python: support DESTDIR in pip install step

Use --root $DESTDIR when the environment variable is set so that staged installs (e.g. 'make DESTDIR=/tmp/pkg install') place the Python package under the staging root. Also pass --no-build-isolation and --prefix to avoid rebuilding in an isolated venv and to honour CMAKE_INSTALL_PREFIX.
thread_pool: notify when task queue becomes empty
2026-11-08 20:37:23 +00:00 · 2026-05-25 13:40:55 -04:00 · 2026-05-21 10:17:08 -04:00 · 2026-05-21 10:17:08 -04:00 · 2026-05-18 10:50:23 -04:00 · 2026-05-18 10:36:48 -04:00
101 changed files with 4423 additions and 1786 deletions
@@ -12,7 +12,7 @@ env:
 on: [push, pull_request]

 jobs:
-    build-ubuntu-meson:
+  build-ubuntu-meson:
    name: Ubuntu/GCC Meson build
    runs-on: ubuntu-latest
    steps:
@@ -36,6 +36,9 @@ jobs:
  build-ubuntu-minimal:
    name: Ubuntu/GCC minimal build
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
    steps:
      - uses: actions/checkout@v6

@@ -50,6 +53,8 @@ jobs:
          mkdir build && cd build
          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
                   -DOPENDHT_C=Off -DBUILD_TESTING=On \
                   -DOPENDHT_PEER_DISCOVERY=Off -DOPENDHT_PYTHON=Off \
                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=Off -DOPENDHT_PROXY_CLIENT=Off
@@ -122,6 +127,9 @@ jobs:
  build-macos:
    name: macOS/Clang build
    runs-on: macos-15
+    strategy:
+      matrix:
+        cxx_standard: [17, 20, 23]
    steps:
      - uses: actions/checkout@v6

@@ -158,6 +166,8 @@ jobs:
          cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
                   -DOPENDHT_DOWNLOAD_DEPS=ON \
                   -DCMAKE_BUILD_TYPE=Debug \
+                   -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} \
+                   -DCMAKE_CXX_STANDARD_REQUIRED=ON \
                   -DOPENDHT_C=On -DBUILD_TESTING=On \
                   -DOPENDHT_PEER_DISCOVERY=On -DOPENDHT_PYTHON=Off \
                   -DOPENDHT_TOOLS=On -DOPENDHT_PROXY_SERVER=On \
@@ -23,11 +23,11 @@ jobs:

      # Run locally with: pipx run cibuildwheel --platform linux python
      - name: Build wheels
-        uses: pypa/cibuildwheel@v3.3.1
+        uses: pypa/cibuildwheel@v3.4.1
        with:
          package-dir: python

-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
        with:
          name: opendht-wheels-${{ matrix.os }}
          path: ./wheelhouse/*.whl
@@ -86,7 +86,7 @@ jobs:
          pipx run cibuildwheel python
        shell: pwsh

-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
        with:
          name: opendht-wheels-win_amd64
          path: ./build/wheelhouse/*.whl
@@ -95,7 +95,7 @@ jobs:
    runs-on: ubuntu-latest
    needs: [build_wheels, build_wheels_windows]
    steps:
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
      with:
        pattern: opendht-wheels-*
        path: dist
@@ -28,13 +28,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -42,12 +42,12 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDeps
@@ -69,13 +69,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -83,13 +83,13 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
@@ -110,13 +110,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -124,12 +124,12 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DEPS_LLVM }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDepsLlvm
@@ -151,13 +151,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -165,13 +165,13 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LLVM }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileLlvm
@@ -193,13 +193,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -207,13 +207,13 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_DHTNODE }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDhtnode
@@ -234,13 +234,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -248,13 +248,13 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE_DEPS }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileDepsAlpine
@@ -276,13 +276,13 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -290,13 +290,13 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_ALPINE }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/DockerfileAlpine
@@ -324,7 +324,7 @@ jobs:
          submodules: recursive

      - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
      
      - name: Install WIX using .net tools
        run: |
@@ -403,7 +403,7 @@ jobs:
          }

      - name: Upload MSI Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-msi
          path: build/${{ steps.cpack_msi.outputs.msi_path }} # Path to the MSI in the build directory
@@ -428,7 +428,7 @@ jobs:
          submodules: recursive

      - name: Set up MSVC developer environment
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

      - name: Cache vcpkg static installed packages
        id: cache-vcpkg-static
@@ -483,7 +483,7 @@ jobs:
          cmake --build build_static --config Release --parallel $([System.Environment]::ProcessorCount)

      - name: Upload Static dhtnode Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-dhtnode
          path: |
@@ -502,20 +502,20 @@ jobs:
        uses: actions/checkout@v6

      - name: Download Windows MSI artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
        with:
          name: opendht-windows-msi
          path: downloaded_artifacts/windows_msi

      - name: Download Static dhtnode artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
        with:
          name: opendht-windows-dhtnode
          path: downloaded_artifacts/static_dhtnode

      - name: Create Release
        id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          draft: true
          files: |
@@ -9,7 +9,7 @@ on:
    branches: [ main, master ]

 env:
-  VCPKG_VERSION: "2025.07.25"
+  VCPKG_VERSION: "2026.01.16"
  VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
  VCPKG_DISABLE_METRICS: "1"
  VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
@@ -30,7 +30,7 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

      - name: Generate Cache Key
        id: generate_cache_key
@@ -78,7 +78,7 @@ jobs:
        uses: actions/checkout@v6

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

      - name: Generate Cache Key for Static Libs
        id: generate_static_cache_key
@@ -121,13 +121,14 @@ jobs:
      matrix:
        build_type: [Debug, Release]
        arch: [x64]
+        cxx_standard: [17, 20, 23]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

      - name: Restore vcpkg installed packages
        id: cache-vcpkg-restore
@@ -152,6 +153,8 @@ jobs:
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
            -DBUILD_TESTING=ON `
            -DOPENDHT_PROXY_CLIENT=ON `
            -DOPENDHT_PROXY_SERVER=ON `
@@ -178,9 +181,9 @@ jobs:

      - name: Upload build artifacts
        if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
-          name: opendht-windows-${{ matrix.arch }}-${{ matrix.build_type }}
+          name: opendht-windows-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
          path: |
            build/**/*.exe
            build/**/*.dll
@@ -195,13 +198,14 @@ jobs:
      matrix:
        build_type: [Release]
        arch: [x64]
+        cxx_standard: [17, 20, 23]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3

      - name: Restore vcpkg static installed packages
        id: cache-vcpkg-static-restore
@@ -226,6 +230,8 @@ jobs:
            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
            -DVCPKG_MANIFEST_FEATURES=test `
            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
+            -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
+            -DCMAKE_CXX_STANDARD_REQUIRED=ON `
            -DBUILD_SHARED_LIBS=OFF `
            -DBUILD_TESTING=ON `
            -DOPENDHT_PROXY_CLIENT=ON `
@@ -250,9 +256,9 @@ jobs:
          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4

      - name: Upload static build artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
-          name: opendht-windows-static-${{ matrix.arch }}-${{ matrix.build_type }}
+          name: opendht-windows-static-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
          path: |
            build/**/*.exe
            build/**/*.lib
@@ -369,7 +375,7 @@ jobs:

      - name: Upload MinGW artifacts
        if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: opendht-windows-mingw-${{ matrix.build_type }}
          path: |
@@ -0,0 +1,74 @@
+# OpenDHT – Agent Instructions
+
+## Build
+
+### Primary: CMake (C++17)
+```sh
+mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON -GNinja
+ninja
+```
+
+### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
+### Alternative: Meson (C++20)
+```sh
+meson setup build . && cd build && ninja
+```
+
+### Run tests
+```sh
+# Full suite
+ctest --output-on-failure --test-dir build
+
+# Single test executable
+./build/test_testName
+```
+
+## dhtnode
+
+The `dhtnode` CLI tool is a simple DHT node implementation using `DhtRunner`.
+
+---
+
+## Commit
+
+After implementing a feature or fixing a bug, commit your changes in clean, atomic commits with descriptive messages with format:
+`topic: short description`
+
+If any test are added or modified, commit them separately before the fix (if any).
+
+---
+
+## Architecture
+
+OpenDHT is a Kademlia-based DHT library. The implementation is layered:
+
+```
+DhtRunner          (public API — thread-safe, manages lifecycle & I/O threads)
+  └── SecureDht    (GnuTLS crypto: signing, encryption, identity)
+        └── Dht    (core DHT logic: routing, storage, find/get/put operations)
+              └── NetworkEngine   (raw UDP sockets, message parsing, IPv4/IPv6)
+```
+
+- **`DhtRunner`** (`include/opendht/dhtrunner.h`, `src/dhtrunner.cpp`) — entry point for all users of the library. Wraps everything in a thread-pool and exposes async callbacks as well as blocking calls.
+- **`Dht`** (`include/opendht/dht.h`, `src/dht.cpp`) — Kademlia protocol: routing table, k-buckets, value replication, expiry.
+- **`SecureDht`** (`include/opendht/securedht.h`, `src/securedht.cpp`) — transparent encryption/signing layer on top of `Dht`. Identity is a GnuTLS certificate.
+- **`NetworkEngine`** (`include/opendht/network_engine.h`, `src/network_engine.cpp`) — UDP socket layer, serializes/deserializes msgpack messages.
+- **`RoutingTable`** (`include/opendht/routing_table.h`, `src/routing_table.cpp`) — Kademlia routing table with bucket splitting.
+- **`Value`** (`include/opendht/value.h`) — the storable unit: binary blob, optional signature, optional encryption; typed via `ValueType`.
+- **`InfoHash`** (`include/opendht/infohash.h`) — 20-byte SHA-1 identifier; alias `Hash<HASH_LEN>`.
+
+Optional components (`DhtProxyServer`, `DhtProxyClient`, `PeerDiscovery`) are compiled in only when the corresponding CMake options are enabled.
+
+---
@@ -21,11 +21,11 @@ Optionally, install RESTinio to enable the OpenDHT proxy client and server:
 mkdir /usr/include/nonstd
 wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp

-wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2
-tar -xjf restinio-0.7.3.tar.bz2
-cd restinio-0.7.3/dev
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
 cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
-make -j2 && make install
+make && make install
 ```

 To run openDHT on a different computer from the build computer, the following runtime dependencies are required:
@@ -48,11 +48,11 @@ Optionally, install RESTinio to enable the OpenDHT proxy client and server:
 mkdir /usr/include/nonstd
 wget https://raw.githubusercontent.com/martinmoene/expected-lite/master/include/nonstd/expected.hpp -O /usr/include/nonstd/expected.hpp

-wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.3/restinio-0.7.3.tar.bz2
-tar -xjf restinio-0.7.3.tar.bz2
-cd restinio-0.7.3/dev
+wget https://github.com/Stiffstream/restinio/releases/download/v.0.7.9/restinio-0.7.9.tar.bz2
+tar -xjf restinio-0.7.9.tar.bz2
+cd restinio-0.7.9/dev
 cmake -DCMAKE_INSTALL_PREFIX=/usr -DRESTINIO_TEST=Off -DRESTINIO_SAMPLE=Off -DRESTINIO_BENCHMARK=Off -DRESTINIO_WITH_SOBJECTIZER=Off -DRESTINIO_DEP_STANDALONE_ASIO=system -DRESTINIO_DEP_LLHTTP=system -DRESTINIO_DEP_FMT=system -DRESTINIO_DEP_EXPECTED_LITE=system .
-make -j2 && make install
+make && make install
 ```

 ### Fedora
@@ -67,7 +67,7 @@ sudo dnf install python3-Cython python3-devel redhat-rpm-config
 ### macOS

 ```sh
-brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt
+brew install gnutls msgpack-cxx argon2 asio readline jsoncpp fmt llhttp
 ```

 ## Build
@@ -81,7 +81,7 @@ git clone https://github.com/savoirfairelinux/opendht.git
 # Build and install
 cd opendht
 mkdir build && cd build
-cmake -DCMAKE_INSTALL_PREFIX=/usr ..
+cmake ..
 make -j$(nproc)
 sudo make install
 ```
@@ -100,10 +100,21 @@ cmake -DOPENDHT_PYTHON=ON \
      -DOPENDHT_PROXY_SERVER=ON \
      -DOPENDHT_PROXY_SERVER_IDENTITY=ON \
      -DOPENDHT_PROXY_CLIENT=ON \
-      -DOPENDHT_PUSH_NOTIFICATIONS=ON \
-      -DCMAKE_INSTALL_PREFIX=/usr ..
+      -DOPENDHT_PUSH_NOTIFICATIONS=ON ..
 ```

+#### Common CMake options
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `OPENDHT_TOOLS` | ON | CLI tools (dhtnode, dhtchat, …) |
+| `OPENDHT_C` | OFF | C language bindings |
+| `OPENDHT_PYTHON` | OFF | Python 3 Cython bindings |
+| `OPENDHT_PROXY_SERVER` | OFF | REST API proxy server (requires RESTinio + llhttp) |
+| `OPENDHT_PROXY_CLIENT` | OFF | REST API proxy client |
+| `OPENDHT_PEER_DISCOVERY` | OFF | Multicast local peer discovery |
+| `OPENDHT_PUSH_NOTIFICATIONS` | OFF | Push notification support |
+| `OPENDHT_SANITIZE` | OFF | AddressSanitizer + stack protector |
+
 ## Windows/MSVC

 Building on Windows with MSVC is supported with VCPKG and CMake.
@@ -1,4 +1,4 @@
-cmake_minimum_required (VERSION 3.21..3.31)
+cmake_minimum_required (VERSION 3.21...3.31)
 if(POLICY CMP0091)
    cmake_policy(SET CMP0091 NEW)
 endif()
@@ -9,8 +9,8 @@ if(POLICY CMP0167)
    cmake_policy(SET CMP0167 NEW)
 endif()

-set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 7.0)
+set (opendht_VERSION_MAJOR 4)
+set (opendht_VERSION_MINOR 0.0)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -130,15 +130,16 @@ if (NOT MSVC)
                message(STATUS "simdutf not found with pkgconfig")
                if (OPENDHT_DOWNLOAD_DEPS)
                    message(STATUS "Fallback mode specified, downloading simdutf")
+                    set(SIMDUTF_CXX_STANDARD ${CMAKE_CXX_STANDARD} CACHE INTERNAL "C++ standard for simdutf downloader")
                    set(SIMDUTF_TESTS OFF CACHE INTERNAL "Disable tests for simdutf downloader")
                    set(SIMDUTF_TOOLS OFF CACHE INTERNAL "Disable tools for simdutf downloader")
-                    set(SIMDUTF_CXX_STANDARD 17 CACHE INTERNAL "Set C++ standard for simdutf downloader")
                    FetchContent_Declare(simdutf
                        GIT_REPOSITORY "https://github.com/simdutf/simdutf.git"
-                        GIT_TAG "v7.5.0"
+                        GIT_TAG "v8.0.0"
                    )
                    FetchContent_MakeAvailable(simdutf)
                    set(SIMDUTF_LIBRARIES simdutf::simdutf)
+                    set(simdutf_lib ", simdutf")
                else()
                    message(SEND_ERROR "simdutf not found and the fallback downloader is not set! Install simdutf or use OPENDHT_DOWNLOAD_DEPS option")
                endif()
@@ -416,7 +417,7 @@ else ()
                    -DSTATIC_GETOPT)
    set(DISABLE_MSC_WARNINGS "/wd4101 /wd4244 /wd4267 /wd4273 /wd4804 /wd4834 /wd4996")
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${DISABLE_MSC_WARNINGS}")
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP /bigobj /utf-8 /EHsc")
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /MP /bigobj /utf-8 /EHsc /Zc:__cplusplus")
 endif ()
 set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DMSGPACK_NO_BOOST -DMSGPACK_DISABLE_LEGACY_NIL -DMSGPACK_DISABLE_LEGACY_CONVERT")

