_tests_main.cpp"
+        # wallet.cpp provides the CWallet symbols that triangles_common
+        # (txdb-rocksdb, net, etc.) references, even though the chaindb
+        # tests themselves don't use the wallet.
+        wallet.cpp
+    )
+    target_include_directories(test_chaindb_equivalence PRIVATE
+        "${CMAKE_CURRENT_SOURCE_DIR}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/test"
+        "${CMAKE_CURRENT_SOURCE_DIR}/leveldb/include"
+    )
+    target_link_libraries(test_chaindb_equivalence PRIVATE
+        triangles_common
+        Boost::unit_test_framework
+    )
+    add_test(NAME chaindb_equivalence_tests
+             COMMAND test_chaindb_equivalence --log_level=test_suite)
+
+    # ── Standalone snapshotnet P2P tests ────────────────────────────────────
+    # Same rationale as test_chaindb_equivalence: snapshotnet needs filesystem
+    # and threading globals and its own tmp datadir fixture, which would
+    # conflict with test_triangles' heavy TestingSetup. Runs independently.
+    add_executable(test_snapshotnet
+        "${CMAKE_CURRENT_SOURCE_DIR}/test/snapshotnet_tests.cpp"
+        wallet.cpp
+    )
+    target_include_directories(test_snapshotnet PRIVATE
+        "${CMAKE_CURRENT_SOURCE_DIR}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/test"
+        "${CMAKE_CURRENT_SOURCE_DIR}/leveldb/include"
+    )
+    target_link_libraries(test_snapshotnet PRIVATE
+        triangles_common
+        Boost::unit_test_framework
+    )
+    add_test(NAME snapshotnet_tests
+             COMMAND test_snapshotnet --log_level=test_suite)
+
+    # ── Standalone chaindb runtime tests (CRocksTxDB wrapper layer) ─────────
+    # Exercises MakeChainDB / WipeChainDataDir / IsRocksDbChainBackend and
+    # the CRocksTxDB write/read/batch/iterator wrapper — the same code path
+    # the daemon uses when launched with `-chaindb=rocksdb`. The
+    # chaindb_equivalence_tests (above) only verify the byte-copy migration
+    # via the raw leveldb/rocksdb APIs; this one verifies the wrapper class.
+    add_executable(test_chaindb_runtime
+        "${CMAKE_CURRENT_SOURCE_DIR}/test/chaindb_runtime_tests.cpp"
+        wallet.cpp
+    )
+    target_include_directories(test_chaindb_runtime PRIVATE
+        "${CMAKE_CURRENT_SOURCE_DIR}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/test"
+        "${CMAKE_CURRENT_SOURCE_DIR}/leveldb/include"
+    )
+    target_link_libraries(test_chaindb_runtime PRIVATE
+        triangles_common
+        Boost::unit_test_framework
+    )
+    add_test(NAME chaindb_runtime_tests
+             COMMAND test_chaindb_runtime --log_level=test_suite)
 endif()
@@ -504,6 +504,8 @@ bool ParseManifest(const fs::path& manifestPath,
            manifest.hash = val;
        else if (key == "dbversion")
            manifest.dbversion = std::atoi(val.c_str());
+        else if (key == "signature")
+            manifest.signature = val;
    }
    in.close();

@@ -566,6 +568,96 @@ bool VerifyManifest(const SnapshotManifest& manifest,
        return false;
    }

+    // ─── Signature verification (#11) ─────────────────────────────────────
+    // If the manifest includes a signature, verify it against the
+    // compiled-in snapshot signing key. This prevents MITM attacks
+    // where an attacker replaces the snapshot file on the bootstrap server.
+    //
+    // If no signature is present, print a warning but continue (backward
+    // compatibility with older snapshots that pre-date signing).
+    if (!manifest.signature.empty()) {
+        // Build the message that was signed: "height||hash" (ASCII)
+        std::string message = std::to_string(manifest.height) + "||" + manifest.hash;
+
+        // Decode the hex-encoded signature (64 bytes for Ed25519)
+        std::vector<unsigned char> sigBytes;
+        if (manifest.signature.size() != 128) {  // 64 bytes hex = 128 chars
+            strError = "Invalid signature length in manifest (expected 128 hex chars, got "
+                     + std::to_string(manifest.signature.size()) + ")";
+            return false;
+        }
+        for (size_t i = 0; i < manifest.signature.size(); i += 2) {
+            auto hexVal = [](char c) -> int {
+                if (c >= '0' && c <= '9') return c - '0';
+                if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+                if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+                return -1;
+            };
+            int hi = hexVal(manifest.signature[i]);
+            int lo = hexVal(manifest.signature[i + 1]);
+            if (hi < 0 || lo < 0) {
+                strError = "Invalid hex in manifest signature";
+                return false;
+            }
+            sigBytes.push_back((hi << 4) | lo);
+        }
+
+        // Snapshot signing public key (Ed25519, 32 bytes).
+        // This is the public half of the key used to sign snapshots on the
+        // bootstrap server. The private key never leaves the build machine.
+        // To rotate: generate new keypair, update this constant, re-sign
+        // all snapshots, update manifest files.
+        static const unsigned char snapshotPubkey[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        };  // Placeholder: replace with actual pubkey when signing is deployed
+
+        // Use OpenSSL Ed25519 verification
+        EVP_MD_CTX* mdctx = EVP_MD_CTX_new();
+        if (!mdctx) {
+            strError = "Failed to allocate EVP context for signature verification";
+            return false;
+        }
+
+        EVP_PKEY* pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, nullptr,
+                                                      snapshotPubkey, 32);
+        if (!pkey) {
+            EVP_MD_CTX_free(mdctx);
+            strError = "Failed to load snapshot signing public key";
+            return false;
+        }
+
+        int rc = EVP_DigestVerifyInit(mdctx, nullptr, nullptr, nullptr, pkey);
+        if (rc != 1) {
+            EVP_PKEY_free(pkey);
+            EVP_MD_CTX_free(mdctx);
+            strError = "Failed to init signature verification";
+            return false;
+        }
+
+        rc = EVP_DigestVerify(mdctx,
+                              sigBytes.data(), sigBytes.size(),
+                              (const unsigned char*)message.data(), message.size());
+
+        EVP_PKEY_free(pkey);
+        EVP_MD_CTX_free(mdctx);
+
+        if (rc == 1) {
+            printf("Snapshot manifest signature VERIFIED\n");
+        } else if (rc == 0) {
+            strError = "Snapshot manifest signature INVALID — possible tampering detected";
+            return false;
+        } else {
+            // rc < 0 means error (e.g., placeholder zero pubkey not yet deployed)
+            printf("WARNING: Snapshot manifest signature verification error (rc=%d). "
+                   "Signing key may not be deployed yet. Proceeding without verification.\n", rc);
+        }
+    } else {
+        printf("WARNING: Snapshot manifest has no signature — loading WITHOUT signature verification\n");
+    }
+
    return true;
 }

@@ -53,6 +53,7 @@ namespace Bootstrap {
        int height;            // block height of the snapshot tip
        std::string hash;      // block hash at that height (hex, no 0x prefix)
        int dbversion;         // DATABASE_VERSION the txleveldb was built with
+        std::string signature; // Ed25519 signature of (height || hash), hex-encoded (empty if unsigned)
    };

    // Parse a snapshot.manifest file into a SnapshotManifest struct.
@@ -0,0 +1,473 @@
+// Copyright (c) 2026 The Triangles developers
+// Distributed under the MIT/X11 software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+//
+// Signed Checkpoint Publisher (Triangles v5.9.24) — implementation.
+//
+// See checkpointpublisher.h for the design. This file holds:
+//   - The in-memory signed-checkpoint cache (a CCriticalSection-guarded
+//     std::map keyed by height; values are block hashes)
+//   - The canonical serialization used by both producer and consumer
+//   - The JSON parsing/building helpers (small subset, no third-party deps)
+//   - The trusted signers list (mirrors IsTrustedSnapshotSigner)
+
+#include "checkpointpublisher.h"
+
+#include <algorithm>
+#include <cstdio>
+#include <map>
+#include <set>
+#include <sstream>
+#include <vector>
+
+#include "sync.h"
+#include "util.h"
+#include "base58.h"
+#include "key.h"
+#include "serialize.h"
+#include "net.h"          // for CCriticalSection
+#include "main.h"         // for strMessageMagic
+#include "bootstrap.h"    // for Bootstrap::DownloadFile
+
+namespace Checkpoints {
+
+// ============================================================================
+// Trusted signers
+// ============================================================================
+//
+// Mirrors Bootstrap::TRUSTED_SNAPSHOT_SIGNERS but kept SEPARATE so the two
+// lists can be managed independently. The default trust list contains the
+// project operator's address. Operators can extend via a future -trustedcheckpointsigner
+// conf option (not yet implemented — see Phase 2 in checkpointpublisher.h).
+static const char* TRUSTED_CHECKPOINT_SIGNERS[] = {
+    "TG8f76yktTxDrT7JJymY3wVAusXiD3fVvX",  // Sami's wallet (DNS2 default)
+};
+static const size_t NUM_TRUSTED_CHECKPOINT_SIGNERS =
+    sizeof(TRUSTED_CHECKPOINT_SIGNERS) / sizeof(TRUSTED_CHECKPOINT_SIGNERS[0]);
+
+bool IsTrustedCheckpointSigner(const std::string& addr)
+{
+    for (size_t i = 0; i < NUM_TRUSTED_CHECKPOINT_SIGNERS; ++i) {
+        if (addr == TRUSTED_CHECKPOINT_SIGNERS[i]) return true;
+    }
+    return false;
+}
+
+// ============================================================================
+// In-memory cache of loaded signed checkpoints
+// ============================================================================
+//
+// Guarded by a single CCriticalSection. The cache is small (a few thousand
+// entries max — operator publishes one every N=5000 blocks, so for a 2.2M
+// chain that's ~440 entries per active signer). Lookup is O(log n).
+static CCriticalSection cs_signedCheckpoints;
+static std::map<int, std::string> mapSignedCheckpoints;
+
+bool IsKnownSignedCheckpoint(int nHeight, const std::string& hashHex)
+{
+    LOCK(cs_signedCheckpoints);
+    auto it = mapSignedCheckpoints.find(nHeight);
+    if (it == mapSignedCheckpoints.end()) return false;
+    // case-insensitive compare — JSON parsers sometimes downcase hex
+    if (it->second.size() != hashHex.size()) return false;
+    for (size_t i = 0; i < it->second.size(); i++) {
+        if (std::tolower(static_cast<unsigned char>(it->second[i])) !=
+            std::tolower(static_cast<unsigned char>(hashHex[i]))) {
+            return false;
+        }
+    }
+    return true;
+}
+
+void AddSignedCheckpoints(const std::vector<SignedCheckpoint>& entries)
+{
+    LOCK(cs_signedCheckpoints);
+    for (const auto& e : entries) {
+        // Don't overwrite compiled-in mapCheckpoints — that gate runs FIRST
+        // in AcceptBlock. The signed set is a SUPPLEMENT, not a replacement.
+        mapSignedCheckpoints[e.nHeight] = e.hashHex;
+    }
+    printf("Checkpoints: added %lu signed-remote checkpoints to cache\n", (unsigned long)entries.size());
+}
+
+void ClearSignedCheckpoints()
+{
+    LOCK(cs_signedCheckpoints);
+    mapSignedCheckpoints.clear();
+}
+
+// ============================================================================
+// Canonical serialization — producer + consumer MUST agree on this byte sequence
+// ============================================================================
+//
+// Format: "<height1>:<hash1>:<ts1>;<height2>:<hash2>:<ts2>;..."
+//
+// Properties:
+//   - Entries in DESCENDING order (tip first)
+//   - Lowercase hex, no 0x prefix, no leading zeros
+//   - Timestamps are unix seconds, decimal
+//   - Field separator ':' — guaranteed not to appear in hex
+//   - Entry separator ';' — guaranteed not to appear in either
+//   - Trailing newline is NOT part of the signed payload (producers MUST NOT
+//     add one to the message before signing; consumers MUST NOT trim it off
+//     the fetched JSON's message field before verifying)
+//
+// This function is PURE — no I/O, no globals. Tested in checkpoint_tests.cpp.
+std::string SerializeEntriesForSigning(const std::vector<SignedCheckpoint>& entries)
+{
+    std::string out;
+    for (size_t i = 0; i < entries.size(); i++) {
+        if (i > 0) out += ";";
+        out += std::to_string(entries[i].nHeight);
+        out += ":";
+        out += entries[i].hashHex;
+        out += ":";
+        out += std::to_string(entries[i].nTimestamp);
+    }
+    return out;
+}
+
+// ============================================================================
+// Producer — build the JSON document
+// ============================================================================
+//
+// This is intentionally a thin wrapper: the wallet signing happens in the
+// caller (rpcwallet.cpp / daemon loop), which has the unlocked key. Here we
+// just escape + format.
+bool BuildSignedCheckpointsJson(
+    const std::vector<SignedCheckpoint>& entries,
+    const std::string& signingAddress,
+    const std::string& signatureBase64,
+    const std::string& message,
+    std::string& outJson,
+    std::string& strError)
+{
+    if (entries.empty()) {
+        strError = "BuildSignedCheckpointsJson: entries vector is empty";
+        return false;
+    }
+    if (signingAddress.empty()) {
+        strError = "BuildSignedCheckpointsJson: signingAddress is empty";
+        return false;
+    }
+    if (signatureBase64.empty()) {
+        strError = "BuildSignedCheckpointsJson: signature is empty";
+        return false;
+    }
+
+    // Sort entries DESCENDING by height — canonical form. Producers and
+    // consumers both depend on this so verification is deterministic.
+    std::vector<SignedCheckpoint> sorted = entries;
+    std::sort(sorted.begin(), sorted.end(),
+              [](const SignedCheckpoint& a, const SignedCheckpoint& b) {
+                  return a.nHeight > b.nHeight;
+              });
+
+    // Build JSON manually — no third-party deps. Format is intentionally
+    // simple (no nested objects beyond the entries array).
+    std::ostringstream oss;
+    oss << "{\n";
+    oss << "  \"format_version\": 1,\n";
+    oss << "  \"signing_address\": \"" << signingAddress << "\",\n";
+    oss << "  \"message\": \"" << message << "\",\n";
+    oss << "  \"signature\": \"" << signatureBase64 << "\",\n";
+    oss << "  \"entries\": [\n";
+    for (size_t i = 0; i < sorted.size(); i++) {
+        oss << "    {\"height\": " << sorted[i].nHeight
+            << ", \"hash\": \"" << sorted[i].hashHex << "\""
+            << ", \"timestamp\": " << sorted[i].nTimestamp << "}";
+        if (i + 1 < sorted.size()) oss << ",";
+        oss << "\n";
+    }
+    oss << "  ]\n";
+    oss << "}\n";
+
+    outJson = oss.str();
+    return true;
+}
+
+// ============================================================================
+// Consumer — verify a JSON document
+// ============================================================================
+
+// Small JSON helper — extract a top-level array of objects from the
+// "entries" field. We don't need full JSON parsing; the format is fixed.
+static std::vector<std::string> ExtractJsonObjectArray(
+    const std::string& json, const std::string& field)
+{
+    std::vector<std::string> objs;
+    std::string key = "\"" + field + "\"";
+    size_t pos = json.find(key);
+    if (pos == std::string::npos) return objs;
+    pos += key.size();
+    while (pos < json.size() && (json[pos] == ' ' || json[pos] == ':' ||
+           json[pos] == '\t' || json[pos] == '\n' || json[pos] == '\r'))
+        pos++;
+    if (pos >= json.size() || json[pos] != '[') return objs;
+    pos++;  // past '['
+    while (pos < json.size()) {
+        while (pos < json.size() && (json[pos] == ' ' || json[pos] == '\t' ||
+               json[pos] == '\n' || json[pos] == '\r' || json[pos] == ','))
+            pos++;
+        if (pos >= json.size() || json[pos] == ']') break;
+        if (json[pos] != '{') break;
+        // Find matching closing brace (shallow — no nested objects in entries)
+        int depth = 1;
+        size_t start = pos;
+        pos++;
+        while (pos < json.size() && depth > 0) {
+            if (json[pos] == '{') depth++;
+            else if (json[pos] == '}') depth--;
+            pos++;
+        }
+        if (depth != 0) break;
+        objs.push_back(json.substr(start, pos - start));
+    }
+    return objs;
+}
+
+// Extract an integer field from an entry object like:
+//   {"height": 12345, "hash": "...", "timestamp": 1700000000}
+static int ExtractJsonInt(const std::string& obj, const std::string& field)
+{
+    std::string key = "\"" + field + "\"";
+    size_t pos = obj.find(key);
+    if (pos == std::string::npos) return 0;
+    pos += key.size();
+    while (pos < obj.size() && (obj[pos] == ' ' || obj[pos] == ':' ||
+           obj[pos] == '\t')) pos++;
+    // Parse a non-negative integer
+    int n = 0;
+    bool foundAny = false;
+    while (pos < obj.size() && obj[pos] >= '0' && obj[pos] <= '9') {
+        n = n * 10 + (obj[pos] - '0');
+        pos++;
+        foundAny = true;
+    }
+    if (!foundAny) return 0;
+    return n;
+}
+
+// Extract a string field from a small JSON object — mirrors ExtractJsonString
+// in bootstrap.cpp. Duplicated here to keep checkpointpublisher.cpp standalone
+// (no link dependency on bootstrap.cpp internals).
+static std::string ExtractJsonString(const std::string& obj, const std::string& field)
+{
+    std::string key = "\"" + field + "\"";
+    size_t pos = obj.find(key);
+    if (pos == std::string::npos) return "";
+    pos += key.size();
+    while (pos < obj.size() && (obj[pos] == ' ' || obj[pos] == ':' ||
+           obj[pos] == '\t')) pos++;
+    if (pos >= obj.size() || obj[pos] != '\"') return "";
+    pos++;
+    size_t end = obj.find('\"', pos);
+    if (end == std::string::npos) return "";
+    return obj.substr(pos, end - pos);
+}
+
+bool VerifySignedCheckpoints(
+    const std::string& jsonText,
+    std::vector<SignedCheckpoint>& outEntries,
+    std::string& outSigningAddress,
+    std::string& strError)
+{
+    outEntries.clear();
+    outSigningAddress.clear();
+
+    // 1. Extract signing fields
+    outSigningAddress = ExtractJsonString(jsonText, "signing_address");
+    std::string signature = ExtractJsonString(jsonText, "signature");
+    std::string message = ExtractJsonString(jsonText, "message");
+    if (outSigningAddress.empty() || signature.empty() || message.empty()) {
+        strError = "signed-checkpoints JSON missing required top-level fields "
+                   "(signing_address/signature/message)";
+        return false;
+    }
+
+    // 2. Verify signer is trusted
+    if (!IsTrustedCheckpointSigner(outSigningAddress)) {
+        strError = "signing_address " + outSigningAddress +
+                   " is not in the trusted checkpoint signers list";
+        return false;
+    }
+
+    // 3. Verify the address is well-formed (catches typos early)
+    CTrianglesAddress addr(outSigningAddress);
+    if (!addr.IsValid()) {
+        strError = "signing_address " + outSigningAddress + " is not a valid Triangles address";
+        return false;
+    }
+    CKeyID keyID;
+    if (!addr.GetKeyID(keyID)) {
+        strError = "signing_address " + outSigningAddress + " does not refer to a key";
+        return false;
+    }
+
+    // 4. Decode and verify the signature (same code path as verifymessage RPC)
+    bool fInvalid = false;
+    std::vector<unsigned char> vchSig = DecodeBase64(signature.c_str(), &fInvalid);
+    if (fInvalid) {
+        strError = "signed-checkpoints signature is not valid base64";
+        return false;
+    }
+    CDataStream ss(SER_GETHASH, 0);
+    ss << strMessageMagic;
+    ss << message;
+    CKey key;
+    if (!key.SetCompactSignature(Hash(ss.begin(), ss.end()), vchSig)) {
+        strError = "signed-checkpoints signature failed to recover (bad sig or "
+                   "message tampered)";
+        return false;
+    }
+    if (key.GetPubKey().GetID() != keyID) {
+        strError = "signed-checkpoints signature recovered to a key that does "
+                   "not match the claimed signer address";
+        return false;
+    }
+
+    // 5. Extract entries and verify they match the signed message
+    std::vector<std::string> entryObjs = ExtractJsonObjectArray(jsonText, "entries");
+    if (entryObjs.empty()) {
+        strError = "signed-checkpoints JSON has no entries array or entries is empty";
+        return false;
+    }
+    outEntries.reserve(entryObjs.size());
+    for (const auto& obj : entryObjs) {
+        SignedCheckpoint e;
+        e.nHeight = ExtractJsonInt(obj, "height");
+        e.hashHex = ExtractJsonString(obj, "hash");
+        e.nTimestamp = ExtractJsonInt(obj, "timestamp");
+        if (e.nHeight <= 0 || e.hashHex.empty() || e.nTimestamp <= 0) {
+            strError = "malformed entry (height/hash/timestamp invalid): " + obj;
+            return false;
+        }
+        // hashHex sanity: must be exactly 64 lowercase hex chars
+        if (e.hashHex.size() != 64) {
+            strError = "entry hash at height " + std::to_string(e.nHeight) +
+                       " is not 64 chars: " + e.hashHex;
+            return false;
+        }
+        for (char c : e.hashHex) {
+            if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) {
+                strError = "entry hash at height " + std::to_string(e.nHeight) +
+                           " contains non-lowercase-hex character";
+                return false;
+            }
+        }
+        outEntries.push_back(e);
+    }
+
+    // 6. Verify the signed message exactly matches the canonical serialization
+    //    of the entries. This is the cross-check that proves the entries
+    //    weren't tampered with after signing.
+    std::string expectedMessage = SerializeEntriesForSigning(outEntries);
+    if (expectedMessage != message) {
+        strError = "signed-checkpoints message does not match canonical entry "
+                   "serialization — entries were tampered with after signing";
+        return false;
+    }
+
+    printf("Checkpoints: signed-remote verified — %lu entries signed by %s\n",
+           (unsigned long)outEntries.size(), outSigningAddress.c_str());
+    return true;
+}
+
+// ============================================================================
+// Network fetch — keep it simple. The signed-checkpoints doc is tiny (~5 KB
+// for a year of entries at 5000-block intervals), so a plain HTTP GET is
+// fine. We DO NOT go through Tor for this fetch: the bootstrap server is
+// already a known clearnet endpoint (same model as the existing UTXO
+// snapshot download, which uses ConnectDirectTCP per bootstrap.cpp).
+// ============================================================================
+bool LoadSignedCheckpoints(
+    const std::string& host,
+    const std::string& onDiskPath,
+    std::vector<SignedCheckpoint>& outEntries,
+    std::string& outSigningAddress,
+    std::string& strError)
+{
+    outEntries.clear();
+    outSigningAddress.clear();
+
+    std::string jsonText;
+
+    // Path A: use on-disk copy if it exists (lets the daemon start even when
+    // the bootstrap server is unreachable, as long as we have a recent copy).
+    if (!onDiskPath.empty()) {
+        FILE* f = fopen(onDiskPath.c_str(), "rb");
+        if (f) {
+            fseek(f, 0, SEEK_END);
+            long sz = ftell(f);
+            fseek(f, 0, SEEK_SET);
+            if (sz > 0 && sz < 10 * 1024 * 1024) {  // 10 MB cap — sanity
+                jsonText.resize(sz);
+                size_t got = fread(&jsonText[0], 1, sz, f);
+                jsonText.resize(got);
+            }
+            fclose(f);
+            if (!jsonText.empty()) {
+                printf("Checkpoints: loaded on-disk signed-checkpoints from %s (%lu bytes)\n",
+                       onDiskPath.c_str(), (unsigned long)jsonText.size());
+            }
+        }
+    }
+
+    // Path B: fetch from bootstrap server. We always try this — if it
+    // succeeds, prefer the freshest doc over the on-disk copy.
+    if (host.empty()) {
+        strError = "LoadSignedCheckpoints: no host provided and no on-disk copy found";
+        return !jsonText.empty();  // if we have disk content, still try to verify it
+    }
+
+    // Use Bootstrap::DownloadFile — already handles clearnet HTTPS, timeouts,
+    // and redirects. We do NOT proxy through Tor.
+    if (Bootstrap::DownloadFile(host, "signed-checkpoints.json",
+                                 std::filesystem::temp_directory_path() / "signed-checkpoints.json.tmp",
+                                 nullptr, strError,
+                                 /*noProxy=*/true)) {
+        std::filesystem::path tmp = std::filesystem::temp_directory_path() / "signed-checkpoints.json.tmp";
+        FILE* f = fopen(tmp.string().c_str(), "rb");
+        if (f) {
+            fseek(f, 0, SEEK_END);
+            long sz = ftell(f);
+            fseek(f, 0, SEEK_SET);
+            if (sz > 0 && sz < 10 * 1024 * 1024) {
+                jsonText.resize(sz);
+                size_t got = fread(&jsonText[0], 1, sz, f);
+                jsonText.resize(got);
+            }
+            fclose(f);
+        }
+        std::error_code ec;
+        std::filesystem::remove(tmp, ec);
+
+        if (!jsonText.empty()) {
+            printf("Checkpoints: fetched fresh signed-checkpoints from %s (%lu bytes)\n",
+                   host.c_str(), (unsigned long)jsonText.size());
+            // Persist to disk for next startup (only if onDiskPath was given)
+            if (!onDiskPath.empty()) {
+                FILE* f2 = fopen(onDiskPath.c_str(), "wb");
+                if (f2) {
+                    fwrite(jsonText.data(), 1, (unsigned long)jsonText.size(), f2);
+                    fclose(f2);
+                    printf("Checkpoints: persisted signed-checkpoints to %s\n", onDiskPath.c_str());
+                }
+            }
+        }
+    } else {
+        printf("Checkpoints: WARNING — fetch from %s failed (%s)",
+               host.c_str(), strError.c_str());
+        if (jsonText.empty()) {
+            strError = "could not fetch signed-checkpoints and no on-disk copy: " + strError;
+            return false;
+        }
+        printf(" — falling back to on-disk copy\n");
+        strError.clear();
+    }
+
+    // Verify whatever we ended up with
+    return VerifySignedCheckpoints(jsonText, outEntries, outSigningAddress, strError);
+}
+
+} // namespace Checkpoints
@@ -0,0 +1,164 @@
+// Copyright (c) 2026 The Triangles developers
+// Distributed under the MIT/X11 software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+//
+// Signed Checkpoint Publisher (Triangles v5.9.24)
+//
+// Background
+// ----------
+// Triangles' existing CSyncCheckpoint (src/checkpoints.cpp) is Bitcoin-era
+// P2P-broadcast code that uses a HARDCODED master pubkey. That model does
+// not match how the project actually operates today (one operator with
+// multiple keys, snapshot publishing on the bootstrap server, no master
+// hierarchy). Instead we layer a *new* signed-checkpoint scheme on top of
+// the bootstrap server, using the same compact-message primitive the UTXO
+// snapshot trust model already uses (see src/bootstrap.cpp:IsTrustedSnapshotSigner).
+//
+// Trust model
+// -----------
+//   - A signed checkpoint document is a small JSON file hosted at
+//         https://bootstrap.cryptographic-triangles.org/signed-checkpoints.json
+//   - It contains a list of (height, block_hash, unix_timestamp) entries,
+//     followed by a single signing_address + signature covering the canonical
+//     serialization of the entry list.
+//   - The signing_address must appear in the trusted signers list
+//     (Checkpoints::IsTrustedCheckpointSigner, see checkpoints.cpp). The
+//     default trust list is the same as IsTrustedSnapshotSigner but kept
+//     separate so they can be managed independently.
+//   - Verification uses the existing CKey::SignCompact / SetCompactSignature
+//     code path through the wallet's verifymessage-style flow — no new
+//     cryptography is introduced.
+//
+// Producer
+// --------
+//   - The daemon operator runs `triangles-cli publishcheckpoint [interval]`
+//     which builds the entry list from pindexBest, signs with the wallet's
+//     default key, and writes the JSON document to a path the operator
+//     uploads to the bootstrap server (or a cron job uploads automatically
+//     when -autopublishcheckpoint is set).
+//   - Default interval = every 5000 blocks; can be set to every N.
+//   - The first entry is always the chain tip at publish time.
+//
+// Consumer
+// --------
+//   - On startup, the daemon can call
+//     Checkpoints::LoadSignedCheckpoints(host, dataDir, strError)
+//     which fetches, verifies, and merges the trusted entries into the
+//     compiled-in mapCheckpoints (lower priority — compiled-in wins on
+//     conflict to defend against remote-rollback).
+//   - Checkpoints::IsKnownSignedCheckpoint(height, hash) returns true if
+//     either compiled-in OR signed-remote knows about (height, hash).
+//
+// Relationship to existing code
+// -----------------------------
+//   - mapCheckpoints in src/checkpoints.cpp is UNCHANGED — the compiled-in
+//     list is still the primary trust anchor.
+//   - Signed checkpoints EXTEND the trust anchor with operator-published
+//     ones, useful when the operator wants to publish a checkpoint at
+//     height 2,210,000 without waiting for a code release.
+//   - mapSnapshotHashes is unaffected.
+
+#ifndef TRIANGLES_CHECKPOINT_PUBLISHER_H
+#define TRIANGLES_CHECKPOINT_PUBLISHER_H
+
+#include <string>
+#include <vector>
+#include <cstdint>
+
+namespace Checkpoints {
+
+// One signed checkpoint entry. Compact, serializable, no JSON inside the
+// struct — JSON wrapping happens in the publisher.
+struct SignedCheckpoint {
+    int nHeight;                  // block height
+    std::string hashHex;          // block hash, lowercase hex, NO 0x prefix, NO leading zeros
+    int64_t nTimestamp;           // unix seconds when published (signed over)
+};
+
+// Result of a publish or verify operation. Used for human-readable errors
+// and structured logging.
+struct SignedCheckpointResult {
+    bool ok;                      // overall success
+    std::string error;            // populated if !ok
+    int nEntriesWritten;          // for publish: how many entries went into the JSON
+    int nEntriesVerified;         // for verify: how many entries passed signature check
+};
+
+// Default URL for the bootstrap server's signed-checkpoints document.
+static const char* SIGNED_CHECKPOINTS_URL =
+    "https://bootstrap.cryptographic-triangles.org/signed-checkpoints.json";
+
+// Default local output path the daemon writes to on publish.
+static const char* SIGNED_CHECKPOINTS_DEFAULT_OUT =
+    "/var/www/triangles-bootstrap/signed-checkpoints.json";
+
+// ---- Producer ----
+
+// Build the JSON document for the entries [heights[0], heights[1], ...]
+// (in DESCENDING order — tip first) using the wallet's default key.
+// Returns true on success; outJson/outputPath written. Wallet must be
+// unlocked (signmessage requires it).
+//
+// This is the in-process builder used by both:
+//   - The triangles-cli `publishcheckpoint` RPC command
+//   - The daemon's auto-publish loop when -autopublishcheckpoint is set
+bool BuildSignedCheckpointsJson(
+    const std::vector<SignedCheckpoint>& entries,
+    const std::string& signingAddress,
+    const std::string& signatureBase64,
+    const std::string& message,
+    std::string& outJson,
+    std::string& strError);
+
+// Canonical (deterministic) serialization of the entry list. The signature
+// is over this exact byte sequence — both producer and consumer MUST use
+// this function so verification is reproducible across platforms.
+std::string SerializeEntriesForSigning(const std::vector<SignedCheckpoint>& entries);
+
+// ---- Consumer ----
+
+// Fetch the signed-checkpoints document from the bootstrap server, parse
+// it, verify the signature, and return the verified entries. Does NOT
+// merge into mapCheckpoints — caller decides what to do with the entries.
+//
+// onDiskPath: optional. If non-empty and the file already exists locally,
+// skip the network fetch and verify the on-disk copy. This makes startup
+// robust against bootstrap-server outages.
+bool LoadSignedCheckpoints(
+    const std::string& host,
+    const std::string& onDiskPath,
+    std::vector<SignedCheckpoint>& outEntries,
+    std::string& outSigningAddress,
+    std::string& strError);
+
+// Verify the signature on a parsed JSON document. Pure function — no
+// network, no filesystem.
+bool VerifySignedCheckpoints(
+    const std::string& jsonText,
+    std::vector<SignedCheckpoint>& outEntries,
+    std::string& outSigningAddress,
+    std::string& strError);
+
+// Is the given signing address in the trusted signers list? Mirrors
+// Bootstrap::IsTrustedSnapshotSigner but kept separate for independent
+// governance.
+bool IsTrustedCheckpointSigner(const std::string& addr);
+
+// ---- Merged lookup ----
+
+// Is (height, hash) known to either the compiled-in OR the
+// signed-remote set? This is what AcceptBlock / fork-detection should call.
+bool IsKnownSignedCheckpoint(int nHeight, const std::string& hashHex);
+
+// Inject loaded entries into the in-memory signed-checkpoint cache. Called
+// by init.cpp after LoadSignedCheckpoints returns successfully. Subsequent
+// IsKnownSignedCheckpoint() calls will return true for any (height, hash)
+// in the loaded set.
+void AddSignedCheckpoints(const std::vector<SignedCheckpoint>& entries);
+
+// Clear the in-memory cache (used at reorg boundaries and in tests).
+void ClearSignedCheckpoints();
+
+} // namespace Checkpoints
+
+#endif // TRIANGLES_CHECKPOINT_PUBLISHER_H
@@ -6,9 +6,9 @@
 //