@@ -853,30 +854,42 @@ if (BUILD_TESTING)
    endif()
    # unit testing
    list (APPEND test_FILES
-        tests/infohashtester.h
-        tests/infohashtester.cpp
-        tests/valuetester.h
-        tests/valuetester.cpp
-        tests/cryptotester.h
-        tests/cryptotester.cpp
-        tests/dhtrunnertester.h
-        tests/dhtrunnertester.cpp
-        tests/threadpooltester.h
-        tests/threadpooltester.cpp
+        tests/test_infohash.h
+        tests/test_infohash.cpp
+        tests/test_value.h
+        tests/test_value.cpp
+        tests/test_crypto.h
+        tests/test_crypto.cpp
+        tests/test_dhtrunner.h
+        tests/test_dhtrunner.cpp
+        tests/test_storage.h
+        tests/test_storage.cpp
+        tests/test_threadpool.h
+        tests/test_threadpool.cpp
+        tests/test_parsedmessage.h
+        tests/test_parsedmessage.cpp
+        tests/test_networkengine.h
+        tests/test_networkengine.cpp
    )
+    if (OPENDHT_PROXY_CLIENT)
+        list (APPEND test_FILES
+            tests/test_dhtproxy_client.h
+            tests/test_dhtproxy_client.cpp
+        )
+    endif()
    if (OPENDHT_TESTS_NETWORK)
        if (OPENDHT_PROXY_SERVER AND OPENDHT_PROXY_CLIENT)
            list (APPEND test_FILES
-                tests/httptester.h
-                tests/httptester.cpp
-                tests/dhtproxytester.h
-                tests/dhtproxytester.cpp
+                tests/test_http.h
+                tests/test_http.cpp
+                tests/test_dhtproxy.h
+                tests/test_dhtproxy.cpp
            )
        endif()
        if (OPENDHT_PEER_DISCOVERY)
            list (APPEND test_FILES
-                tests/peerdiscoverytester.h
-                tests/peerdiscoverytester.cpp
+                tests/test_peerdiscovery.h
+                tests/test_peerdiscovery.cpp
            )
        endif()
    endif()
@@ -884,7 +897,7 @@ if (BUILD_TESTING)
    # We keep using the common tests_runner.cpp (CppUnit registry based) and compile it with each test file.
    foreach(test_src ${test_FILES})
        if (test_src MATCHES ".*\\.cpp$")
-            get_filename_component(test_name ${test_src} NAME_WE) # e.g. infohashtester
+            get_filename_component(test_name ${test_src} NAME_WE) # e.g. test_infohash
            set(target_name ${test_name})
            add_executable(${target_name}
                tests/tests_runner.cpp
@@ -140,20 +140,22 @@ asyncio.run(dht_async_demo("unique_key"))
 ```

 ## Dependencies
+Core dependencies:
 - msgpack-c 1.2+, used for data serialization.
 - GnuTLS 3.3+, used for cryptographic operations.
 - Nettle 2.4+, a GnuTLS dependency for crypto.
 - {fmt} 9.0+, for log formatting.
- (optional) restinio used for the REST API.
- (optional) llhttp used for the REST API.
- (optional) jsoncpp 1.7.4-3+, used for the REST API.
+
+Optional dependencies for the REST API (DHT proxy client/server):
+- (optional) restinio
+- (optional) llhttp
+- (optional) jsoncpp 1.7.4-3+
+- (optional) simdutf
+
+Build environment:
 - Build tested with GCC 9+ (GNU/Linux, Windows with MinGW), Clang/LLVM (GNU/Linux, Android, macOS, iOS).
 - Build tested with Microsoft Visual Studio 2019, 2022

-## Contact
-
-IRC: join us on Libera.chat at [`#opendht`](https://web.libera.chat/#opendht).
-
 ## License
 Copyright (c) 2014-2026 Savoir-faire Linux Inc.

@@ -1,15 +0,0 @@
-lib_LTLIBRARIES = libopendht-c.la
-noinst_HEADERS = opendht_c.h
-
-AM_CPPFLAGS = -DOPENDHT_C_BUILD -isystem @top_srcdir@/include @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@
-if OPENDHT_SHARED
-AM_CPPFLAGS += -Dopendht_c_EXPORTS
-endif
-
-libopendht_c_la_LIBADD = $(LIBOBJS) ../src/.libs/libopendht.la
-
-libopendht_c_la_SOURCES  = \
-        opendht.cpp
-
-nobase_include_HEADERS = \
-        opendht_c.h
@@ -600,7 +600,7 @@ dht_runner_put_signed(
 void
 dht_runner_put_encrypted(dht_runner* r,
                         const dht_infohash* h,
-                         const dht_infohash* to,
+                         const dht_pkid* to,
                         const dht_value* v,
                         dht_done_cb done_cb,
                         void* cb_user_data,
@@ -608,7 +608,7 @@ dht_runner_put_encrypted(dht_runner* r,
 {
    auto runner = reinterpret_cast<dht::DhtRunner*>(r);
    auto hash = reinterpret_cast<const dht::InfoHash*>(h);
-    auto toHash = reinterpret_cast<const dht::InfoHash*>(to);
+    auto toHash = reinterpret_cast<const dht::PkId*>(to);
    auto value = reinterpret_cast<const ValueSp*>(v);
    runner->putEncrypted(
        *hash,
@@ -195,7 +195,7 @@ OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
                                            bool permanent);
 OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
                                               const dht_infohash* hash,
-                                               const dht_infohash* to,
+                                               const dht_pkid* to,
                                               const dht_value* value,
                                               dht_done_cb done_cb,
                                               void* cb_user_data,
@@ -1,16 +0,0 @@
-dist_man1_MANS = dhtnode.1
-
-noinst_HEADERS = \
-	Doxyfile
-
-if HAVE_DOXYGEN
-doxyfile.stamp: Doxyfile
-	$(DOXYGEN) Doxyfile
-	echo stamp > doxyfile.stamp
-
-CLEANFILES = doxyfile.stamp
-
-all-local: doxyfile.stamp
-clean-local:
-	rm -rf $(top_srcdir)/doc/man $(top_srcdir)/doc/html
-endif
@@ -1,102 +1,193 @@
-.TH DHTNODE 1 2019-06-08
+.TH DHTNODE 1 2026-04-18
 .SH NAME
 .B dhtnode
 - a simple OpenDHT command line node runner.
 .SH SYNOPSIS
 .B dhtnode
 [\fB\-h\fR]
+[\fB\-V\fR]
 [\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
-[\fB\-i\fR [\fB\-\-save\-identity\fR \fIfile\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
 [\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
 [\fB\-n\fR \fInetwork_id\fR]
 [\fB\-p\fR \fIlocal_port\fR]
 [\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
-[\fB\-\-certificate\fR \fIfile\fR]
-[\fB\-\-privkey\fR \fIfile\fR]
-[\fB\-\-privkey\-password\fR \fIpassword\fR]
-[\fB\-\-proxyserver\fR \fIport\fR]
-[\fB\-\-proxyclient\fR \fIserver\fR]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
 .SH DESCRIPTION
-Runs an OpenDHT node, with a CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
 Commands available in the interactive shell are:
 .EX
    h, help    Print this help message.
-    q, quit    Quit the program.
+    x, quit    Quit the program.
    log        Start/stop printing DHT logs.

    Node information:
    ll         Print basic information and stats about the current node.
-    ls         Print basic information about current searches.
-    ld         Print basic information about currenty stored values on this node.
-    lr         Print the full current routing table of this node
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.

    Operations on the DHT:
-    b ip:port             Ping potential node at given IP address/port.
-    g [key]               Get values at [key].
-    l [key]               Listen for value changes at [key].
-    p [key] [str]         Put string value at [key].
-    s [key] [str]         Put string value at [key], signed with our generated
-                          private key.
-    e [key] [dest] [str]  Put string value at [key], encrypted for [dest] with
-                          its public key (if found).
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
 .EE
 .SH OPTIONS
 .TP
-\fB\-h\fP
-Prints some help.
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
 .TP
-\fB\-v\fP
-Enable the verbose mode (log to stdout/stderr by default)
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
 .TP
-\fB\-l\fP \fIlog_file\fP
-Write log to file instead of stdout/stderr
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
 .TP
-\fB\-L\fP
-Write log to syslog instead of stdout/stderr
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
 .TP
-\fB\-i\fP
-Generate cryptographic identity for the node.
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
 .TP
-\fB\-\-save\-identity\fP \fIfile\fP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
 Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
 .TP
-\fB\-\-certificate\fP \fIfile\fP
-Load identity certificate from given file.
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
 .TP
-\fB\-\-privkey\fP \fIfile\fP
-Load identity private key from given file.
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
 .TP
-\fB\-\-privkey\-password\fP \fIpassword\fP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
 Password to use for private key encryption or decryption (optional).
 .TP
-\fB\-d\fP
-Run the program in daemon mode (will fork in the background).
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
 .TP
-\fB\-s\fP
+\fB\-s\fP, \fB\-\-service\fP
 Run the program in service mode (non\-forking daemon).
 .TP
-\fB\-D\fP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
 Enables multicast automatic local peer discovery.
 .TP
-\fB\-f\fP \fIfile\fP
-Specify a file path to persist/load the node state.
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
 .TP
-\fB\-n\fP \fInetwork_id\fP
-Specify the network id. This let you connect to distinct networks and prevents
-the merge of two different networks (available since OpenDHT v0.6.1).
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
 .TP
-\fB\-p\fP \fIlocal_port\fP
-Use UDP port \fIlocal_port\fP for the program to bind to.
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
 .TP
-\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP]
-The program needs to be given a node to connect to the network. You use this
-option to provide the ip address of that node.
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
 .TP
-\fB\-\-proxyserver\fP \fIlocal_port\fP
-Run a proxy server bound to this DHT node on HTTP port \fIlocal_port\fP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
 .TP
-\fB\-\-proxyclient\fP \fIserver\fP
-Run this DHT node in proxy client mode, and connect to \fIserver\fP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
 .SH AUTHORS
 .TP
 Program written by
@@ -23,15 +23,15 @@ struct Node;
 */
 enum class NodeStatus {
    Disconnected, // 0 nodes
-    Connecting,   // 1+ nodes
+    Connecting,   // bootstrap pending or 1+ nodes
    Connected     // 1+ good nodes
 };

-inline constexpr const char*
+inline constexpr std::string_view
 statusToStr(NodeStatus status)
 {
-    return status == NodeStatus::Connected ? "connected"
-                                           : (status == NodeStatus::Connecting ? "connecting" : "disconnected");
+    return status == NodeStatus::Connected ? "connected"sv
+                                           : (status == NodeStatus::Connecting ? "connecting"sv : "disconnected"sv);
 }

 struct OPENDHT_PUBLIC NodeStats
@@ -65,6 +65,8 @@ struct OPENDHT_PUBLIC NodeInfo
    size_t ongoing_ops {0};
    size_t storage_values {0};
    size_t storage_size {0};
+    size_t local_storage_values {0};
+    size_t local_storage_size {0};
    in_port_t bound4 {0};
    in_port_t bound6 {0};

@@ -77,7 +79,17 @@ struct OPENDHT_PUBLIC NodeInfo
    explicit NodeInfo(const Json::Value& v);
 #endif

-    MSGPACK_DEFINE_MAP(id, node_id, ipv4, ipv6)
+    MSGPACK_DEFINE_MAP(id,
+                       node_id,
+                       ipv4,
+                       ipv6,
+                       ongoing_ops,
+                       storage_values,
+                       storage_size,
+                       local_storage_values,
+                       local_storage_size,
+                       bound4,
+                       bound6)
 };

 /**
@@ -113,9 +125,12 @@ struct OPENDHT_PUBLIC Config
    /* If non-0, overrides the default maximum number of searches. -1 means no limit.  */
    ssize_t max_searches {0};

-    /* If non-0, overrides the default maximum store size. -1 means no limit.  */
+    /* If non-0, overrides the default maximum store size for remote values. -1 means no limit.  */
    ssize_t max_store_size {0};

+    /* If non-0, overrides the default maximum store size for locally stored values. -1 means no limit.  */
+    ssize_t max_local_store_size {0};
+
    /* If non-0, overrides the default maximum store key count. -1 means no limit.  */
    ssize_t max_store_keys {0};

@@ -159,7 +174,8 @@ enum class OPENDHT_PUBLIC PushNotificationResult : uint8_t {
    Error
 };

-static constexpr size_t DEFAULT_STORAGE_LIMIT {1024 * 1024 * 64};
+static constexpr size_t STORAGE_LIMIT_DEFAULT {1024 * 1024 * 64};
+static constexpr size_t STORAGE_LIMIT_UNLIMITED {(size_t) -1};

 using ValuesExport = std::pair<InfoHash, Blob>;

@@ -171,8 +187,6 @@ using ShutdownCallback = std::function<void()>;
 using IdentityAnnouncedCb = std::function<void(bool)>;
 using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;

-using CertificateStoreQueryLegacy
-    = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;

 using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;
@@ -214,7 +214,7 @@ private:
    PrivateKey& operator=(const PrivateKey&) = delete;
    Blob decryptBloc(const uint8_t* src, size_t src_size) const;

-    mutable std::mutex publicKeyMutex_ {};
+    mutable std::mutex publicKeyMutex_;
    mutable std::shared_ptr<PublicKey> publicKey_ {};
 };

@@ -685,7 +685,7 @@ private:

    std::set<std::shared_ptr<RevocationList>, crlNumberCmp> revocation_lists;

-    mutable std::mutex publicKeyMutex_ {};
+    mutable std::mutex publicKeyMutex_;
    mutable std::shared_ptr<PublicKey> publicKey_ {};
 };

@@ -296,17 +296,28 @@ public:
    }

    /**
-     * Set the in-memory storage limit in bytes
+     * Set the in-memory storage limit in bytes for remote values
     */
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) override { max_store_size = limit; }
+    void setStorageLimit(size_t limit = 0) override { max_store_size = limit == 0 ? STORAGE_LIMIT_DEFAULT : limit; }
    size_t getStorageLimit() const override { return max_store_size; }

+    /**
+     * Set the in-memory storage limit in bytes for locally stored values
+     */
+    void setLocalStorageLimit(size_t limit = 0) override
+    {
+        max_local_store_size = limit == 0 ? STORAGE_LIMIT_UNLIMITED : limit;
+    }
+    size_t getLocalStorageLimit() const override { return max_local_store_size; }
+
    /**
     * Returns the total memory usage of stored values and the number
     * of stored values.
     */
    std::pair<size_t, size_t> getStoreSize() const override { return {total_store_size, total_values}; }

+    std::pair<size_t, size_t> getLocalStoreSize() const override;
+
    std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) override;

    PushNotificationResult pushNotificationReceived(const std::map<std::string, std::string>&) override
@@ -400,13 +411,16 @@ private:
    std::vector<std::pair<std::string, std::string>> bootstrap_nodes {};
    std::chrono::steady_clock::duration bootstrap_period {BOOTSTRAP_PERIOD};
    Sp<Scheduler::Job> bootstrapJob {};
+    bool bootstrap_pending {false};

    std::map<InfoHash, Storage> store;
    std::map<SockAddr, StorageBucket, SockAddr::ipCmp> store_quota;
+    std::unique_ptr<StorageBucket> local_store_quota;
    size_t total_values {0};
    size_t total_store_size {0};
    size_t max_store_keys {MAX_HASHES};
-    size_t max_store_size {DEFAULT_STORAGE_LIMIT};
+    size_t max_store_size {STORAGE_LIMIT_DEFAULT};
+    size_t max_local_store_size {STORAGE_LIMIT_UNLIMITED};

    size_t max_searches {MAX_SEARCHES};
    size_t search_id {0};
@@ -451,7 +465,8 @@ private:
                      const Sp<Value>& value,
                      time_point created,
                      const SockAddr& sa = {},
-                      bool permanent = false);
+                      bool permanent = false,
+                      time_point expiration = time_point::min());
    bool storageRefresh(const InfoHash& id, Value::Id vid);
    void expireStore();
    void expireStorage(InfoHash h);
@@ -613,7 +628,7 @@ private:
    /* when we receive a listen request */
    net::RequestAnswer onListen(
        Sp<Node> node, const InfoHash& hash, const Blob& token, size_t socket_id, const Query& query, int version = 0);
-    void onListenDone(const Sp<Node>& status, net::RequestAnswer& a, Sp<Search>& sr);
+    void onListenDone(const Sp<Node>& node, net::RequestAnswer& a, Sp<Search>& sr);
    /* when we receive an announce request */
    net::RequestAnswer onAnnounce(Sp<Node> node,
                                  const InfoHash& hash,
@@ -18,9 +18,6 @@ class OPENDHT_PUBLIC DhtInterface
 {
 public:
    DhtInterface() = default;
-    DhtInterface(const Logger& l)
-        : logger_(std::make_shared<Logger>(l))
-    {}
    DhtInterface(const std::shared_ptr<Logger>& l)
        : logger_(l)
    {}
@@ -221,17 +218,25 @@ public:
    virtual std::vector<unsigned> getNodeMessageStats(bool in = false) = 0;

    /**
-     * Set the in-memory storage limit in bytes
+     * Set the in-memory storage limit in bytes for remote values
     */
-    virtual void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) = 0;
+    virtual void setStorageLimit(size_t limit = 0) = 0;
    virtual size_t getStorageLimit() const = 0;

+    /**
+     * Set the in-memory storage limit in bytes for locally stored values
+     */
+    virtual void setLocalStorageLimit(size_t limit = 0) = 0;
+    virtual size_t getLocalStorageLimit() const = 0;
+
    /**
     * Returns the total memory usage of stored values and the number
     * of stored values.
     */
    virtual std::pair<size_t, size_t> getStoreSize() const = 0;

+    virtual std::pair<size_t, size_t> getLocalStoreSize() const = 0;
+
    virtual std::vector<SockAddr> getPublicAddress(sa_family_t family = 0) = 0;

    virtual void setLogger(const std::shared_ptr<Logger>& l) { logger_ = l; }
@@ -276,6 +276,7 @@ public:
    void insertNode(const InfoHash&, const SockAddr&) override {}
    void insertNode(const NodeExport&) override {}
    std::pair<size_t, size_t> getStoreSize() const override { return {}; }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return {}; }
    std::vector<NodeExport> exportNodes() const override { return {}; }
    std::vector<ValuesExport> exportValues() const override { return {}; }
    void importValues(const std::vector<ValuesExport>&) override {}
@@ -288,6 +289,8 @@ public:
    std::vector<unsigned> getNodeMessageStats(bool) override { return {}; }
    void setStorageLimit(size_t) override {}
    virtual size_t getStorageLimit() const override { return 0; }
+    void setLocalStorageLimit(size_t) override {}
+    virtual size_t getLocalStorageLimit() const override { return STORAGE_LIMIT_UNLIMITED; }
    void connectivityChanged(sa_family_t) override { getProxyInfos(); }
    void connectivityChanged() override
    {
@@ -425,7 +425,7 @@ private:
                p.pack(clientId);
            }
            if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                std::lock_guard l(sessionCtx->lock);
                p.pack("sid");
                p.pack(sessionCtx->sessionId);
            }
@@ -478,7 +478,7 @@ private:
            p.pack("exp");
            p.pack(to_time_t(expiration));
            if (sessionCtx) {
-                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                std::lock_guard l(sessionCtx->lock);
                p.pack("sid");
                p.pack(sessionCtx->sessionId);
            }
@@ -61,8 +61,7 @@ public:
        std::unique_ptr<net::DatagramSocket> sock;
        std::shared_ptr<PeerDiscovery> peerDiscovery {};
        StatusCallback statusChangedCallback {};
-        CertificateStoreQueryLegacy certificateStore {};
-        CertificateStoreQuery certificateStorePkId {};
+        CertificateStoreQuery certificateStore {};
        IdentityAnnouncedCb identityAnnouncedCb {};
        PublicAddressChangedCb publicAddressChangedCb {};
        std::unique_ptr<std::mt19937_64> rng {};
@@ -286,21 +285,6 @@ public:
    }
    void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);

-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
-    }
-
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
-    }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      std::shared_ptr<Value> value,
@@ -315,13 +299,11 @@ public:
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }

-    [[deprecated("Use the shared_ptr version instead")]]
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      Value&& value,
                      DoneCallback cb = {},
                      bool permanent = false);
-    [[deprecated("Use the shared_ptr version instead")]]
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      Value&& value,
@@ -338,6 +320,14 @@ public:
    {
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }

    /**
     * Insert known nodes to the routing table, without necessarly ping them.
@@ -406,15 +396,17 @@ public:

    std::pair<size_t, size_t> getStoreSize() const;

-    void getStorageLimit() const;
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT);
+    size_t getStorageLimit() const;
+    void setStorageLimit(size_t limit = 0);
+
+    size_t getLocalStorageLimit() const;
+    void setLocalStorageLimit(size_t limit = 0);

    std::vector<NodeExport> exportNodes() const;

    std::vector<ValuesExport> exportValues() const;

    void setLogger(const Sp<Logger>& logger = {});
-    void setLogger(const Logger& logger) { setLogger(std::make_shared<Logger>(logger)); }

    /**
     * Only print logs related to the given InfoHash (if given), or disable filter (if zeroes).
@@ -448,12 +440,9 @@ public:
    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);

    // securedht methods
-
-    void findCertificate(InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
    void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);

    void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method);
    void setLocalCertificateStore(CertificateStoreQuery&& query_method);

    /**
@@ -496,7 +485,7 @@ public:
     */
    time_point loop()
    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
        return loop_();
    }

@@ -576,16 +565,16 @@ private:
     */
    void resetDht();

-    mutable std::mutex dht_mtx {};
+    mutable std::mutex dht_mtx;
    std::thread dht_thread {};
    std::condition_variable cv {};
-    std::mutex sock_mtx {};
+    std::mutex sock_mtx;
    net::PacketList rcv {};
    decltype(rcv) rcv_free {};

    std::queue<std::function<void(SecureDht&)>> pending_ops_prio {};
    std::queue<std::function<void(SecureDht&)>> pending_ops {};
-    std::mutex storage_mtx {};
+    std::mutex storage_mtx;

    std::atomic<State> running {State::Idle};
    std::atomic_size_t ongoing_ops {0};
@@ -42,8 +42,7 @@ OPENDHT_PUBLIC void hash(const uint8_t* data, size_t data_length, uint8_t* hash,
 }

 /**
- * Represents an Hash,
- * a byte array of N bytes.
+ * Represents an Hash, a byte array of N bytes.
 * Hashes identify nodes and values in the Dht.
 */
 template<size_t N>
@@ -54,31 +53,25 @@ public:
    typedef typename T::iterator iterator;
    typedef typename T::const_iterator const_iterator;

-    Hash() noexcept { data_.fill(0); }
-    Hash(const uint8_t* h, size_t data_len)
-    {
-        if (data_len < N)
-            data_.fill(0);
-        else
-            std::copy_n(h, N, data_.begin());
-    }
+    constexpr Hash() noexcept
+        : data_ {}
+    {}
+    constexpr Hash(const uint8_t* h, size_t data_len)
+        : data_(fromBytes(h, data_len))
+    {}
    /**
     * Constructor from an hexadecimal string (without "0x").
-     * hex must be at least 2.HASH_LEN characters long.
-     * If too long, only the first 2.HASH_LEN characters are read.
+     * hex must be at least 2.N characters long.
+     * If too long, only the first 2.N characters are read.
     */
-    explicit Hash(std::string_view hex)
-    {
-        if (hex.size() < 2 * N)
-            data_.fill(0);
-        else
-            fromString(hex.data());
-    }
+    explicit constexpr Hash(std::string_view hex)
+        : data_(fromString(hex))
+    {}

    Hash(const msgpack::object& o) { msgpack_unpack(o); }

    static constexpr size_t size() noexcept { return N; }
-    const uint8_t* data() const { return data_.data(); }
+    constexpr const uint8_t* data() const { return data_.data(); }
    uint8_t* data() { return data_.data(); }
    iterator begin() { return data_.begin(); }
    const_iterator cbegin() const { return data_.cbegin(); }
@@ -87,10 +80,21 @@ public:

    static constexpr inline Hash zero() noexcept { return Hash {}; }

-    bool operator==(const Hash& h) const { return data_ == h.data_; }
-    bool operator!=(const Hash& h) const { return !(*this == h); }
+    constexpr bool operator==(const Hash& h) const
+    {
+#if __cplusplus >= 202002L
+        return data_ == h.data_;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != h.data_[i])
+                return false;
+        }
+        return true;
+#endif
+    }
+    constexpr bool operator!=(const Hash& h) const { return !(*this == h); }

-    bool operator<(const Hash& o) const
+    constexpr bool operator<(const Hash& o) const
    {