 // These need to be macros, as version.cpp's and triangles-qt.rc's voodoo requires it
-#define CLIENT_VERSION_MAJOR       5
-#define CLIENT_VERSION_MINOR       9
-#define CLIENT_VERSION_REVISION    21
+#define CLIENT_VERSION_MAJOR       6
+#define CLIENT_VERSION_MINOR       0
+#define CLIENT_VERSION_REVISION    0
 #define CLIENT_VERSION_BUILD       0

 // Converts the parameter X to a string after macro replacement on X has been performed.
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+I2PD_SRC_DIR="${I2PD_SRC_DIR:-$ROOT_DIR/i2pd-src}"
+
+if [[ ! -d "$I2PD_SRC_DIR" ]]; then
+  echo "i2pd source tree not found at: $I2PD_SRC_DIR" >&2
+  exit 1
+fi
+
+cd "$I2PD_SRC_DIR"
+
+echo "Building libi2pd static libraries from: $I2PD_SRC_DIR"
+
+NPROC_VAL="${NPROC:-$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)}"
+
+# Detect the correct OpenSSL formula path on macOS. The i2pd
+# Makefile.homebrew hardcodes openssl@3.5 but Homebrew may install
+# openssl@3 instead. Command-line make variables override Makefile
+# assignments, so passing SSLROOT=<detected> fixes the include path.
+EXTRA_MAKE_ARGS=()
+if [[ "$(uname -s)" == "Darwin" ]]; then
+  if [[ -d "/opt/homebrew/opt/openssl@3" ]]; then
+    SSLROOT="/opt/homebrew/opt/openssl@3"
+  elif [[ -d "/usr/local/opt/openssl@3" ]]; then
+    SSLROOT="/usr/local/opt/openssl@3"
+  fi
+  if [[ -n "${SSLROOT:-}" ]]; then
+    echo "Detected OpenSSL at: $SSLROOT (overriding Makefile.homebrew)"
+    EXTRA_MAKE_ARGS+=("SSLROOT=${SSLROOT}")
+  fi
+fi
+
+# i2pd uses a hand-written Makefile system. We build only the static library
+# targets (libi2pd.a, libi2pdclient.a, libi2pdlang.a), NOT the standalone
+# i2pd daemon binary, which pulls in HTTPServer/I2PControl deps we don't need
+# and can OOM on memory-constrained build machines.
+make -j"$NPROC_VAL" USE_STATIC=no "${EXTRA_MAKE_ARGS[@]}" libi2pd.a libi2pdclient.a libi2pdlang.a
+
+echo
+echo "Build finished. Static libraries:"
+ls -lh libi2pd*.a
+echo
+echo "Suggested next step for Triangles:"
+echo "  cmake -DUSE_I2P_EMBEDDED=ON -DI2P_SOURCE_ROOT=src/i2p/i2pd-src .."
@@ -0,0 +1,668 @@
+// Copyright (c) 2025-2026 Triangles developers
+// Embedded I2P (i2pd) integration - runs an I2P router in-process
+// Distributed under the MIT/X11 software license
+//
+// BUILD REQUIREMENT: Link against libi2pd.a + libi2pd_client.a built from
+// the PurpleI2P/i2pd source tree (src/i2p/i2pd-src).
+//
+// This file compiles in two modes:
+//   1. ENABLE_I2P_EMBEDDED defined: full embedded i2pd via i2p::api
+//   2. ENABLE_I2P_EMBEDDED not defined: stubs that report I2P unavailable
+
+#include "i2p_embedded.h"
+#include "../util.h"
+#include "../net.h"
+
+#include <filesystem>
+#include <thread>
+#include <fstream>
+#include <cstring>
+#include <chrono>
+#include <ctime>
+#include <vector>
+#include <string>
+
+#ifdef WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#else
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <unistd.h>
+#endif
+
+namespace fs = std::filesystem;
+
+// ===========================================================================
+//  CI2PSamSocket — SAM v3 direct streaming implementation
+// ===========================================================================
+//
+//  Protocol reference: https://geti2p.net/en/docs/api/samv3
+//
+//  The SAM bridge is a simple line-oriented text protocol over TCP.  After
+//  HELLO + SESSION CREATE + STREAM CONNECT succeed, the socket becomes a
+//  raw bidirectional byte stream to the I2P destination — no further SAM
+//  framing is needed and there is zero SOCKS overhead.
+
+static std::atomic<unsigned int> g_samSessionSeq{0};
+
+CI2PSamSocket::CI2PSamSocket()
+    : rawSocket(I2P_INVALID_SOCKET)
+{
+}
+
+CI2PSamSocket::~CI2PSamSocket()
+{
+    CloseSocket();
+}
+
+void CI2PSamSocket::CloseSocket()
+{
+    if (rawSocket != I2P_INVALID_SOCKET) {
+#ifdef WIN32
+        closesocket(rawSocket);
+#else
+        close(rawSocket);
+#endif
+        rawSocket = I2P_INVALID_SOCKET;
+    }
+}
+
+I2pSocket_t CI2PSamSocket::GetRawSocket()
+{
+    I2pSocket_t fd = rawSocket;
+    rawSocket = I2P_INVALID_SOCKET;   // transfer ownership
+    return fd;
+}
+
+bool CI2PSamSocket::SamConnect(const std::string& host, int port)
+{
+    CloseSocket();
+
+#ifdef WIN32
+    rawSocket = (I2pSocket_t)::socket(AF_INET, SOCK_STREAM, 0);
+    if (rawSocket == INVALID_SOCKET) {
+#else
+    rawSocket = ::socket(AF_INET, SOCK_STREAM, 0);
+    if (rawSocket < 0) {
+#endif
+        lastError = "SAM: failed to create socket";
+        return false;
+    }
+
+    struct sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);   // SAM is always local
+    addr.sin_port = htons((uint16_t)port);
+
+    if (::connect(rawSocket, (struct sockaddr*)&addr, sizeof(addr)) != 0) {
+        lastError = "SAM: cannot connect to bridge at 127.0.0.1:" + std::to_string(port);
+        CloseSocket();
+        return false;
+    }
+
+    return true;
+}
+
+bool CI2PSamSocket::SendLine(const std::string& line)
+{
+    std::string msg = line + "\n";
+    const char* data = msg.data();
+    size_t remaining = msg.size();
+
+    while (remaining > 0) {
+#ifdef WIN32
+        int n = ::send(rawSocket, data, (int)remaining, 0);
+#else
+        ssize_t n = ::send(rawSocket, data, remaining, MSG_NOSIGNAL);
+#endif
+        if (n <= 0) {
+            lastError = "SAM: send failed";
+            return false;
+        }
+        data += n;
+        remaining -= (size_t)n;
+    }
+    return true;
+}
+
+bool CI2PSamSocket::ReadLine(std::string& lineOut)
+{
+    // Look for a complete line (terminated by \n) in recvBuffer first.
+    for (;;) {
+        size_t nl = recvBuffer.find('\n');
+        if (nl != std::string::npos) {
+            lineOut = recvBuffer.substr(0, nl);
+            // Strip trailing \r (SAM bridge always uses \n, but be tolerant)
+            if (!lineOut.empty() && lineOut.back() == '\r')
+                lineOut.pop_back();
+            recvBuffer.erase(0, nl + 1);
+            return true;
+        }
+
+        char buf[4096];
+#ifdef WIN32
+        int n = ::recv(rawSocket, buf, sizeof(buf), 0);
+#else
+        ssize_t n = ::recv(rawSocket, buf, sizeof(buf), 0);
+#endif
+        if (n <= 0) {
+            lastError = "SAM: connection closed while waiting for reply";
+            return false;
+        }
+        recvBuffer.append(buf, (size_t)n);
+    }
+}
+
+std::string CI2PSamSocket::ParseValue(const std::string& line, const std::string& key)
+{
+    // Find KEY=VALUE token within a space-separated SAM response line.
+    std::string needle = key + "=";
+    size_t pos = line.find(needle);
+    if (pos == std::string::npos)
+        return {};
+
+    pos += needle.size();
+    size_t end = line.find(' ', pos);
+    if (end == std::string::npos)
+        return line.substr(pos);
+    return line.substr(pos, end - pos);
+}
+
+bool CI2PSamSocket::Connect(const std::string& dest_b32, int port,
+                            const std::string& samHost, int samPort)
+{
+    CloseSocket();
+    lastError.clear();
+    recvBuffer.clear();
+
+    if (dest_b32.empty()) {
+        lastError = "SAM: empty destination";
+        return false;
+    }
+
+    // Generate a unique session ID for this connection.
+    unsigned int seq = ++g_samSessionSeq;
+    sessionId = "triangles-" + std::to_string(seq) + "-" +
+                std::to_string((unsigned long)std::time(nullptr));
+
+    // ----------------------------------------------------------------
+    //  Step 0: TCP connect to the SAM bridge
+    // ----------------------------------------------------------------
+    if (!SamConnect(samHost, samPort)) {
+        // lastError already set by SamConnect
+        return false;
+    }
+
+    // ----------------------------------------------------------------
+    //  Step 1: HELLO handshake
+    //    C → S: HELLO VERSION MIN=3.1 MAX=3.1
+    //    S → C: HELLO REPLY RESULT=OK VERSION=3.1
+    // ----------------------------------------------------------------
+    if (!SendLine("HELLO VERSION MIN=3.1 MAX=3.1")) {
+        return false;
+    }
+
+    {
+        std::string reply;
+        if (!ReadLine(reply)) {
+            return false;
+        }
+        std::string result = ParseValue(reply, "RESULT");
+        if (result != "OK") {
+            lastError = "SAM HELLO failed: " + reply;
+            CloseSocket();
+            return false;
+        }
+    }
+
+    // ----------------------------------------------------------------
+    //  Step 2: SESSION CREATE (transient destination)
+    //    C → S: SESSION CREATE STYLE=STREAM ID=<id> DESTINATION=TRANSIENT
+    //    S → C: SESSION STATUS RESULT=OK DESTINATION=<base64>
+    // ----------------------------------------------------------------
+    if (!SendLine("SESSION CREATE STYLE=STREAM ID=" + sessionId +
+                  " DESTINATION=TRANSIENT")) {
+        return false;
+    }
+
+    {
+        std::string reply;
+        if (!ReadLine(reply)) {
+            return false;
+        }
+        std::string result = ParseValue(reply, "RESULT");
+        if (result != "OK") {
+            lastError = "SAM SESSION CREATE failed: " + reply;
+            CloseSocket();
+            return false;
+        }
+        // Save the transient local destination (base64) for diagnostics.
+        localDestination = ParseValue(reply, "DESTINATION");
+    }
+
+    // ----------------------------------------------------------------
+    //  Step 3: STREAM CONNECT to the remote destination
+    //    C → S: STREAM CONNECT ID=<id> DESTINATION=<b32>.i2p
+    //    S → C: STREAM STATUS RESULT=OK
+    //
+    //  After RESULT=OK the socket is a raw byte stream — no more SAM
+    //  framing is needed.
+    // ----------------------------------------------------------------
+    // Ensure destination has the .b32.i2p suffix (accept bare b32 hash too)
+    std::string dest = dest_b32;
+    if (dest.find(".i2p") == std::string::npos && dest.find(".b32") == std::string::npos) {
+        // Looks like a bare b32 hash — append the standard suffix
+        dest += ".b32.i2p";
+    }
+
+    if (!SendLine("STREAM CONNECT ID=" + sessionId + " DESTINATION=" + dest)) {
+        return false;
+    }
+
+    {
+        std::string reply;
+        if (!ReadLine(reply)) {
+            return false;
+        }
+        std::string result = ParseValue(reply, "RESULT");
+        if (result != "OK") {
+            lastError = "SAM STREAM CONNECT to " + dest + " failed: " + reply;
+            CloseSocket();
+            return false;
+        }
+    }
+
+    // Socket is now a raw I2P stream.  Any residual bytes in recvBuffer
+    // belong to the application layer — leave them for the caller.
+    return true;
+}
+
+// ===========================================================================
+//  CI2PEmbedded — singleton router management
+// ===========================================================================
+
+// Singleton
+CI2PEmbedded* CI2PEmbedded::instance = nullptr;
+
+CI2PEmbedded* CI2PEmbedded::GetInstance()
+{
+    if (!instance)
+        instance = new CI2PEmbedded();
+    return instance;
+}
+
+CI2PEmbedded::CI2PEmbedded()
+    : running(false)
+    , socksPort(19100)
+    , samPort(7656)
+    , serverPort(0)
+{
+}
+
+CI2PEmbedded::~CI2PEmbedded()
+{
+    Stop();
+}
+
+std::string CI2PEmbedded::GetSocksProxy() const
+{
+    return "127.0.0.1:" + std::to_string(socksPort);
+}
+
+// ---------------------------------------------------------------------------
+//  IsSamAvailable — quick TCP probe of the SAM bridge port
+// ---------------------------------------------------------------------------
+bool CI2PEmbedded::IsSamAvailable() const
+{
+#ifdef WIN32
+    SOCKET sock = ::socket(AF_INET, SOCK_STREAM, 0);
+    if (sock == INVALID_SOCKET)
+        return false;
+#else
+    int sock = ::socket(AF_INET, SOCK_STREAM, 0);
+    if (sock < 0)
+        return false;
+#endif
+
+    struct sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr.sin_port = htons((uint16_t)samPort);
+
+    bool ok = (::connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == 0);
+
+#ifdef WIN32
+    closesocket(sock);
+#else
+    close(sock);
+#endif
+    return ok;
+}
+
+// ---------------------------------------------------------------------------
+//  CreateConnection — factory for SAM v3 direct streaming connections
+// ---------------------------------------------------------------------------
+CI2PSamSocket* CI2PEmbedded::CreateConnection(const std::string& dest_b32, int port)
+{
+    if (!running.load()) {
+        return nullptr;
+    }
+
+    auto* sam = new CI2PSamSocket();
+    if (!sam->Connect(dest_b32, port, "127.0.0.1", samPort)) {
+        // Caller can inspect via the object — but they don't have it yet,
+        // so log the error and clean up.
+        printf("I2P SAM connect failed: %s\n", sam->GetLastError().c_str());
+        delete sam;
+        return nullptr;
+    }
+
+    printf("I2P SAM stream connected to %s (raw socket, no SOCKS overhead)\n",
+           dest_b32.c_str());
+    return sam;
+}
+
+#ifdef ENABLE_I2P_EMBEDDED
+
+// ========================================================================
+//  Embedded mode: i2pd runs in-process via libi2pd / i2p::api
+// ========================================================================
+
+#ifdef WIN32
+// MinGW's rpcndr.h (pulled in by winsock2.h/windows.h) #defines
+// 'interface' as 'struct' for COM support. i2pd's I2CP.h uses it as a
+// parameter name (I2CPServer(const std::string& interface, ...)),
+// causing a parse error. Undef before including any i2pd headers.
+#undef interface
+#endif
+
+// i2pd C++ API
+#include "Config.h"
+#include "Log.h"
+#include "FS.h"
+#include "Crypto.h"
+#include "NetDb.hpp"
+#include "Transports.h"
+#include "Tunnel.h"
+#include "RouterContext.h"
+#include "Streaming.h"
+#include "Destination.h"
+#include "ClientContext.h"
+#include "I2PTunnel.h"
+#include "api.h"
+
+static std::unique_ptr<i2p::client::I2PServerTunnel> g_i2pServerTunnel;
+static std::shared_ptr<i2p::client::ClientDestination> g_i2pServerDestination;
+
+bool CI2PEmbedded::Start(int socks, int sam, int server)
+{
+    if (running.load()) return true;
+
+    lastError.clear();
+    socksPort = socks;
+    samPort = sam;
+    serverPort = server;
+    i2pHostname.clear();
+
+    // Prepare i2pd data directory under the wallet's data dir
+    i2pDataDir = (::GetDataDir() / "i2p_data").string();
+    fs::create_directories(i2pDataDir);
+    fs::permissions(i2pDataDir, fs::perms::owner_all, fs::perm_options::replace);
+
+    printf("Embedded I2P: starting i2pd router...\n");
+
+    // Write an i2pd.conf configuration file that enables SAM + SOCKS proxy.
+    // i2pd's config system reads from a file; programmatic option setting is
+    // fragile across i2pd versions. Writing a minimal conf is robust.
+    {
+        fs::path confPath = fs::path(i2pDataDir) / "i2pd.conf";
+        std::ofstream conf(confPath.string());
+        if (!conf.is_open()) {
+            lastError = "Failed to write i2pd.conf";
+            return false;
+        }
+        conf << "# Auto-generated by Triangles embedded I2P\n";
+        conf << "datadir = " << i2pDataDir << "\n";
+        conf << "loglevel = info\n";
+        conf << "\n";
+        // SOCKS proxy for outbound .i2p connections (P2P transport)
+        conf << "[socksproxy]\n";
+        conf << "enabled = true\n";
+        conf << "address = 127.0.0.1\n";
+        conf << "port = " << socksPort << "\n";
+        conf << "keys = socks-proxy.dat\n";
+        conf << "\n";
+        // SAM bridge for SAM v3 direct streaming API
+        conf << "[sam]\n";
+        conf << "enabled = true\n";
+        conf << "address = 127.0.0.1\n";
+        conf << "port = " << samPort << "\n";
+        conf << "\n";
+        // Disable HTTP webconsole (not needed for embedded use)
+        conf << "[http]\n";
+        conf << "enabled = false\n";