        for (unsigned i = 0; i < N; i++) {
            if (data_[i] != o.data_[i])
@@ -99,7 +103,7 @@ public:
        return false;
    }

-    Hash operator^(const Hash& o) const
+    constexpr Hash operator^(const Hash& o) const
    {
        Hash result;
        for (auto i = 0u; i < N; i++) {
@@ -108,8 +112,9 @@ public:
        return result;
    }

-    explicit operator bool() const
+    explicit constexpr operator bool() const
    {
+#if __cplusplus >= 202002L
        auto a = reinterpret_cast<const uint32_t*>(data_.data());
        auto b = reinterpret_cast<const uint32_t*>(data_.data() + N);
        for (; a != b; a++) {
@@ -117,24 +122,32 @@ public:
                return true;
        }
        return false;
+#else
+        for (size_t i = 0; i < N; ++i) {
+            if (data_[i] != 0)
+                return true;
+        }
+        return false;
+#endif
    }

    uint8_t& operator[](size_t index) { return data_[index]; }
-    const uint8_t& operator[](size_t index) const { return data_[index]; }
+    constexpr const uint8_t& operator[](size_t index) const { return data_[index]; }

    /**
     * Find the lowest 1 bit in an id.
     * Result will allways be lower than 8*N
     */
-    inline int lowbit() const
+    constexpr int lowbit() const
    {
-        int i, j;
-        for (i = N - 1; i >= 0; i--)
+        int i = N - 1;
+        for (; i >= 0; i--)
            if (data_[i] != 0)
                break;
        if (i < 0)
            return -1;
-        for (j = 7; j >= 0; j--)
+        int j = 7;
+        for (; j >= 0; j--)
            if ((data_[i] & (0x80 >> j)) != 0)
                break;
        return 8 * i + j;
@@ -146,11 +159,10 @@ public:
    }

    /** Find how many bits two ids have in common. */
-    static inline unsigned commonBits(const Hash& id1, const Hash& id2)
+    static constexpr inline unsigned commonBits(const Hash& id1, const Hash& id2)
    {
-        unsigned i, j;
-        uint8_t x;
-        for (i = 0; i < N; i++) {
+        unsigned i = 0;
+        for (; i < N; i++) {
            if (id1.data_[i] != id2.data_[i])
                break;
        }
@@ -158,9 +170,9 @@ public:
        if (i == N)
            return 8 * N;

-        x = id1.data_[i] ^ id2.data_[i];
+        uint8_t x = id1.data_[i] ^ id2.data_[i];

-        j = 0;
+        unsigned j = 0;
        while ((x & 0x80) == 0) {
            x <<= 1;
            j++;
@@ -170,7 +182,7 @@ public:
    }

    /** Determine whether id1 or id2 is closer to this */
-    int xorCmp(const Hash& id1, const Hash& id2) const
+    constexpr int xorCmp(const Hash& id1, const Hash& id2) const
    {
        for (unsigned i = 0; i < N; i++) {
            if (id1.data_[i] == id2.data_[i])
@@ -182,7 +194,7 @@ public:
        return 0;
    }

-    bool getBit(unsigned nbit) const
+    constexpr bool getBit(unsigned nbit) const
    {
        auto& num = *(data_.cbegin() + (nbit / 8));
        unsigned bit = 7 - (nbit % 8);
@@ -257,8 +269,9 @@ public:
    }

 private:
-    T data_;
-    void fromString(const char*);
+    alignas(alignof(uint32_t)) T data_;
+    static constexpr T fromBytes(const uint8_t*, size_t);
+    static constexpr T fromString(std::string_view);
 };

 #define HASH_LEN 20u
@@ -281,30 +294,51 @@ operator>>(std::istream& s, Hash<N>& h)
    std::array<char, h.size() * 2> dat;
    s.exceptions(std::istream::eofbit | std::istream::failbit);
    s.read(&(*dat.begin()), dat.size());
-    fromString(dat.data());
+    h = Hash<N>(std::string_view(dat.data(), dat.size()));
    return s;
 }

 template<size_t N>
-void
-Hash<N>::fromString(const char* in)
+constexpr typename Hash<N>::T
+Hash<N>::fromBytes(const uint8_t* in, size_t size)
 {
-    auto hex2bin = [](char c) -> uint8_t {
+    T data {};
+    if (size < N)
+        return data;
+    for (size_t i = 0; i < N; ++i)
+        data[i] = in[i];
+    return data;
+}
+
+template<size_t N>
+constexpr typename Hash<N>::T
+Hash<N>::fromString(std::string_view in)
+{
+    T data {};
+    if (in.size() < 2 * N)
+        return data;
+
+    constexpr auto hex2bin = [](char c, bool& valid) -> uint8_t {
        if (c >= 'a' and c <= 'f')
            return 10 + c - 'a';
        else if (c >= 'A' and c <= 'F')
            return 10 + c - 'A';
        else if (c >= '0' and c <= '9')
            return c - '0';
-        else
-            throw std::domain_error("not an hex character");
+        else {
+            valid = false;
+            return 0;
+        }
    };
-    try {
-        for (size_t i = 0; i < N; i++)
-            data_[i] = (hex2bin(in[2 * i]) << 4) | hex2bin(in[2 * i + 1]);
-    } catch (const std::domain_error&) {
-        data_.fill(0);
+    bool valid = true;
+    for (size_t i = 0; i < N && valid; i++) {
+        uint8_t high = hex2bin(in[2 * i], valid);
+        uint8_t low = hex2bin(in[2 * i + 1], valid);
+        data[i] = (high << 4) | low;
    }
+    if (!valid)
+        return {};
+    return data;
 }

 template<size_t N>
@@ -369,6 +403,19 @@ toHex(const std::vector<uint8_t>& data)
    return toHex(data.data(), data.size());
 }

+template<size_t N>
+constexpr std::array<char, N * 2>
+toHexArray(const Hash<N>& h)
+{
+    std::array<char, N * 2> ret {};
+    for (size_t i = 0; i < N; i++) {
+        const auto& m = hex_map[h[i]];
+        ret[i * 2] = m[0];
+        ret[i * 2 + 1] = m[1];
+    }
+    return ret;
+}
+
 template<size_t N>
 const char*
 Hash<N>::to_c_str() const
@@ -8,6 +8,7 @@
 #include <fmt/printf.h>

 #include <functional>
+#include <mutex>
 #include <string_view>
 #include <type_traits>
 #include <cstdarg>
@@ -130,17 +131,19 @@ struct OPENDHT_PUBLIC Logger

    std::shared_ptr<Logger> createChild(std::string tag)
    {
+        std::lock_guard lock {children_mutex_};
        auto child = std::make_shared<Logger>(*this, std::move(tag));
        children_.push_back(child);
        return child;
    }

-    void setFilter(std::string_view tag)
+    void setFilter(std::string_view filter)
    {
-        enable_ = tag.empty() or tag_ == tag;
+        std::lock_guard lock {children_mutex_};
+        enable_ = filter.empty() or tag_.find(filter) != std::string_view::npos;
        for (auto it = children_.begin(); it != children_.end();) {
            if (auto c = it->lock()) {
-                c->setFilter(enable_ ? std::string_view {} : tag);
+                c->setFilter(enable_ ? std::string_view {} : filter);
                ++it;
            } else {
                it = children_.erase(it);
@@ -193,8 +196,9 @@ private:
    const LogMethod logger_ = {};
    const std::string tag_ {};
    const std::string prefix_ {};
-    bool enable_ {true};
+    std::mutex children_mutex_;
    std::vector<std::weak_ptr<Logger>> children_ {};
+    bool enable_ {true};
 };

 } // namespace log
@@ -547,7 +547,7 @@ private:
    std::pair<Blob, Blob> bufferNodes(
        sa_family_t af, const InfoHash& id, want_t want, std::vector<Sp<Node>>& nodes, std::vector<Sp<Node>>& nodes6);
    /* answer to a listen request */
-    void sendListenConfirmation(const SockAddr& addr, Tid tid);
+    void sendListenConfirmation(const SockAddr& addr, Tid tid, const Blob& token = {});
    /* answer to put request */
    void sendValueAnnounced(const SockAddr& addr, Tid, Value::Id);
    /* answer in case of error */
@@ -58,7 +58,7 @@ public:

    inline void setOnReceive(OnReceive&& cb)
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        rx_callback = std::move(cb);
    }

@@ -67,12 +67,12 @@ public:

    SockAddr getBound(sa_family_t family = AF_UNSPEC) const
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return getBoundRef(family);
    }
    in_port_t getPort(sa_family_t family = AF_UNSPEC) const
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return getBoundRef(family).getPort();
    }

@@ -102,7 +102,7 @@ protected:

    inline void onReceived(PacketList&& packets)
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        if (rx_callback) {
            auto r = rx_callback(std::move(packets));
            if (not r.empty() and toRecycle_.size() < RX_QUEUE_MAX_SIZE)
@@ -134,12 +134,12 @@ public:

    bool hasIPv4() const override
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return s4 != -1;
    }
    bool hasIPv6() const override
    {
-        std::lock_guard<std::mutex> lk(lock);
+        std::lock_guard lk(lock);
        return s6 != -1;
    }

@@ -113,14 +113,6 @@ public:
     * and put it in the DHT.
     * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
     */
-    void putEncrypted(
-        const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
-    }
    void putEncrypted(const InfoHash& hash,
                      const crypto::PublicKey& to,
                      Sp<Value> val,
@@ -145,17 +137,11 @@ public:

    Value decrypt(const Value& v);

-    void findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb);
-    void findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb);
-
    void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
    void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);

    void registerCertificate(const Sp<crypto::Certificate>& cert);

-    Sp<crypto::Certificate> getCertificate(const InfoHash& node) const;
-    Sp<crypto::PublicKey> getPublicKey(const InfoHash& node) const;
-
    Sp<crypto::Certificate> getCertificate(const PkId& node) const;
    Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;

@@ -164,10 +150,6 @@ public:
     * The search key used is the public key ID, so there may be multiple certificates retured, signed with
     * the same private key.
     */
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-    {
-        localQueryMethodLegacy_ = std::move(query_method);
-    }
    void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }

@@ -179,15 +161,35 @@ public:
    inline const InfoHash& getNodeId() const override { return dht_->getNodeId(); }

    std::pair<size_t, size_t> getStoreSize() const override { return dht_->getStoreSize(); }
+    std::pair<size_t, size_t> getLocalStoreSize() const override { return dht_->getLocalStoreSize(); }
    std::string getStorageLog() const override { return dht_->getStorageLog(); }
    std::string getStorageLog(const InfoHash& h) const override { return dht_->getStorageLog(h); }
-    void setStorageLimit(size_t limit = DEFAULT_STORAGE_LIMIT) override { dht_->setStorageLimit(limit); }
+    void setStorageLimit(size_t limit = 0) override { dht_->setStorageLimit(limit); }
    size_t getStorageLimit() const override { return dht_->getStorageLimit(); }
+    void setLocalStorageLimit(size_t limit = 0) override { dht_->setLocalStorageLimit(limit); }
+    size_t getLocalStorageLimit() const override { return dht_->getLocalStorageLimit(); }

    std::vector<NodeExport> exportNodes() const override { return dht_->exportNodes(); }
    std::vector<ValuesExport> exportValues() const override { return dht_->exportValues(); }
    void importValues(const std::vector<ValuesExport>& v) override { dht_->importValues(v); }
    NodeStats getNodesStats(sa_family_t af) const override { return dht_->getNodesStats(af); }
+
+    NodeInfo getNodeInfo()
+    {
+        NodeInfo info;
+        info.id = getId();
+        info.node_id = getNodeId();
+        info.ipv4 = getNodesStats(AF_INET);
+        info.ipv6 = getNodesStats(AF_INET6);
+        std::tie(info.storage_size, info.storage_values) = getStoreSize();
+        std::tie(info.local_storage_size, info.local_storage_values) = getLocalStoreSize();
+        if (auto sock = getSocket()) {
+            info.bound4 = sock->getBoundRef(AF_INET).getPort();
+            info.bound6 = sock->getBoundRef(AF_INET6).getPort();
+        }
+        return info;
+    }
+
    std::vector<unsigned> getNodeMessageStats(bool in = false) override { return dht_->getNodeMessageStats(in); }
    std::string getRoutingTablesLog(sa_family_t af) const override { return dht_->getRoutingTablesLog(af); }
    std::string getSearchesLog(sa_family_t af) const override { return dht_->getSearchesLog(af); }
@@ -325,13 +327,10 @@ private:

    // method to query the local certificate store
    CertificateStoreQuery localQueryMethod_ {};
-    CertificateStoreQueryLegacy localQueryMethodLegacy_ {};

    // our certificate cache
-    std::map<InfoHash, Sp<crypto::Certificate>> nodesCertificates_ {};
-    std::map<InfoHash, Sp<crypto::PublicKey>> nodesPubKeys_ {};
-    std::map<PkId, Sp<crypto::Certificate>> nodesCertificatesLong_ {};
-    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeysLong_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};

    std::atomic_bool forward_all_ {false};
    bool enableCache_ {false};
@@ -98,6 +98,9 @@ public:
    {
        return len == o.len && std::memcmp((const uint8_t*) get(), (const uint8_t*) o.get(), len) == 0;
    }
+    bool operator==(const SockAddr& o) const { return equals(o); }
+    bool operator!=(const SockAddr& o) const { return !equals(o); }
+
    SockAddr& operator=(const SockAddr& o)
    {
        set(o.get(), o.getLength());
@@ -327,8 +330,6 @@ private:
    }
 };

-OPENDHT_PUBLIC bool operator==(const SockAddr& a, const SockAddr& b);
-
 } // namespace dht

 #if FMT_VERSION >= 90000
@@ -53,12 +53,14 @@ public:
    void detach();

 private:
-    std::mutex lock_ {};
+    std::mutex lock_;
    std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
    std::queue<std::function<void()>> tasks_ {};
    std::vector<std::unique_ptr<std::thread>> threads_;
    unsigned readyThreads_ {0};
    bool running_ {true};
+    bool stopping_ {false};

    unsigned minThreads_;
    const unsigned maxThreads_;
@@ -81,7 +83,7 @@ public:
 private:
    std::reference_wrapper<ThreadPool> threadPool_;
    const unsigned maxConcurrent_ {1};
-    std::mutex lock_ {};
+    std::mutex lock_;
    unsigned current_ {0};
    std::queue<std::function<void()>> tasks_ {};

@@ -104,7 +106,7 @@ public:

    void run(std::function<void()>&& task)
    {
-        std::lock_guard<std::mutex> lock(state_->mtx);
+        std::lock_guard lock(state_->mtx);
        if (state_->shutdown_)
            return;
        state_->pendingTasks++;
@@ -114,7 +116,7 @@ public:
 private:
    struct SharedState
    {
-        std::mutex mtx {};
+        std::mutex mtx;
        std::condition_variable cv {};
        unsigned pendingTasks {0};
        unsigned ongoingTasks {0};
@@ -125,7 +127,7 @@ private:

        void destroy(bool wait = true)
        {
-            std::unique_lock<std::mutex> lock(mtx);
+            std::unique_lock lock(mtx);
            if (destroyed)
                return;
            if (wait) {
@@ -141,7 +143,7 @@ private:
        void run(const std::function<void()>& task)
        {
            {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                pendingTasks--;
                ongoingTasks++;
            }
@@ -149,7 +151,7 @@ private:
                return;
            task();
            {
-                std::lock_guard<std::mutex> lock(mtx);
+                std::lock_guard lock(mtx);
                ongoingTasks--;
                cv.notify_all();
            }
@@ -85,8 +85,8 @@ using system_clock = std::chrono::system_clock;
 using time_point = clock::time_point;
 using duration = clock::duration;

-time_point from_time_t(std::time_t t);
-std::time_t to_time_t(time_point t);
+OPENDHT_PUBLIC time_point from_time_t(std::time_t t);
+OPENDHT_PUBLIC std::time_t to_time_t(time_point t);

 template<class DT>
 static std::string
@@ -126,6 +126,8 @@ print_time_relative(TimePoint now, TimePoint d)
    return (d > now) ? concat("in "sv, print_duration(d - now)) : concat(print_duration(now - d), " ago"sv);
 }

+OPENDHT_PUBLIC std::string printByteCount(size_t bytes);
+
 template<typename Duration = duration>
 class uniform_duration_distribution : public std::uniform_int_distribution<typename Duration::rep>
 {
@@ -172,15 +174,19 @@ packMsg(const Type& t)

 template<typename Type>
 Type
-unpackMsg(Blob b)
+unpackMsg(const Blob& b)
 {
    msgpack::unpacked msg_res = msgpack::unpack((const char*) b.data(), b.size());
    return msg_res.get().as<Type>();
 }

-msgpack::unpacked unpackMsg(Blob b);
+inline msgpack::unpacked
+unpackMsg(const Blob& b)
+{
+    return msgpack::unpack((const char*) b.data(), b.size());
+}

-msgpack::object* findMapValue(const msgpack::object& map, const char* key, size_t length);
+OPENDHT_PUBLIC msgpack::object* findMapValue(const msgpack::object& map, const char* key, size_t length);

 inline msgpack::object*
 findMapValue(const msgpack::object& map, const char* key)
@@ -31,6 +31,7 @@ using namespace std::literals;
 static constexpr auto VALUE_KEY_ID("id");
 static const std::string VALUE_KEY_DAT("dat");
 static const std::string VALUE_KEY_PRIO("p");
+static const std::string VALUE_KEY_PUSHTYPE("pt");
 static const std::string VALUE_KEY_SIGNATURE("sig");

 static const std::string VALUE_KEY_SEQ("seq");
@@ -451,6 +452,7 @@ struct OPENDHT_PUBLIC Value
        , signature(std::move(o.signature))
        , cypher(std::move(o.cypher))
        , priority(o.priority)
+        , pushType(std::move(o.pushType))
    {}

    template<typename Type>
@@ -574,7 +576,7 @@ struct OPENDHT_PUBLIC Value
    template<typename Packer>
    void msgpack_pack(Packer& pk) const
    {
-        pk.pack_map(2 + (priority ? 1 : 0));
+        pk.pack_map(2 + (priority ? 1 : 0) + (!pushType.empty() ? 1 : 0));
        pk.pack(VALUE_KEY_ID);
        pk.pack(id);
        pk.pack(VALUE_KEY_DAT);
@@ -583,6 +585,10 @@ struct OPENDHT_PUBLIC Value
            pk.pack(VALUE_KEY_PRIO);
            pk.pack(priority);
        }
+        if (!pushType.empty()) {
+            pk.pack(VALUE_KEY_PUSHTYPE);
+            pk.pack(pushType);
+        }
    }

    template<typename Packer>
@@ -672,6 +678,13 @@ struct OPENDHT_PUBLIC Value
     */
    unsigned priority {0};

+    /**
+     * Push notification type — set by the sender so that the proxy server
+     * can include it in the FCM/APNs payload without decrypting the value.
+     * Example: "audioCall", "videoCall"
+     */
+    std::string pushType {};
+
    inline bool isSignatureChecked() const { return signatureChecked; }
    inline bool isDecrypted() const { return decrypted; }
    bool checkSignature();
@@ -1026,9 +1039,9 @@ struct OPENDHT_PUBLIC Query
    void msgpack_pack(Packer& pk) const
    {
        pk.pack_map(2);
-        pk.pack(std::string("s"));
+        pk.pack("s"sv);
        pk.pack(select); /* packing field selectors */
-        pk.pack(std::string("w"));
+        pk.pack("w"sv);
        pk.pack(where); /* packing filters */
    }

@@ -1081,7 +1094,7 @@ template<typename T, typename std::enable_if<std::is_base_of<Value::Serializable
 Value::Filter
 getFilterSet(Value::Filter f)
 {
-    return Value::Filter::chain({Value::TypeFilter(T::TYPE), T::getFilter(), f});
+    return Value::Filter::chain({Value::TypeFilter(T::TYPE), T::getFilter(), std::move(f)});
 }

 template<typename T, typename std::enable_if<!std::is_base_of<Value::SerializableBase, T>::value, T>::type* = nullptr>
@@ -5,9 +5,9 @@ project(
    'cython',
    license: 'MIT',
    license_files: 'LICENSE',
-    version: '3.7.0',
+    version: '4.0.0',
    meson_version: '>=1.1.0',
-    default_options: ['cpp_std=c++17', 'warning_level=3'],
+    default_options: ['cpp_std=c++20', 'warning_level=3'],
 )

 gnutls = dependency('gnutls')
@@ -118,6 +118,17 @@ opendht = library(
    install: true,
 )

+opendht_dep_args = []
+if get_option('default_library') != 'static'
+    opendht_dep_args += '-Dopendht_EXPORTS'
+endif
+
+opendht_dep = declare_dependency(
+    link_with: opendht,
+    include_directories: opendht_interface_inc,
+    compile_args: opendht_dep_args,
+)
+
 # Install library headers.
 install_subdir('include', install_dir: get_option('includedir'), strip_directory: true)

@@ -128,6 +139,13 @@ conf_data.set('libdir', join_paths(get_option('prefix'), get_option('libdir')))
 conf_data.set('includedir', join_paths(get_option('prefix'), get_option('includedir')))
 conf_data.set('argon2_lib', ', libargon2')
 conf_data.set('simdutf_lib', ', simdutf')
+conf_data.set('opendht_public_cflags', '')
+conf_data.set('opendht_c_public_cflags', '')
+
+if get_option('default_library') != 'static'
+    conf_data.set('opendht_public_cflags', ' -Dopendht_EXPORTS')
+    conf_data.set('opendht_c_public_cflags', ' -Dopendht_c_EXPORTS')
+endif

 configure_file(
    input: 'opendht.pc.in',
@@ -143,9 +161,7 @@ if get_option('c').enabled()
    opendht_c = library(
        'opendht-c',
        ['c/opendht.cpp', 'c/opendht_c.h'],
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [msgpack, jsoncpp, fmt],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt],
        cpp_args: ['-DOPENDHT_C_BUILD', '-Dopendht_c_EXPORTS'],
        install: true,
    )
@@ -181,10 +197,8 @@ if get_option('python').require(
    py.extension_module(
        'opendht',
        'python/opendht.pyx',
-        include_directories: opendht_interface_inc,
        override_options: ['cython_language=cpp'],
-        link_with: [opendht],
-        dependencies: [msgpack, jsoncpp, fmt, dep_py],
+        dependencies: [opendht_dep, msgpack, jsoncpp, fmt, dep_py],
        install: true,
    )
 endif
@@ -193,25 +207,19 @@ if get_option('tools').enabled()
    dhtnode = executable(
        'dhtnode',
        'tools/dhtnode.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    dhtchat = executable(
        'dhtchat',
        'tools/dhtchat.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    dhtscanner = executable(
        'dhtscanner',
        'tools/dhtscanner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [readline, jsoncpp, msgpack, fmt, openssl],
+        dependencies: [opendht_dep, readline, jsoncpp, msgpack, fmt, openssl],
        install: true,
    )
    if llhttp.found()
@@ -224,9 +232,7 @@ if get_option('tools').enabled()
        durl = executable(
            'durl',
            'tools/durl.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: durl_deps,
+            dependencies: [opendht_dep] + durl_deps,
        )
    endif
 endif
@@ -237,62 +243,68 @@ if get_option('tests').enabled()

    test_infohash = executable(
        'test_infohash',
-        'tests/infohashtester.cpp',
+        'tests/test_infohash.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('Infohash', test_infohash)

    test_value = executable(
        'test_value',
-        'tests/valuetester.cpp',
+        'tests/test_value.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('Value', test_value)

+    test_parsedmessage = executable(
+        'test_parsedmessage',
+        'tests/test_parsedmessage.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('ParsedMessage', test_parsedmessage)
+
+    test_networkengine = executable(
+        'test_networkengine',
+        'tests/test_networkengine.cpp',
+        'tests/tests_runner.cpp',
+        include_directories: opendht_inc,
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
+    )
+    test('NetworkEngine', test_networkengine)
+
    test_crypto = executable(
        'test_crypto',
-        'tests/cryptotester.cpp',
+        'tests/test_crypto.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack, gnutls],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack, gnutls],
    )
-    test('Crypto', test_crypto)
+    test('Crypto', test_crypto, timeout: 60)

    test_dhtrunner = executable(
        'test_dhtrunner',
-        'tests/dhtrunnertester.cpp',
+        'tests/test_dhtrunner.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
-    test('DhtRunner', test_dhtrunner)
+    test('DhtRunner', test_dhtrunner, timeout: 60)

    test_threadpool = executable(
        'test_threadpool',
-        'tests/threadpooltester.cpp',
+        'tests/test_threadpool.cpp',
        'tests/tests_runner.cpp',
-        include_directories: opendht_interface_inc,
-        link_with: opendht,
-        dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+        dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
    )
    test('ThreadPool', test_threadpool)

    if get_option('proxy_client').enabled() or get_option('proxy_server').enabled()
        test_http = executable(
            'test_http',
-            'tests/httptester.cpp',
+            'tests/test_http.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('Http', test_http)
    endif
@@ -300,11 +312,9 @@ if get_option('tests').enabled()
    if get_option('peer_discovery').enabled()
        test_peerdiscovery = executable(
            'test_peerdiscovery',
-            'tests/peerdiscoverytester.cpp',
+            'tests/test_peerdiscovery.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('PeerDiscovery', test_peerdiscovery)
    endif
@@ -312,11 +322,9 @@ if get_option('tests').enabled()
    if get_option('proxy_server').enabled()
        test_proxy = executable(
            'test_dhtproxy',
-            'tests/dhtproxytester.cpp',
+            'tests/test_dhtproxy.cpp',
            'tests/tests_runner.cpp',
-            include_directories: opendht_interface_inc,
-            link_with: opendht,
-            dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+            dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
        )
        test('DhtProxy', test_proxy)