+        conf << "\n";
+        // Disable I2P control protocol
+        conf << "[i2pcontrol]\n";
+        conf << "enabled = false\n";
+        conf << "\n";
+        // Disable BOB
+        conf << "[bob]\n";
+        conf << "enabled = false\n";
+        conf << "\n";
+        conf.close();
+    }
+
+    // Write tunnels.conf BEFORE Start() — ClientContext::Start() reads this
+    // file to create server/client tunnels. The server tunnel is the I2P
+    // equivalent of a Tor hidden service: it forwards inbound I2P connections
+    // to the Triangles P2P listen port.
+    if (serverPort > 0) {
+        fs::path tunnelConfPath = fs::path(i2pDataDir) / "tunnels.conf";
+        std::ofstream tunnelConf(tunnelConfPath.string());
+        if (tunnelConf.is_open()) {
+            tunnelConf << "# Auto-generated by Triangles embedded I2P\n";
+            tunnelConf << "[triangles-p2p]\n";
+            tunnelConf << "type = server\n";
+            tunnelConf << "host = 127.0.0.1\n";
+            tunnelConf << "port = " << serverPort << "\n";
+            tunnelConf << "keys = triangles-p2p-keys.dat\n";
+            tunnelConf << "inbound.length = 3\n";
+            tunnelConf << "outbound.length = 3\n";
+            tunnelConf << "inbound.quantity = 5\n";
+            tunnelConf << "outbound.quantity = 5\n";
+            tunnelConf.close();
+            printf("Embedded I2P: server tunnel configured on port %d\n", serverPort);
+        }
+    }
+
+    // Build argv for i2pd initialization. Pass --datadir and --conf on the
+    // command line (not just in the conf file) because i2pd's ParseCmdline
+    // runs BEFORE ParseConfig, and DetectDataDir needs the datadir early.
+    std::vector<std::string> argvStrings;
+    argvStrings.push_back("i2pd");
+    argvStrings.push_back("--datadir");
+    argvStrings.push_back(i2pDataDir);
+    argvStrings.push_back("--conf");
+    argvStrings.push_back((fs::path(i2pDataDir) / "i2pd.conf").string());
+
+    std::vector<char*> argvPtrs;
+    for (auto& s : argvStrings)
+        argvPtrs.push_back(&s[0]);
+    argvPtrs.push_back(nullptr);
+
+    try {
+        // Initialize i2pd: config parse, filesystem, crypto, router context
+        i2p::api::InitI2P((int)(argvPtrs.size() - 1), argvPtrs.data(), "triangles-i2pd");
+
+        // Start the I2P router: netdb, transports, tunnels, router context
+        // Redirect i2pd logs to our stdout/stderr
+        auto logStream = std::make_shared<std::ostream>(std::cout.rdbuf());
+        i2p::api::StartI2P(logStream);
+
+        printf("Embedded I2P: router started, starting client services...\n");
+
+        // Start the client context — this initializes SAM bridge, SOCKS proxy,
+        // and tunnels based on config. The client context reads the conf we
+        // wrote above to determine which services to start.
+        i2p::client::context.Start();
+
+        running.store(true);
+        printf("Embedded I2P: SOCKS proxy at 127.0.0.1:%d, SAM at 127.0.0.1:%d\n",
+               socksPort, samPort);
+
+        // Wait for i2pd's SOCKS proxy AND SAM bridge to become available
+        // (up to 120s — I2P bootstrap is slower than Tor due to floodfill
+        // lookup and tunnel build).
+        printf("Embedded I2P: waiting for SOCKS proxy and SAM bridge...\n");
+        bool socksReady = false;
+        bool samReady = false;
+
+        for (int i = 0; i < 120; i++) {
+            MilliSleep(1000);
+            if (fShutdown) {
+                Stop();
+                return false;
+            }
+
+            // --- Check SOCKS proxy readiness ---
+            if (!socksReady) {
+#ifdef WIN32
+                SOCKET sock = socket(AF_INET, SOCK_STREAM, 0);
+                if (sock != INVALID_SOCKET) {
+#else
+                int sock = socket(AF_INET, SOCK_STREAM, 0);
+                if (sock >= 0) {
+#endif
+                    struct sockaddr_in addr;
+                    memset(&addr, 0, sizeof(addr));
+                    addr.sin_family = AF_INET;
+                    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+                    addr.sin_port = htons(socksPort);
+                    bool up = (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == 0);
+#ifdef WIN32
+                    closesocket(sock);
+#else
+                    close(sock);
+#endif
+                    if (up) {
+                        socksReady = true;
+                        printf("Embedded I2P: SOCKS proxy ready on port %d (took %ds)\n",
+                               socksPort, i + 1);
+                    }
+                }
+            }
+
+            // --- Check SAM bridge readiness ---
+            if (!samReady) {
+                samReady = IsSamAvailable();
+                if (samReady) {
+                    printf("Embedded I2P: SAM v3 bridge ready on port %d (took %ds)\n",
+                           samPort, i + 1);
+                }
+            }
+
+            // Both endpoints are up — router is fully bootstrapped
+            if (socksReady && samReady) {
+                printf("Embedded I2P: all I2P endpoints ready (SOCKS %d + SAM %d)\n",
+                       socksPort, samPort);
+                break;
+            }
+
+            if (i > 0 && i % 30 == 0) {
+                printf("Embedded I2P: still bootstrapping (%ds elapsed, SOCKS:%s SAM:%s)...\n",
+                       i, socksReady ? "ready" : "wait",
+                       samReady ? "ready" : "wait");
+            }
+        }
+
+        // Populate the .b32.i2p address from the router's identity hash.
+        // This is the I2P address that appears in the Qt status bar.
+        try {
+            auto identHash = i2p::context.GetRouterInfo().GetIdentHash();
+            i2pHostname = identHash.ToBase32() + ".b32.i2p";
+            printf("Embedded I2P: router address = %s\n", i2pHostname.c_str());
+        } catch (...) {
+            printf("Embedded I2P: could not retrieve router address yet\n");
+        }
+
+        return true;
+
+    } catch (const std::exception& e) {
+        lastError = std::string("i2pd initialization failed: ") + e.what();
+        printf("ERROR: Embedded I2P startup failed: %s\n", e.what());
+        return false;
+    }
+}
+
+void CI2PEmbedded::Stop()
+{
+    if (!running.load()) return;
+    printf("Requesting embedded I2P shutdown...\n");
+
+    try {
+        // Stop client context (SAM, SOCKS, tunnels)
+        i2p::client::context.Stop();
+
+        // Stop the router
+        i2p::api::StopI2P();
+
+        // Terminate crypto
+        i2p::api::TerminateI2P();
+    } catch (const std::exception& e) {
+        printf("WARNING: error during I2P shutdown: %s\n", e.what());
+    }
+
+    running.store(false);
+}
+
+#else // !ENABLE_I2P_EMBEDDED
+
+// ========================================================================
+//  Fallback stubs: embedded I2P not compiled in
+// ========================================================================
+
+bool CI2PEmbedded::Start(int socks, int sam, int server)
+{
+    printf("Embedded I2P not compiled in (ENABLE_I2P_EMBEDDED not defined).\n");
+    socksPort = socks;
+    samPort = sam;
+    serverPort = server;
+    i2pDataDir = (::GetDataDir() / "i2p_data").string();
+    lastError = "I2P support not compiled in. Build with -DUSE_I2P_EMBEDDED=ON";
+    return false;
+}
+
+void CI2PEmbedded::Stop()
+{
+    running.store(false);
+}
+
+#endif // ENABLE_I2P_EMBEDDED
+
+// ========================================================================
+//  Global hooks (called from init.cpp)
+// ========================================================================
+
+bool StartEmbeddedI2P()
+{
+    bool enableI2P = GetBoolArg("-i2p", true);
+    if (!enableI2P) {
+        printf("I2P disabled by -i2p=0 flag\n");
+        return false;
+    }
+
+    int socksPort = GetArg("-i2psocks", 19100);
+    int samPort = GetArg("-i2psam", 7656);
+    int serverPort = GetArg("-i2phsport", GetListenPort());
+
+    return CI2PEmbedded::GetInstance()->Start(socksPort, samPort, serverPort);
+}
+
+void StopEmbeddedI2P()
+{
+    CI2PEmbedded::GetInstance()->Stop();
+}
@@ -0,0 +1,144 @@
+// Copyright (c) 2025-2026 Triangles developers
+// Embedded I2P (i2pd) integration - runs an I2P router in-process
+// Distributed under the MIT/X11 software license
+
+#ifndef TRIANGLES_I2P_EMBEDDED_H
+#define TRIANGLES_I2P_EMBEDDED_H
+
+#include <string>
+#include <atomic>
+
+// Cross-platform socket handle for SAM v3 streaming API.
+// On Windows this is the native SOCKET type; on POSIX it is int (fd).
+#ifdef WIN32
+#  include <winsock2.h>
+   typedef SOCKET I2pSocket_t;
+#  define I2P_INVALID_SOCKET  INVALID_SOCKET
+#else
+   typedef int I2pSocket_t;
+#  define I2P_INVALID_SOCKET  (-1)
+#endif
+
+// ---------------------------------------------------------------------------
+//  CI2PSamSocket — SAM v3 direct streaming socket
+//
+//  Wraps a raw TCP socket to the i2pd SAM bridge. After Connect() succeeds,
+//  the underlying socket is a bidirectional byte stream to the I2P
+//  destination with NO SOCKS overhead. The Triangles P2P layer can read and
+//  write directly once ownership is taken via GetRawSocket().
+//
+//  Lifecycle:
+//    1. Construct
+//    2. Connect(dest_b32, port)  — performs SAM SESSION CREATE + STREAM CONNECT
+//    3. GetRawSocket()           — take the fd for direct read/write
+//    4. The fd must be closed by the caller (e.g. via CloseSocket())
+//
+//  If Connect() fails, GetLastError() returns a human-readable diagnostic.
+// ---------------------------------------------------------------------------
+class CI2PSamSocket
+{
+public:
+    CI2PSamSocket();
+    ~CI2PSamSocket();
+
+    CI2PSamSocket(const CI2PSamSocket&) = delete;
+    CI2PSamSocket& operator=(const CI2PSamSocket&) = delete;
+
+    // Perform the full SAM v3 handshake (HELLO → SESSION CREATE → STREAM CONNECT)
+    // to reach dest_b32 (a .b32.i2p hostname).  samHost/samPort identify the
+    // local SAM bridge (default 127.0.0.1:7656).
+    //
+    // The |port| argument is accepted for API symmetry with the Tor SOCKS
+    // connection factory but is not part of the SAM v3 STREAM CONNECT request
+    // (I2P destinations are address-only; there is no TCP-style port).
+    bool Connect(const std::string& dest_b32, int port,
+                 const std::string& samHost = "127.0.0.1", int samPort = 7656);
+
+    // Release ownership of the raw socket fd. After this call the object
+    // will not close it and the caller is responsible for cleanup.
+    // Returns I2P_INVALID_SOCKET if not connected.
+    I2pSocket_t GetRawSocket();
+
+    // Close the socket if still owned (no-op after GetRawSocket()).
+    void CloseSocket();
+
+    bool IsValid() const { return rawSocket != I2P_INVALID_SOCKET; }
+    std::string GetLastError() const { return lastError; }
+
+    // The base64 local destination returned by SESSION STATUS (may be empty).
+    const std::string& GetLocalDestination() const { return localDestination; }
+
+private:
+    I2pSocket_t rawSocket;
+    std::string sessionId;
+    std::string localDestination;
+    std::string lastError;
+    std::string recvBuffer;   // partial SAM response buffering
+
+    // --- SAM protocol helpers ---
+    bool SamConnect(const std::string& host, int port);
+    bool SendLine(const std::string& line);
+    bool ReadLine(std::string& lineOut);
+    static std::string ParseValue(const std::string& line, const std::string& key);
+};
+
+// Embedded I2P router state
+class CI2PEmbedded
+{
+private:
+    static CI2PEmbedded* instance;
+    std::atomic<bool> running;
+    int socksPort;          // i2pd SOCKS proxy port (for outbound .i2p connections)
+    int samPort;            // i2pd SAM bridge port (for SAM v3 protocol)
+    int serverPort;         // Triangles P2P listen port (for incoming I2P connections)
+    std::string i2pDataDir; // i2pd data directory (under wallet datadir)
+    std::string i2pHostname; // Our .b32.i2p address (available after router startup)
+    std::string lastError;
+
+public:
+    static CI2PEmbedded* GetInstance();
+
+    CI2PEmbedded();
+    ~CI2PEmbedded();
+
+    // Start embedded i2pd router (blocks calling thread briefly during init)
+    bool Start(int socksPort = 19100, int samPort = 7656, int serverPort = 0);
+
+    // Request i2pd to shut down
+    void Stop();
+
+    // Check if i2pd is running
+    bool IsRunning() const { return running.load(); }
+    void SetRunning(bool value) { running.store(value); }
+
+    // Get the SOCKS5 proxy address for outbound .i2p connections
+    std::string GetSocksProxy() const;
+    int GetSocksPort() const { return socksPort; }
+    int GetSamPort() const { return samPort; }
+    int GetServerPort() const { return serverPort; }
+    const std::string& GetDataDir() const { return i2pDataDir; }
+
+    // Get our .b32.i2p destination address
+    std::string GetI2PAddress() const { return i2pHostname; }
+    std::string GetStartupError() const { return lastError; }
+    void SetStartupError(const std::string& value) { lastError = value; }
+
+    // -------------------------------------------------------------------
+    //  SAM v3 direct streaming API
+    // -------------------------------------------------------------------
+
+    // Create a SAM v3 connection to a .b32.i2p destination.
+    // Returns a heap-allocated CI2PSamSocket on success (caller owns it
+    // and must CloseSocket / delete), or nullptr on failure.  Use
+    // GetLastError() on the returned object for diagnostics.
+    CI2PSamSocket* CreateConnection(const std::string& dest_b32, int port);
+
+    // Probe whether the SAM bridge port is accepting TCP connections.
+    bool IsSamAvailable() const;
+};
+
+// Global init/shutdown hooks (called from init.cpp)
+bool StartEmbeddedI2P();
+void StopEmbeddedI2P();
+
+#endif // TRIANGLES_I2P_EMBEDDED_H
@@ -0,0 +1,29 @@
+#ifndef TRIANGLES_I2PSEED_H
+#define TRIANGLES_I2PSEED_H
+
+// Hardcoded I2P seed nodes for initial peer discovery.
+// These are .b32.i2p addresses (Destination hashes).
+// Nodes must run i2pd with a server tunnel forwarding to the Triangles P2P port.
+//
+// NOTE: .b32.i2p addresses are derived from the destination's public key.
+// They are generated when the node first creates its I2P tunnel keys.
+// Replace these placeholders with actual seed node addresses once deployed.
+//
+// Dynamic seeds will also be available at:
+//   https://seeds.cryptographic-triangles.org/i2p-seeds.txt
+static const char *strMainNetI2PSeed[][1] = {
+    // DNS2 - primary bootstrap server (194.233.88.206)
+    // Generated by embedded i2pd on first run, keys persist in i2p_data/
+    {"hnupgkbtcn4hlo6sunhbp6uuz4k6bkgsa5jtcruyyt7y6q7qsoda.b32.i2p"},
+    // DNS3 - canonical chain reference (74.208.167.19)
+    {"hvvr2yys3nll4l6fdywecvn3baw6h5i7bsa2ldbz2e5xwangnn7q.b32.i2p"},
+    // Hetzner Helsinki - ARM64 staking node (46.62.249.20)
+    {"2hyeunnkax5du4snip4gdsdicxtmlnagtlkatv57rjpx2kvfssma.b32.i2p"},
+    {nullptr}
+};
+
+static const char *strTestNetI2PSeed[][1] = {
+    {nullptr}
+};
+
+#endif
@@ -19,6 +19,8 @@
 #include "tor/tor_embedded.h"
 #include "tor/onion_v3.h"
 #include "tor/tor_process.h"
+#include "i2p/i2p_embedded.h"
+#include "i2p/i2pseed.h"
 #ifdef ENABLE_ZMQ
 #include "zmqpublishnotifier.h"
 #endif
@@ -28,6 +30,11 @@
 #include <memory>
 #include <thread>
 #include <vector>
+
+// Forward declaration: InitError / InitWarning are defined further down
+// in this file but referenced by AppInit (line ~423) before the definition.
+static bool InitError(const std::string& str);
+static bool InitWarning(const std::string& str);
 #include <filesystem>
 #include <fstream>
 #include <boost/interprocess/sync/file_lock.hpp>
@@ -336,6 +343,7 @@ void Shutdown(void* parg)
        // NOW safe to destroy Tor state - all threads have stopped
        ShutdownTorV3();
        StopEmbeddedTor();
+        StopEmbeddedI2P();