@@ -325,9 +333,7 @@ if get_option('tests').enabled()
                'test_dhtproxystress',
                'tests/dhtproxy_stress_tester.cpp',
                'tests/tests_runner.cpp',
-                include_directories: opendht_interface_inc,
-                link_with: opendht,
-                dependencies: [cppunit, jsoncpp, fmt, openssl, msgpack],
+                dependencies: [opendht_dep, cppunit, jsoncpp, fmt, openssl, msgpack],
            )
            test('DhtProxy Stress', test_proxystress)
        endif
@@ -7,4 +7,4 @@ Description: Distributed Hash Table library (C Wrapper)
 Version: @VERSION@
 Libs: -L${libdir} -lopendht-c
 Requires.private: opendht gnutls >= 3.1 @argon2_lib@
-Cflags: -I${includedir}
+Cflags: -I${includedir}@opendht_c_public_cflags@
@@ -9,4 +9,4 @@ Libs: -L${libdir} -lopendht -lfmt
 Libs.private: @http_lib@ -pthread
 Requires: gnutls >= 3.3@jsoncpp_lib@@openssl_lib@
 Requires.private: nettle >= 2.4@argon2_lib@@llhttp_lib@@iouring_lib@@simdutf_lib@
-Cflags: -I${includedir}
+Cflags: -I${includedir}@opendht_public_cflags@
@@ -28,8 +28,18 @@ install(CODE [[
        if(NOT _pip_check EQUAL 0)
            message(WARNING "Skipping Python package install: pip not available for ${Python3_EXECUTABLE}.")
        else()
+            set(_pip_install_args
+                install
+                --no-deps
+                --no-build-isolation
+                --break-system-packages
+                --prefix ${CMAKE_INSTALL_PREFIX})
+            if(DEFINED ENV{DESTDIR} AND NOT "$ENV{DESTDIR}" STREQUAL "")
+                list(APPEND _pip_install_args --root "$ENV{DESTDIR}")
+            endif()
+            list(APPEND _pip_install_args .)
            execute_process(
-                COMMAND ${Python3_EXECUTABLE} -m pip install --no-deps --break-system-packages .
+                COMMAND ${Python3_EXECUTABLE} -m pip ${_pip_install_args}
                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python
                OUTPUT_VARIABLE _pip_output
                ERROR_VARIABLE _pip_error
@@ -1,30 +0,0 @@
-if USE_CYTHON
-
-noinst_HEADERS = \
-	opendht.pyx \
-	opendht_cpp.pxd \
-	pyproject.toml
-
-PYTHON_INSTALL_RECORD = $(builddir)/install_record.txt
-
-pybuild.stamp:
-	LDFLAGS="-L$(top_srcdir)/src/.libs" $(PYTHON) -m build .
-	echo stamp > pybuild.stamp
-
-CLEANFILES = pybuild.stamp
-
-all-local: pybuild.stamp
-clean-local:
-	rm -rf $(builddir)/build $(builddir)/*.so $(PYTHON_INSTALL_RECORD)
-
-install-exec-local:
-	$(PYTHON) -m pip install --no-deps --no-build-isolation . \
-		--root=$(DESTDIR)/ --prefix=$(prefix)
-	rm -rf $(builddir)/build
-
-if HAVE_PIP
-uninstall-local:
-	/usr/bin/yes | $(PIP) uninstall $(PACKAGE)
-endif
-
-endif
@@ -820,13 +820,8 @@ cdef class DhtRunner(_WithID):
                        key._infohash, (<PkId>to)._pkid, val._value,
                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
                    )
-                elif isinstance(to, InfoHash):
-                    self.thisptr.get().putEncrypted(
-                        key._infohash, (<InfoHash>to)._infohash, val._value,
-                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
-                    )
                else:
-                    raise TypeError("'to' must be PublicKey, PkId, or InfoHash")
+                    raise TypeError("'to' must be PublicKey or PkId")
            except:
                ref.Py_DECREF(cb_obj)
                raise
@@ -282,7 +282,6 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
        void get(InfoHash key, GetCallback get_cb, DoneCallback done_cb, nullptr_t f, Where w)
        void put(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, time_point created, bool permanent)
        void putSigned(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, bool permanent) 
-        void putEncrypted(InfoHash key, InfoHash to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void putEncrypted(InfoHash key, PkId to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void putEncrypted(InfoHash key, shared_ptr[PublicKey] to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void cancelPut(InfoHash key, shared_ptr[Value] val)
@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"

 [tool.cibuildwheel]
 build = [
-  'cp3{9,10,11,12,13}-manylinux_x86_64',
-  'cp3{10,11,12,13}-manylinux_aarch64',
-  'cp3{11,12,13}-macosx_x86_64',
-  'cp3{11,12,13}-macosx_arm64',
-  'cp3{11,12,13}-win_amd64',
+  'cp3{9,10,11,12,13,14}-manylinux_x86_64',
+  'cp3{10,11,12,13,14}-manylinux_aarch64',
+  'cp3{11,12,13,14}-macosx_x86_64',
+  'cp3{11,12,13,14}-macosx_arm64',
+  'cp3{11,12,13,14}-win_amd64',
 ]

 [tool.cibuildwheel.linux]
@@ -226,7 +226,7 @@ impl DhtRunner {
    pub fn put_encrypted<'a>(
        &mut self,
        h: &InfoHash,
-        to: &InfoHash,
+        to: &PkId,
        v: Box<Value>,
        done_cb: &'a mut (dyn FnMut(bool)),
        permanent: bool,
@@ -190,7 +190,7 @@ extern {
                                 cb_user_data: *mut c_void,
                                 permanent: bool);
    pub fn dht_runner_put_encrypted(dht: *mut DhtRunner, h: *const InfoHash,
-                                    to: *const InfoHash, v: *const Value,
+                                    to: *const PkId, v: *const Value,
                                    done_cb: extern fn(bool, *mut c_void),
                                    cb_user_data: *mut c_void,
                                    permanent: bool);
@@ -1,82 +0,0 @@
-lib_LTLIBRARIES = libopendht.la
-
-libopendht_la_CPPFLAGS = @CPPFLAGS@ -I$(top_srcdir)/include/opendht @Argon2_CFLAGS@ @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@ @OpenSSL_CFLAGS@ @Fmt_CFLAGS@ @Llhttp_CFLAGS@ @Liburing_CFLAGS@ @simdutf_CFLAGS@
-libopendht_la_LIBADD   = @Argon2_LIBS@ @JsonCpp_LIBS@ @GnuTLS_LIBS@ @Nettle_LIBS@ @OpenSSL_LIBS@ @Fmt_LIBS@ @Llhttp_LIBS@ @Liburing_LIBS@ @simdutf_LIBS@
-libopendht_la_LDFLAGS  = @LDFLAGS@ -version-number @OPENDHT_MAJOR_VERSION@:@OPENDHT_MINOR_VERSION@:@OPENDHT_PATCH_VERSION@
-libopendht_la_SOURCES  = \
-        dht.cpp \
-        storage.h \
-        listener.h \
-        request.h \
-        search.h \
-        value_cache.h \
-        op_cache.h \
-        op_cache.cpp \
-        net.h \
-        parsed_message.h \
-        node_cache.cpp \
-        callbacks.cpp \
-        routing_table.cpp \
-        network_engine.cpp \
-        utils.cpp \
-        node.cpp \
-        value.cpp \
-        crypto.cpp \
-        securedht.cpp \
-        dhtrunner.cpp \
-        default_types.cpp \
-        log.cpp \
-        network_utils.cpp \
-        thread_pool.cpp
-
-nobase_include_HEADERS = \
-        ../include/opendht.h \
-        ../include/opendht/def.h \
-        ../include/opendht/dht.h \
-        ../include/opendht/callbacks.h \
-        ../include/opendht/node_cache.h \
-        ../include/opendht/node_export.h \
-        ../include/opendht/routing_table.h \
-        ../include/opendht/network_engine.h \
-        ../include/opendht/scheduler.h \
-        ../include/opendht/rate_limiter.h \
-        ../include/opendht/utils.h \
-        ../include/opendht/sockaddr.h \
-        ../include/opendht/infohash.h \
-        ../include/opendht/node.h \
-        ../include/opendht/value.h \
-        ../include/opendht/crypto.h \
-        ../include/opendht/securedht.h \
-        ../include/opendht/dhtrunner.h \
-        ../include/opendht/default_types.h \
-        ../include/opendht/log.h \
-        ../include/opendht/logger.h \
-        ../include/opendht/network_utils.h \
-        ../include/opendht/rng.h \
-        ../include/opendht/thread_pool.h
-
-if ENABLE_PROXY_SERVER
-libopendht_la_SOURCES += dht_proxy_server.cpp
-nobase_include_HEADERS += ../include/opendht/dht_proxy_server.h
-endif
-
-if ENABLE_PROXY_CLIENT
-libopendht_la_SOURCES += dht_proxy_client.cpp
-nobase_include_HEADERS += ../include/opendht/dht_proxy_client.h ../include/opendht/dht_interface.h
-endif
-
-libopendht_la_SOURCES += base64.h base64.cpp
-if PROXY_CLIENT_OR_SERVER
-libopendht_la_SOURCES += http.cpp compat/os_cert.cpp
-nobase_include_HEADERS += ../include/opendht/proxy.h ../include/opendht/http.h compat/os_cert.h
-endif
-
-if ENABLE_PEER_DISCOVERY
-libopendht_la_SOURCES += peer_discovery.cpp
-nobase_include_HEADERS += ../include/opendht/peer_discovery.h
-endif
-
-if ENABLE_INDEXATION
-libopendht_la_SOURCES += indexation/pht.cpp
-nobase_include_HEADERS += ../include/opendht/indexation/pht.h
-endif
@@ -139,6 +139,12 @@ NodeInfo::toJson() const
    val["ipv4"] = ipv4.toJson();
    val["ipv6"] = ipv6.toJson();
    val["ops"] = Json::Value::LargestUInt(ongoing_ops);
+    val["storage_values"] = Json::Value::LargestUInt(storage_values);
+    val["storage_size"] = Json::Value::LargestUInt(storage_size);
+    val["local_storage_values"] = Json::Value::LargestUInt(local_storage_values);
+    val["local_storage_size"] = Json::Value::LargestUInt(local_storage_size);
+    val["port_ipv4"] = Json::Value::LargestUInt(bound4);
+    val["port_ipv6"] = Json::Value::LargestUInt(bound6);
    return val;
 }

@@ -150,6 +156,12 @@ NodeInfo::NodeInfo(const Json::Value& v)
    ipv4 = NodeStats(v["ipv4"]);
    ipv6 = NodeStats(v["ipv6"]);
    ongoing_ops = v["ops"].asLargestUInt();
+    storage_values = v["storage_values"].asLargestUInt();
+    storage_size = v["storage_size"].asLargestUInt();
+    local_storage_values = v["local_storage_values"].asLargestUInt();
+    local_storage_size = v["local_storage_size"].asLargestUInt();
+    bound4 = v["port_ipv4"].asLargestUInt();
+    bound6 = v["port_ipv6"].asLargestUInt();
 }

 #endif
@@ -11,6 +11,7 @@ extern "C" {
 #include <nettle/gcm.h>
 #include <nettle/aes.h>
 #include <nettle/hmac.h>
+#include <nettle/version.h>
 #include <gnutls/crypto.h>

 #include <argon2.h>
@@ -98,6 +99,46 @@ private:
 #define GCM_DIGEST_SIZE GCM_BLOCK_SIZE
 #endif

+static void
+gcmAes128Digest(gcm_aes128_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes128_digest(ctx, digest);
+#else
+    gcm_aes128_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes192Digest(gcm_aes192_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes192_digest(ctx, digest);
+#else
+    gcm_aes192_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes256Digest(gcm_aes256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes256_digest(ctx, digest);
+#else
+    gcm_aes256_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+hmacSha256Digest(hmac_sha256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    hmac_sha256_digest(ctx, digest);
+#else
+    hmac_sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+#endif
+}
+
 Blob
 aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
 {
@@ -115,19 +156,19 @@ aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
        gcm_aes128_set_key(&aes, key.data());
        gcm_aes128_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes128_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes128Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    } else if (key.size() == AES_LENGTHS[1]) {
        struct gcm_aes192_ctx aes;
        gcm_aes192_set_key(&aes, key.data());
        gcm_aes192_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes192_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes192Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    } else if (key.size() == AES_LENGTHS[2]) {
        struct gcm_aes256_ctx aes;
        gcm_aes256_set_key(&aes, key.data());
        gcm_aes256_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes256_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes256Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    }

    return ret;
@@ -160,19 +201,19 @@ aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
        gcm_aes128_set_key(&aes, key.data());
        gcm_aes128_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes128_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes128Digest(&aes, digest.data());
    } else if (key.size() == AES_LENGTHS[1]) {
        struct gcm_aes192_ctx aes;
        gcm_aes192_set_key(&aes, key.data());
        gcm_aes192_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes192_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes192Digest(&aes, digest.data());
    } else if (key.size() == AES_LENGTHS[2]) {
        struct gcm_aes256_ctx aes;
        gcm_aes256_set_key(&aes, key.data());
        gcm_aes256_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes256_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes256Digest(&aes, digest.data());
    }

    if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
@@ -446,7 +487,7 @@ PrivateKey::getPublicKey() const
 const std::shared_ptr<PublicKey>&
 PrivateKey::getSharedPublicKey() const
 {
-    std::lock_guard<std::mutex> lock(publicKeyMutex_);
+    std::lock_guard lock(publicKeyMutex_);
    if (not publicKey_) {
        auto pk = std::make_shared<PublicKey>();
        if (auto err = gnutls_pubkey_import_privkey(pk->pk, key, GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN, 0))
@@ -959,7 +1000,7 @@ Certificate::getPublicKey() const
 const std::shared_ptr<PublicKey>&
 Certificate::getSharedPublicKey() const
 {
-    std::lock_guard<std::mutex> lock(publicKeyMutex_);
+    std::lock_guard lock(publicKeyMutex_);
    if (not publicKey_) {
        auto pk = std::make_shared<PublicKey>();
        if (auto err = gnutls_pubkey_import_x509(pk->pk, cert, 0))
@@ -2045,7 +2086,7 @@ hkdf_extract(const Blob& salt, const Blob& ikm)
    hmac_sha256_set_key(&ctx, salt.size(), salt.data());
    hmac_sha256_update(&ctx, ikm.size(), ikm.data());
    Blob prk(SHA256_DIGEST_SIZE);
-    hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, prk.data());
+    hmacSha256Digest(&ctx, prk.data());
    return prk;
 }

@@ -2063,7 +2104,7 @@ hkdf_expand(const Blob& prk, const uint8_t* info, size_t info_len, size_t len)
        hmac_sha256_update(&ctx, info_len, info);
        hmac_sha256_update(&ctx, 1, &i);
        T.resize(SHA256_DIGEST_SIZE);
-        hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, T.data());
+        hmacSha256Digest(&ctx, T.data());
        okm.insert(okm.end(), T.begin(), T.end());
        i++;
    }
@@ -2223,7 +2264,7 @@ webPushEncrypt(const Blob& p256dh,

    Blob ciphertext(plaintext.size() + GCM_DIGEST_SIZE);
    gcm_aes128_encrypt(&aes, plaintext.size(), ciphertext.data(), plaintext.data());
-    gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ciphertext.data() + plaintext.size());
+    gcmAes128Digest(&aes, ciphertext.data() + plaintext.size());

    // 6. Construct Output
    Blob output;
@@ -35,6 +35,8 @@ Dht::updateStatus(sa_family_t af)
    auto& d = dht(af);
    auto old = d.status;
    d.status = d.getStatus(scheduler.time());
+    if (d.status == NodeStatus::Disconnected && bootstrap_pending && bootstrapJob && !bootstrap_nodes.empty())
+        d.status = NodeStatus::Connecting;
    if (d.status != old) {
        auto& other = dht(af == AF_INET ? AF_INET6 : AF_INET);
        if (other.status == NodeStatus::Disconnected && d.status == NodeStatus::Disconnected) {
@@ -166,6 +168,12 @@ Dht::getPublicAddress(sa_family_t family)
    return ret;
 }

+std::pair<size_t, size_t>
+Dht::getLocalStoreSize() const
+{
+    return {local_store_quota->size(), local_store_quota->valueCount()};
+}
+
 bool
 Dht::trySearchInsert(const Sp<Node>& node)
 {
@@ -379,7 +387,7 @@ Dht::paginate(std::weak_ptr<Search> ws, Sp<Query> query, SearchNode* n)
    n->pagination_queries[query].push_back(select_q);

    if (logger_)
-        logger_->debug("[search {}] [node {}] Sending {}", sr->id.to_view(), n->node->toString(), select_q->toString());
+        logger_->debug("[search {}] [node {}] Sending {}", sr->id.toString(), n->node->toString(), select_q->toString());
    n->getStatus[select_q] = network_engine.sendGetValues(
        n->node, sr->id, *select_q, -1, onSelectDone, std::bind(&Dht::searchNodeGetExpired, this, _1, _2, ws, select_q));
 }
@@ -648,6 +656,20 @@ Dht::searchSynchedNodeListen(const Sp<Search>& sr, SearchNode& n)
    for (const auto& l : sr->listeners) {
        const auto& query = l.second.query;

+        auto openListenSocket = [this, ws, query, node = n.node] {
+            return node->openSocket([this, ws, query](const Sp<Node>& node, net::RequestAnswer&& answer) mutable {
+                /* on new values */
+                if (auto sr = ws.lock()) {
+                    scheduler.edit(sr->nextSearchStep, scheduler.time());
+                    if (auto sn = sr->getNode(node)) {
+                        if (not answer.ntoken.empty())
+                            sn->refreshToken(answer.ntoken);
+                        sn->onValues(query, std::move(answer), types, scheduler);
+                    }
+                }
+            });
+        };
+
        auto r = n.listenStatus.find(query);
        if (n.getListenTime(r, listenExp) > scheduler.time())
            continue;
@@ -659,21 +681,7 @@ Dht::searchSynchedNodeListen(const Sp<Search>& sr, SearchNode& n)
            r = n.listenStatus
                    .emplace(std::piecewise_construct,
                             std::forward_as_tuple(query),
-                             std::forward_as_tuple(l.second.get_cb,
-                                                   l.second.sync_cb,
-                                                   n.node->openSocket([this,
-                                                                       ws,
-                                                                       query](const Sp<Node>& node,
-                                                                              net::RequestAnswer&& answer) mutable {
-                                                       /* on new values */
-                                                       if (auto sr = ws.lock()) {
-                                                           scheduler.edit(sr->nextSearchStep, scheduler.time());
-                                                           sr->insertNode(node, scheduler.time(), answer.ntoken);
-                                                           if (auto sn = sr->getNode(node)) {
-                                                               sn->onValues(query, std::move(answer), types, scheduler);
-                                                           }
-                                                       }
-                                                   })))
+                             std::forward_as_tuple(l.second.get_cb, l.second.sync_cb, openListenSocket()))
                    .first;
            r->second.cacheExpirationJob = scheduler.add(time_point::max(), [this, ws, query, node = n.node] {
                if (auto sr = ws.lock()) {
@@ -682,6 +690,8 @@ Dht::searchSynchedNodeListen(const Sp<Search>& sr, SearchNode& n)
                    }
                }
            });
+        } else if (not n.node->getSocket(r->second.socketId)) {
+            r->second.socketId = openListenSocket();
        }
        auto new_req = network_engine.sendListen(
            n.node,
@@ -883,10 +893,16 @@ Dht::search(const InfoHash& id,
            sr = std::make_shared<Search>();
            srs.emplace(id, sr);
        } else {
-            for (auto it = srs.begin(); it != srs.end();) {
+            for (auto it = srs.begin(); it != srs.end(); ++it) {
                auto& s = *it->second;
                if ((s.done or s.expired) and s.announce.empty() and s.listeners.empty()) {
                    sr = it->second;
+                    if (sr->nextSearchStep)
+                        scheduler.cancel(sr->nextSearchStep);
+                    if (sr->opExpirationJob)
+                        scheduler.cancel(sr->opExpirationJob);
+                    sr->clear();
+                    srs.erase(it);
                    break;
                }
            }
@@ -895,8 +911,11 @@ Dht::search(const InfoHash& id,
                    logger_->error("[search {} IPv{}] Maximum number of searches reached!",
                                   id.toString(),
                                   (af == AF_INET) ? '4' : '6');
+                if (dcb)
+                    dcb(false, {});
                return {};
            }
+            srs.emplace(id, sr);
        }
        sr->af = af;
        sr->tid = search_id++;
@@ -1402,11 +1421,19 @@ Dht::storageChanged(const InfoHash& id, Storage& st, const Sp<Value>& v, bool ne
 }

 bool
-Dht::storageStore(const InfoHash& id, const Sp<Value>& value, time_point created, const SockAddr& sa, bool permanent)
+Dht::storageStore(const InfoHash& id,
+                  const Sp<Value>& value,
+                  time_point created,
+                  const SockAddr& sa,
+                  bool permanent,
+                  time_point expiration)
 {
    const auto& now = scheduler.time();
    created = std::min(created, now);
-    auto expiration = permanent ? time_point::max() : created + getType(value->type).expiration;
+    if (expiration == time_point::min())
+        expiration = permanent ? time_point::max() : created + getType(value->type).expiration;
+    else if (not permanent)
+        expiration = std::min(expiration, created + getType(value->type).expiration);
    if (expiration < now)
        return false;

@@ -1421,8 +1448,22 @@ Dht::storageStore(const InfoHash& id, const Sp<Value>& value, time_point created
    }

    StorageBucket* store_bucket {nullptr};
+    bool is_local = !sa;
    if (sa)
-        store_bucket = &store_quota[sa];
+        store_bucket = &store_quota.try_emplace(sa, sa).first->second;
+    else
+        store_bucket = local_store_quota.get();
+
+    // Reject new local values if local storage limit is exceeded
+    if (is_local && max_local_store_size != STORAGE_LIMIT_UNLIMITED
+        && local_store_quota->size() + value->size() > max_local_store_size) {
+        if (logger_)
+            logger_->warn("[store {}] Rejecting local put: local storage limit exceeded ({}/{})",
+                          id.to_view(),
+                          local_store_quota->size(),
+                          max_local_store_size);
+        return false;
+    }

    auto store = st->second.store(id, value, created, expiration, store_bucket);
    if (auto vs = store.first) {
@@ -1432,7 +1473,7 @@ Dht::storageStore(const InfoHash& id, const Sp<Value>& value, time_point created
        if (not permanent) {
            vs->expiration_job = scheduler.add(expiration, std::bind(&Dht::expireStorage, this, id));
        }
-        if (total_store_size > max_store_size) {
+        if (total_store_size - local_store_quota->size() > max_store_size) {
            auto value = vs->data;
            auto value_diff = store.second.values_diff;
            auto value_edit = store.second.edited_values;
@@ -1483,8 +1524,8 @@ Dht::expireStore(decltype(store)::iterator i)
    const auto& id = i->first;
    auto& st = i->second;
    auto stats = st.expire(id, scheduler.time());
-    if (not stats.second.empty()) {
-        storageRemoved(id, st, stats.second, -stats.first);
+    if (not stats.expired_values.empty()) {
+        storageRemoved(id, st, stats.expired_values, -stats.size_diff);
    }
 }

@@ -1545,8 +1586,8 @@ Dht::expireStore()
            ++i;
    }

-    // remove more values if storage limit is exceeded
-    while (total_store_size > max_store_size) {
+    // remove more values if remote storage limit is exceeded
+    while (total_store_size - local_store_quota->size() > max_store_size) {
        // find IP using the most storage
        if (store_quota.empty()) {
            if (logger_)
@@ -1558,7 +1599,7 @@ Dht::expireStore()
            if (it->second.size() > largest->second.size())
                largest = it;
        }
-        if (largest != store_quota.end()) {
+        if (largest != store_quota.end() && !largest->second.empty()) {
            while (true) {
                auto exp_value = largest->second.getOldest();
                auto storage = store.find(exp_value.first);
@@ -1575,12 +1616,16 @@ Dht::expireStore()
                    }
                }
            }
+        } else {
+            if (logger_)
+                logger_->warn("No space left: remote data consumes all the quota!");
+            break;
        }
    }

    // remove unused quota entires
    for (auto i = store_quota.begin(); i != store_quota.end();) {
-        if (i->second.size() == 0)
+        if (i->second.empty())
            i = store_quota.erase(i);
        else
            ++i;
@@ -1811,21 +1856,32 @@ std::string
 Dht::getStorageLog() const
 {
    std::ostringstream out;
-    for (const auto& s : store)
-        out << printStorageLog(s);
+    for (const auto& s : store) {
+        const auto& st = s.second;
+        out << "Storage " << s.first << " " << st.listeners.size() << " list., " << st.valueCount() << " values, "
+            << printByteCount(st.totalSize()) << "\n";
+    }
    out << std::endl << std::endl;
    std::multimap<size_t, const SockAddr*> q_map;
    for (const auto& ip : store_quota)
        if (ip.second.size())
            q_map.emplace(ip.second.size(), &ip.first);
    for (auto ip = q_map.rbegin(); ip != q_map.rend(); ++ip)
-        out << "IP " << ip->second->toString() << " uses " << ip->first << " bytes" << std::endl;