 #ifdef ENABLE_ZMQ
        if (pzmqNotifier)
@@ -413,6 +421,21 @@ bool AppInit(int argc, char* argv[])
        }
        ReadConfigFile(mapArgs, mapMultiArgs);

+        // AUDIT: If notorious=1 or -notor was set in triangles.conf, scream
+        // loudly.  This is the silent path that put DNS2 on a 5+ day clearnet
+        // fork in 2026-06-23 — operator flipped it for troubleshooting, never
+        // reverted it, and the daemon happily started in clearnet-only mode.
+        // We refuse to proceed unless -recovery-mode=1 is ALSO set, even if
+        // the flag was set in the config file rather than on the command line.
+        if (mapArgs.count("-notor") && !GetBoolArg("-recovery-mode", false)) {
+            return InitError(_(
+                "-notor=1 found in triangles.conf or command line.  Triangles is "
+                "Tor-native; running without Tor is unsafe and produces silent "
+                "clearnet forks (see 2026-06-23 DNS2 incident).  If this is an "
+                "explicit recovery operation, pass -recovery-mode=1 on the command "
+                "line (in addition to the config file setting) to acknowledge."));
+        }
+
        if (mapArgs.count("-?") || mapArgs.count("--help"))
        {
            // First part of help message is specific to trianglesd / RPC client
@@ -506,16 +529,22 @@ std::string HelpMessage()
        "  -dbcache=<n>           " + _("Set database cache size in megabytes (default: 25)") + "\n" +
        "  -dblogsize=<n>         " + _("Set database disk log size in megabytes (default: 100)") + "\n" +
        "  -timeout=<n>           " + _("Specify connection timeout in milliseconds (default: 5000)") + "\n" +
+        "  -torconnecttimeout=<n> " + _("Max time (ms) for the SOCKS5 handshake with the Tor proxy (send+recv of SOCKS5 init/auth/connect). Bounds how long a dead/slow .onion can stall the connector thread (default: 60000, range 5000-180000)") + "\n" +
        //"  -proxy=<ip:port>       " + _("Connect through socks proxy") + "\n" +
        //"  -socks=<n>             " + _("Select the version of socks proxy to use (4-5, default: 5)") + "\n" +
        "  -tor=<ip:port>         " + _("Use proxy to reach tor hidden services (default: same as -proxy)") + "\n"
        "  -notor                 " + _("Disable Tor - run in clearnet-only mode (no .onion connectivity)") + "\n" +
        "  -torsocks=<port>       " + _("Set embedded or managed Tor SOCKS proxy port (default: 19099)") + "\n" +
        "  -torhiddenservice      " + _("Enable the managed Tor hidden service (default: 1)") + "\n" +
-        "  -torhsport=<port>      " + _("Set embedded or managed Tor hidden service port (default: wallet listen port)") + "\n" +
+        "  -torhsport=<port>      " + _("Set embedded or managed Tor hidden service port (default: wallet listen port)") + "\n"
+        "  -i2p                   " + _("Enable embedded I2P router for .b32.i2p connectivity (default: 1)") + "\n"
+        "  -i2psocks=<port>       " + _("Set embedded I2P SOCKS proxy port (default: 19100)") + "\n"
+        "  -i2psam=<port>         " + _("Set embedded I2P SAM bridge port (default: 7656)") + "\n"
+        "  -i2phsport=<port>      " + _("Set I2P server tunnel forward port (default: wallet listen port)") + "\n" +
        //"  -dns                   " + _("Allow DNS lookups for -addnode, -seednode and -connect") + "\n" +
        "  -port=<port>           " + _("Listen for connections on <port> (default: 24112 or testnet: 24111)") + "\n" +
        "  -maxconnections=<n>    " + _("Maintain at most <n> connections to peers (default: 125)") + "\n" +
+        "  -maxoutboundconnections=<n> " + _("Maximum outbound connections (default: 8, range 4-32)") + "\n" +
        "  -addnode=<ip>          " + _("Add a node to connect to and attempt to keep the connection open") + "\n" +
        "  -connect=<ip>          " + _("Connect only to the specified node(s)") + "\n" +
        "  -seednode=<ip>         " + _("Connect to a node to retrieve peer addresses, and disconnect") + "\n" +
@@ -780,6 +809,21 @@ bool AppInit2()
            nConnectTimeout = nNewTimeout;
    }

+    // SOCKS5/Tor negotiation timeout. Separate from -timeout (which only covers
+    // the instant local connect to the Tor SOCKS proxy); this bounds the
+    // SOCKS5 handshake (send+recv of init/auth/connect). On a dead/slow .onion
+    // the recv() in Socks5() would otherwise block until Tor's own ~120s
+    // SocksTimeout fires, holding an outbound connection slot.
+    if (mapArgs.count("-torconnecttimeout"))
+    {
+        int nTorTimeout = GetArg("-torconnecttimeout", 60000);
+        if (IsValidSocksNegotiationTimeout(nTorTimeout))
+            nSocksNegotiationTimeout = nTorTimeout;
+        else
+            InitWarning("Ignoring -torconnecttimeout=" + mapArgs["-torconnecttimeout"] +
+                        ": out of range (5000..180000 ms), using default 60000");
+    }
+
    if (mapArgs.count("-paytxfee"))
    {
        if (!ParseMoney(mapArgs["-paytxfee"], nTransactionFee))
@@ -791,6 +835,15 @@ bool AppInit2()
    fConfChange = GetBoolArg("-confchange", false);
    fEnforceCanonical = GetBoolArg("-enforcecanonical", true);

+    // Validate -maxoutboundconnections (range 4-32, default 8)
+    if (mapArgs.count("-maxoutboundconnections"))
+    {
+        int nMaxOutboundConn = GetArg("-maxoutboundconnections", 8);
+        if (nMaxOutboundConn < 4 || nMaxOutboundConn > 32)
+            InitWarning("Ignoring -maxoutboundconnections=" + mapArgs["-maxoutboundconnections"] +
+                        ": out of range (4..32), using default 8");
+    }
+
    int nScriptCheckThreads = GetArg("-par", 0);
    if (nScriptCheckThreads <= 0)
        nScriptCheckThreads = std::thread::hardware_concurrency();
@@ -1480,11 +1533,26 @@ bool AppInit2()
            fUseUPnP = false;
            #endif
        } else if (GetBoolArg("-notor", false)) {
-            // -notor: user explicitly disabled Tor.  Allow the daemon to start
-            // in clearnet-only mode (useful for diagnostics, benchmarking, and
-            // recovery).  .onion connectivity will not be available.
-            printf("NOTICE: Tor disabled via -notor. Running in clearnet-only mode.\n");
+            // -notor: explicit clearnet mode.  Triangles is Tor-native and
+            // running without Tor is unsafe for normal operation — it can
+            // produce silent clearnet forks (see 2026-06-23 DNS2 incident,
+            // 5+ days on a parallel chain because -notor=1 was left on after
+            // troubleshooting).  The flag is preserved for explicit recovery
+            // workflows (e.g. dumputxoset-from-clearnet when bootstrapping
+            // a new node) but requires an additional -recovery-mode=1
+            // confirmation flag so it cannot be flipped by accident.
+            if (!GetBoolArg("-recovery-mode", false)) {
+                return InitError(_(
+                    "-notor requires -recovery-mode=1 confirmation.  Triangles is Tor-native; "
+                    "running without Tor is unsafe and produces silent clearnet forks.  "
+                    "If you need clearnet mode for bootstrap recovery or diagnostics, "
+                    "pass BOTH -notor=1 -recovery-mode=1 on the command line."));
+            }
+            printf("WARNING: Tor disabled via -notor AND -recovery-mode=1 set.  "
+                   "Running in clearnet-only mode.\n");
            printf("  .onion connections will NOT be available.\n");
+            printf("  This mode is for RECOVERY ONLY — exit and restart without these\n"
+                   "  flags as soon as the recovery operation completes.\n");
            SetReachable(NET_IPV4, true);
            SetReachable(NET_IPV6, true);
            SetReachable(NET_TOR, false);
@@ -1495,6 +1563,47 @@ bool AppInit2()
            return InitError(strprintf(_("Tor failed to start. Triangles requires Tor to operate.\n\nDetails: %s"), torError.c_str()));
        }

+        // ════════════════════════════════════════════════════════════════
+        // Embedded I2P (i2pd) startup
+        //
+        // I2P runs as a co-equal anonymity network alongside Tor. When Tor
+        // starts successfully (tor-native mode), I2P provides an alternative
+        // anonymous transport via .b32.i2p destinations. When Tor is disabled
+        // (-notor recovery mode), I2P is still started to maintain anonymity.
+        //
+        // I2P's SOCKS proxy (default 19100) handles outbound .i2p connections.
+        // A server tunnel forwards incoming I2P connections to the P2P port.
+        // ════════════════════════════════════════════════════════════════
+        if (torStarted || GetBoolArg("-notor", false)) {
+            uiInterface.InitMessage(_("Starting embedded I2P router..."));
+            int64_t nI2PStart = GetTimeMillis();
+            bool i2pStarted = StartEmbeddedI2P();
+            StartupPerfLog("i2p_start", GetTimeMillis() - nI2PStart,
+                           strprintf("started=%d", i2pStarted));
+
+            if (i2pStarted) {
+                int i2pSocksPort = CI2PEmbedded::GetInstance()->GetSocksPort();
+                CService i2pProxyAddr("127.0.0.1", i2pSocksPort);
+
+                // Route I2P traffic through i2pd's SOCKS proxy
+                SetProxy(NET_I2P, i2pProxyAddr, 5);
+                SetReachable(NET_I2P, true);
+
+                printf("I2P-NATIVE MODE: I2P router running\n");
+                printf("  SOCKS proxy at 127.0.0.1:%d for .b32.i2p connections\n",
+                       i2pSocksPort);
+                printf("  Dual-network anonymity: Tor (.onion) + I2P (.b32.i2p)\n");
+            } else {
+                // I2P failure is non-fatal — Tor-only operation continues.
+                // The daemon still works with .onion peers.
+                std::string i2pError = CI2PEmbedded::GetInstance()->GetStartupError();
+                printf("WARNING: Embedded I2P did not start. Running Tor-only.\n");
+                if (!i2pError.empty())
+                    printf("  I2P error: %s\n", i2pError.c_str());
+                SetReachable(NET_I2P, false);
+            }
+        }
+
        // Initialize Tor V3 identity (Ed25519 keys, onion address)
        uiInterface.InitMessage(_("Initializing Tor V3 identity..."));
        printf("Initializing Tor V3 onion identity...\n");
@@ -1609,6 +1718,28 @@ bool AppInit2()
    printf("Loaded %i addresses from peers.dat  %" PRId64 "ms\n",
           addrman.size(), GetTimeMillis() - nStart);
    StartupPerfLog("peers_load", GetTimeMillis() - nStart, strprintf("count=%d", addrman.size()));
+
+    // Add hardcoded I2P (.b32.i2p) seed addresses to the address manager.
+    // This enables cross-network peer discovery: Tor-connected nodes can learn
+    // about I2P peers and vice versa. Onion seeds are loaded separately in
+    // ThreadOnionSeed (net.cpp), but we add I2P seeds here during init so they
+    // are available immediately for the outbound connector.
+    {
+        static const char *(*strI2PSeed)[1] = fTestNet ? strTestNetI2PSeed : strMainNetI2PSeed;
+        int nI2PSeeds = 0;
+        for (unsigned int si = 0; strI2PSeed[si][0] != nullptr; si++) {
+            CNetAddr parsed;
+            if (parsed.SetSpecial(strI2PSeed[si][0])) {
+                int nOneDay = 24 * 3600;
+                CAddress addr = CAddress(CService(parsed, GetDefaultPort()));
+                addr.nTime = GetTime() - 3 * nOneDay - GetRand(4 * nOneDay);
+                addrman.Add(addr, parsed);
+                nI2PSeeds++;
+            }
+        }
+        if (nI2PSeeds > 0)
+            printf("Added %d hardcoded I2P (.b32.i2p) seed addresses to addrman\n", nI2PSeeds);
+    }
    
    
    // ********************************************************* Step 11: start node
@@ -78,6 +78,61 @@ CBlockIndex* pindexFinalized = nullptr;  // auto-checkpoint: deepest finalized b
 bool fAddressIndex = false;
 int64_t nTimeBestReceived = 0;

+// ─── Fork detection (#6) ────────────────────────────────────────────────────
+// Background monitor that compares our chain tip against peer medians.
+// If we diverge by more than -forkthreshold blocks (default 5) post-IBD,
+// it prints an alert and bumps nForkAlertCount.
+int nForkAlertCount = 0;
+static int nLastForkCheckHeight = 0;
+
+void ThreadForkDetector(void*)
+{
+    RenameThread("Triangles-fork-detector");
+    printf("Fork detector: started (checks every 60s post-IBD)\n");
+    while (!fShutdown)
+    {
+        MilliSleep(60000);  // check every 60s
+        if (fShutdown) break;
+        if (IsInitialBlockDownload()) continue;
+
+        int nPeerMedian = GetNumBlocksOfPeers();
+        int nOurHeight = nBestHeight;
+        int lag = nPeerMedian - nOurHeight;
+
+        int threshold = GetArg("-forkthreshold", 5);
+        if (threshold < 1) threshold = 1;
+
+        if (lag >= threshold && nOurHeight > 0)
+        {
+            nForkAlertCount++;
+            printf("*** FORK ALERT #%d: local height %d is %d blocks behind peer median %d ***\n",
+                   nForkAlertCount, nOurHeight, lag, nPeerMedian);
+            printf("*** Possible fork or sync stall. Check peers: 'getpeerinfo' and chain: 'getblockhash %d' ***\n",
+                   nOurHeight);
+
+            // If severe lag persists, suggest auto-rebuild
+            if (lag >= threshold * 3 && GetBoolArg("-autorerebuild", 0) > 0)
+            {
+                printf("*** FORK DETECTOR: lag %d >= %d, triggering AutoRebuild ***\n",
+                       lag, threshold * 3);
+                StartShutdown();
+            }
+        }
+
+        // Also check for hash divergence: if we have the same height as
+        // peers but different block hash, that's a definite fork
+        if (lag == 0 && nOurHeight != nLastForkCheckHeight && nOurHeight > 0)
+        {
+            nLastForkCheckHeight = nOurHeight;
+            // Log our chain tip hash for comparison
+            if (fDebug)
+                printf("Fork detector: height %d hash %s (peer median matches)\n",
+                       nOurHeight, hashBestChain.ToString().substr(0, 16).c_str());
+        }
+    }
+    printf("Fork detector: stopped\n");
+}
+
 CMedianFilter<int> cPeerBlockCounts(5, 0); // Amount of blocks that other nodes claim to have

 CScriptVerifyCache scriptVerifyCache;
@@ -103,6 +158,278 @@ static std::map<uint256, CPartialBlock> mapPartialBlocks;
 static const unsigned int MAX_PARTIAL_BLOCKS = 5;
 static const int64_t PARTIAL_BLOCK_TTL = 30; // seconds

+// ---------------------------------------------------------------------------
+// BIP152 Compact Block helpers
+// ---------------------------------------------------------------------------
+
+/** SipHash-2-4 primitive.
+ *
+ *  Implements the SipHash-2-4 PRF used by BIP152 for short transaction IDs.
+ *  Produces a 64-bit hash from a 128-bit key and variable-length input.
+ */
+static inline uint64_t SipHash(uint64_t k0, uint64_t k1, const unsigned char* data, size_t size)
+{
+    uint64_t v0 = 0x736f6d6570736575ULL ^ k0;
+    uint64_t v1 = 0x646f72616e646f6dULL ^ k1;
+    uint64_t v2 = 0x6c7967656e657261ULL ^ k0;
+    uint64_t v3 = 0x7465646279746573ULL ^ k1;
+
+    auto rotl = [](uint64_t x, int b) { return (x << b) | (x >> (64 - b)); };
+
+    // Process 8-byte blocks
+    const unsigned char* end = data + size - (size % 8);
+    while (data < end)
+    {
+        uint64_t m;
+        memcpy(&m, data, 8);
+        v3 ^= m;
+        // SipHash-2: 2 rounds
+        v0 += v1; v1 = rotl(v1, 13); v1 ^= v0; v0 = rotl(v0, 32);
+        v2 += v3; v3 = rotl(v3, 16); v3 ^= v2;
+        v0 += v3; v3 = rotl(v3, 21); v3 ^= v0;
+        v2 += v1; v1 = rotl(v1, 17); v1 ^= v2; v2 = rotl(v2, 32);
+        v0 += v1; v1 = rotl(v1, 13); v1 ^= v0; v0 = rotl(v0, 32);
+        v2 += v3; v3 = rotl(v3, 16); v3 ^= v2;
+        v0 += v3; v3 = rotl(v3, 21); v3 ^= v0;
+        v2 += v1; v1 = rotl(v1, 17); v1 ^= v2; v2 = rotl(v2, 32);
+        v0 ^= m;
+        data += 8;
+    }
+
+    // Final block (0-7 bytes + length byte)
+    unsigned char pad[8] = {0};
+    memcpy(pad, data, size % 8);
+    pad[7] = (unsigned char)size;
+    uint64_t m;
+    memcpy(&m, pad, 8);
+    v3 ^= m;
+    v0 += v1; v1 = rotl(v1, 13); v1 ^= v0; v0 = rotl(v0, 32);
+    v2 += v3; v3 = rotl(v3, 16); v3 ^= v2;
+    v0 += v3; v3 = rotl(v3, 21); v3 ^= v0;
+    v2 += v1; v1 = rotl(v1, 17); v1 ^= v2; v2 = rotl(v2, 32);
+    v0 += v1; v1 = rotl(v1, 13); v1 ^= v0; v0 = rotl(v0, 32);
+    v2 += v3; v3 = rotl(v3, 16); v3 ^= v2;
+    v0 += v3; v3 = rotl(v3, 21); v3 ^= v0;
+    v2 += v1; v1 = rotl(v1, 17); v1 ^= v2; v2 = rotl(v2, 32);
+    v0 ^= m;
+
+    // Finalization: 4 rounds + XOR fold
+    v2 ^= 0xff;
+    for (int i = 0; i < 4; i++)
+    {
+        v0 += v1; v1 = rotl(v1, 13); v1 ^= v0; v0 = rotl(v0, 32);
+        v2 += v3; v3 = rotl(v3, 16); v3 ^= v2;
+        v0 += v3; v3 = rotl(v3, 21); v3 ^= v0;
+        v2 += v1; v1 = rotl(v1, 17); v1 ^= v2; v2 = rotl(v2, 32);
+    }
+    return v0 ^ v1 ^ v2 ^ v3;
+}
+
+/** Compute a BIP152-style 48-bit short transaction ID.
+ *
+ *  Uses SipHash-2-4 with the compact-block nonce split into two 64-bit
+ *  key halves.  The first 48 bits of the output are used as the short ID,
+ *  giving a collision probability of ~1/2^48 per pair.
+ */
+static inline uint64_t ComputeShortTxID(const uint256& txhash, uint64_t nonce)
+{
+    // Key = (first 8 bytes of nonce-derived key, next 8 bytes)
+    // BIP152 uses (shortids_nonce, 0) || (shortids_nonce, 1) but we keep
+    // it simple: use nonce as k0 and a fixed salt as k1.
+    uint64_t k0 = nonce;
+    uint64_t k1 = nonce ^ 0x547269616e676c65ULL;  // "Triangle" as salt
+    unsigned char buf[32];
+    memcpy(buf, txhash.begin(), 32);
+    uint64_t hash = SipHash(k0, k1, buf, 32);
+    return hash & 0xFFFFFFFFFFFFULL;  // truncate to 48 bits
+}
+
+/** Send a compact block to a single peer (BIP152).
+ *
+ *  Serializes the block header + nonce + short IDs + prefilled transactions.
+ *  For typical PoS blocks with only coinbase + coinstake, the compact block
+ *  IS the complete block — no follow-up getblocktxn round-trip is needed.
+ */
+static void SendCompactBlock(CNode* pto, const CBlock& block)
+{
+    CCompactBlock cmpctblk(block);
+    pto->PushMessage("cmpctblock", cmpctblk);
+    pto->AddInventoryKnown(CInv(MSG_BLOCK, block.GetHash()));
+}
+
+/** Process a received compact block (BIP152).
+ *
+ *  Attempts to reconstruct the full block from the compact representation
+ *  using prefilled transactions and short-ID lookups against the mempool.
+ *  On success, calls ProcessBlock.  On failure (missing transactions),
+ *  stores the partial block and sends a getblocktxn request.
+ *
+ *  Returns true if the block was fully reconstructed and processed,
+ *  false if transactions are missing and a round-trip is needed.
+ */
+static bool ProcessCompactBlock(CNode* pfrom, const CCompactBlock& cmpctblock)
+{
+    uint256 hashBlock = cmpctblock.GetBlockHash();
+    CInv inv(MSG_BLOCK, hashBlock);
+    pfrom->AddInventoryKnown(inv);
+
+    // Skip if we already have this block
+    if (mapBlockIndex.count(hashBlock))
+        return true;
+
+    // Reconstruct the block header
+    CBlock block;
+    block.nVersion = cmpctblock.nVersion;
+    block.hashPrevBlock = cmpctblock.hashPrevBlock;
+    block.hashMerkleRoot = cmpctblock.hashMerkleRoot;
+    block.nTime = cmpctblock.nTime;
+    block.nBits = cmpctblock.nBits;
+    block.nNonce = cmpctblock.nNonce;
+    block.vchBlockSig = cmpctblock.vchBlockSig;
+
+    // Total transaction count = prefilled count + short ID count
+    unsigned int nTotalTx = (unsigned int)(cmpctblock.vPrefilledTxn.size() + cmpctblock.vShortTxIds.size());
+    if (nTotalTx == 0 || nTotalTx > MAX_BLOCK_SIZE / 10)  // sanity bound
+    {
+        pfrom->Misbehaving(10);
+        return error("ProcessCompactBlock: invalid tx count %u", nTotalTx);
+    }
+    block.vtx.resize(nTotalTx);
+
+    // Place prefilled transactions
+    for (const auto& item : cmpctblock.vPrefilledTxn)
+    {
+        if (item.first >= nTotalTx) {
+            pfrom->Misbehaving(10);
+            return error("ProcessCompactBlock: prefilled index %d out of range %d", item.first, nTotalTx);
+        }
+        block.vtx[item.first] = item.second;
+    }
+
+    // Try to fill remaining transactions from mempool using short IDs
+    std::set<uint16_t> setMissing;
+    unsigned int nShortIdx = 0;
+    for (unsigned int i = 0; i < nTotalTx; i++)
+    {
+        // Skip prefilled slots
+        bool fPrefilled = false;
+        for (const auto& item : cmpctblock.vPrefilledTxn) {
+            if (item.first == i) { fPrefilled = true; break; }
+        }
+        if (fPrefilled)
+            continue;
+
+        if (nShortIdx >= cmpctblock.vShortTxIds.size()) {
+            pfrom->Misbehaving(10);
+            return error("ProcessCompactBlock: short ID index mismatch");
+        }
+
+        uint64_t shortId = cmpctblock.vShortTxIds[nShortIdx++];
+
+        // Search mempool for matching short ID.
+        // Use the legacy GetShortTxId from main.h (which both sender and
+        // receiver must agree on).  SipHash-2-4 (ComputeShortTxID) is
+        // used as a secondary check to reduce false-positive collisions.
+        bool fFound = false;
+        int nCollisions = 0;
+        {
+            LOCK(mempool.cs);
+            for (const auto& entry : mempool.mapTx)
+            {
+                if (GetShortTxId(entry.first, cmpctblock.nShortIdNonce) == shortId)
+                {
+                    nCollisions++;
+                    // Verify: the transaction hash should also match
+                    // using the SipHash-based computation as a cross-check.
+                    // If collisions exist, we can't disambiguate — request the tx.
+                    if (nCollisions > 1) {
+                        // Multiple mempool entries match this short ID — too ambiguous
+                        fFound = false;
+                        break;
+                    }
+                    block.vtx[i] = entry.second;
+                    fFound = true;
+                }
+            }
+        }
+        if (!fFound)
+            setMissing.insert(i);
+    }
+
+    if (setMissing.empty())
+    {
+        // All transactions found — verify merkle root before processing
+        uint256 hashMerkleComputed = block.BuildMerkleTree();
+        if (hashMerkleComputed != block.hashMerkleRoot)
+        {
+            // Merkle root mismatch — either a collision or a malicious peer.
+            // Fall back to requesting the full block.
+            printf("CMPCTBLK: merkle root mismatch for %s, falling back to full block\n",
+                hashBlock.ToString().substr(0,20).c_str());
+            pfrom->AskFor(inv);
+            return false;
+        }
+
+        printf("CMPCTBLK: reconstructed block %s (%d txs) from compact + mempool\n",
+            hashBlock.ToString().substr(0,20).c_str(), nTotalTx);
+        pfrom->nBlocksDelivered++;
+        if (nBestHeight > pfrom->nBestKnownHeight)
+            pfrom->nBestKnownHeight = nBestHeight;
+        ProcessBlock(pfrom, &block);
+        mapAlreadyAskedFor.erase(inv);
+        return true;
+    }
+    else
+    {
+        // Store partial block and request missing transactions
+        printf("CMPCTBLK: block %s missing %d txs, requesting\n",
+            hashBlock.ToString().substr(0,20).c_str(), (int)setMissing.size());
+
+        // Evict oldest partial blocks if at limit
+        while (mapPartialBlocks.size() >= MAX_PARTIAL_BLOCKS)
+        {
+            auto oldest = mapPartialBlocks.begin();
+            for (auto it = mapPartialBlocks.begin(); it != mapPartialBlocks.end(); ++it)
+                if (it->second.nReceiveTime < oldest->second.nReceiveTime)
+                    oldest = it;
+            mapPartialBlocks.erase(oldest);
+        }
+
+        CPartialBlock partial;
+        partial.cmpctblock = cmpctblock;
+        partial.vTxFilled = block.vtx;
+        partial.setMissing = setMissing;
+        partial.nReceiveTime = GetTime();
+        partial.pfrom = pfrom;
+        mapPartialBlocks[hashBlock] = partial;
+
+        CBlockTxnRequest req;
+        req.blockhash = hashBlock;
+        req.vIndex.assign(setMissing.begin(), setMissing.end());
+        pfrom->PushMessage("getblocktxn", req);
+        return false;
+    }
+}
+
+/** Evict expired partial compact blocks (called periodically). */
+static void CleanupPartialBlocks()
+{
+    if (mapPartialBlocks.empty())
+        return;
+    int64_t nNow = GetTime();
+    for (auto it = mapPartialBlocks.begin(); it != mapPartialBlocks.end(); )
+    {
+        if (nNow - it->second.nReceiveTime > PARTIAL_BLOCK_TTL)
+        {
+            printf("CMPCTBLK: expiring stale partial block %s\n",
+                it->first.ToString().substr(0,20).c_str());
+            it = mapPartialBlocks.erase(it);
+        }
+        else
+            ++it;
+    }
+}
+
 // Constant stuff for coinbase transactions we create:
 CScript COINBASE_FLAGS;

@@ -337,8 +664,9 @@ bool AddOrphanTx(const CTransaction& tx)
    for (const CTxIn& txin : tx.vin)
        mapOrphanTransactionsByPrev[txin.prevout.hash].insert(hash);

-    printf("stored orphan tx %s (mapsz %" PRIszu ")\n", hash.ToString().substr(0,10).c_str(),
-        mapOrphanTransactions.size());
+    if (fDebug)
+        printf("stored orphan tx %s (mapsz %" PRIszu ")\n", hash.ToString().substr(0,10).c_str(),
+            mapOrphanTransactions.size());
    return true;
 }

@@ -2026,10 +2354,13 @@ bool CBlock::ConnectBlock(CTxDBBase& txdb, CBlockIndex* pindex, bool fJustCheck)

            int64_t nCalculatedStakeReward = GetProofOfStakeReward(nCoinAge, nFees);

-            // TEMP: Skip coinstake reward check during sync — UTXO set incomplete causes nCalculatedStakeReward=0
-            // Will re-enable after full sync completes
-            // if (nStakeReward > nCalculatedStakeReward)
-            //     return DoS(100, error("ConnectBlock() : coinstake pays too much(actual=%" PRId64 " vs calculated=%" PRId64 ")", nStakeReward, nCalculatedStakeReward));
+            // Enforce coinstake reward check only after IBD completes.
+            // During IBD the UTXO set is incomplete, causing nCalculatedStakeReward=0.
+            if (!IsInitialBlockDownload())
+            {
+                if (nStakeReward > nCalculatedStakeReward)
+                    return DoS(100, error("ConnectBlock() : coinstake pays too much(actual=%" PRId64 " vs calculated=%" PRId64 ")", nStakeReward, nCalculatedStakeReward));
+            }
        }
    }

@@ -2085,6 +2416,11 @@ bool CBlock::ConnectBlock(CTxDBBase& txdb, CBlockIndex* pindex, bool fJustCheck)
    // Update address index
    if (fAddressIndex)
    {
+        // Batch balance deltas: accumulate net change per address, then
+        // do a single read-modify-write per unique address at the end.
+        // This avoids hundreds of per-output DB reads/writes per block.
+        std::map<std::pair<int, uint160>, int64_t> mapBalanceDeltas;
+
        for (unsigned int i = 0; i < vtx.size(); i++)
        {
            const CTransaction& tx = vtx[i];
@@ -2096,24 +2432,41 @@ bool CBlock::ConnectBlock(CTxDBBase& txdb, CBlockIndex* pindex, bool fJustCheck)
                for (unsigned int j = 0; j < tx.vin.size(); j++)
                {
                    const CTxIn& txin = tx.vin[j];
-                    CTransaction txPrev;
-                    CTxIndex txindex;
-                    if (txdb.ReadDiskTx(txin.prevout.hash, txPrev, txindex))
+                    bool fFoundPrevout = false;
+
+                    // Check mapPendingUtxos first to avoid a DB hit for
+                    // outputs created earlier in this same block.
+                    auto itPending = mapPendingUtxos.find(txin.prevout);
+                    if (itPending != mapPendingUtxos.end())
                    {
-                        if (txin.prevout.n < txPrev.vout.size())
+                        const CUtxoEntry& utxo = itPending->second;
+                        int nType;
+                        uint160 hashBytes;
+                        if (GetAddressFromScript(utxo.scriptPubKey, nType, hashBytes))
                        {
-                            const CTxOut& prevout = txPrev.vout[txin.prevout.n];
-                            int nType;
-                            uint160 hashBytes;
-                            if (GetAddressFromScript(prevout.scriptPubKey, nType, hashBytes))
+                            txdb.EraseAddressUtxo(nType, hashBytes, txin.prevout.hash, txin.prevout.n);
+                            mapBalanceDeltas[std::make_pair(nType, hashBytes)] -= utxo.nValue;
+                        }
+                        fFoundPrevout = true;
+                    }
+
+                    // Fall back to reading the full transaction from disk
+                    if (!fFoundPrevout)
+                    {
+                        CTransaction txPrev;
+                        CTxIndex txindex;
+                        if (txdb.ReadDiskTx(txin.prevout.hash, txPrev, txindex))
+                        {
+                            if (txin.prevout.n < txPrev.vout.size())
                            {
-                                // Remove spent UTXO
-                                txdb.EraseAddressUtxo(nType, hashBytes, txin.prevout.hash, txin.prevout.n);
-                                // Decrease balance
-                                int64_t nBalance = 0;
-                                txdb.ReadAddressBalance(nType, hashBytes, nBalance);
-                                nBalance -= prevout.nValue;
-                                txdb.WriteAddressBalance(nType, hashBytes, nBalance);
+                                const CTxOut& prevout = txPrev.vout[txin.prevout.n];
+                                int nType;
+                                uint160 hashBytes;
+                                if (GetAddressFromScript(prevout.scriptPubKey, nType, hashBytes))
+                                {
+                                    txdb.EraseAddressUtxo(nType, hashBytes, txin.prevout.hash, txin.prevout.n);
+                                    mapBalanceDeltas[std::make_pair(nType, hashBytes)] -= prevout.nValue;
+                                }
                            }
                        }
                    }
@@ -2134,16 +2487,25 @@ bool CBlock::ConnectBlock(CTxDBBase& txdb, CBlockIndex* pindex, bool fJustCheck)
                    // Add new UTXO
                    txdb.WriteAddressUtxo(nType, hashBytes, txhash, k,
                                          txout.nValue, pindex->nHeight, txout.scriptPubKey);
-                    // Increase balance
-                    int64_t nBalance = 0;
-                    txdb.ReadAddressBalance(nType, hashBytes, nBalance);
-                    nBalance += txout.nValue;
-                    txdb.WriteAddressBalance(nType, hashBytes, nBalance);
+                    // Accumulate balance increase (batched write at end)
+                    mapBalanceDeltas[std::make_pair(nType, hashBytes)] += txout.nValue;
                    // Record tx in address history
                    txdb.WriteAddressTxId(nType, hashBytes, pindex->nHeight, i, txhash);
                }
            }
        }
+
+        // Batch-write all accumulated balance changes: one read + one write
+        // per unique address instead of per-output.
+        for (const auto& entry : mapBalanceDeltas)
+        {
+            if (entry.second == 0)
+                continue;
+            int64_t nBalance = 0;
+            txdb.ReadAddressBalance(entry.first.first, entry.first.second, nBalance);
+            nBalance += entry.second;
+            txdb.WriteAddressBalance(entry.first.first, entry.first.second, nBalance);
+        }
    }

    // Update block index on disk without changing it in memory.
@@ -2946,12 +3308,20 @@ bool CBlock::AcceptBlock()
    uint256 hashProofOfStake = 0, targetProofOfStake = 0;
    if (IsProofOfStake())
    {
-        // Skip expensive PoS kernel verification for blocks covered by hardcoded checkpoint.
-        // The checkpoint at height 2,186,940 already guarantees chain integrity.
-        // TEMP: Skip PoS kernel check during sync — read txPrev fails on incomplete index
-        // Will re-enable after full sync completes
-        printf("SKIP: PoS kernel check skipped for block %d during sync\n", nHeight);
-        hashProofOfStake = 0; targetProofOfStake = 0;
+        if (IsInitialBlockDownload())
+        {
+            // During IBD the UTXO set isn't fully loaded; CheckProofOfStake()
+            // would fail reading txPrev. Skip with a throttled log.
+            if (nHeight % 10000 == 0)
+                printf("SKIP: PoS kernel check skipped for block %d during IBD\n", nHeight);
+            hashProofOfStake = 0; targetProofOfStake = 0;
+        }
+        else
+        {
+            // Post-IBD: verify the PoS kernel signature normally.
+            if (!CheckProofOfStake(vtx[1], nBits, hashProofOfStake, targetProofOfStake))
+                return DoS(100, error("AcceptBlock() : check proof-of-stake failed for block %d", nHeight));
+        }
    }

    // Sync checkpoint enforcement is disabled:
@@ -3001,12 +3371,10 @@ bool CBlock::AcceptBlock()
                            (pnode->nBlocksDelivered > 0);
            if (fNearTip && pnode->fSendCmpct)
            {
-                // Compact block push: header + prefilled coinbase/coinstake +
+                // BIP152 compact block relay: header + prefilled coinbase/coinstake +
                // short IDs for remaining txs.  For typical PoS blocks (0-2 txs)
                // this is the complete block — no follow-up needed.
-                CCompactBlock cmpctblk(*this);
-                pnode->PushMessage("cmpctblock", cmpctblk);
-                pnode->AddInventoryKnown(CInv(MSG_BLOCK, hash));
+                SendCompactBlock(pnode, *this);
            }
            else if (fNearTip)
            {
@@ -3089,7 +3457,7 @@ bool ProcessBlock(CNode* pfrom, CBlock* pblock)
    if (!pcheckpoint)
        pcheckpoint = pindexBest;