+        out << "IP " << ip->second->toString() << " uses " << printByteCount(ip->first) << std::endl;
    out << std::endl;
    out << "Total " << store.size() << " storages, " << total_values << " values (";
    if (total_store_size < 1024)
        out << total_store_size << " bytes)";
-    else
-        out << (total_store_size / 1024) << " / " << (max_store_size / 1024) << " KB)";
+    else {
+        auto remote_store_size = total_store_size - local_store_quota->size();
+        out << (remote_store_size / 1024) << " / " << (max_store_size / 1024) << " KB remote, "
+            << (local_store_quota->size() / 1024) << " / ";
+        if (max_local_store_size == STORAGE_LIMIT_UNLIMITED)
+            out << "unlimited";
+        else
+            out << (max_local_store_size / 1024) << " KB";
+        out << " local)";
+    }
    out << std::endl;
    return out.str();
 }
@@ -1834,11 +1890,8 @@ std::string
 Dht::getStorageLog(const InfoHash& h) const
 {
    auto s = store.find(h);
-    if (s == store.end()) {
-        std::ostringstream out;
-        out << "Storage " << h << " empty" << std::endl;
-        return out.str();
-    }
+    if (s == store.end())
+        return fmt::format("Storage {} empty\n", h);
    return printStorageLog(*s);
 }

@@ -1848,8 +1901,14 @@ Dht::printStorageLog(const decltype(store)::value_type& s) const
    std::ostringstream out;
    using namespace std::chrono;
    const auto& st = s.second;
-    out << "Storage " << s.first << " " << st.listeners.size() << " list., " << st.valueCount() << " values ("
-        << st.totalSize() << " bytes)" << std::endl;
+    const auto& now = scheduler.time();
+    out << "Storage " << s.first << " " << st.listeners.size() << " list., " << st.valueCount() << " values, "
+        << printByteCount(st.totalSize()) << std::endl;
+    for (const auto& v : st.getValues()) {
+        out << "   Value " << v.data->id << " size: " << printByteCount(v.data->size())
+            << " created: " << print_time_relative(now, v.created)
+            << " expires: " << print_time_relative(now, v.expiration) << std::endl;
+    }
    if (not st.local_listeners.empty())
        out << "   " << st.local_listeners.size() << " local listeners" << std::endl;
    for (const auto& node_listeners : st.listeners) {
@@ -1939,8 +1998,10 @@ Dht::Dht(std::unique_ptr<net::DatagramSocket>&& sock,
    , myid(config.node_id ? config.node_id : InfoHash::getRandom(rd))
    , store()
    , store_quota()
+    , local_store_quota(std::make_unique<StorageBucket>())
    , max_store_keys(config.max_store_keys ? (int) config.max_store_keys : MAX_HASHES)
-    , max_store_size(config.max_store_size ? (int) config.max_store_size : DEFAULT_STORAGE_LIMIT)
+    , max_store_size(config.max_store_size ? (size_t) config.max_store_size : STORAGE_LIMIT_DEFAULT)
+    , max_local_store_size(config.max_local_store_size ? (size_t) config.max_local_store_size : STORAGE_LIMIT_UNLIMITED)
    , max_searches(config.max_searches ? (int) config.max_searches : MAX_SEARCHES)
    , network_engine(myid,
                     fromDhtConfig(config),
@@ -2140,7 +2201,7 @@ Dht::maintainStorage(decltype(store)::value_type& storage, bool force, const Don
    if (not want4 and not want6) {
        if (logger_)
            logger_->debug("Discarding storage values {}", storage.first.to_view());
-        auto diff = storage.second.clear();
+        auto diff = storage.second.clear(storage.first);
        total_store_size += diff.size_diff;
        total_values += diff.values_diff;
    }
@@ -2180,6 +2241,18 @@ void
 Dht::onConnected()
 {
    stopBootstrap();
+
+    auto restartSearches = [this](std::map<InfoHash, Sp<Search>>& searches) {
+        const auto& now = scheduler.time();
+        for (auto& srp : searches) {
+            auto& sr = *srp.second;
+            if (sr.done)
+                continue;
+            scheduler.edit(sr.nextSearchStep, now);
+        }
+    };
+    restartSearches(dht4.searches);
+    restartSearches(dht6.searches);
    auto callbacks = std::move(onConnectCallbacks_);
    while (not callbacks.empty()) {
        callbacks.front()();
@@ -2201,6 +2274,7 @@ Dht::bootstrap()
        return;
    if (logger_)
        logger_->debug("[{}] Bootstraping", myid.to_view());
+    bootstrap_pending = false;
    for (const auto& boootstrap : bootstrap_nodes) {
        try {
            auto ips = network_engine.getSocket()->resolve(boootstrap.first, boootstrap.second);
@@ -2227,6 +2301,7 @@ void
 Dht::startBootstrap()
 {
    stopBootstrap();
+    bootstrap_pending = !bootstrap_nodes.empty();
    bootstrapJob = scheduler.add(scheduler.time(), std::bind(&Dht::bootstrap, this));
 }

@@ -2234,6 +2309,7 @@ void
 Dht::stopBootstrap()
 {
    scheduler.cancel(bootstrapJob);
+    bootstrap_pending = false;
    bootstrap_period = BOOTSTRAP_PERIOD;
 }

@@ -2290,9 +2366,16 @@ Dht::exportValues() const
        const auto& vals = h.second.getValues();
        pk.pack_array(vals.size());
        for (const auto& v : vals) {
-            pk.pack_array(2);
+            pk.pack_array(4);
            pk.pack(v.created.time_since_epoch().count());
            v.data->msgpack_pack(pk);
+            if (const auto& store_addr = v.store_bucket ? v.store_bucket->getAddr() : SockAddr {}) {
+                pk.pack_bin(store_addr.getLength());
+                pk.pack_bin_body(reinterpret_cast<const char*>(store_addr.get()), store_addr.getLength());
+            } else {
+                pk.pack_bin(0);
+            }
+            pk.pack(v.expiration.time_since_epoch().count());
        }
        ve.second = {buffer.data(), buffer.data() + buffer.size()};
        e.push_back(std::move(ve));
@@ -2305,9 +2388,13 @@ Dht::importValues(const std::vector<ValuesExport>& import)
 {
    const auto& now = scheduler.time();

+    unsigned imported = 0, ignored = 0;
+    size_t imported_size = 0;
    for (const auto& value : import) {
-        if (value.second.empty())
+        if (value.second.empty()) {
+            ignored++;
            continue;
+        }

        try {
            msgpack::unpacked msg;
@@ -2320,25 +2407,53 @@ Dht::importValues(const std::vector<ValuesExport>& import)
                if (valel.type != msgpack::type::ARRAY or valel.via.array.size < 2)
                    throw msgpack::type_error();
                time_point val_time;
+                time_point expiration = time_point::min();
                Value tmp_val;
+                SockAddr store_addr;
                try {
                    val_time = time_point {
                        time_point::duration {valel.via.array.ptr[0].as<time_point::duration::rep>()}};
                    tmp_val.msgpack_unpack(valel.via.array.ptr[1]);
+                    if (valel.via.array.size >= 3) {
+                        auto addr_blob = valel.via.array.ptr[2].as<Blob>();
+                        if (not addr_blob.empty()) {
+                            store_addr = SockAddr(reinterpret_cast<const sockaddr*>(addr_blob.data()),
+                                                  static_cast<socklen_t>(addr_blob.size()));
+                        }
+                    }
+                    if (valel.via.array.size >= 4) {
+                        expiration = time_point {
+                            time_point::duration {valel.via.array.ptr[3].as<time_point::duration::rep>()}};
+                    }
                } catch (const std::exception&) {
                    if (logger_)
                        logger_->error("Error reading value at {}", value.first.to_view());
+                    ignored++;
                    continue;
                }
                val_time = std::min(val_time, now);
-                storageStore(value.first, std::make_shared<Value>(std::move(tmp_val)), val_time);
+                auto val_size = tmp_val.size();
+                if (storageStore(value.first,
+                                 std::make_shared<Value>(std::move(tmp_val)),
+                                 val_time,
+                                 store_addr,
+                                 false,
+                                 expiration)) {
+                    imported++;
+                    imported_size += val_size;
+                } else {
+                    ignored++;
+                }
            }
        } catch (const std::exception&) {
+            ignored++;
            if (logger_)
                logger_->error("Error reading values at {}", value.first.to_view());
            continue;
        }
    }
+    if (logger_)
+        logger_->debug("Imported {} values, {}, ignored {}", imported, dht::printByteCount(imported_size), ignored);
 }

 std::vector<NodeExport>
@@ -2423,6 +2538,17 @@ Dht::onError(Sp<net::Request> req, net::DhtProtocolException e)
                    continue;
                n->token.clear();
                n->last_get_reply = time_point::min();
+                for (auto& listen : n->listenStatus) {
+                    if (listen.second.req and listen.second.req->pending())
+                        n->node->cancelRequest(listen.second.req);
+                    listen.second.req = {};
+                    n->node->closeSocket(listen.second.socketId);
+                    if (listen.second.refresh) {
+                        listen.second.refresh->cancel();
+                        listen.second.refresh = {};
+                    }
+                    listen.second.cache.onSynced(false);
+                }
                searchSendGetValues(sr);
                scheduler.edit(sr->nextSearchStep, scheduler.time());
                break;
@@ -2579,11 +2705,13 @@ Dht::onListen(Sp<Node> node, const InfoHash& hash, const Blob& token, size_t soc
    }
    Query q = query;
    storageAddListener(hash, node, socket_id, std::move(q), version);
-    return {};
+    net::RequestAnswer answer {};
+    answer.ntoken = makeToken(node->getAddr(), false);
+    return answer;
 }

 void
-Dht::onListenDone(const Sp<Node>& /* node */, net::RequestAnswer& /* answer */, Sp<Search>& sr)
+Dht::onListenDone(const Sp<Node>& node, net::RequestAnswer& answer, Sp<Search>& sr)
 {
    // if (logger_)
    //     logger_->d(sr->id, node->id, "[search %s] [node %s] Got listen confirmation",
@@ -2591,6 +2719,9 @@ Dht::onListenDone(const Sp<Node>& /* node */, net::RequestAnswer& /* answer */,

    if (not sr->done) {
        const auto& now = scheduler.time();
+        if (not answer.ntoken.empty())
+            if (auto sn = sr->getNode(node))
+                sn->refreshToken(answer.ntoken);
        searchSendGetValues(sr);
        scheduler.edit(sr->nextSearchStep, now);
    }
@@ -195,7 +195,7 @@ DhtProxyClient::stop()
    if (not isDestroying_.exchange(true)) {
        std::shared_ptr<http::Resolver> resolver;
        {
-            std::lock_guard<std::mutex> l(resolverLock_);
+            std::lock_guard l(resolverLock_);
            resolver = std::move(resolver_);
        }
        if (resolver)
@@ -204,7 +204,7 @@ DhtProxyClient::stop()
        if (infoState_)
            infoState_->cancel = true;
        {
-            std::lock_guard<std::mutex> lock(requestLock_);
+            std::lock_guard lock(requestLock_);
            for (auto& request : requests_)
                request.second->cancel();
        }
@@ -219,7 +219,7 @@ DhtProxyClient::stop()
 std::vector<Sp<Value>>
 DhtProxyClient::getLocal(const InfoHash& k, const Value::Filter& filter) const
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto s = searches_.find(k);
    if (s == searches_.end())
        return {};
@@ -229,7 +229,7 @@ DhtProxyClient::getLocal(const InfoHash& k, const Value::Filter& filter) const
 Sp<Value>
 DhtProxyClient::getLocalById(const InfoHash& k, Value::Id id) const
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto s = searches_.find(k);
    if (s == searches_.end())
        return {};
@@ -239,7 +239,7 @@ DhtProxyClient::getLocalById(const InfoHash& k, Value::Id id) const
 void
 DhtProxyClient::cancelAllListeners()
 {
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    if (logger_)
        logger_->debug("[proxy:client] [listeners] [{} searches] cancel all", searches_.size());
    for (auto& s : searches_) {
@@ -266,7 +266,7 @@ DhtProxyClient::shutdown(ShutdownCallback cb, bool)
 NodeStatus
 DhtProxyClient::getStatus(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
    switch (af) {
    case AF_INET:
        return statusIpv4_;
@@ -280,7 +280,7 @@ DhtProxyClient::getStatus(sa_family_t af) const
 bool
 DhtProxyClient::isRunning(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
    switch (af) {
    case AF_INET:
        return statusIpv4_ != NodeStatus::Disconnected;
@@ -297,7 +297,7 @@ DhtProxyClient::periodic(const uint8_t*, size_t, SockAddr, const time_point& /*n
    // Exec all currently stored callbacks
    decltype(callbacks_) callbacks;
    {
-        std::lock_guard<std::mutex> lock(lockCallbacks_);
+        std::lock_guard lock(lockCallbacks_);
        callbacks = std::move(callbacks_);
    }
    for (auto& callback : callbacks)
@@ -357,7 +357,7 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
                }
                if (not values.empty() and cb) {
                    {
-                        std::lock_guard<std::mutex> lock(lockCallbacks_);
+                        std::lock_guard lock(lockCallbacks_);
                        callbacks_.emplace_back([opstate, cb, values = std::move(values)]() {
                            if (not opstate->stop.load() and not cb(values)) {
                                opstate->stop.store(true);
@@ -382,7 +382,7 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
            }
            if (donecb) {
                {
-                    std::lock_guard<std::mutex> lock(lockCallbacks_);
+                    std::lock_guard lock(lockCallbacks_);
                    callbacks_.emplace_back([donecb, opstate]() {
                        donecb(opstate->ok, {});
                        opstate->stop.store(true);
@@ -391,12 +391,12 @@ DhtProxyClient::get(const InfoHash& key, GetCallback cb, DoneCallback donecb, Va
                loopSignal_();
            }
            if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                requests_.erase(reqid);
            }
        });
        {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_[reqid] = request;
        }
        request->send();
@@ -419,7 +419,7 @@ DhtProxyClient::put(const InfoHash& key, Sp<Value> val, DoneCallback cb, time_po

    std::shared_ptr<std::atomic_bool> ok;
    if (permanent) {
-        std::lock_guard<std::mutex> lock(searchLock_);
+        std::lock_guard lock(searchLock_);
        ok = std::make_shared<std::atomic_bool>(true);
        auto& search = searches_[key];
        if (val->id) {
@@ -443,7 +443,7 @@ DhtProxyClient::put(const InfoHash& key, Sp<Value> val, DoneCallback cb, time_po
            if (ok)
                *ok = result;
            if (cb) {
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                callbacks_.emplace_back([cb, result]() { cb(result, {}); });
            }
            loopSignal_();
@@ -464,7 +464,7 @@ DhtProxyClient::handleRefreshPut(const asio::error_code& ec, InfoHash key, Value
    }
    if (logger_)
        logger_->debug("[proxy:client] [put] [refresh {}]", key.to_view());
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto search = searches_.find(key);
    if (search != searches_.end()) {
        auto p = search->second.puts.find(id);
@@ -480,7 +480,7 @@ DhtProxyClient::handleRefreshPut(const asio::error_code& ec, InfoHash key, Value
 std::shared_ptr<http::Request>
 DhtProxyClient::buildRequest(const std::string& target)
 {
-    std::unique_lock<std::mutex> l(resolverLock_);
+    std::unique_lock l(resolverLock_);
    auto resolver = resolver_;
    l.unlock();
    if (not resolver)
@@ -535,7 +535,7 @@ DhtProxyClient::doPut(const InfoHash& key, Sp<Value> val, DoneCallbackSimple cb,
                        auto id = dht::Value(parsedValue).id;
                        val->id = id;
                        if (permanent) {
-                            std::lock_guard<std::mutex> lock(searchLock_);
+                            std::lock_guard lock(searchLock_);
                            auto& search = searches_[key];
                            auto it = search.pendingPuts.find(val);
                            if (it != search.pendingPuts.end()) {
@@ -565,12 +565,12 @@ DhtProxyClient::doPut(const InfoHash& key, Sp<Value> val, DoneCallbackSimple cb,
            if (cb)
                cb(ok);
            if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                requests_.erase(reqid);
            }
        });
        {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_[reqid] = request;
        }
        request->send();
@@ -640,7 +640,7 @@ DhtProxyClient::getProxyInfos()
        logger_->debug("[proxy:client] [info] requesting proxy server node information");
    auto infoState = std::make_shared<InfoState>();
    {
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
        if (infoState_)
            infoState_->cancel = true;
        infoState_ = infoState;
@@ -655,7 +655,7 @@ DhtProxyClient::getProxyInfos()
    auto resolver = std::make_shared<http::Resolver>(httpContext_, proxyUrl_, logger_);
    queryProxyInfo(infoState, resolver, AF_INET);
    queryProxyInfo(infoState, resolver, AF_INET6);
-    std::lock_guard<std::mutex> l(resolverLock_);
+    std::lock_guard l(resolverLock_);
    resolver_ = resolver;
 }

@@ -701,7 +701,7 @@ DhtProxyClient::queryProxyInfo(const Sp<InfoState>& infoState, const Sp<http::Re
                }
            }
            if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                requests_.erase(reqid);
            }
        });
@@ -709,7 +709,7 @@ DhtProxyClient::queryProxyInfo(const Sp<InfoState>& infoState, const Sp<http::Re
        if (infoState->cancel.load())
            return;
        {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_[reqid] = request;
        }
        request->send();
@@ -724,10 +724,9 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
 {
    if (isDestroying_)
        return;
-    std::unique_lock<std::mutex> l(lockCurrentProxyInfos_);
+    std::unique_lock l(lockCurrentProxyInfos_);
    auto oldStatus = std::max(statusIpv4_, statusIpv6_);
    auto& status = family == AF_INET ? statusIpv4_ : statusIpv6_;
-    auto ipChanged = false;
    auto& pubAddress = family == AF_INET ? publicAddressV4_ : publicAddressV6_;
    auto& localAddress = family == AF_INET ? localAddrv4_ : localAddrv6_;
    if (not proxyInfos.isMember("node_id")) {
@@ -736,7 +735,6 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
        status = NodeStatus::Disconnected;
        if (pubAddress) {
            pubAddress = {};
-            ipChanged = true;
        }
    } else {
        if (logger_)
@@ -746,15 +744,14 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
            stats4_ = NodeStats(proxyInfos["ipv4"]);
            stats6_ = NodeStats(proxyInfos["ipv6"]);
            auto publicIp = parsePublicAddress(proxyInfos["public_ip"]);
-            ipChanged = pubAddress && pubAddress.toString() != publicIp.toString();
-            bool pub = ipChanged || !pubAddress;
+            bool pub = pubAddress != publicIp;
            pubAddress = publicIp;

            if (proxyInfos.isMember("local_ip")) {
                std::string localIp = proxyInfos["local_ip"].asString();
                if (localAddress.toString() != localIp) {
                    localAddress.setAddress(localIp.c_str());
-                    ipChanged = (bool) localAddress;
+                    pub = (bool) localAddress;
                }
            }

@@ -764,14 +761,14 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
                    addresses.emplace_back(publicAddressV4_);
                if (publicAddressV6_)
                    addresses.emplace_back(publicAddressV6_);
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                callbacks_.emplace_back(
                    [cb = publicAddressChangedCb_, addresses = std::move(addresses)]() { cb(std::move(addresses)); });
            }

-            if (!ipChanged && stats4_.good_nodes + stats6_.good_nodes)
+            if (stats4_.good_nodes + stats6_.good_nodes)
                status = NodeStatus::Connected;
-            else if (!ipChanged && stats4_.dubious_nodes + stats6_.dubious_nodes)
+            else if (stats4_.dubious_nodes + stats6_.dubious_nodes)
                status = NodeStatus::Connecting;
            else
                status = NodeStatus::Disconnected;
@@ -788,7 +785,7 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
            listenerRestartTimer_->expires_at(std::chrono::steady_clock::now());
            listenerRestartTimer_->async_wait(std::bind(&DhtProxyClient::restartListeners, this, std::placeholders::_1));
            if (not onConnectCallbacks_.empty()) {
-                std::lock_guard<std::mutex> lock(lockCallbacks_);
+                std::lock_guard lock(lockCallbacks_);
                callbacks_.emplace_back([cbs = std::move(onConnectCallbacks_)]() mutable {
                    while (not cbs.empty()) {
                        cbs.front()();
@@ -801,10 +798,7 @@ DhtProxyClient::onProxyInfos(const Json::Value& proxyInfos, const sa_family_t fa
        nextProxyConfirmationTimer_->async_wait(
            std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));
    } else if (newStatus == NodeStatus::Disconnected) {
-        auto next = std::chrono::steady_clock::now();
-        if (!ipChanged)
-            next += std::chrono::minutes(1);
-        nextProxyConfirmationTimer_->expires_at(next);
+        nextProxyConfirmationTimer_->expires_at(std::chrono::steady_clock::now() + std::chrono::minutes(1));
        nextProxyConfirmationTimer_->async_wait(
            std::bind(&DhtProxyClient::handleProxyConfirm, this, std::placeholders::_1));
    }
@@ -826,7 +820,7 @@ DhtProxyClient::parsePublicAddress(const Json::Value& val)
 std::vector<SockAddr>
 DhtProxyClient::getPublicAddress(sa_family_t family)
 {
-    std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+    std::lock_guard l(lockCurrentProxyInfos_);
    std::vector<SockAddr> result;
    if (publicAddressV6_ && family != AF_INET)
        result.emplace_back(publicAddressV6_);
@@ -843,7 +837,7 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
    if (isDestroying_)
        return 0;

-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto& search = searches_[key];
    auto query = std::make_shared<Query>(Select {}, std::move(where));
    return search.ops
@@ -880,7 +874,7 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
                                                       system_clock::time_point t) {
                if (opstate->stop)
                    return false;
-                std::lock_guard<std::mutex> lock(searchLock_);
+                std::lock_guard lock(searchLock_);
                auto s = searches_.find(key);
                if (s != searches_.end()) {
                    auto l = s->second.listeners.find(token);
@@ -909,11 +903,11 @@ DhtProxyClient::listen(const InfoHash& key, ValueCallback cb, Value::Filter filt
            if (deviceKey_.empty()) { // listen
                method = ListenMethod::LISTEN;
                header.method(restinio::http_method_get());
-                header.request_target("/key/" + key.toString() + "/listen");
+                header.request_target(fmt::format("/key/{}/listen", key.to_view()));
            } else {
                method = ListenMethod::SUBSCRIBE;
                header.method(restinio::http_method_subscribe());
-                header.request_target("/key/" + key.toString());
+                header.request_target(fmt::format("/key/{}", key.to_view()));
            }
            sendListen(header, l->second.cb, opstate, l->second, method);
            return token;
@@ -935,7 +929,7 @@ DhtProxyClient::handleResubscribe(const asio::error_code& ec,
    }
    if (opstate->stop)
        return;
-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto s = searches_.find(key);
    if (s != searches_.end()) {
        auto l = s->second.listeners.find(token);
@@ -954,7 +948,7 @@ DhtProxyClient::cancelListen(const InfoHash& key, size_t gtoken)
    if (logger_)
        logger_->debug("[proxy:client] [search {}] cancel listen {}", key.to_view(), gtoken);

-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    // find the listener in cache
    auto it = searches_.find(key);
    if (it == searches_.end())
@@ -985,7 +979,7 @@ DhtProxyClient::handleExpireListener(const asio::error_code& ec, const InfoHash&
    if (logger_)
        logger_->debug("[proxy:client] [listen {}] expire listener", key.to_view());

-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    auto search = searches_.find(key);
    if (search == searches_.end())
        return;
@@ -1021,12 +1015,12 @@ DhtProxyClient::handleExpireListener(const asio::error_code& ec, const InfoHash&
                            opFailed();
                    }
                    if (not isDestroying_) {
-                        std::lock_guard<std::mutex> l(requestLock_);
+                        std::lock_guard l(requestLock_);
                        requests_.erase(reqid);
                    }
                });
                {
-                    std::lock_guard<std::mutex> l(requestLock_);
+                    std::lock_guard l(requestLock_);
                    requests_[reqid] = request;
                }
                request->send();
@@ -1103,7 +1097,7 @@ DhtProxyClient::sendListen(const restinio::http_request_header_t& header,
                    if (cb) {
                        auto expired = json.get("expired", Json::Value(false)).asBool();
                        {
-                            std::lock_guard<std::mutex> lock(lockCallbacks_);
+                            std::lock_guard lock(lockCallbacks_);
                            callbacks_.emplace_back([cb, value, opstate, expired]() {
                                if (not opstate->stop.load()
                                    and not cb({value}, expired, system_clock::time_point::min()))
@@ -1130,12 +1124,12 @@ DhtProxyClient::sendListen(const restinio::http_request_header_t& header,
                    opFailed();
            }
            if (not isDestroying_) {
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                requests_.erase(reqid);
            }
        });
        {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_[reqid] = request;
        }
        request->add_on_status_callback([request, seconds = this->listenKeepIdle()](unsigned status_code) {
@@ -1159,7 +1153,7 @@ DhtProxyClient::opFailed()
    if (logger_)
        logger_->error("[proxy:client] proxy request failed");
    {
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
        statusIpv4_ = NodeStatus::Disconnected;
        statusIpv6_ = NodeStatus::Disconnected;
    }
@@ -1192,7 +1186,7 @@ DhtProxyClient::restartListeners(const asio::error_code& ec)
    if (logger_)
        logger_->d("[proxy:client] [listeners] refresh permanent puts");

-    std::lock_guard<std::mutex> lock(searchLock_);
+    std::lock_guard lock(searchLock_);
    for (auto& search : searches_) {
        const auto& key = search.first;
        for (auto& put : search.second.puts) {
@@ -1255,7 +1249,7 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
    {
        // If a push notification is received, the proxy is up and running
-        std::lock_guard<std::mutex> l(lockCurrentProxyInfos_);
+        std::lock_guard l(lockCurrentProxyInfos_);
        auto oldStatus = std::max(statusIpv4_, statusIpv6_);
        if (oldStatus != NodeStatus::Connected)
            launchConnectedCbs_ = true;
@@ -1270,7 +1264,7 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                logger_->debug("[proxy:client] [push] ignoring push for other session");
            return PushNotificationResult::IgnoredWrongSession;
        }
-        std::lock_guard<std::mutex> lock(searchLock_);
+        std::lock_guard lock(searchLock_);
        auto timeout = notification.find("timeout");
        if (timeout != notification.cend()) {
            InfoHash key(timeout->second);
@@ -1332,11 +1326,11 @@ DhtProxyClient::pushNotificationReceived([[maybe_unused]] const std::map<std::st
                        ids.emplace_back(std::stoull(substr));
                    }
                    {
-                        std::lock_guard<std::mutex> lockCb(lockCallbacks_);
+                        std::lock_guard lockCb(lockCallbacks_);
                        callbacks_.emplace_back([this, key, token, opstate, ids, sendTime]() {
                            if (opstate->stop)
                                return;
-                            std::lock_guard<std::mutex> lock(searchLock_);
+                            std::lock_guard lock(searchLock_);
                            auto s = searches_.find(key);
                            if (s == searches_.end())
                                return;
@@ -1382,7 +1376,7 @@ DhtProxyClient::resubscribe([[maybe_unused]] const InfoHash& key,

    restinio::http_request_header_t header;
    header.method(restinio::http_method_subscribe());
-    header.request_target("/" + key.toString());
+    header.request_target("/key/" + key.toString());
    if (!listener.refreshSubscriberTimer) {
        listener.refreshSubscriberTimer = std::make_unique<asio::steady_timer>(httpContext_);
    }
@@ -1428,17 +1422,20 @@ void
 DhtProxyClient::setPushNotificationToken([[maybe_unused]] const std::string& token)
 {
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
-    std::unique_lock<std::mutex> l(lockCurrentProxyInfos_);
-    if (deviceKey_ != token) {
+    {
+        std::unique_lock l(lockCurrentProxyInfos_);
+        if (deviceKey_ == token)
+            return;
        deviceKey_ = token;
-        if (statusIpv4_ == NodeStatus::Connected || statusIpv6_ == NodeStatus::Connected) {
-            if (logger_)
-                logger_->debug("[proxy:client] [push] token changed, resubscribing");
-            for (auto& search : searches_) {
-                for (auto& listener : search.second.listeners) {
-                    resubscribe(search.first, listener.first, listener.second);
-                }
-            }
+        if (!(statusIpv4_ == NodeStatus::Connected || statusIpv6_ == NodeStatus::Connected))
+            return;
+    }
+    if (logger_)
+        logger_->debug("[proxy:client] [push] token changed, resubscribing");
+    std::lock_guard lock(searchLock_);
+    for (auto& search : searches_) {
+        for (auto& listener : search.second.listeners) {
+            resubscribe(search.first, listener.first, listener.second);
        }
    }
 #endif
@@ -176,7 +176,7 @@ DhtProxyServer::ConnectionListener::state_changed(const restinio::connection_sta
 void
 DhtProxyServer::onConnectionClosed(restinio::connection_id_t id)
 {
-    std::lock_guard<std::mutex> lock(lockListener_);
+    std::lock_guard lock(lockListener_);
    auto it = listeners_.find(id);
    if (it != listeners_.end()) {
        dht_->cancelListen(it->second.hash, std::move(it->second.token));
@@ -381,13 +381,13 @@ DhtProxyServer::saveState(Os& stream)
    msgpack::packer<Os> pk(&stream);
    pk.pack_map(2);
    {
-        std::lock_guard<std::mutex> lock(lockSearchPuts_);
+        std::lock_guard lock(lockSearchPuts_);
        pk.pack("puts");
        pk.pack(puts_);
    }
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
    {
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
        pk.pack("pushListeners");
        pk.pack(pushListeners_);
    }
@@ -408,7 +408,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
            if (oh.get().type != msgpack::type::MAP)
                continue;
            if (auto puts = findMapValue(oh.get(), "puts"sv)) {
-                std::lock_guard<std::mutex> lock(lockSearchPuts_);
+                std::lock_guard lock(lockSearchPuts_);
                puts_ = puts->as<decltype(puts_)>();
                if (logger_)
                    logger_->debug("[proxy:server] Loading {} persistent puts", puts_.size());
@@ -432,7 +432,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                json["to"] = clientId;
                                json["vid"] = std::to_string(vid);
                                if (sessionCtx) {
-                                    std::lock_guard<std::mutex> l(sessionCtx->lock);
+                                    std::lock_guard l(sessionCtx->lock);
                                    json["s"] = sessionCtx->sessionId;
                                }
                                return json;
@@ -459,7 +459,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
            }
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
            if (auto pushListeners = findMapValue(oh.get(), "pushListeners"sv)) {
-                std::lock_guard<std::mutex> lock(lockListener_);
+                std::lock_guard lock(lockListener_);
                pushListeners_ = pushListeners->as<decltype(pushListeners_)>();
                if (logger_)
                    logger_->debug("[proxy:server] Loading {} push listeners", pushListeners_.size());
@@ -496,7 +496,7 @@ DhtProxyServer::loadState(Is& is, size_t size)
                                Json::Value json;
                                json["timeout"] = infoHash;
                                json["to"] = clientId;
-                                std::lock_guard<std::mutex> l(sessionCtx->lock);
+                                std::lock_guard l(sessionCtx->lock);
                                json["s"] = sessionCtx->sessionId;
                                return json;
                            };
@@ -546,7 +546,7 @@ DhtProxyServer::~DhtProxyServer()
        saveState(stateFile);
    }
    if (dht_) {
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
        for (auto& l : listeners_) {
            dht_->cancelListen(l.second.hash, std::move(l.second.token));
            if (l.second.response)
@@ -817,7 +817,7 @@ DhtProxyServer::listen(restinio::request_handle_t request, restinio::router::rou
        auto response = std::make_shared<ResponseByPartsBuilder>(
            initHttpResponse(request->create_response<ResponseByParts>()));
        response->flush();
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
        // save the listener to handle a disconnect
        auto& session = listeners_[request->connection_id()];
        session.hash = infoHash;
@@ -931,7 +931,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
            logger_->debug("[proxy:server] [subscribe {}] [client {}] [session {}]", infoHash, clientId, sessionId);

        // Insert new or return existing push listeners of a token
-        std::lock_guard<std::mutex> lock(lockListener_);
+        std::lock_guard lock(lockListener_);
        auto& pushListener = pushListeners_[pushToken];
        auto& pushListeners = pushListener.listeners[infoHash];

@@ -945,7 +945,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
            listIt->clientId = clientId;
            listIt->sessionCtx = std::make_shared<PushSessionContext>(sessionId);
        } else {
-            std::lock_guard<std::mutex> l(listIt->sessionCtx->lock);
+            std::lock_guard l(listIt->sessionCtx->lock);
            listIt->sessionCtx->sessionId = sessionId;
        }
        auto& listener = *listIt;
@@ -963,7 +963,7 @@ DhtProxyServer::subscribe(restinio::request_handle_t request, restinio::router::
            Json::Value json;
            json["timeout"] = h;
            json["to"] = clientId;
-            std::lock_guard<std::mutex> l(sessionCtx->lock);
+            std::lock_guard l(sessionCtx->lock);
            json["s"] = sessionCtx->sessionId;
            return json;
        };
@@ -1110,7 +1110,7 @@ DhtProxyServer::handleCancelPushListen(const asio::error_code& ec,
    }
    if (logger_)
        logger_->debug("[proxy:server] [listen:push {}] cancelled for {}", key, clientId);
-    std::lock_guard<std::mutex> lock(lockListener_);
+    std::lock_guard lock(lockListener_);

    auto pushListener = pushListeners_.find(pushToken);
    if (pushListener == pushListeners_.end())
@@ -1151,19 +1151,24 @@ DhtProxyServer::handlePushListen(const InfoHash& infoHash,
    json["t"] = Json::Value::Int64(duration_cast<milliseconds>(system_clock::now().time_since_epoch()).count());

    {
-        std::lock_guard<std::mutex> l(sessionCtx->lock);
+        std::lock_guard l(sessionCtx->lock);
        json["s"] = sessionCtx->sessionId;
    }

    // Build a comma-separated list of ids from the values. This is intended to be used when
    // streaming from the iOS notification extension in order to filter out unwanted values.
    std::string ids;
+    std::string pushTypes;
    for (const auto& value : values) {
-        if (!ids.empty())
+        if (!ids.empty()) {
            ids += ",";
+            pushTypes += ",";
+        }
+        pushTypes += value->pushType;
        ids += std::to_string(value->id);
    }
    json["ids"] = ids;
+    json["pt"] = pushTypes;

    // If message is expired copy the value ID to the `exp` field.
    // This is presumably used by the Android notification system.
@@ -1302,12 +1307,12 @@ DhtProxyServer::sendPushNotification(
            if (state == http::Request::State::DONE) {
                if (logger_ and response.status_code != 200)
                    logger_->error("[proxy:server] [notification] push failed: {}", response.status_code);
-                std::lock_guard<std::mutex> l(requestLock_);
+                std::lock_guard l(requestLock_);
                requests_.erase(reqid);
            }
        });
        {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_[reqid] = request;
        }
        request->send();
@@ -1330,7 +1335,7 @@ DhtProxyServer::sendPushNotification(
        if (logger_)
            logger_->error("[proxy:server] [notification] error send push: {}", e.what());
        if (reqid) {
-            std::lock_guard<std::mutex> l(requestLock_);
+            std::lock_guard l(requestLock_);
            requests_.erase(reqid);
        }
    }
@@ -1349,7 +1354,7 @@ DhtProxyServer::handleCancelPermamentPut(const asio::error_code& ec, const InfoH
    }
    if (logger_)
        logger_->debug("[proxy:server] [put {}] cancel permament put {}", key, vid);
-    std::lock_guard<std::mutex> lock(lockSearchPuts_);
+    std::lock_guard lock(lockSearchPuts_);
    auto sPuts = puts_.find(key);
    if (sPuts == puts_.end())
        return;
@@ -1406,7 +1411,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                    sessionId = pVal["session_id"].asString();
                    topic = pVal["topic"].asString();
                }
-                std::lock_guard<std::mutex> lock(lockSearchPuts_);
+                std::lock_guard lock(lockSearchPuts_);
                auto timeout = std::chrono::steady_clock::now() + proxy::OP_TIMEOUT;
                auto& sPuts = puts_[infoHash];
                if (value->id == Value::INVALID_ID) {
@@ -1423,7 +1428,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                                if (not pp.second.sessionCtx)
                                    pp.second.sessionCtx = std::make_shared<PushSessionContext>(sessionId);
                                else {
-                                    std::lock_guard<std::mutex> l(pp.second.sessionCtx->lock);
+                                    std::lock_guard l(pp.second.sessionCtx->lock);
                                    pp.second.sessionCtx->sessionId = sessionId;
                                }
                            }
@@ -1458,7 +1463,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                        if (not pput.sessionCtx)
                            pput.sessionCtx = std::make_shared<PushSessionContext>(sessionId);
                        else {
-                            std::lock_guard<std::mutex> l(pput.sessionCtx->lock);
+                            std::lock_guard l(pput.sessionCtx->lock);
                            pput.sessionCtx->sessionId = sessionId;
                        }
                    }
@@ -1475,7 +1480,7 @@ DhtProxyServer::put(restinio::request_handle_t request, restinio::router::route_
                        json["timeout"] = infoHash.toString();
                        json["to"] = clientId;
                        json["vid"] = std::to_string(vid);
-                        std::lock_guard<std::mutex> l(sessionCtx->lock);
+                        std::lock_guard l(sessionCtx->lock);
                        json["s"] = sessionCtx->sessionId;
                        return json;
                    };
@@ -76,7 +76,7 @@ DhtRunner::run(const char* ip4, const char* ip6, const char* service, Config& co
 void
 DhtRunner::run(const Config& config, Context&& context)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    auto expected = State::Idle;
    if (not running.compare_exchange_strong(expected, State::Running)) {
        if (context.logger)
@@ -141,7 +141,7 @@ DhtRunner::run(const Config& config, Context&& context)
            context.sock->setOnReceive([&](net::PacketList&& pkts) {
                net::PacketList ret;
                {
-                    std::lock_guard<std::mutex> lck(sock_mtx);
+                    std::lock_guard lck(sock_mtx);
                    rcv.splice(rcv.end(), std::move(pkts));
                    size_t dropped = 0;
                    while (rcv.size() > net::RX_QUEUE_MAX_SIZE) {
@@ -186,9 +186,6 @@ DhtRunner::run(const Config& config, Context&& context)
    if (context.certificateStore) {
        dht_->setLocalCertificateStore(std::move(context.certificateStore));
    }
-    if (context.certificateStorePkId) {
-        dht_->setLocalCertificateStore(std::move(context.certificateStorePkId));
-    }
    if (context.publicAddressChangedCb) {
        dht_->setOnPublicAddressChanged(std::move(context.publicAddressChangedCb));
    }
@@ -197,19 +194,19 @@ DhtRunner::run(const Config& config, Context&& context)
        return;
    dht_thread = std::thread([this]() {
        while (running != State::Idle) {
-            std::unique_lock<std::mutex> lk(dht_mtx);
+            std::unique_lock lk(dht_mtx);
            time_point wakeup = loop_();

            auto hasJobToDo = [this]() {
                if (running == State::Idle)
                    return true;
                {
-                    std::lock_guard<std::mutex> lck(sock_mtx);
+                    std::lock_guard lck(sock_mtx);
                    if (not rcv.empty())
                        return true;
                }
                {
-                    std::lock_guard<std::mutex> lck(storage_mtx);
+                    std::lock_guard lck(storage_mtx);
                    if (not pending_ops_prio.empty())
                        return true;
                    auto s = getStatus();
@@ -284,7 +281,7 @@ DhtRunner::run(const Config& config, Context&& context)
 void
 DhtRunner::shutdown(ShutdownCallback cb, bool stop)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    auto expected = State::Running;
    if (not running.compare_exchange_strong(expected, State::Stopping)) {
        if (expected == State::Stopping and ongoing_ops) {
@@ -344,7 +341,7 @@ DhtRunner::checkShutdown()
 {
    decltype(shutdownCallbacks_) cbs;
    {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
        if (running != State::Stopping or ongoing_ops)
            return false;
        cbs = std::move(shutdownCallbacks_);
@@ -359,7 +356,7 @@ void
 DhtRunner::join()
 {
    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
        if (running.exchange(State::Idle) == State::Idle)
            return;
        cv.notify_all();
@@ -378,7 +375,7 @@ DhtRunner::join()
        dht_thread.join();

    {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
        if (ongoing_ops and logger_) {
            logger_->warn("[runner {:p}] stopping with {:d} remaining ops", fmt::ptr(this), ongoing_ops.load());
        }
@@ -388,7 +385,7 @@ DhtRunner::join()
        shutdownCallbacks_.clear();
    }
    {
-        std::lock_guard<std::mutex> lck(dht_mtx);
+        std::lock_guard lck(dht_mtx);
        resetDht();
        status4 = NodeStatus::Disconnected;
        status6 = NodeStatus::Disconnected;
@@ -398,7 +395,7 @@ DhtRunner::join()
 SockAddr
 DhtRunner::getBound(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        if (auto sock = dht_->getSocket())
            return sock->getBound(af);
@@ -408,7 +405,7 @@ DhtRunner::getBound(sa_family_t af) const
 in_port_t
 DhtRunner::getBoundPort(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        if (auto sock = dht_->getSocket())
            return sock->getPort(af);
@@ -418,7 +415,7 @@ DhtRunner::getBoundPort(sa_family_t af) const
 void
 DhtRunner::dumpTables() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    dht_->dumpTables();
 }

@@ -443,7 +440,7 @@ DhtRunner::getNodeId() const
 std::pair<size_t, size_t>
 DhtRunner::getStoreSize() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (!dht_)
        return {};
    return dht_->getStoreSize();
@@ -452,16 +449,43 @@ DhtRunner::getStoreSize() const
 void
 DhtRunner::setStorageLimit(size_t limit)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (!dht_)
        throw std::runtime_error("dht is not running");
    return dht_->setStorageLimit(limit);
 }

+size_t
+DhtRunner::getStorageLimit() const
+{
+    std::lock_guard lck(dht_mtx);
+    if (!dht_)
+        throw std::runtime_error("dht is not running");
+    return dht_->getStorageLimit();
+}
+
+void
+DhtRunner::setLocalStorageLimit(size_t limit)
+{
+    std::lock_guard lck(dht_mtx);
+    if (!dht_)
+        throw std::runtime_error("dht is not running");
+    return dht_->setLocalStorageLimit(limit);
+}
+
+size_t
+DhtRunner::getLocalStorageLimit() const
+{
+    std::lock_guard lck(dht_mtx);
+    if (!dht_)
+        throw std::runtime_error("dht is not running");
+    return dht_->getLocalStorageLimit();
+}
+
 std::vector<NodeExport>
 DhtRunner::exportNodes() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (!dht_)
        return {};
    return dht_->exportNodes();
@@ -470,7 +494,7 @@ DhtRunner::exportNodes() const
 std::vector<ValuesExport>
 DhtRunner::exportValues() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (!dht_)
        return {};
    return dht_->exportValues();
@@ -479,7 +503,7 @@ DhtRunner::exportValues() const
 void
 DhtRunner::setLogger(const Sp<Logger>& logger)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    logger_ = logger;
    if (dht_)
        dht_->setLogger(logger);
@@ -488,7 +512,7 @@ DhtRunner::setLogger(const Sp<Logger>& logger)
 void
 DhtRunner::setLogFilter(const InfoHash& f)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        dht_->setLogFilter(f);
 }
@@ -496,21 +520,21 @@ DhtRunner::setLogFilter(const InfoHash& f)
 void
 DhtRunner::registerType(const ValueType& type)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    dht_->registerType(type);
 }

 void
 DhtRunner::registerInsecureType(const ValueType& type)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    dht_->registerInsecureType(type);
 }

 void
 DhtRunner::importValues(const std::vector<ValuesExport>& values)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    dht_->importValues(values);
 }

@@ -521,7 +545,7 @@ DhtRunner::getNodesStats(sa_family_t af,
                         unsigned* cached_return,
                         unsigned* incoming_return) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    const auto stats = dht_->getNodesStats(af);
    if (good_return)
        *good_return = stats.good_nodes;
@@ -537,25 +561,17 @@ DhtRunner::getNodesStats(sa_family_t af,
 NodeStats
 DhtRunner::getNodesStats(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getNodesStats(af);
 }

 NodeInfo
 DhtRunner::getNodeInfo() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
    NodeInfo info {};
-    if (dht_) {
-        info.id = dht_->getId();
-        info.node_id = dht_->getNodeId();
-        info.ipv4 = dht_->getNodesStats(AF_INET);
-        info.ipv6 = dht_->getNodesStats(AF_INET6);
-        if (auto sock = dht_->getSocket()) {
-            info.bound4 = sock->getBoundRef(AF_INET).getPort();
-            info.bound6 = sock->getBoundRef(AF_INET6).getPort();
-        }
-    }
+    std::lock_guard lck(dht_mtx);
+    if (dht_)
+        info = dht_->getNodeInfo();
    info.ongoing_ops = ongoing_ops;
    return info;
 }
@@ -563,21 +579,12 @@ DhtRunner::getNodeInfo() const
 void
 DhtRunner::getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)> cb)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    ongoing_ops++;
    pending_ops_prio.emplace([cb = std::move(cb), this](SecureDht& dht) {
        auto sinfo = std::make_shared<NodeInfo>();
-        auto& info = *sinfo;
-        info.id = dht.getId();
-        info.node_id = dht.getNodeId();
-        info.ipv4 = dht.getNodesStats(AF_INET);
-        info.ipv6 = dht.getNodesStats(AF_INET6);
-        std::tie(info.storage_size, info.storage_values) = dht.getStoreSize();
-        if (auto sock = dht.getSocket()) {
-            info.bound4 = sock->getBoundRef(AF_INET).getPort();
-            info.bound6 = sock->getBoundRef(AF_INET6).getPort();
-        }
-        info.ongoing_ops = ongoing_ops;
+        *sinfo = dht.getNodeInfo();
+        sinfo->ongoing_ops = ongoing_ops;
        cb(std::move(sinfo));
        opEnded();
    });
@@ -587,44 +594,44 @@ DhtRunner::getNodeInfo(std::function<void(std::shared_ptr<NodeInfo>)> cb)
 std::vector<unsigned>
 DhtRunner::getNodeMessageStats(bool in) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getNodeMessageStats(in);
 }

 std::string
 DhtRunner::getStorageLog() const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getStorageLog();
 }
 std::string
 DhtRunner::getStorageLog(const InfoHash& f) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getStorageLog(f);
 }
 std::string
 DhtRunner::getRoutingTablesLog(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getRoutingTablesLog(af);
 }
 std::string
 DhtRunner::getSearchesLog(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getSearchesLog(af);