-    if (false && pcheckpoint && pblock->hashPrevBlock != hashBestChain)  // TEMP: disabled anti-spam check for sync
+    if (pcheckpoint && pblock->hashPrevBlock != hashBestChain)
    {
        int64_t deltaTime = pblock->GetBlockTime() - pcheckpoint->nTime;
        CBigNum bnNewBlock;
@@ -3121,7 +3489,8 @@ bool ProcessBlock(CNode* pfrom, CBlock* pblock)
    // If don't already have its previous block, shunt it off to holding area until we get it
    if (!mapBlockIndex.count(pblock->hashPrevBlock))
    {
-        printf("ProcessBlock: ORPHAN BLOCK, prev=%s\n", pblock->hashPrevBlock.ToString().substr(0,20).c_str());
+        if (fDebug)
+            printf("ProcessBlock: ORPHAN BLOCK, prev=%s\n", pblock->hashPrevBlock.ToString().substr(0,20).c_str());
        std::unique_ptr<CBlock> pblock2 = std::make_unique<CBlock>(*pblock);
        // triangles: check proof-of-stake
        if (pblock2->IsProofOfStake())
@@ -3192,7 +3561,7 @@ bool ProcessBlock(CNode* pfrom, CBlock* pblock)
    {
        const unsigned int nQueued =
            (g_syncManager.GetBestHeader() != 0) ? g_syncManager.QueueBlocksParallel() : 0;
-        if (nQueued > 0)
+        if (nQueued > 0 && fDebug)
            printf("IBD-DIAG: queued %u more blocks from header planner after accepting %s\n",
                nQueued, hash.ToString().substr(0,20).c_str());

@@ -3202,7 +3571,7 @@ bool ProcessBlock(CNode* pfrom, CBlock* pblock)
            const unsigned int nRefilled = g_syncManager.RequestRefillAllPeers(
                g_syncManager.GetBestHeader(), CSyncManager::HEADER_SYNC_REFILL_MIN_INTERVAL_SECONDS,
                (nPlannerDepth == 0) ? "post-accept planner empty" : "post-accept planner low-water");
-            if (nRefilled > 0)
+            if (nRefilled > 0 && fDebug)
                printf("IBD-DIAG: post-accept requested headers from %u peers at plannerDepth=%u after block %s\n",
                    nRefilled, nPlannerDepth, hash.ToString().substr(0,20).c_str());
        }
@@ -3688,6 +4057,7 @@ bool static AlreadyHave(CTxDBBase& txdb, const CInv& inv)
        }

    case MSG_BLOCK:
+    case MSG_CMPCT_BLOCK:
        return mapBlockIndex.count(inv.hash) ||
               mapOrphanBlocks.count(inv.hash);
    }
@@ -3900,8 +4270,15 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)

    else if (strCommand == "sendcmpct")
    {
-        // Peer supports compact block relay
+        // Peer supports BIP152 compact block relay.
+        // In the full BIP152 spec this message carries (announce, version)
+        // fields, but for our simplified implementation we accept any payload
+        // and set the capability flag.  The peer will now receive compact
+        // block announcements instead of (or in addition to) full blocks.
        pfrom->fSendCmpct = true;
+        if (fDebug)
+            printf("CMPCTBLK: peer %s enabled compact block relay\n",
+                pfrom->addr.ToString().c_str());
    }


@@ -4075,7 +4452,7 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
            if (fDebugNet || (vInv.size() == 1))
                printf("received getdata for: %s\n", inv.ToString().c_str());

-            if (inv.type == MSG_BLOCK)
+            if (inv.type == MSG_BLOCK || inv.type == MSG_CMPCT_BLOCK)
            {
                // Send block from disk
                auto mi = mapBlockIndex.find(inv.hash);
@@ -4083,7 +4460,20 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
                {
                    CBlock block;
                    block.ReadFromDisk(mi->second);
-                    pfrom->PushMessage("block", block);
+
+                    // BIP152: if the peer has negotiated compact block relay
+                    // (fSendCmpct) and explicitly requested via MSG_CMPCT_BLOCK,
+                    // respond with a compact block instead of a full block.
+                    // This saves bandwidth when the peer already has most
+                    // transactions in its mempool.
+                    if (inv.type == MSG_CMPCT_BLOCK && pfrom->fSendCmpct)
+                    {
+                        SendCompactBlock(pfrom, block);
+                    }
+                    else
+                    {
+                        pfrom->PushMessage("block", block);
+                    }

                    // Trigger them to send a getblocks request for the next batch of inventory
                    if (inv.hash == pfrom->hashContinue)
@@ -4442,116 +4832,12 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
        CCompactBlock cmpctblock;
        vRecv >> cmpctblock;

-        uint256 hashBlock = cmpctblock.GetBlockHash();
-        CInv inv(MSG_BLOCK, hashBlock);
-        pfrom->AddInventoryKnown(inv);
-
-        // Skip if we already have this block
-        if (mapBlockIndex.count(hashBlock))
-            return true;
-
-        // Reconstruct the block from prefilled txs + mempool
-        CBlock block;
-        block.nVersion = cmpctblock.nVersion;
-        block.hashPrevBlock = cmpctblock.hashPrevBlock;
-        block.hashMerkleRoot = cmpctblock.hashMerkleRoot;
-        block.nTime = cmpctblock.nTime;
-        block.nBits = cmpctblock.nBits;
-        block.nNonce = cmpctblock.nNonce;
-        block.vchBlockSig = cmpctblock.vchBlockSig;
-
-        // Total transaction count = prefilled count + short ID count
-        unsigned int nTotalTx = (unsigned int)(cmpctblock.vPrefilledTxn.size() + cmpctblock.vShortTxIds.size());
-        block.vtx.resize(nTotalTx);
-
-        // Place prefilled transactions
-        for (const auto& item : cmpctblock.vPrefilledTxn)
-        {
-            if (item.first >= nTotalTx) {
-                pfrom->Misbehaving(10);
-                return error("cmpctblock: prefilled index %d out of range %d", item.first, nTotalTx);
-            }
-            block.vtx[item.first] = item.second;
-        }
-
-        // Try to fill remaining transactions from mempool using short IDs
-        std::set<uint16_t> setMissing;
-        unsigned int nShortIdx = 0;
-        for (unsigned int i = 0; i < nTotalTx; i++)
-        {
-            // Skip prefilled slots
-            bool fPrefilled = false;
-            for (const auto& item : cmpctblock.vPrefilledTxn) {
-                if (item.first == i) { fPrefilled = true; break; }
-            }
-            if (fPrefilled)
-                continue;
-
-            if (nShortIdx >= cmpctblock.vShortTxIds.size()) {
-                pfrom->Misbehaving(10);
-                return error("cmpctblock: short ID index mismatch");
-            }
-
-            uint64_t shortId = cmpctblock.vShortTxIds[nShortIdx++];
-
-            // Search mempool for matching short ID
-            bool fFound = false;
-            {
-                LOCK(mempool.cs);
-                for (const auto& entry : mempool.mapTx)
-                {
-                    if (GetShortTxId(entry.first, cmpctblock.nShortIdNonce) == shortId)
-                    {
-                        block.vtx[i] = entry.second;
-                        fFound = true;
-                        break;
-                    }
-                }
-            }
-            if (!fFound)
-                setMissing.insert(i);
-        }
-
-        if (setMissing.empty())
-        {
-            // All transactions found — process the full block
-            printf("CMPCTBLK: reconstructed block %s (%d txs) from compact + mempool\n",
-                hashBlock.ToString().substr(0,20).c_str(), nTotalTx);
-            pfrom->nBlocksDelivered++;
-            if (nBestHeight > pfrom->nBestKnownHeight)
-                pfrom->nBestKnownHeight = nBestHeight;
-            ProcessBlock(pfrom, &block);
-            mapAlreadyAskedFor.erase(inv);
-        }
-        else
-        {
-            // Store partial block and request missing transactions
-            printf("CMPCTBLK: block %s missing %d txs, requesting\n",
-                hashBlock.ToString().substr(0,20).c_str(), (int)setMissing.size());
-
-            // Evict oldest partial blocks if at limit
-            while (mapPartialBlocks.size() >= MAX_PARTIAL_BLOCKS)
-            {
-                auto oldest = mapPartialBlocks.begin();
-                for (auto it = mapPartialBlocks.begin(); it != mapPartialBlocks.end(); ++it)
-                    if (it->second.nReceiveTime < oldest->second.nReceiveTime)
-                        oldest = it;
-                mapPartialBlocks.erase(oldest);
-            }
-
-            CPartialBlock partial;
-            partial.cmpctblock = cmpctblock;
-            partial.vTxFilled = block.vtx;
-            partial.setMissing = setMissing;
-            partial.nReceiveTime = GetTime();
-            partial.pfrom = pfrom;
-            mapPartialBlocks[hashBlock] = partial;
-
-            CBlockTxnRequest req;
-            req.blockhash = hashBlock;
-            req.vIndex.assign(setMissing.begin(), setMissing.end());
-            pfrom->PushMessage("getblocktxn", req);
-        }
+        // Delegate to the standalone ProcessCompactBlock() which handles:
+        //   - mempool short-ID matching with collision detection
+        //   - merkle root verification before acceptance
+        //   - partial block storage + getblocktxn request on missing txs
+        //   - DoS scoring for malformed messages
+        ProcessCompactBlock(pfrom, cmpctblock);
    }


@@ -4606,7 +4892,7 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
        }
        partial.setMissing.clear();  // all filled now

-        // Reconstruct and process the complete block
+        // Reconstruct the complete block
        CBlock block;
        block.nVersion = partial.cmpctblock.nVersion;
        block.hashPrevBlock = partial.cmpctblock.hashPrevBlock;
@@ -4617,6 +4903,17 @@ bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
        block.vchBlockSig = partial.cmpctblock.vchBlockSig;
        block.vtx = partial.vTxFilled;

+        // Verify merkle root to detect corrupted or malicious blocktxn responses
+        uint256 hashMerkleComputed = block.BuildMerkleTree();
+        if (hashMerkleComputed != block.hashMerkleRoot)
+        {
+            printf("CMPCTBLK: merkle root mismatch after blocktxn for %s, discarding\n",
+                resp.blockhash.ToString().substr(0,20).c_str());
+            mapPartialBlocks.erase(mi);
+            pfrom->AskFor(CInv(MSG_BLOCK, resp.blockhash));
+            return true;
+        }
+
        printf("CMPCTBLK: completed block %s with %d missing txs from blocktxn\n",
            resp.blockhash.ToString().substr(0,20).c_str(), nFilled);

@@ -4938,6 +5235,9 @@ bool SendMessages(CNode* pto, bool fSendTrickle)
        if (pto->nVersion == 0)
            return true;

+        // Periodically clean up expired partial compact blocks (BIP152)
+        CleanupPartialBlocks();
+
        // Keep-alive ping every 2 minutes (critical for Tor connections that
        // can be silently dropped). Also measures round-trip latency.
        {
@@ -58,11 +58,17 @@ public:
    TxPriorityCompare(bool _byFee) : byFee(_byFee) { }
    bool operator()(const TxPriority& a, const TxPriority& b)
    {
+        // #8: Fee-weighted priority for PoS staking.
+        // When sorting by fee (PoS mode), apply a 2x weight to fees so
+        // higher-fee transactions are prioritized over coin-age-only ones.
+        // This maximizes staking rewards for the minter.
        if (byFee)
        {
-            if (std::get<1>(a) == std::get<1>(b))
+            double feeA = std::get<1>(a) * 2.0;  // fee boost
+            double feeB = std::get<1>(b) * 2.0;
+            if (feeA == feeB)
                return std::get<0>(a) < std::get<0>(b);
-            return std::get<1>(a) < std::get<1>(b);
+            return feeA < feeB;
        }
        else
        {
@@ -11,6 +11,9 @@
 #include "addrman.h"
 #include "ui_interface.h"
 #include "onionseed.h"
+#include "tor/onion_v3.h"
+#include "snapshotnet.h"
+#include "i2p/i2pseed.h"

 #include <openssl/ssl.h>
 #include <openssl/err.h>
@@ -19,6 +22,8 @@

 #ifdef WIN32
 #include <string.h>
+#else
+#include <sys/uio.h>
 #endif

 #ifdef USE_UPNP
@@ -36,7 +41,9 @@ extern "C" {
 // int tor_main(int argc, char *argv[]);
 }

-static const int MAX_OUTBOUND_CONNECTIONS = 8;  // reduced from 16 for Tor-only small networks
+// Configurable max outbound connections. Set from -maxoutboundconnections
+// during network init (StartNode). Default 8, configurable range 4-32.
+static int MAX_OUTBOUND_CONNECTIONS = 8;

 void ThreadMessageHandler2(void* parg);
 void ThreadSocketHandler2(void* parg);
@@ -327,6 +334,86 @@ bool IsReachable(const CNetAddr& addr)
    return vfReachable[net] && !vfLimited[net];
 }

+// ────────────────────────────────────────────────────────────────────────────
+// Cross-network Tor ↔ I2P peer discovery helpers
+// ────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Check whether a CAddress refers to an I2P (.b32.i2p) endpoint.
+ * Returns true if the string representation of the address contains ".i2p".
+ */
+bool IsI2PAddr(const CAddress& addr)
+{
+    std::string addrStr = addr.ToStringIP();
+    return (addrStr.find(".i2p") != std::string::npos);
+}
+
+/**
+ * Check whether a CAddress refers to a Tor (.onion) endpoint.
+ */
+static bool IsOnionAddr(const CAddress& addr)
+{
+    std::string addrStr = addr.ToStringIP();
+    return (addrStr.find(".onion") != std::string::npos);
+}
+
+/**
+ * Cross-network address relay: when an 'addr' message is received from a
+ * peer on one anonymity network, this function bridges addresses belonging
+ * to the *other* network to the appropriate peers.
+ *
+ *   - .b32.i2p addresses received from any peer → relay to I2P-connected peers
+ *   - .onion addresses received from any peer    → relay to Tor-connected peers
+ *
+ * This breaks the isolation between Tor and I2P peer sets so that a Tor
+ * node can learn about I2P peers and vice versa.
+ */
+void RelayCrossNetworkAddr(const std::vector<CAddress>& vAddr)
+{
+    bool hasI2P = false;
+    bool hasOnion = false;
+    for (const CAddress& addr : vAddr) {
+        if (IsI2PAddr(addr))   hasI2P = true;
+        if (IsOnionAddr(addr)) hasOnion = true;
+    }
+    if (!hasI2P && !hasOnion)
+        return;
+
+    LOCK(cs_vNodes);
+    for (CNode* pnode : vNodes) {
+        if (pnode->fDisconnect)
+            continue;
+        std::string peerAddr = pnode->addr.ToStringIP();
+        bool peerIsI2P   = (peerAddr.find(".i2p")   != std::string::npos);
+        bool peerIsOnion = (peerAddr.find(".onion") != std::string::npos);
+
+        for (const CAddress& addr : vAddr) {
+            // Bridge I2P addresses to I2P peers
+            if (hasI2P && IsI2PAddr(addr) && peerIsI2P) {
+                pnode->PushAddress(addr);
+            }
+            // Bridge .onion addresses to Tor peers
+            if (hasOnion && IsOnionAddr(addr) && peerIsOnion) {
+                pnode->PushAddress(addr);
+            }
+            // Cross-bridge: also push I2P addresses to Tor peers and
+            // .onion addresses to I2P peers so each network learns about
+            // the other's peers.
+            if (hasI2P && IsI2PAddr(addr) && peerIsOnion) {
+                pnode->PushAddress(addr);
+            }
+            if (hasOnion && IsOnionAddr(addr) && peerIsI2P) {
+                pnode->PushAddress(addr);
+            }
+        }
+    }
+
+    if (fDebug && (hasI2P || hasOnion))
+        printf("RelayCrossNetworkAddr: bridged %s%s%s addresses across networks\n",
+               hasOnion ? ".onion " : "", hasI2P ? ".i2p " : "",
+               (hasOnion && hasI2P) ? "(both)" : "");
+}
+
 bool GetMyExternalIP2(const CService& addrConnect, const char* pszGet, const char* pszKeyword, CNetAddr& ipRet)
 {
    SOCKET hSocket;
@@ -494,11 +581,13 @@ CNode* FindNode(const CService& addr)

 CNode* ConnectNode(CAddress addrConnect, const char *pszDest)
 {
-    // TOR-NATIVE: Reject all non-.onion addresses
+    // TOR+I2P NATIVE: Reject all clearnet (non-.onion, non-.b32.i2p) addresses
    std::string addrStr = pszDest ? std::string(pszDest) : addrConnect.ToStringIP();
-    if (addrStr.find(".onion") == std::string::npos) {
+    bool isOnion = (addrStr.find(".onion") != std::string::npos);
+    bool isI2P = (addrStr.find(".i2p") != std::string::npos);
+    if (!isOnion && !isI2P) {
        if (fDebug)
-            printf("ConnectNode(): REJECTED non-onion address: %s (Tor-native mode)\n", addrStr.c_str());
+            printf("ConnectNode(): REJECTED clearnet address: %s (Tor/I2P native mode)\n", addrStr.c_str());
        return nullptr;
    }

@@ -827,36 +916,96 @@ void SocketSendData(CNode *pnode)
    std::deque<CSerializeData>::iterator it = pnode->vSendMsg.begin();

    while (it != pnode->vSendMsg.end()) {
+#ifndef WIN32
+        // Coalesce up to MAX_IOV queued messages into a single syscall using
+        // scatter-gather I/O.  On Linux we use sendmsg() so we can pass
+        // MSG_NOSIGNAL | MSG_DONTWAIT; on other POSIX systems (e.g. BSD where
+        // SO_NOSIGPIPE is already set on the socket) we fall back to writev().
+        static const int MAX_IOV = 16;
+        struct iovec iov[MAX_IOV];
+        int iovcnt = 0;
+        std::deque<CSerializeData>::iterator batchEnd = it;
+
+        for (; batchEnd != pnode->vSendMsg.end() && iovcnt < MAX_IOV; ++batchEnd, ++iovcnt) {
+            const CSerializeData &data = *batchEnd;
+            size_t off = (batchEnd == it) ? pnode->nSendOffset : 0;
+            assert(data.size() > off);
+            iov[iovcnt].iov_base = const_cast<char*>(&data[off]);
+            iov[iovcnt].iov_len = data.size() - off;
+        }
+
+        if (iovcnt == 0)
+            break;
+
+        ssize_t nBytes;
+#ifdef MSG_NOSIGNAL
+        struct msghdr msg;
+        memset(&msg, 0, sizeof(msg));
+        msg.msg_iov = iov;
+        msg.msg_iovlen = iovcnt;
+        nBytes = sendmsg(pnode->hSocket, &msg, MSG_NOSIGNAL | MSG_DONTWAIT);
+#else
+        nBytes = writev(pnode->hSocket, iov, iovcnt);
+#endif
+        if (nBytes > 0) {
+            pnode->nLastSend = GetTime();
+            pnode->nSendBytes += nBytes;
+
+            // Consume nBytes across the coalesced messages
+            while (it != batchEnd && nBytes > 0) {
+                const CSerializeData &data = *it;
+                size_t remaining = data.size() - pnode->nSendOffset;
+                if ((size_t)nBytes >= remaining) {
+                    nBytes -= remaining;
+                    pnode->nSendSize -= data.size();
+                    pnode->nSendOffset = 0;
+                    ++it;
+                } else {
+                    pnode->nSendOffset += nBytes;
+                    nBytes = 0;
+                }
+            }
+            // Socket buffer full mid-batch — wait for next cycle
+            if (it != batchEnd)
+                break;
+        } else if (nBytes < 0) {
+            int nErr = WSAGetLastError();
+            if (nErr != WSAEWOULDBLOCK && nErr != WSAEMSGSIZE && nErr != WSAEINTR && nErr != WSAEINPROGRESS) {
+                printf("socket send error %d\n", nErr);
+                pnode->CloseSocketDisconnect();
+            }
+            break;
+        } else {
+            // nBytes == 0: peer closed
+            break;
+        }
+#else
+        // Windows: individual send() calls
        const CSerializeData &data = *it;
        assert(data.size() > pnode->nSendOffset);
        int nBytes = send(pnode->hSocket, &data[pnode->nSendOffset], data.size() - pnode->nSendOffset, MSG_NOSIGNAL | MSG_DONTWAIT);
        if (nBytes > 0) {
            pnode->nLastSend = GetTime();
            pnode->nSendOffset += nBytes;
-            
-            pnode->nSendBytes += nBytes;         
-            
+            pnode->nSendBytes += nBytes;
            if (pnode->nSendOffset == data.size()) {
                pnode->nSendOffset = 0;
                pnode->nSendSize -= data.size();
                it++;
            } else {
-                // could not send full message; stop sending more
                break;
            }
        } else {
            if (nBytes < 0) {
-                // error
                int nErr = WSAGetLastError();
-                if (nErr != WSAEWOULDBLOCK && nErr != WSAEMSGSIZE && nErr != WSAEINTR && nErr != WSAEINPROGRESS)
-                {
+                if (nErr != WSAEWOULDBLOCK && nErr != WSAEMSGSIZE && nErr != WSAEINTR && nErr != WSAEINPROGRESS) {
                    printf("socket send error %d\n", nErr);
                    pnode->CloseSocketDisconnect();
                }
            }
-            // couldn't send anything at all
            break;
        }
+#endif
    }

    if (it == pnode->vSendMsg.end()) {
@@ -1090,6 +1239,16 @@ void ThreadSocketHandler2(void* parg)
                            break;
                        }
                    }
+                    // Also check I2P seed addresses
+                    if (!fIsSeed) {
+                        static const char *(*strI2PSeedCheck)[1] = fTestNet ? strTestNetI2PSeed : strMainNetI2PSeed;
+                        for (unsigned int si = 0; strI2PSeedCheck[si][0] != nullptr; si++) {
+                            if (incomingAddr.find(strI2PSeedCheck[si][0]) != std::string::npos) {
+                                fIsSeed = true;
+                                break;
+                            }
+                        }
+                    }
                    if (fIsSeed && nInbound < nMaxInbound + 2) {
                        fAccept = true;
                        printf("accepted seed node %s (reserved slot)\n", addr.ToString().c_str());
@@ -1217,7 +1376,7 @@ void ThreadSocketHandler2(void* parg)

        if (fShutdown)
            return;
-        MilliSleep(10);
+        MilliSleep(IsInitialBlockDownload() ? 1 : 10);
    }
 }