 }
 std::string
 DhtRunner::getSearchLog(const InfoHash& f, sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    return dht_->getSearchLog(f, af);
 }
 std::vector<SockAddr>
 DhtRunner::getPublicAddress(sa_family_t af) const
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        return dht_->getPublicAddress(af);
    return {};
@@ -641,7 +648,7 @@ DhtRunner::getPublicAddressStr(sa_family_t af) const
 void
 DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_family_t af)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    ongoing_ops++;
    pending_ops_prio.emplace([cb = std::move(cb), this, af](SecureDht& dht) {
        cb(dht.getPublicAddress(af));
@@ -653,22 +660,14 @@ DhtRunner::getPublicAddress(std::function<void(std::vector<SockAddr>&&)> cb, sa_
 void
 DhtRunner::registerCertificate(const std::shared_ptr<crypto::Certificate>& cert)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    dht_->registerCertificate(cert);
 }

-void
-DhtRunner::setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-{
-    std::lock_guard<std::mutex> lck(dht_mtx);
-    if (dht_)
-        dht_->setLocalCertificateStore(std::forward<CertificateStoreQueryLegacy>(query_method));
-}
-
 void
 DhtRunner::setLocalCertificateStore(CertificateStoreQuery&& query_method)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        dht_->setLocalCertificateStore(std::forward<CertificateStoreQuery>(query_method));
 }
@@ -681,7 +680,7 @@ DhtRunner::loop_()

    decltype(pending_ops) ops {};
    {
-        std::lock_guard<std::mutex> lck(storage_mtx);
+        std::lock_guard lck(storage_mtx);
        auto s = getStatus();
        ops = (pending_ops_prio.empty()
               && (s == NodeStatus::Connected or s == NodeStatus::Disconnected or running == State::Stopping))
@@ -697,7 +696,7 @@ DhtRunner::loop_()
    decltype(rcv) received {};
    decltype(rcv) received_treated {};
    {
-        std::lock_guard<std::mutex> lck(sock_mtx);
+        std::lock_guard lck(sock_mtx);
        // move to stack
        received = std::move(rcv);
    }
@@ -732,7 +731,7 @@ DhtRunner::loop_()
    }

    if (not received_treated.empty()) {
-        std::lock_guard<std::mutex> lck(sock_mtx);
+        std::lock_guard lck(sock_mtx);
        if (rcv_free.size() < net::RX_QUEUE_MAX_SIZE)
            rcv_free.splice(rcv_free.end(), std::move(received_treated));
    }
@@ -756,7 +755,7 @@ DhtRunner::loop_()
 void
 DhtRunner::get(InfoHash hash, GetCallback vcb, DoneCallback dcb, Value::Filter f, Where w)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (dcb)
@@ -778,7 +777,7 @@ DhtRunner::get(const std::string& key, GetCallback vcb, DoneCallbackSimple dcb,
 void
 DhtRunner::query(const InfoHash& hash, QueryCallback cb, DoneCallback done_cb, Query q)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (done_cb)
@@ -796,7 +795,7 @@ std::future<size_t>
 DhtRunner::listen(InfoHash hash, ValueCallback vcb, Value::Filter f, Where w)
 {
    auto ret_token = std::make_shared<std::promise<size_t>>();
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        ret_token->set_value(0);
@@ -818,7 +817,7 @@ DhtRunner::listen(const std::string& key, GetCallback vcb, Value::Filter f, Wher
 void
 DhtRunner::cancelListen(InfoHash h, size_t token)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    if (running != State::Running)
        return;
    ongoing_ops++;
@@ -832,7 +831,7 @@ DhtRunner::cancelListen(InfoHash h, size_t token)
 void
 DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    if (running != State::Running)
        return;
    ongoing_ops++;
@@ -846,7 +845,7 @@ DhtRunner::cancelListen(InfoHash h, std::shared_future<size_t> ftoken)
 void
 DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -863,7 +862,7 @@ DhtRunner::put(InfoHash hash, Value&& value, DoneCallback cb, time_point created
 void
 DhtRunner::put(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, time_point created, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -886,7 +885,7 @@ DhtRunner::put(const std::string& key, Value&& value, DoneCallbackSimple cb, tim
 void
 DhtRunner::cancelPut(const InfoHash& h, Value::Id id)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops.emplace([=](SecureDht& dht) { dht.cancelPut(h, id); });
    cv.notify_all();
 }
@@ -894,7 +893,7 @@ DhtRunner::cancelPut(const InfoHash& h, Value::Id id)
 void
 DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops.emplace([=](SecureDht& dht) { dht.cancelPut(h, value->id); });
    cv.notify_all();
 }
@@ -902,7 +901,7 @@ DhtRunner::cancelPut(const InfoHash& h, const std::shared_ptr<Value>& value)
 void
 DhtRunner::putSigned(InfoHash hash, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -931,7 +930,7 @@ DhtRunner::putSigned(const std::string& key, Value&& value, DoneCallbackSimple c
 void
 DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -945,35 +944,6 @@ DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> va
    cv.notify_all();
 }

-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
-{
-    std::unique_lock<std::mutex> lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        if (cb)
-            cb(false, {});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([=, cb = std::move(cb), value = std::move(value)](SecureDht& dht) mutable {
-        dht.putEncrypted(hash, to, value, bindOpDoneCallback(std::move(cb)), permanent);
-    });
-    cv.notify_all();
-}
-
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
-}
-
-void
-DhtRunner::putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(InfoHash::get(key), to, std::forward<Value>(value), std::move(cb), permanent);
-}
-
 void
 DhtRunner::putEncrypted(InfoHash hash,
                        const std::shared_ptr<crypto::PublicKey>& to,
@@ -981,7 +951,7 @@ DhtRunner::putEncrypted(InfoHash hash,
                        DoneCallback cb,
                        bool permanent)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -1005,7 +975,7 @@ DhtRunner::putEncrypted(
 void
 DhtRunner::bootstrap(const std::string& host, const std::string& service)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops_prio.emplace([host, service](SecureDht& dht) mutable { dht.addBootstrap(host, service); });
    cv.notify_all();
 }
@@ -1013,7 +983,7 @@ DhtRunner::bootstrap(const std::string& host, const std::string& service)
 void
 DhtRunner::bootstrap(const std::string& hostService)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    auto [h, s] = splitPort(hostService);
    pending_ops_prio.emplace(
        [host = std::string(h), service = std::string(s)](SecureDht& dht) { dht.addBootstrap(host, service); });
@@ -1023,7 +993,7 @@ DhtRunner::bootstrap(const std::string& hostService)
 void
 DhtRunner::clearBootstrap()
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops_prio.emplace([](SecureDht& dht) mutable { dht.clearBootstrap(); });
    cv.notify_all();
 }
@@ -1035,7 +1005,7 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb)
        cb(false);
        return;
    }
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    ongoing_ops++;
    pending_ops_prio.emplace([cb = bindOpDoneCallback(std::move(cb)), nodes = std::move(nodes)](SecureDht& dht) mutable {
        auto rem = cb ? std::make_shared<std::pair<size_t, bool>>(nodes.size(), false) : nullptr;
@@ -1058,7 +1028,7 @@ DhtRunner::bootstrap(std::vector<SockAddr> nodes, DoneCallbackSimple cb)
 void
 DhtRunner::bootstrap(SockAddr addr, DoneCallbackSimple cb)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        if (cb)
@@ -1075,7 +1045,7 @@ DhtRunner::bootstrap(SockAddr addr, DoneCallbackSimple cb)
 void
 DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    if (running != State::Running)
        return;
    pending_ops_prio.emplace([id, address](SecureDht& dht) mutable { dht.insertNode(id, address); });
@@ -1085,7 +1055,7 @@ DhtRunner::bootstrap(const InfoHash& id, const SockAddr& address)
 void
 DhtRunner::bootstrap(std::vector<NodeExport> nodes)
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    if (running != State::Running)
        return;
    pending_ops_prio.emplace([nodes = std::move(nodes)](SecureDht& dht) {
@@ -1098,7 +1068,7 @@ DhtRunner::bootstrap(std::vector<NodeExport> nodes)
 void
 DhtRunner::connectivityChanged()
 {
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops_prio.emplace([=](SecureDht& dht) {
        dht.connectivityChanged();
 #ifdef OPENDHT_PEER_DISCOVERY
@@ -1109,29 +1079,10 @@ DhtRunner::connectivityChanged()
    cv.notify_all();
 }

-void
-DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb)
-{
-    std::unique_lock<std::mutex> lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        cb({});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([this, hash, cb = std::move(cb)](SecureDht& dht) {
-        dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt) {
-            cb(crt);
-            opEnded();
-        });
-    });
-    cv.notify_all();
-}
-
 void
 DhtRunner::findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)> cb)
 {
-    std::unique_lock<std::mutex> lck(storage_mtx);
+    std::unique_lock lck(storage_mtx);
    if (running != State::Running) {
        lck.unlock();
        return;
@@ -1157,7 +1108,7 @@ void
 DhtRunner::setProxyServer(const std::string& proxy, const std::string& pushNodeId)
 {
 #ifdef OPENDHT_PROXY_CLIENT
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (config_.proxy_server == proxy and config_.push_node_id == pushNodeId)
        return;
    config_.proxy_server = proxy;
@@ -1184,8 +1135,8 @@ DhtRunner::enableProxy(bool proxify)
            config_.client_identity,
            [this] {
                if (config_.threaded) {
-                    std::lock_guard<std::mutex> lck(storage_mtx);
-                    pending_ops_prio.emplace([=](SecureDht&) mutable {});
+                    std::lock_guard lck(storage_mtx);
+                    pending_ops_prio.emplace([](SecureDht&) {});
                    cv.notify_all();
                }
            },
@@ -1197,11 +1148,8 @@ DhtRunner::enableProxy(bool proxify)
            config_.push_platform,
            logger_);
        dht_ = std::make_unique<SecureDht>(std::move(dht_via_proxy), config_.dht_config, identityAnnouncedCb_, logger_);
-        // and use it
-        use_proxy = proxify;
-    } else {
-        use_proxy = proxify;
    }
+    use_proxy = proxify;
 #else
    if (proxify)
        throw std::runtime_error("DHT proxy requested but OpenDHT built without proxy support.");
@@ -1211,7 +1159,7 @@ DhtRunner::enableProxy(bool proxify)
 void
 DhtRunner::forwardAllMessages(bool forward)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
    if (dht_)
        dht_->forwardAllMessages(forward);
 }
@@ -1222,7 +1170,7 @@ DhtRunner::forwardAllMessages(bool forward)
 void
 DhtRunner::setPushNotificationToken(const std::string& token)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
    config_.push_token = token;
    if (dht_)
@@ -1235,7 +1183,7 @@ DhtRunner::setPushNotificationToken(const std::string& token)
 void
 DhtRunner::setPushNotificationTopic(const std::string& topic)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
    config_.push_topic = topic;
    if (dht_)
@@ -1248,7 +1196,7 @@ DhtRunner::setPushNotificationTopic(const std::string& topic)
 void
 DhtRunner::setPushNotificationPlatform(const std::string& platform)
 {
-    std::lock_guard<std::mutex> lck(dht_mtx);
+    std::lock_guard lck(dht_mtx);
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
    config_.push_platform = platform;
    if (dht_)
@@ -1264,7 +1212,7 @@ DhtRunner::pushNotificationReceived([[maybe_unused]] const std::map<std::string,
 #if defined(OPENDHT_PROXY_CLIENT) && defined(OPENDHT_PUSH_NOTIFICATIONS)
    auto ret_token = std::make_shared<std::promise<PushNotificationResult>>();
    auto future = ret_token->get_future();
-    std::lock_guard<std::mutex> lck(storage_mtx);
+    std::lock_guard lck(storage_mtx);
    pending_ops_prio.emplace([ret_token, this, data](SecureDht&) {
        if (dht_)
            ret_token->set_value(dht_->pushNotificationReceived(data));
@@ -239,7 +239,7 @@ Connection::~Connection()
 void
 Connection::close()
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    asio::error_code ec;
    if (ssl_socket_) {
        if (ssl_socket_->is_open())
@@ -490,7 +490,7 @@ ocspValidateResponse(const OscpRequestInfo& info,
 void
 Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::verify_mode verify_mode)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (ssl_socket_) {
        // Set SNI Hostname (many hosts need this to handshake successfully)
        SSL_set_tlsext_host_name(ssl_socket_->asio_ssl_stream().native_handle(), hostname.c_str());
@@ -499,9 +499,9 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
            ssl_socket_->asio_ssl_stream().set_verify_callback(
                [id = id_, logger = logger_, hostname, checkOcsp = checkOcsp_](bool preverified,
                                                                               asio::ssl::verify_context& ctx) -> bool {
-                    X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
                    if (logger) {
                        char subject_name[1024];
+                        X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
                        X509_NAME_oneline(X509_get_subject_name(cert), subject_name, 1024);
                        logger->debug("[connection:{:d}] verify {:s} compliance to RFC 2818:\n{:s}",
                                      id,
@@ -513,8 +513,13 @@ Connection::set_ssl_verification(const std::string& hostname, const asio::ssl::v
                    auto verifier = asio::ssl::host_name_verification(hostname);
                    bool verified = verifier(preverified, ctx);
                    auto verify_ec = X509_STORE_CTX_get_error(ctx.native_handle());
-                    if (verify_ec != 0 /*X509_V_OK*/ and logger)
-                        logger->error("[http::connection:{:d}] ssl verification error={:d} {}", id, verify_ec, verified);
+                    if (verify_ec != 0 /*X509_V_OK*/ and logger) {
+                        logger->error("[http::connection:{:d}] ssl verification error {:d}: {}. verified: {}",
+                                      id,
+                                      verify_ec,
+                                      X509_verify_cert_error_string(verify_ec),
+                                      verified);
+                    }
                    if (verified and checkOcsp) {
                        std::unique_ptr<stack_st_X509, void (*)(stack_st_X509*)> chain(X509_STORE_CTX_get1_chain(
                                                                                           ctx.native_handle()),
@@ -571,7 +576,7 @@ Connection::input()
 std::string
 Connection::read_bytes(size_t bytes)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (bytes == 0)
        bytes = read_buf_.in_avail();
    std::string content;
@@ -592,7 +597,7 @@ Connection::read_until(const char delim)
 void
 Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, ConnectHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!ssl_socket_ && !socket_) {
        cb(asio::error::operation_aborted, {});
        return;
@@ -624,7 +629,7 @@ Connection::async_connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, Conn
 void
 Connection::async_handshake(HandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (ssl_socket_) {
        std::weak_ptr<Connection> wthis = shared_from_this();
        ssl_socket_
@@ -658,7 +663,7 @@ Connection::async_handshake(HandlerCb cb)
 void
 Connection::async_write(BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!is_open()) {
        if (cb)
            asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -675,7 +680,7 @@ Connection::async_write(BytesHandlerCb cb)
 void
 Connection::async_read_until(const char* delim, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!is_open()) {
        if (cb)
            asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -692,7 +697,7 @@ Connection::async_read_until(const char* delim, BytesHandlerCb cb)
 void
 Connection::async_read_until(char delim, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!is_open()) {
        if (cb)
            asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -709,7 +714,7 @@ Connection::async_read_until(char delim, BytesHandlerCb cb)
 void
 Connection::async_read(size_t bytes, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!is_open()) {
        if (cb)
            asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -726,7 +731,7 @@ Connection::async_read(size_t bytes, BytesHandlerCb cb)
 void
 Connection::async_read_some(size_t bytes, BytesHandlerCb cb)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!is_open()) {
        if (cb)
            asio::post(ctx_, [cb]() { cb(asio::error::broken_pipe, 0); });
@@ -746,7 +751,7 @@ Connection::async_read_some(size_t bytes, BytesHandlerCb cb)
 void
 Connection::set_keepalive(uint32_t seconds)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!ssl_socket_ && !socket_)
        return;

@@ -866,7 +871,7 @@ Resolver::~Resolver()
 {
    decltype(cbs_) cbs;
    {
-        std::lock_guard<std::mutex> lock(mutex_);
+        std::lock_guard lock(mutex_);
        cbs = std::move(cbs_);
    }
    while (not cbs.empty()) {
@@ -902,7 +907,7 @@ filter(const std::vector<asio::ip::tcp::endpoint>& epts, sa_family_t family)
 void
 Resolver::add_callback(ResolverCb cb, sa_family_t family)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (!completed_)
        cbs_.emplace(family == AF_UNSPEC ? std::move(cb)
                                         : [cb, family](const asio::error_code& ec,
@@ -941,7 +946,7 @@ Resolver::resolve(std::string_view host, std::string_view service)
                                }
                                decltype(cbs_) cbs;
                                {
-                                    std::lock_guard<std::mutex> lock(mutex_);
+                                    std::lock_guard lock(mutex_);
                                    ec_ = ec;
                                    endpoints_ = std::vector<asio::ip::tcp::endpoint> {endpoints.begin(),
                                                                                       endpoints.end()};
@@ -1385,7 +1390,7 @@ Request::connect(std::vector<asio::ip::tcp::endpoint>&& endpoints, HandlerCb cb)
                             if (not sthis)
                                 return;
                             auto& this_ = *sthis;
-                             std::lock_guard<std::mutex> lock(this_.mutex_);
+                             std::lock_guard lock(this_.mutex_);
                             if (ec == asio::error::operation_aborted) {
                                 this_.terminate(ec);
                                 return;
@@ -1438,7 +1443,7 @@ Request::send()
        [wthis](const asio::error_code& ec, std::vector<asio::ip::tcp::endpoint> endpoints) {
            if (auto sthis = wthis.lock()) {
                auto& this_ = *sthis;
-                std::lock_guard<std::mutex> lock(this_.mutex_);
+                std::lock_guard lock(this_.mutex_);
                if (ec) {
                    if (this_.logger_)
                        this_.logger_->error("[http:request:{:d}] resolve error: {:s}", this_.id_, ec.message());
@@ -1513,7 +1518,7 @@ Request::terminate(const asio::error_code& ec)
 void
 Request::handle_request(const asio::error_code& ec)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (ec and ec != asio::error::eof) {
        terminate(ec);
        return;
@@ -1537,7 +1542,7 @@ Request::handle_request(const asio::error_code& ec)
 void
 Request::handle_response(const asio::error_code& ec, size_t /* n_bytes */)
 {
-    std::lock_guard<std::mutex> lock(mutex_);
+    std::lock_guard lock(mutex_);
    if (ec && ec != asio::error::eof) {
        terminate(ec);
        return;
@@ -1655,11 +1660,11 @@ const Response&
 Request::await()
 {
    std::mutex mtx;
-    std::unique_lock<std::mutex> lock(mtx);
+    std::unique_lock lock(mtx);
    std::condition_variable cv;
    bool ok {false};
    add_on_done_callback([&](const Response&) {
-        std::lock_guard<std::mutex> lk(mtx);
+        std::lock_guard lk(mtx);
        ok = true;
        cv.notify_all();
    });
@@ -78,7 +78,7 @@ void
 printLog(std::ostream& s, source_loc loc, std::string_view prefix, fmt::string_view format, fmt::format_args args)
 {
    auto num = duration_cast<log_precision>(steady_clock::now().time_since_epoch()).count();
-    fmt::print(s, "[{:06d}.{:06d}] {}", num / den, num % den, prefix);
+    fmt::print(s, "[{:06d}.{:06d}] [{:>16}:{:<5}] {}", num / den, num % den, loc.file, loc.line, prefix);
    fmt::vprint(s, format, args);
    s << std::endl;
 }
@@ -142,11 +142,14 @@ getSyslogLogger(const char* name)
    return std::make_shared<Logger>(
        [logfile](source_loc loc, LogLevel level, std::string_view prefix, std::string&& message) {
            syslog(syslogLevel(level),
-                   "%.*s%.*s",
+                   "%.*s:%u %.*s%.*s",
+                   (int) loc.file.size(),
+                   loc.file.data(),
+                   loc.line,
                   (int) prefix.size(),
                   prefix.data(),
                   (int) message.size(),
-                   message.c_str());
+                   message.data());
        });
 #else
    return getStdLogger();
@@ -298,6 +298,7 @@ NetworkEngine::clear()
        request.second->node->setExpired();
    }
    requests.clear();
+    partial_messages.clear();
 }

 void
@@ -487,10 +488,11 @@ NetworkEngine::processMessage(const uint8_t* buf, size_t buflen, SockAddr f)
                try {
                    // process the full message
                    process(std::move(pmsg_it->second.msg), from);
-                    partial_messages.erase(pmsg_it);
-                } catch (...) {
-                    return;
+                } catch (const std::exception& e) {
+                    if (logger_)
+                        logger_->warn("Error while processing partial message: {}", e.what());
                }
+                partial_messages.erase(pmsg_it);
            } else
                scheduler.add(now + RX_TIMEOUT, std::bind(&NetworkEngine::maintainRxBuffer, this, msg->tid));
        }
@@ -515,7 +517,9 @@ NetworkEngine::processMessage(const uint8_t* buf, size_t buflen, SockAddr f)
    if (msg->value_parts.empty()) {
        try {
            process(std::move(msg), from);
-        } catch (...) {
+        } catch (const std::exception& e) {
+            if (logger_)
+                logger_->warn("Error while processing message: {}", e.what());
            return;
        }
    } else {
@@ -699,7 +703,7 @@ NetworkEngine::process(std::unique_ptr<ParsedMessage>&& msg, const SockAddr& fro
                RequestAnswer answer
                    = onListen(node, msg->info_hash, msg->token, msg->socket_id, std::move(msg->query), msg->version);
                auto nnodes = bufferNodes(from.getFamily(), msg->info_hash, msg->want, answer.nodes4, answer.nodes6);
-                sendListenConfirmation(from, msg->tid);
+                sendListenConfirmation(from, msg->tid, answer.ntoken);
                break;
            }
            case MessageType::UpdateValue: {
@@ -1278,17 +1282,21 @@ NetworkEngine::sendListen(const Sp<Node>& n,
 }

 void
-NetworkEngine::sendListenConfirmation(const SockAddr& addr, Tid tid)
+NetworkEngine::sendListenConfirmation(const SockAddr& addr, Tid tid, const Blob& token)
 {
    msgpack::sbuffer buffer;
    msgpack::packer<msgpack::sbuffer> pk(&buffer);
    pk.pack_map(4 + (config.network ? 1 : 0) + (config.is_client ? 1 : 0));

    pk.pack(KEY_R);
-    pk.pack_map(2);
+    pk.pack_map(2 + (not token.empty() ? 1 : 0));
    pk.pack(KEY_REQ_ID);
    pk.pack(myid);
    insertAddr(pk, addr);
+    if (not token.empty()) {
+        pk.pack(KEY_REQ_TOKEN);
+        packToken(pk, token);
+    }

    pk.pack(KEY_TID);
    pk.pack(tid);
@@ -107,14 +107,14 @@ UdpSocket::UdpSocket(in_port_t port, const std::shared_ptr<Logger>& l)
    SockAddr bind6;
    bind6.setFamily(AF_INET6);
    bind6.setPort(port);
-    std::lock_guard<std::mutex> lk(lock);
+    std::lock_guard lk(lock);
    openSockets(bind4, bind6);
 }

 UdpSocket::UdpSocket(const SockAddr& bind4, const SockAddr& bind6, const std::shared_ptr<Logger>& l)
    : logger(l)
 {
-    std::lock_guard<std::mutex> lk(lock);
+    std::lock_guard lk(lock);
    openSockets(bind4, bind6);
 }

@@ -161,7 +161,7 @@ UdpSocket::sendTo(const SockAddr& dest, const uint8_t* data, size_t size, [[mayb
        if (logger)
            logger->d("Can't send message to %s: %s", dest.toString().c_str(), strerror(err));
        if (err == EPIPE || err == ENOTCONN || err == ECONNRESET) {
-            std::lock_guard<std::mutex> lk(lock);
+            std::lock_guard lk(lock);
            auto bind4 = std::move(bound4), bind6 = std::move(bound6);
            openSockets(bind4, bind6);
            return sendTo(dest, data, size, false);
@@ -286,13 +286,13 @@ UdpSocket::openSockets(const SockAddr& bind4, const SockAddr& bind6)
                        pkt.received = clock::now();