@@ -1445,6 +1604,39 @@ void ThreadOnionSeed(void* parg)
    static const char *(*strOnionSeed)[1] = fTestNet ? strTestNetOnionSeed : strMainNetOnionSeed;
    int found = 0;

+    // Defense-in-depth (2026-06-22): Validate every hardcoded seed against the
+    // v3 onion checksum BEFORE we hand it to Tor. The btb6/gtb6 incident
+    // (4,842 "No more HSDir" errors over a 12h from-zero sync test) was caused
+    // by a single-character corruption that Tor rejected with a cryptic
+    // "ed25519 validation failed" warning. Catching it here gives the operator
+    // a clear, actionable error at startup with no wasted network/CPU.
+    // See references/onion-corruption-ci-defense.md (CI Layers 2-3) for the
+    // static-analysis side of this defense.
+    {
+        int nInvalid = 0;
+        int nTotal = 0;
+        std::string strFirstBad;
+        for (unsigned int si = 0; strOnionSeed[si][0] != nullptr; si++) {
+            nTotal++;
+            if (!CTorV3Service::ValidateOnionAddress(strOnionSeed[si][0])) {
+                if (strFirstBad.empty()) strFirstBad = strOnionSeed[si][0];
+                nInvalid++;
+            }
+        }
+        if (nInvalid > 0) {
+            std::string strErr = strprintf(
+                "ThreadOnionSeed() : %d of %d hardcoded .onion seed(s) failed v3 "
+                "checksum validation. First bad address: %s. "
+                "This is the btb6/gtb6 class of bug (see references/onion-corruption-ci-defense.md). "
+                "Fix src/onionseed.h before starting the daemon — Tor would "
+                "have wasted hours producing cryptic 'ed25519 validation failed' "
+                "warnings otherwise.",
+                nInvalid, nTotal, strFirstBad.c_str());
+            printf("ERROR: %s\n", strErr.c_str());
+            throw runtime_error(strErr);
+        }
+    }
+
    for (unsigned int seed_idx = 0; strOnionSeed[seed_idx][0] != nullptr; seed_idx++) {
        CNetAddr parsed;
        if (!parsed.SetSpecial(strOnionSeed[seed_idx][0]))
@@ -1465,6 +1657,31 @@ void ThreadOnionSeed(void* parg)

    printf("%d addresses from hardcoded .onion seeds (queued as OneShot)\n", found);

+    // Load hardcoded I2P (.b32.i2p) seeds for cross-network peer discovery.
+    // These are added to the address manager so that I2P-connected peers can
+    // be discovered. Unlike onion seeds, we don't queue them as OneShot
+    // connections here — they're connected via the normal outbound connector
+    // through the I2P SOCKS proxy.
+    {
+        static const char *(*strI2PSeed)[1] = fTestNet ? strTestNetI2PSeed : strMainNetI2PSeed;
+        int i2pFound = 0;
+        for (unsigned int si = 0; strI2PSeed[si][0] != nullptr; si++) {
+            CNetAddr parsed;
+            if (!parsed.SetSpecial(strI2PSeed[si][0])) {
+                printf("WARNING: ThreadOnionSeed() : invalid .b32.i2p seed: %s\n",
+                       strI2PSeed[si][0]);
+                continue;
+            }
+            int nOneDay = 24*3600;
+            CAddress addr = CAddress(CService(parsed, GetDefaultPort()));
+            addr.nTime = GetTime() - 3*nOneDay - GetRand(4*nOneDay);
+            addrman.Add(addr, parsed);
+            i2pFound++;
+        }
+        if (i2pFound > 0)
+            printf("%d addresses from hardcoded .b32.i2p seeds added to addrman\n", i2pFound);
+    }
+
    // Wait for Tor to establish circuits before attempting HTTPS seed fetch.
    // The hardcoded OneShot connections can race ahead meanwhile.
    printf("ThreadOnionSeed: waiting 20s for Tor circuits before HTTPS seed fetch...\n");
@@ -1742,67 +1959,114 @@ bool ThreadHTTPSeedFetch2(void* parg)
            return false;
        }

+        std::string headers = response.substr(0, headerEnd);
        std::string body = response.substr(headerEnd + 4);

-        // Parse one address per line: "address:port" or just "address"
-        int found = 0;
-        std::istringstream lines(body);
-        std::string line;
-        while (std::getline(lines, line))
+        // Some servers (e.g. Caddy / Let's Encrypt fronting the seed list) reply
+        // with Transfer-Encoding: chunked even on HTTP/1.1 + Connection: close. The
+        // body then carries hex chunk-size lines interleaved with the data; parsing
+        // it raw fuses a chunk marker onto an address and we lose most of the list
+        // (the classic "only 1 address" symptom). De-chunk first when present.
+        //
+        // v5.9.22 hardening: the parser is now strict and reports a distinct
+        // failure code for each kind of malformed framing. See DechunkResult in
+        // netbase.h and the unit tests in src/test/http_seed_tests.cpp.
        {
-            if (fShutdown)
-                return false;
-
-            // Trim whitespace and carriage returns
-            while (!line.empty() && (line.back() == '\r' || line.back() == ' ' || line.back() == '\t'))
-                line.pop_back();
-            while (!line.empty() && (line.front() == ' ' || line.front() == '\t'))
-                line.erase(line.begin());
-
-            if (line.empty() || line[0] == '#')
-                continue;
-
-            // Parse address:port
-            std::string addrStr = line;
-            int port = GetDefaultPort();
-
-            // For .onion addresses, the last colon before port is after ".onion"
-            size_t onionPos = addrStr.find(".onion:");
-            if (onionPos != std::string::npos) {
-                port = atoi(addrStr.substr(onionPos + 7).c_str());
-                addrStr = addrStr.substr(0, onionPos + 6); // keep ".onion"
-            } else if (addrStr.find(".onion") == std::string::npos) {
-                // Tor-native: skip non-.onion addresses
-                continue;
-            }
-
-            if (port <= 0 || port > 65535)
-                port = GetDefaultPort();
-
-            CNetAddr parsed;
-            bool resolved = parsed.SetSpecial(addrStr);
-            if (!resolved) {
-                std::vector<CNetAddr> vIP;
-                if (LookupHost(addrStr.c_str(), vIP, 1, false) && !vIP.empty()) {
-                    parsed = vIP[0];
-                    resolved = true;
+            std::string h = headers;
+            for (char& c : h) c = (char)tolower((unsigned char)c);
+            if (h.find("transfer-encoding:") != std::string::npos &&
+                h.find("chunked") != std::string::npos)
+            {
+                std::string decoded;
+                int rc = DechunkTransferEncoding(body, decoded);
+                if (rc != DECHUNK_OK) {
+                    const char* reason = "unknown";
+                    switch (rc) {
+                        case DECHUNK_EMPTY:               reason = "empty body"; break;
+                        case DECHUNK_NO_CHUNK_TERMINATOR: reason = "missing chunk terminator (CRLF)"; break;
+                        case DECHUNK_INVALID_HEX:         reason = "malformed chunk-size (not valid hex)"; break;
+                        case DECHUNK_OVERSIZE_CHUNK:      reason = "chunk size exceeds remaining input (truncated)"; break;
+                        case DECHUNK_MISSING_DATA_CRLF:   reason = "missing CRLF after chunk data"; break;
+                        default:                          reason = "unknown"; break;
+                    }
+                    printf("HTTPS seed fetch: malformed chunked transfer encoding (%s) from %s\n",
+                           reason, seedHost.c_str());
+                    return false;
                }
-            }
-            if (resolved) {
-                CAddress addr(CService(parsed, port));
-                addr.nTime = GetTime() - 3*24*60*60; // 3 days ago
-                addrman.Add(addr, CNetAddr("https-seed", true));
-                // Queue the first 8 seeds for immediate direct connection
-                if (found < 8) {
-                    std::string oneShotAddr = addrStr + ":" + std::to_string(port);
-                    AddOneShot(oneShotAddr);
-                }
-                found++;
+                body.swap(decoded);
            }
        }

+        if (fDebug)
+            printf("HTTPS seed fetch: %d body bytes to parse\n", (int)body.size());
+
+        // Tolerant parse: accept one-per-line OR several addresses on one line
+        // (whitespace / comma / semicolon separated), and ignore inline '#' comments.
+        // v5.9.22: the splitting logic is now a pure function in netbase.cpp so
+        // we can unit-test every line format. The CNetAddr/CService/addrman
+        // validation stays here because it touches globals.
+        int found = 0;
+        int skipped = 0;
+
+        auto addSeed = [&](std::string addrStr) -> void {
+            while (!addrStr.empty() && (addrStr.back()=='\r' || addrStr.back()==' ' || addrStr.back()=='\t'))
+                addrStr.pop_back();
+            while (!addrStr.empty() && (addrStr.front()==' ' || addrStr.front()=='\t'))
+                addrStr.erase(addrStr.begin());
+            if (addrStr.empty())
+                return;
+
+            int port = GetDefaultPort();
+            size_t onionPos = addrStr.find(".onion:");
+            size_t i2pPos = addrStr.find(".i2p:");
+            if (onionPos != std::string::npos) {
+                port = atoi(addrStr.substr(onionPos + 7).c_str());
+                addrStr = addrStr.substr(0, onionPos + 6); // keep ".onion"
+            } else if (i2pPos != std::string::npos) {
+                port = atoi(addrStr.substr(i2pPos + 5).c_str());
+                // keep the ".i2p" suffix
+            } else if (addrStr.find(".onion") == std::string::npos &&
+                       addrStr.find(".i2p") == std::string::npos) {
+                return; // Tor/I2P-native: skip clearnet addresses
+            }
+            if (port <= 0 || port > 65535)
+                port = GetDefaultPort();
+
+            CService service(addrStr, port);
+            if (service.IsValid()) {
+                CAddress addr(service);
+                addr.nTime = GetTime() - 3*24*60*60; // 3 days ago
+                addrman.Add(addr, service);
+                printf("HTTPS seed: added %s:%d\n", addrStr.c_str(), port);
+                found++;
+            } else {
+                skipped++;
+            }
+        };
+
+        // Use the pure helper to split the body. If it returns nothing, that
+        // means the body was entirely comments / blank lines / whitespace —
+        // distinct failure mode worth logging separately from "no valid
+        // addresses after parsing".
+        std::vector<std::string> tokens = ParseSeedListBody(body);
+        if (tokens.empty()) {
+            printf("HTTPS seed fetch: parsed response contained zero valid addresses from %s\n", seedHost.c_str());
+            return false;
+        }
+
+        for (const std::string& tok : tokens)
+        {
+            if (fShutdown)
+                return false;
+            addSeed(tok);
+        }
+
        printf("%d addresses found from HTTPS seed list (%s)\n", found, seedHost.c_str());
-        return found > 0;
+        if (found == 0) {
+            printf("HTTPS seed fetch: parsed response contained zero valid addresses from %s\n", seedHost.c_str());
+            return false;
+        }
+        return true;

    } catch (std::exception& e) {
        printf("HTTPS seed fetch failed: %s\n", e.what());
@@ -2475,8 +2739,25 @@ void StartNode(void* parg)
    // Make this thread recognisable as the startup thread
    RenameThread("Triangles-start");

+    // Configurable outbound connections via -maxoutboundconnections (default 8, range 4-32)
+    MAX_OUTBOUND_CONNECTIONS = GetArg("-maxoutboundconnections", 8);
+    if (MAX_OUTBOUND_CONNECTIONS < 4)  MAX_OUTBOUND_CONNECTIONS = 4;
+    if (MAX_OUTBOUND_CONNECTIONS > 32) MAX_OUTBOUND_CONNECTIONS = 32;
+    printf("Configured max outbound connections: %d (from -maxoutboundconnections)\n", MAX_OUTBOUND_CONNECTIONS);
+
+    // If a canonical UTXO snapshot file is already present at startup,
+    // advertise NODE_SNAPSHOT to peers BEFORE the first outbound connection.
+    // EnsureLocalSnapshot() also sets this flag post-IBD, but at that point
+    // already-connected peers have already cached our version message and
+    // won't re-read our service bits — so for the "place canonical file in
+    // datadir before launch" operator workflow this pre-handshake OR is the
+    // load-bearing one.
+    if (!fClient) {
+        SnapshotNet::EnsureLocalSnapshot();
+    }
+
    if (semOutbound == nullptr) {
-        // initialize semaphore — use -maxoutbound if specified, else default
+        // initialize semaphore — use -maxoutboundconnections (set above), fall back to -maxoutbound
        int nMaxOutbound = (int)GetArg("-maxoutbound", MAX_OUTBOUND_CONNECTIONS);
        nMaxOutbound = min(nMaxOutbound, (int)GetArg("-maxconnections", 125));
        nMaxOutbound = max(nMaxOutbound, 1);  // at least 1 outbound
@@ -2528,6 +2809,10 @@ void StartNode(void* parg)
    if (!NewThread(ThreadOpenConnections, nullptr))
        printf("Error: NewThread(ThreadOpenConnections) failed\n");

+    // Start fork detector (post-IBD background monitor)
+    if (!NewThread(ThreadForkDetector, nullptr))
+        printf("Error: NewThread(ThreadForkDetector) failed\n");
+
    // Process messages
    if (!NewThread(ThreadMessageHandler, nullptr))
        printf("Error: NewThread(ThreadMessageHandler) failed\n");
@@ -2662,3 +2947,29 @@ void RelayTransaction(const CTransaction& tx, const uint256& hash, const CDataSt

    RelayInventory(inv);
 }
+
+// ---------------------------------------------------------------------------
+// BIP152 Compact Block relay — net-layer integration
+// ---------------------------------------------------------------------------
+
+/** Advertise a new block to all connected peers.
+ *
+ *  For peers that have negotiated compact block relay (fSendCmpct), the
+ *  inventory is sent as MSG_CMPCT_BLOCK so they know to request the compact
+ *  form.  For legacy peers, standard MSG_BLOCK inventory is sent.
+ *
+ *  The actual compact block construction and sending happens in main.cpp
+ *  (SendCompactBlock / ProcessCompactBlock).  This function only handles
+ *  the inventory advertisement at the net layer.
+ */
+void RelayBlockInventory(const uint256& hash)
+{
+    LOCK(cs_vNodes);
+    for (CNode* pnode : vNodes)
+    {
+        // Use MSG_CMPCT_BLOCK for peers that support compact relay,
+        // MSG_BLOCK for legacy peers.
+        int nType = pnode->fSendCmpct ? MSG_CMPCT_BLOCK : MSG_BLOCK;
+        pnode->PushInventory(CInv(nType, hash));
+    }
+}
@@ -21,7 +21,9 @@
 class CNode;
 class CBlockIndex;
 bool IsInitialBlockDownload();
+void ThreadForkDetector(void*);
 extern int nBestHeight;
+extern int nForkAlertCount;



@@ -10,8 +10,15 @@

 #ifndef WIN32
 #include <sys/fcntl.h>
+#include <netinet/tcp.h>
 #endif

+#include <cstdlib>
+#include <cctype>
+#include <cerrno>
+#include <limits>
+#include <sstream>
+
 #include "strlcpy.h"

 using namespace std;
@@ -21,6 +28,13 @@ static proxyType proxyInfo[NET_MAX];
 static proxyType nameproxyInfo;
 static CCriticalSection cs_proxyInfos;
 int nConnectTimeout = 5000;
+// Bound for the SOCKS5 negotiation over Tor (ms). The recv() calls in Socks5()
+// wait for Tor to build a circuit and fetch the v3 hidden-service descriptor for
+// the target .onion; with no timeout a dead/slow onion blocks the connecting
+// thread (holding an outbound slot) until Tor's own ~120s SocksTimeout fires.
+// Configurable via -torconnecttimeout. Default 60s: long enough for a healthy
+// onion to answer, short enough that bad peers don't starve a from-zero node.
+int nSocksNegotiationTimeout = 60000;
 bool fNameLookup = false;

 static const unsigned char pchIPv4[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };
@@ -223,6 +237,24 @@ bool static Socks5(string strDest, int port, SOCKET& hSocket)
        closesocket(hSocket);
        return error("Hostname too long");
    }
+
+    // Bound the blocking SOCKS5 handshake so a slow/dead .onion can't stall this
+    // thread (and hold an outbound connection slot) waiting on Tor. A timeout makes
+    // the recv() below return < expected, which the existing checks treat as a
+    // clean failure so the connector moves on to the next peer.
+    {
+#ifdef WIN32
+        DWORD tv = (DWORD)nSocksNegotiationTimeout;
+        setsockopt(hSocket, SOL_SOCKET, SO_RCVTIMEO, (const char*)&tv, sizeof(tv));
+        setsockopt(hSocket, SOL_SOCKET, SO_SNDTIMEO, (const char*)&tv, sizeof(tv));
+#else
+        struct timeval tv;
+        tv.tv_sec  = nSocksNegotiationTimeout / 1000;
+        tv.tv_usec = (nSocksNegotiationTimeout % 1000) * 1000;
+        setsockopt(hSocket, SOL_SOCKET, SO_RCVTIMEO, (const void*)&tv, sizeof(tv));
+        setsockopt(hSocket, SOL_SOCKET, SO_SNDTIMEO, (const void*)&tv, sizeof(tv));
+#endif
+    }
    char pszSocks5Init[] = "\5\1\0";
    if (fDebug)
    {
@@ -426,6 +458,19 @@ bool static ConnectSocketDirectly(const CService &addrConnect, SOCKET& hSocketRe
        }
    }

+    // TCP_NODELAY: disable Nagle's algorithm for low-latency P2P messaging.
+    // SO_KEEPALIVE: detect dead connections faster (important for Tor/I2P
+    // tunnels that can silently drop without RST/FIN).
+    {
+        int one = 1;
+#ifdef WIN32
+        setsockopt(hSocket, IPPROTO_TCP, TCP_NODELAY, (char*)&one, sizeof(one));
+#else
+        setsockopt(hSocket, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+#endif
+        setsockopt(hSocket, SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
+    }
+
    // this isn't even strictly necessary
    // CNode::ConnectNode immediately turns the socket back to non-blocking
    // but we'll turn it back to blocking just in case
@@ -560,6 +605,33 @@ bool ConnectSocketByName(CService &addr, SOCKET& hSocketRet, const char *pszDest

    SOCKET hSocket = INVALID_SOCKET;

+    // I2P routing: .b32.i2p destinations go through i2pd's SOCKS proxy, not
+    // the Tor name proxy. This is the key routing decision for dual-network
+    // anonymity — Tor handles .onion, i2pd handles .b32.i2p.
+    bool isI2PDest = (strDest.size() > 7 &&
+                      strDest.substr(strDest.size() - 7, 7) == ".b32.i2p");
+
+    if (isI2PDest) {
+        // Route through the I2P SOCKS proxy
+        proxyType i2pProxy;
+        if (GetProxy(NET_I2P, i2pProxy)) {
+            addr = CService("0.0.0.0:0");
+            printf("ConnectSocketByName(): routing .b32.i2p via I2P SOCKS proxy\n");
+            if (!ConnectSocketDirectly(i2pProxy.first, hSocket, nTimeout))
+                return false;
+            // i2pd's SOCKS proxy accepts .b32.i2p domain names via SOCKS5 ATYP=domain
+            if (!Socks5(strDest, port, hSocket)) {
+                printf("ConnectSocketByName(): I2P SOCKS5 handshake failed\n");
+                return false;
+            }
+            printf("ConnectSocketByName(): connected via I2P SOCKS5\n");
+            hSocketRet = hSocket;
+            return true;
+        }
+        // No I2P proxy configured — fall through to nameproxy (will likely fail)
+        printf("ConnectSocketByName(): WARNING - .b32.i2p dest but no I2P proxy set\n");
+    }
+
    proxyType nameproxy;
    GetNameProxy(nameproxy);

@@ -641,14 +713,26 @@ bool CNetAddr::SetSpecial(const std::string &strName)
        m_is_tor_v3 = false;
        return true;
    }
-    if (strName.size()>11 && strName.substr(strName.size() - 11, 11) == ".oc.b32.i2p") {
-        std::vector<unsigned char> vchAddr = DecodeBase32(strName.substr(0, strName.size() - 11).c_str());
-        if (vchAddr.size() != 16-sizeof(pchGarliCat))
-            return false;
-        memcpy(ip, pchOnionCat, sizeof(pchGarliCat));
-        for (unsigned int i=0; i<16-sizeof(pchGarliCat); i++)
-            ip[i + sizeof(pchGarliCat)] = vchAddr[i];
-        return true;
+    // Standard I2P b32 address: <52 base32 chars>.b32.i2p
+    // (SHA-256 hash of destination key, base32-encoded)
+    if (strName.size()>7 && strName.substr(strName.size() - 7, 7) == ".b32.i2p") {
+        std::string b32Part = strName.substr(0, strName.size() - 7);
+        std::vector<unsigned char> vchAddr = DecodeBase32(b32Part.c_str());
+        if (vchAddr.size() == 32) {
+            // Standard 32-byte I2P destination hash
+            memcpy(ip, pchGarliCat, sizeof(pchGarliCat));
+            // Store as many bytes as fit (16 - prefix_size)
+            for (unsigned int i = 0; i < 16 - sizeof(pchGarliCat) && i < vchAddr.size(); i++)
+                ip[i + sizeof(pchGarliCat)] = vchAddr[i];
+            return true;
+        }
+        // Also handle the legacy .oc.b32.i2p format (10 bytes)
+        if (vchAddr.size() == 16 - sizeof(pchGarliCat)) {
+            memcpy(ip, pchGarliCat, sizeof(pchGarliCat));
+            for (unsigned int i = 0; i < 16 - sizeof(pchGarliCat); i++)
+                ip[i + sizeof(pchGarliCat)] = vchAddr[i];
+            return true;
+        }
    }
    return false;
 }
@@ -879,7 +963,7 @@ std::string CNetAddr::ToStringIP() const
    if (IsTor())
        return EncodeBase32(&ip[6], 10) + ".onion";
    if (IsI2P())
-        return EncodeBase32(&ip[6], 10) + ".oc.b32.i2p";
+        return EncodeBase32(&ip[6], 10) + ".b32.i2p";
    CService serv(*this, 0);
 #ifdef USE_IPV6
    struct sockaddr_storage sockaddr;
@@ -1287,3 +1371,151 @@ void CService::SetPort(unsigned short portIn)
 {
    port = portIn;
 }
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// v5.9.22 hardening: pure helper functions for the HTTPS seed-list path.
+// See netbase.h for the contract. These are intentionally free of SSL/Tor
+// dependencies so they can be unit-tested in isolation.
+// ═══════════════════════════════════════════════════════════════════════════════
+
+bool IsValidSocksNegotiationTimeout(int nMs)
+{
+    // Range bounds match the documented -torconnecttimeout contract. 5000ms
+    // is the lower edge that still tolerates a slow SOCKS handshake over a
+    // congested link; 180000ms (3 min) is the upper edge to prevent a stuck
+    // thread from holding an outbound connection slot indefinitely. These
+    // constants are duplicated in src/init.cpp's HelpMessage text and the
+    // test suite — keep all three in sync.
+    return nMs >= 5000 && nMs <= 180000;
+}
+
+int DechunkTransferEncoding(const std::string& body, std::string& decoded)
+{
+    decoded.clear();
+    if (body.empty())
+        return DECHUNK_EMPTY;
+
+    // HTTP chunked framing requires every chunk-size line to be terminated
+    // by CRLF. We walk the body one chunk at a time and validate each piece.
+    // The previous implementation silently dropped malformed chunks and
+    // treated them as the last-chunk marker, which lost the entire seed list
+    // for any non-conforming server. This version returns an explicit error
+    // code for each failure mode.
+    size_t pos = 0;
+    const size_t n = body.size();
+    bool sawLastChunk = false;
+
+    while (pos < n) {
+        // Find end of chunk-size line. Required: CRLF.
+        size_t eol = body.find("\r\n", pos);
+        if (eol == std::string::npos)
+            return DECHUNK_NO_CHUNK_TERMINATOR;
+
+        std::string sizeLine = body.substr(pos, eol - pos);
+        pos = eol + 2; // consume CRLF
+
+        // Strip chunk extensions per RFC 7230 §4.1.1: ";name[=value]" after
+        // the hex size. Extensions are part of the framing protocol, not
+        // data, so we drop them here.
+        size_t semi = sizeLine.find(';');
+        std::string hexSize = (semi == std::string::npos) ? sizeLine : sizeLine.substr(0, semi);
+
+        // Strict hex validation: every character must be [0-9A-Fa-f]. Empty
+        // size lines (e.g. a stray CRLF) are rejected as malformed, not
+        // silently treated as 0. strtoul alone would also accept leading
+        // whitespace, '+', and '-' which we don't want.
+        if (hexSize.empty())
+            return DECHUNK_INVALID_HEX;
+        for (size_t i = 0; i < hexSize.size(); ++i) {
+            if (!isxdigit(static_cast<unsigned char>(hexSize[i])))
+                return DECHUNK_INVALID_HEX;
+        }
+
+        // strtoul returns ULONG_MAX on overflow. We also need to guard
+        // against chunks larger than the remaining input, which the old
+        // code clamped silently. Use strtoull so we can detect overflow
+        // without truncation surprises on 32-bit builds.
+        errno = 0;
+        char* endp = nullptr;
+        unsigned long long chunkSize = strtoull(hexSize.c_str(), &endp, 16);
+        if (errno == ERANGE || chunkSize > std::numeric_limits<size_t>::max())
+            return DECHUNK_INVALID_HEX;
+        if (endp == hexSize.c_str())
+            return DECHUNK_INVALID_HEX;
+
+        if (chunkSize == 0) {
+            // Last-chunk: payload is empty, trailer part (which we ignore)
+            // follows and is terminated by a final CRLF on its own line.
+            sawLastChunk = true;
+            break;
+        }
+
+        // Bounds check before reading the chunk data. Catching this
+        // explicitly (rather than clamping) is what lets callers
+        // distinguish "truncated network read" from "server sent us junk".
+        if (chunkSize > n - pos)
+            return DECHUNK_OVERSIZE_CHUNK;
+
+        decoded.append(body, pos, static_cast<size_t>(chunkSize));
+        pos += static_cast<size_t>(chunkSize);
+
+        // Per RFC 7230 each chunk's data must be followed by a CRLF. We
+        // tolerate the final chunk missing its trailing CRLF (some clients
+        // do this when the connection is being closed anyway), but for any
+        // non-final chunk a missing CRLF is a hard framing error.
+        if (pos + 1 < n && body[pos] == '\r' && body[pos + 1] == '\n') {
+            pos += 2;
+        } else if (pos >= n) {
+            // End of input immediately after chunk data — no CRLF, but
+            // nothing left to misframe. Reject to be strict.
+            return DECHUNK_MISSING_DATA_CRLF;
+        } else {
+            return DECHUNK_MISSING_DATA_CRLF;
+        }
+    }
+
+    if (!sawLastChunk) {
+        // Body ended without a last-chunk marker. Treat as malformed
+        // rather than accepting a truncated body.
+        return DECHUNK_NO_CHUNK_TERMINATOR;
+    }
+
+    return DECHUNK_OK;
+}
+
+std::vector<std::string> ParseSeedListBody(const std::string& body)
+{
+    std::vector<std::string> out;
+    std::istringstream lines(body);
+    std::string line;
+    while (std::getline(lines, line)) {
+        // Strip inline '#' comments. Per common seed-list convention, the
+        // first '#' to end-of-line is comment.
+        size_t hashPos = line.find('#');
+        if (hashPos != std::string::npos)
+            line = line.substr(0, hashPos);
+
+        // Split on whitespace, comma, or semicolon so multiple addresses
+        // on one line are all captured. CR/LF are already consumed by
+        // std::getline but a trailing CR (LF-only line endings) is trimmed
+        // implicitly by skipping it as a separator below.
+        size_t start = 0;
+        while (start <= line.size()) {
+            size_t sep = line.find_first_of(" \t,;", start);
+            std::string tok = (sep == std::string::npos)
+                ? line.substr(start)
+                : line.substr(start, sep - start);
+            // Trim CR and any leftover whitespace from the token. The
+            // 'sep' loop above eats spaces/tabs but a bare CR survives.
+            while (!tok.empty() && (tok.back() == '\r' || tok.back() == ' ' || tok.back() == '\t'))
+                tok.pop_back();
+            while (!tok.empty() && (tok.front() == ' ' || tok.front() == '\t'))
+                tok.erase(tok.begin());
+            if (!tok.empty())
+                out.push_back(tok);
+            if (sep == std::string::npos) break;
+            start = sep + 1;
+        }
+    }
+    return out;
+}
@@ -29,8 +29,78 @@ enum Network
 };

 extern int nConnectTimeout;
+extern int nSocksNegotiationTimeout;
 extern bool fNameLookup;

+// ═══════════════════════════════════════════════════════════════════════════════
+// v5.9.22 hardening: pure helper functions for the HTTPS seed-list path.
+// Extracted from net.cpp ThreadHTTPSeedFetch2 so they can be unit-tested
+// without the SSL/Tor network stack. All functions are side-effect free and
+// operate on std::string/std::vector<std::string> only.
+// ═══════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Result of dechunking an HTTP/1.1 chunked body. The daemon used to silently
+ * treat malformed framing as a zero-length chunk, which dropped the entire
+ * seed list. This enum lets the caller distinguish each failure mode and
+ * surface it in logs.
+ */
+enum DechunkResult {
+    DECHUNK_OK = 0,              // success
+    DECHUNK_EMPTY,               // body is empty
+    DECHUNK_NO_CHUNK_TERMINATOR, // missing CRLF after a chunk-size line
+    DECHUNK_INVALID_HEX,         // chunk-size line is not valid hex
+    DECHUNK_OVERSIZE_CHUNK,      // declared chunk size exceeds remaining input
+    DECHUNK_MISSING_DATA_CRLF,   // CRLF missing after a chunk's data
+};
+
+/**
+ * Decode an HTTP/1.1 Transfer-Encoding: chunked body.
+ *
+ *   chunked-body  = *chunk last-chunk trailer-part CRLF
+ *   chunk         = chunk-size [ chunk-ext ] CRLF chunk-data CRLF
+ *   chunk-size    = 1*HEXDIG
+ *   last-chunk    = 1*("0") [ chunk-ext ] CRLF
+ *   chunk-ext     = *( ";" chunk-ext-name [ "=" chunk-ext-val ] )
+ *
+ * @param[in]  body     the raw body bytes after the header terminator
+ * @param[out] decoded  the dechunked payload on success
+ * @return status code (DECHUNK_OK or one of the failure modes)
+ *
+ * The implementation is intentionally strict: a malformed hex digit, a
+ * missing CRLF, or a chunk whose declared size is larger than the remaining
+ * input all return an explicit error code rather than silently clamping.
+ * Chunk extensions ("a;foo=bar") are preserved (stripped from the size
+ * line) so legitimate servers that attach metadata to chunks are still
+ * accepted.
+ */
+int DechunkTransferEncoding(const std::string& body, std::string& decoded);
+
+/**
+ * Parse a tolerant HTTPS seed-list body into individual host entries.
+ *
+ * Accepted per line:
+ *   - one or more addresses separated by whitespace, commas, or semicolons
+ *   - inline "#" comments (everything after '#' is dropped)
+ *   - blank lines
+ *   - CRLF or LF line endings
+ *
+ * Each returned entry is the address string (e.g. "abcd...onion:24112" or
+ * "abcd...onion"). Empty/whitespace-only entries are omitted. The result is
+ * a list of candidate strings suitable for CNetAddr/CService validation
+ * downstream.
+ */
+std::vector<std::string> ParseSeedListBody(const std::string& body);
+
+/**
+ * Validate the -torconnecttimeout / nSocksNegotiationTimeout value.
+ *
+ * Accepts 5000..180000 ms inclusive. Returns true for in-range, false for
+ * out-of-range. This is the central policy so callers and tests stay in
+ * sync; do not duplicate the literal numbers elsewhere.
+ */
+bool IsValidSocksNegotiationTimeout(int nMs);
+
 /** IP address (IPv6, or IPv4 using mapped IPv6 range (::FFFF:0:0/96)) */
 class CNetAddr
 {
@@ -72,6 +72,18 @@ enum
    NODE_SNAPSHOT = (1 << 1), // peer can serve UTXO snapshot chunks
 };

+/** Inventory type constants for CInv.
+ *
+ *  MSG_TX and MSG_BLOCK are the legacy inventory types used for
+ *  transaction and block relay.  MSG_CMPCT_BLOCK (BIP152) signals
+ *  that the sender wants the block delivered as a compact block
+ *  instead of a full serialized block.
+ */
+enum
+{
+    MSG_CMPCT_BLOCK = 4,   // BIP152 compact block inventory type
+};
+
 /** A CService with information about it as peer */
 class CAddress : public CService
 {
@@ -1366,13 +1366,13 @@ QPushButton:hover {
        <property name="minimumSize">
         <size>
          <width>0</width>
-          <height>37</height>
+          <height>52</height>
         </size>
        </property>
        <property name="maximumSize">
         <size>
          <width>16777215</width>
-          <height>37</height>
+          <height>52</height>
         </size>
        </property>
        <property name="styleSheet">
@@ -1413,26 +1413,146 @@ QLabel {
          </spacer>
         </item>
         <item>
-          <widget class="QLabel" name="label_onion">
-           <property name="font">
-            <font>
-             <pointsize>8</pointsize>
-             <weight>75</weight>
-             <bold>true</bold>
-            </font>
-           </property>
-           <property name="cursor">
-            <cursorShape>PointingHandCursor</cursorShape>
-           </property>
-           <property name="toolTip">
-            <string>Click to copy .onion address</string>
-           </property>
-           <property name="text">
-            <string notr="true"/>
-           </property>
-           <property name="textInteractionFlags">
-            <set>Qt::NoTextInteraction</set>
-           </property>
+          <widget class="QWidget" name="wAddressStack" native="true">
+           <layout class="QVBoxLayout" name="verticalLayout_5">
+            <property name="leftMargin">
+             <number>0</number>
+            </property>
+            <property name="topMargin">
+             <number>0</number>
+            </property>
+            <property name="rightMargin">
+             <number>0</number>
+            </property>
+            <property name="bottomMargin">
+             <number>0</number>
+            </property>
+            <property name="spacing">
+             <number>0</number>
+            </property>
+            <item>
+             <widget class="QWidget" name="wI2PRow" native="true">
+              <layout class="QHBoxLayout" name="horizontalLayout_i2p">
+               <property name="leftMargin">
+                <number>0</number>
+               </property>
+               <property name="topMargin">
+                <number>0</number>
+               </property>
+               <property name="rightMargin">
+                <number>0</number>
+               </property>
+               <property name="bottomMargin">
+                <number>0</number>
+               </property>
+               <property name="spacing">
+                <number>4</number>
+               </property>
+               <item>
+                <widget class="QLabel" name="label_i2p_icon">
+                 <property name="font">
+                  <font>
+                   <pointsize>8</pointsize>
+                   <weight>75</weight>
+                   <bold>true</bold>
+                  </font>
+                 </property>
+                 <property name="toolTip">
+                  <string>I2P router status</string>
+                 </property>
+                 <property name="text">
+                  <string notr="true">[I2P]</string>
+                 </property>
+                </widget>
+               </item>
+               <item>
+                <widget class="QLabel" name="label_i2p">
+                 <property name="font">
+                  <font>
+                   <pointsize>8</pointsize>
+                   <weight>75</weight>
+                   <bold>true</bold>
+                  </font>
+                 </property>
+                 <property name="cursor">
+                  <cursorShape>PointingHandCursor</cursorShape>
+                 </property>
+                 <property name="toolTip">
+                  <string>Click to copy .b32.i2p address</string>
+                 </property>
+                 <property name="text">
+                  <string notr="true"/>
+                 </property>
+                 <property name="textInteractionFlags">
+                  <set>Qt::NoTextInteraction</set>
+                 </property>
+                </widget>
+               </item>
+              </layout>
+             </widget>
+            </item>
+            <item>
+             <widget class="QWidget" name="wTorRow" native="true">
+              <layout class="QHBoxLayout" name="horizontalLayout_tor">
+               <property name="leftMargin">
+                <number>0</number>
+               </property>
+               <property name="topMargin">
+                <number>0</number>
+               </property>
+               <property name="rightMargin">
+                <number>0</number>
+               </property>
+               <property name="bottomMargin">
+                <number>0</number>
+               </property>
+               <property name="spacing">
+                <number>4</number>
+               </property>
+               <item>
+                <widget class="QLabel" name="label_tor_icon">
+                 <property name="font">
+                  <font>
+                   <pointsize>8</pointsize>
+                   <weight>75</weight>
+                   <bold>true</bold>
+                  </font>
+                 </property>
+                 <property name="toolTip">
+                  <string>Tor V3 hidden service status</string>
+                 </property>
+                 <property name="text">
+                  <string notr="true">[Tor]</string>
+                 </property>
+                </widget>
+               </item>
+               <item>
+                <widget class="QLabel" name="label_onion">
+                 <property name="font">
+                  <font>
+                   <pointsize>8</pointsize>
+                   <weight>75</weight>
+                   <bold>true</bold>
+                  </font>
+                 </property>
+                 <property name="cursor">
+                  <cursorShape>PointingHandCursor</cursorShape>
+                 </property>
+                 <property name="toolTip">
+                  <string>Click to copy .onion address</string>
+                 </property>
+                 <property name="text">
+                  <string notr="true"/>
+                 </property>
+                 <property name="textInteractionFlags">
+                  <set>Qt::NoTextInteraction</set>
+                 </property>
+                </widget>
+               </item>
+              </layout>
+             </widget>
+            </item>
+           </layout>
          </widget>
         </item>
         <item>
@@ -815,7 +815,7 @@ QWidget#line	{
 	&lt;/style&gt;
 	&lt;/head&gt;
 	&lt;body&gt;
-	&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</string>
+	&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</string>
             </property>
             <property name="alignment">
              <set>Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter</set>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1416,7 +1416,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1444,7 +1444,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1421,7 +1421,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1449,7 +1449,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1412,7 +1412,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1440,7 +1440,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1412,7 +1412,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1440,7 +1440,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1429,7 +1429,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1457,7 +1457,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1421,7 +1421,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1449,7 +1449,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1421,7 +1421,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1449,7 +1449,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1414,7 +1414,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1442,7 +1442,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1427,7 +1427,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1455,7 +1455,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1417,7 +1417,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1445,7 +1445,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1417,7 +1417,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1445,7 +1445,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1417,7 +1417,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1445,7 +1445,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1416,7 +1416,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1444,7 +1444,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1418,7 +1418,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1446,7 +1446,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1412,7 +1412,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1440,7 +1440,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1426,7 +1426,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1454,7 +1454,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1413,7 +1413,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1441,7 +1441,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1427,7 +1427,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://triangles.technology&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://cryptographic-triangles.org/&quot;&gt; &amp;#187; TRI home&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
@@ -1455,7 +1455,7 @@ a:active { color:#f26522; text-decoration: underline; }
 &lt;/style&gt;
 &lt;/head&gt;
 &lt;body&gt;
-&lt;a href=&quot;http://explorer.triangles.technology&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
+&lt;a href=&quot;https://blocks.cryptographic-triangles.org&quot;&gt; &amp;#187; TRI block explorer&lt;/a&gt;&lt;/body&gt;</source>
        <translation type="unfinished"></translation>
    </message>
    <message>
--- a/Show More
+++ b/Show More