                        onReceived(std::move(pkts));
                    } else if (rc == -1) {
-                        if (logger)
-                            logger->e("Error receiving packet: %s", strerror(errno));
                        int err = errno;
+                        if (logger)
+                            logger->e("Error receiving packet: %s", strerror(err));
                        if (err == EPIPE || err == ENOTCONN || err == ECONNRESET) {
                            if (not running)
                                break;
-                            std::unique_lock<std::mutex> lk(lock, std::try_to_lock);
+                            std::unique_lock lk(lock, std::try_to_lock);
                            if (lk.owns_lock()) {
                                if (not running)
                                    break;
@@ -337,7 +337,7 @@ UdpSocket::openSockets(const SockAddr& bind4, const SockAddr& bind6)
            close(stop_readfd);
        if (stopfd != -1)
            close(stopfd);
-        std::unique_lock<std::mutex> lk(lock, std::try_to_lock);
+        std::unique_lock lk(lock, std::try_to_lock);
        if (lk.owns_lock()) {
            s4 = -1;
            s6 = -1;
@@ -210,6 +210,13 @@ SearchCache::cancelAll(const std::function<void(size_t)>& onCancel)
    ops.clear();
 }

+void
+SearchCache::clear()
+{
+    ops.clear();
+    nextExpiration_ = time_point::max();
+}
+
 time_point
 SearchCache::expire(const time_point& now, const std::function<void(size_t)>& onCancel)
 {
@@ -164,6 +164,7 @@ public:

    bool cancelListen(size_t gtoken, const time_point& now);
    void cancelAll(const std::function<void(size_t)>& onCancel);
+    void clear();

    time_point expire(const time_point& now, const std::function<void(size_t)>& onCancel);
    time_point getExpiration() const { return nextExpiration_; }
@@ -6,6 +6,7 @@
 #include "sockaddr.h"
 #include "net.h"

+#include <algorithm>
 #include <map>
 #include <string_view>

@@ -58,8 +59,12 @@ unpackTid(const msgpack::object& o)
    switch (o.type) {
    case msgpack::type::POSITIVE_INTEGER:
        return o.as<Tid>();
-    default:
-        return ntohl(*reinterpret_cast<const uint32_t*>(o.as<std::array<char, 4>>().data()));
+    default: {
+        auto arr = o.as<std::array<char, 4>>();
+        uint32_t val;
+        std::memcpy(&val, arr.data(), sizeof(val));
+        return ntohl(val);
+    }
    }
 }

@@ -95,9 +100,25 @@ struct ParsedMessage
    std::vector<Value::Id> expired_values {};
    /* index for fields values */
    std::vector<Sp<FieldValueIndex>> fields;
-    /** When part of the message header: {index -> (total size, {})}
-     *  When part of partial value data: {index -> (offset, part_data)} */
-    std::map<unsigned, std::pair<unsigned, Blob>> value_parts;
+    /** Tracks partial value reassembly for fragmented messages.
+     *  Populated from message header with total expected sizes. */
+    struct PartialValue
+    {
+        size_t total_size {0};
+        size_t received_bytes {0};
+        std::map<size_t, Blob> fragments {}; // offset -> fragment data
+        bool isComplete() const { return total_size > 0 && received_bytes == total_size; }
+        Blob reassemble() const
+        {
+            Blob result(total_size);
+            for (const auto& [offset, data] : fragments)
+                std::copy(data.begin(), data.end(), result.begin() + offset);
+            return result;
+        }
+    };
+    std::map<unsigned, PartialValue> value_parts;
+    /** When part of partial value data: {index -> (offset, part_data)} */
+    std::map<unsigned, std::pair<size_t, Blob>> fragment_parts;
    /* query describing a filter to apply on values. */
    Query query;
    /* states if ipv4 or ipv6 request */
@@ -118,17 +139,32 @@ bool
 ParsedMessage::append(const ParsedMessage& block)
 {
    bool ret(false);
-    for (const auto& ve : block.value_parts) {
-        auto part_val = value_parts.find(ve.first);
-        if (part_val == value_parts.end() || part_val->second.second.size() >= part_val->second.first)
+    for (const auto& [index, fragment] : block.fragment_parts) {
+        auto part_it = value_parts.find(index);
+        if (part_it == value_parts.end())
            continue;
-        // TODO: handle out-of-order packets
-        if (ve.second.first != part_val->second.second.size()) {
-            // std::cout << "skipping out-of-order packet" << std::endl;
+        auto& pv = part_it->second;
+        if (pv.isComplete())
            continue;
+        auto offset = fragment.first;
+        const auto& data = fragment.second;
+        if (data.empty() || offset > pv.total_size || data.size() > pv.total_size - offset)
+            continue;
+        // Check for overlap with existing fragments
+        auto it = pv.fragments.lower_bound(offset);
+        if (it != pv.fragments.end()) {
+            auto distance = it->first - offset;
+            if (distance < data.size())
+                continue;
        }
+        if (it != pv.fragments.begin()) {
+            auto prev = std::prev(it);
+            if (prev->second.size() > offset - prev->first)
+                continue;
+        }
+        pv.fragments.emplace(offset, data);
+        pv.received_bytes += data.size();
        ret = true;
-        part_val->second.second.insert(part_val->second.second.end(), ve.second.second.begin(), ve.second.second.end());
    }
    return ret;
 }
@@ -136,16 +172,14 @@ ParsedMessage::append(const ParsedMessage& block)
 bool
 ParsedMessage::complete()
 {
-    for (auto& e : value_parts) {
-        if (e.second.first > e.second.second.size()) {
-            // std::cout << "uncomplete part " << e.first << ": " << e.second.second.size() << "/" << e.second.first <<
-            // std::endl;
+    for (const auto& [index, pv] : value_parts) {
+        if (!pv.isComplete())
            return false;
-        }
    }
-    for (auto& e : value_parts) {
+    for (auto& [index, pv] : value_parts) {
+        auto assembled = pv.reassemble();
        msgpack::unpacked msg;
-        msgpack::unpack(msg, (const char*) e.second.second.data(), e.second.second.size());
+        msgpack::unpack(msg, (const char*) assembled.data(), assembled.size());
        values.emplace_back(std::make_shared<Value>(msg.get()));
    }
    return true;
@@ -233,7 +267,7 @@ ParsedMessage::msgpack_unpack(const msgpack::object& msg)
            auto d = findMapValue(vdat.val, "d"sv);
            if (not o or not d)
                continue;
-            value_parts.emplace(vdat.key.as<unsigned>(), std::pair<size_t, Blob>(o->as<size_t>(), unpackBlob(*d)));
+            fragment_parts.emplace(vdat.key.as<unsigned>(), std::pair<size_t, Blob>(o->as<size_t>(), unpackBlob(*d)));
        }
        return;
    }
@@ -324,7 +358,7 @@ ParsedMessage::msgpack_unpack(const msgpack::object& msg)
                // Skip oversize values with a small margin for header overhead
                if (packed_v.via.u64 > MAX_VALUE_SIZE + 32)
                    continue;
-                value_parts.emplace(i, std::make_pair(packed_v.via.u64, Blob {}));
+                value_parts[i].total_size = packed_v.via.u64;
            } else {
                try {
                    values.emplace_back(std::make_shared<Value>(parsedReq.values->via.array.ptr[i]));
@@ -123,7 +123,7 @@ PeerDiscovery::DomainPeerDiscovery::~DomainPeerDiscovery()
 void
 PeerDiscovery::DomainPeerDiscovery::startDiscovery(std::string_view type, ServiceDiscoveredCallback callback)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
    callbackmap_[std::string(type)] = callback;
    if (not drunning_) {
        drunning_ = true;
@@ -137,7 +137,7 @@ PeerDiscovery::DomainPeerDiscovery::startDiscovery(std::string_view type, Servic
 void
 PeerDiscovery::DomainPeerDiscovery::loopListener()
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
    if (not drunning_)
        return;
    sockFd_.async_receive_from(asio::buffer(receiveBuf_),
@@ -163,7 +163,7 @@ PeerDiscovery::DomainPeerDiscovery::loopListener()
                                                   continue;
                                               ServiceDiscoveredCallback cb;
                                               {
-                                                   std::lock_guard<std::mutex> lck(dmtx_);
+                                                   std::lock_guard lck(dmtx_);
                                                   if (drunning_) {
                                                       auto callback = callbackmap_.find(o.key.as<std::string_view>());
                                                       if (callback != callbackmap_.end())
@@ -189,7 +189,7 @@ PeerDiscovery::DomainPeerDiscovery::loopListener()
 void
 PeerDiscovery::DomainPeerDiscovery::query(const asio::ip::udp::endpoint& peer)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
    if (not drunning_)
        return;

@@ -209,7 +209,7 @@ PeerDiscovery::DomainPeerDiscovery::query(const asio::ip::udp::endpoint& peer)
 void
 PeerDiscovery::DomainPeerDiscovery::publish(const asio::ip::udp::endpoint& peer)
 {
-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
    if (not lrunning_)
        return;

@@ -229,7 +229,7 @@ PeerDiscovery::DomainPeerDiscovery::startPublish(std::string_view type, const ms
    msgpack::sbuffer pack_buf_c(pack_buf.size());
    pack_buf_c.write(pack_buf.data(), pack_buf.size());

-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
    messages_[std::string(type)] = std::move(pack_buf_c);
    reloadMessages();
    lrunning_ = true;
@@ -239,7 +239,7 @@ PeerDiscovery::DomainPeerDiscovery::startPublish(std::string_view type, const ms
 bool
 PeerDiscovery::DomainPeerDiscovery::stopDiscovery(std::string_view type)
 {
-    std::lock_guard<std::mutex> lck(dmtx_);
+    std::lock_guard lck(dmtx_);
    auto it = callbackmap_.find(type);
    if (it != callbackmap_.end()) {
        callbackmap_.erase(it);
@@ -253,7 +253,7 @@ PeerDiscovery::DomainPeerDiscovery::stopDiscovery(std::string_view type)
 bool
 PeerDiscovery::DomainPeerDiscovery::stopPublish(std::string_view type)
 {
-    std::lock_guard<std::mutex> lck(mtx_);
+    std::lock_guard lck(mtx_);
    auto it = messages_.find(type);
    if (it != messages_.end()) {
        messages_.erase(it);
@@ -282,11 +282,11 @@ void
 PeerDiscovery::DomainPeerDiscovery::stop()
 {
    {
-        std::lock_guard<std::mutex> lck(dmtx_);
+        std::lock_guard lck(dmtx_);
        stopDiscovery();
    }
    {
-        std::lock_guard<std::mutex> lck(mtx_);
+        std::lock_guard lck(mtx_);
        stopPublish();
    }
 }
@@ -97,19 +97,18 @@ std::vector<Sp<Node>>
 RoutingTable::findClosestNodes(const InfoHash id, time_point now, size_t count) const
 {
    std::vector<Sp<Node>> nodes;
-    nodes.reserve(count);
    auto bucket = findBucket(id);
-
    if (bucket == end()) {
        return nodes;
    }
+    nodes.reserve(count);

    auto sortedBucketInsert = [&](const Bucket& b) {
-        for (auto n : b.nodes) {
+        for (const auto& n : b.nodes) {
            if (not n->isGood(now))
                continue;

-            auto here = std::find_if(nodes.begin(), nodes.end(), [&id, &n](Sp<Node>& node) {
+            auto here = std::find_if(nodes.begin(), nodes.end(), [&id, &n](const Sp<Node>& node) {
                return id.xorCmp(n->id, node->id) < 0;
            });
            nodes.insert(here, n);
@@ -199,7 +198,7 @@ RoutingTable::onNewNode(
    if (confirm == 2)
        b->time = now;

-    for (auto& n : b->nodes) {
+    for (const auto& n : b->nodes) {
        if (n == node)
            return false;
    }
@@ -133,6 +133,16 @@ struct Dht::SearchNode
        return last_get_reply + Node::NODE_EXPIRE_TIME;
    }

+    /**
+     * Update the token without refreshing last_get_reply,
+     * so that periodic find_node/get requests still occur.
+     */
+    void refreshToken(const Blob& tok)
+    {
+        if (not tok.empty() and tok.size() <= 64)
+            token = tok;
+    }
+
    friend std::ostream& operator<<(std::ostream& s, const SearchNode& node)
    {
        s << "getStatus:" << node.getStatus.size() << " listenStatus:" << node.listenStatus.size()
@@ -836,6 +846,7 @@ struct Dht::Search
        listeners.clear();
        nodes.clear();
        nextSearchStep.reset();
+        cache.clear();
    }
 };

@@ -40,26 +40,12 @@ SecureDht::SecureDht(std::unique_ptr<DhtInterface> dht,
    registerInsecureType(CERTIFICATE_TYPE);

    if (certificate_) {
-        auto certId = certificate_->getId();
        auto certLongId = certificate_->getLongId();
-        if (key_ and (certId != key_->getPublicKey().getId() or certLongId != key_->getPublicKey().getLongId()))
+        if (key_ and (certLongId != key_->getPublicKey().getLongId()))
            throw DhtException("SecureDht: provided certificate doesn't match private key.");

-        auto cb = iacb ? [
-            this,
-            completedState = std::make_shared<std::pair<unsigned,bool>>(2, true),
-            iacb = std::move(iacb)
-        ](bool ok) {
-            if (logger_)
-                logger_->debug("SecureDht: certificate announcement {}", ok ? "succeeded" : "failed");
-            completedState->second = completedState->second and ok;
-            if (--completedState->first == 0)
-                iacb(completedState->second);
-        } : iacb;
-
-        dht_->addOnConnectedCallback([this, certId, certLongId, cb = std::move(cb)] {
-            dht_->put(certId, Value {CERTIFICATE_TYPE, *certificate_, 1}, cb, {}, true);
-            dht_->put(InfoHash::get(certLongId), Value {CERTIFICATE_TYPE, *certificate_, 1}, cb, {}, true);
+        dht_->addOnConnectedCallback([this, certLongId, cb = std::move(iacb)]() mutable {
+            dht_->put(InfoHash::get(certLongId), Value {CERTIFICATE_TYPE, *certificate_, 1}, std::move(cb), {}, true);
        });
    }
 }
@@ -110,37 +96,13 @@ SecureDht::secureType(ValueType&& type)
    return type;
 }

-Sp<crypto::Certificate>
-SecureDht::getCertificate(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_;
-    auto it = nodesCertificates_.find(node);
-    if (it == nodesCertificates_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
-Sp<crypto::PublicKey>
-SecureDht::getPublicKey(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeys_.find(node);
-    if (it == nodesPubKeys_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
 Sp<crypto::Certificate>
 SecureDht::getCertificate(const PkId& node) const
 {
    if (node == getLongId())
        return certificate_;
-    auto it = nodesCertificatesLong_.find(node);
-    if (it == nodesCertificatesLong_.end())
+    auto it = nodesCertificates_.find(node);
+    if (it == nodesCertificates_.end())
        return nullptr;
    else
        return it->second;
@@ -151,8 +113,8 @@ SecureDht::getPublicKey(const PkId& node) const
 {
    if (node == getLongId())
        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeysLong_.find(node);
-    if (it == nodesPubKeysLong_.end())
+    auto it = nodesPubKeys_.find(node);
+    if (it == nodesPubKeys_.end())
        return nullptr;
    else
        return it->second;
@@ -205,85 +167,10 @@ void
 SecureDht::registerCertificate(const Sp<crypto::Certificate>& cert)
 {
    if (cert) {
-        nodesCertificates_[cert->getId()] = cert;
-        nodesCertificatesLong_[cert->getLongId()] = cert;
+        nodesCertificates_[cert->getLongId()] = cert;
    }
 }

-void
-SecureDht::findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
-{
-    Sp<crypto::Certificate> b = getCertificate(node);
-    if (b && *b) {
-        if (logger_)
-            logger_->debug("Using certificate from cache for {}", node.toString());
-        if (cb)
-            cb(b);
-        return;
-    }
-    if (localQueryMethodLegacy_) {
-        auto res = localQueryMethodLegacy_(node);
-        if (not res.empty()) {
-            if (logger_)
-                logger_->debug("Registering certificate from local store for {}", node.toString());
-            nodesCertificates_.emplace(node, res.front());
-            nodesCertificatesLong_.emplace(res.front()->getLongId(), res.front());
-            if (cb)
-                cb(res.front());
-            return;
-        }
-    }
-
-    auto found = std::make_shared<bool>(false);
-    dht_->get(
-        node,
-        [cb, node, found, this](const std::vector<Sp<Value>>& vals) {
-            for (const auto& v : vals) {
-                if (auto cert = registerCertificate(node, v->data)) {
-                    *found = true;
-                    if (logger_)
-                        logger_->debug("Found certificate for {}", node.toString());
-                    if (cb)
-                        cb(cert);
-                    return false;
-                }
-            }
-            return !*found;
-        },
-        [cb, found](bool) {
-            if (!*found and cb)
-                cb(nullptr);
-        },
-        Value::TypeFilter(CERTIFICATE_TYPE));
-}
-
-void
-SecureDht::findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb)
-{
-    auto pk = getPublicKey(node);
-    if (pk && *pk) {
-        if (logger_)
-            logger_->debug("Found public key from cache for {}", node.toString());
-        if (cb)
-            cb(pk);
-        return;
-    }
-    findCertificate(node, [=](const Sp<crypto::Certificate>& crt) {
-        if (crt && *crt) {
-            auto pk = crt->getSharedPublicKey();
-            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
-                if (cb)
-                    cb(pk);
-                return;
-            }
-        }
-        if (cb)
-            cb(nullptr);
-    });
-}
-
 void
 SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
 {
@@ -301,8 +188,7 @@ SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<c
        if (not res.empty()) {
            if (logger_)
                logger_->debug("Registering certificate from local store for {}", node.to_c_str());
-            nodesCertificates_.emplace(res.front()->getId(), res.front());
-            nodesCertificatesLong_.emplace(node, res.front());
+            nodesCertificates_.emplace(node, res.front());
            if (cb)
                cb(res.front());
            return;
@@ -347,8 +233,7 @@ SecureDht::findPublicKey(const PkId& node, const std::function<void(const Sp<cry
        if (crt && *crt) {
            auto pk = crt->getSharedPublicKey();
            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
+                nodesPubKeys_[pk->getLongId()] = pk;
                if (cb)
                    cb(pk);
                return;
@@ -376,8 +261,7 @@ SecureDht::checkValue(const Sp<Value>& v)
            if (auto decrypted_val = v->decrypt(*key_)) {
                auto cacheValue = not isDecrypted and decrypted_val->owner;
                if (cacheValue) {
-                    nodesPubKeys_[decrypted_val->owner->getId()] = decrypted_val->owner;
-                    nodesPubKeysLong_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
+                    nodesPubKeys_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
                }
                return decrypted_val;
            }
@@ -391,8 +275,7 @@ SecureDht::checkValue(const Sp<Value>& v)
        auto cacheValue = not v->isSignatureChecked() and enableCache_ and v->owner;
        if (v->checkSignature()) {
            if (cacheValue) {
-                nodesPubKeys_[v->owner->getId()] = v->owner;
-                nodesPubKeysLong_[v->owner->getLongId()] = v->owner;
+                nodesPubKeys_[v->owner->getLongId()] = v->owner;
            }
            return v;
        } else if (logger_)
@@ -506,35 +389,6 @@ SecureDht::putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback,
        Where().id(val->id));
 }

-void
-SecureDht::putEncrypted(const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent)
-{
-    if (not key_) {
-        if (callback)
-            callback(false, {});
-        return;
-    }
-    findPublicKey(to,
-                  [this, hash, val = std::move(val), callback = std::move(callback), permanent](
-                      const Sp<crypto::PublicKey>& pk) {
-                      if (!pk || !*pk) {
-                          if (callback)
-                              callback(false, {});
-                          return;
-                      }
-                      if (logger_)
-                          logger_->warn("Encrypting data for PK: {}", pk->getId().toString());
-                      try {
-                          dht_->put(hash, encrypt(*val, *pk), callback, time_point::max(), permanent);
-                      } catch (const std::exception& e) {
-                          if (logger_)
-                              logger_->error("Error putting encrypted data: {}", e.what());
-                          if (callback)
-                              callback(false, {});
-                      }
-                  });
-}
-
 void
 SecureDht::putEncrypted(const InfoHash& hash, const PkId& to, Sp<Value> val, DoneCallback callback, bool permanent)
 {
@@ -3,8 +3,9 @@
 #pragma once

 #include "infohash.h"
-#include "value.h"
 #include "listener.h"
+#include "sockaddr.h"
+#include "value.h"

 #include <map>
 #include <utility>
@@ -17,6 +18,11 @@ namespace dht {
 class StorageBucket
 {
 public:
+    StorageBucket() = default;
+    explicit StorageBucket(SockAddr addr)
+        : addr_(std::move(addr))
+    {}
+
    void insert(const InfoHash& id, const Value& value, time_point expiration)
    {
        totalSize_ += value.size();
@@ -50,12 +56,16 @@ public:
        insert(id, value, expiration);
    }
    size_t size() const { return totalSize_; }
+    size_t valueCount() const { return storedValues_.size(); }
+    bool empty() const { return storedValues_.empty(); }
    std::pair<InfoHash, Value::Id> getOldest() const
    {
        return storedValues_.empty() ? std::pair<InfoHash, Value::Id> {} : storedValues_.begin()->second;
    }
+    const SockAddr& getAddr() const { return addr_; }

 private:
+    SockAddr addr_ {};
    std::multimap<time_point, std::pair<InfoHash, Value::Id>> storedValues_;
    size_t totalSize_ {0};
 };
@@ -110,7 +120,7 @@ struct Storage

    bool empty() const { return values.empty(); }

-    StoreDiff clear();
+    StoreDiff clear(const InfoHash& id);

    size_t valueCount() const { return values.size(); }

@@ -179,7 +189,12 @@ struct Storage

    Sp<Value> remove(const InfoHash& id, Value::Id);

-    std::pair<ssize_t, std::vector<Sp<Value>>> expire(const InfoHash& id, time_point now);
+    struct ExpireResult
+    {
+        ssize_t size_diff;
+        std::vector<Sp<Value>> expired_values;
+    };
+    ExpireResult expire(const InfoHash& id, time_point now);

 private:
    Storage(const Storage&) = delete;
@@ -262,16 +277,22 @@ Storage::remove(const InfoHash& id, Value::Id vid)
 }

 Storage::StoreDiff
-Storage::clear()
+Storage::clear(const InfoHash& id)
 {
    ssize_t num_values = values.size();
    ssize_t tot_size = total_size;
+    for (auto& v : values) {
+        if (v.store_bucket)
+            v.store_bucket->erase(id, *v.data, v.expiration);
+        if (v.expiration_job)
+            v.expiration_job->cancel();
+    }
    values.clear();
    total_size = 0;
    return {-tot_size, -num_values, 0, 0};
 }

-std::pair<ssize_t, std::vector<Sp<Value>>>
+Storage::ExpireResult
 Storage::expire(const InfoHash& id, time_point now)
 {
    // expire listeners
@@ -78,6 +78,8 @@ ThreadPool::run(std::function<void()>&& cb)
                            break;
                        task = std::move(tasks_.front());
                        tasks_.pop();
+                        if (tasks_.empty() && stopping_)
+                            stopCv_.notify_one();
                    }

                    // run task
@@ -135,7 +137,9 @@ ThreadPool::stop(bool wait)
 {
    std::unique_lock l(lock_);
    if (wait) {
-        cv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = true;
+        stopCv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = false;
    }
    running_ = false;
    tasks_ = {};
@@ -71,7 +71,7 @@ SockAddr::resolve(const std::string& host, const std::string& service)
    addrinfo* info = nullptr;
    int rc = getaddrinfo(host.c_str(), service.empty() ? nullptr : service.c_str(), &hints, &info);
    if (rc != 0)
-        throw std::invalid_argument(std::string("Error: `") + host + ":" + service + "`: " + gai_strerror(rc));
+        throw std::invalid_argument(fmt::format("Error: `{}:{}`: {}", host, service, gai_strerror(rc)));

    for (addrinfo* infop = info; infop; infop = infop->ai_next)
        ips.emplace_back(infop->ai_addr, infop->ai_addrlen);
@@ -282,12 +282,6 @@ unpackBlob(const msgpack::object& o)
    }
 }

-msgpack::unpacked
-unpackMsg(Blob b)
-{
-    return msgpack::unpack((const char*) b.data(), b.size());
-}
-
 msgpack::object*
 findMapValue(const msgpack::object& map, const char* key, size_t key_length)
 {
@@ -302,4 +296,19 @@ findMapValue(const msgpack::object& map, const char* key, size_t key_length)
    return nullptr;
 }

+std::string
+printByteCount(size_t bytes)
+{
+    static constexpr std::string_view suffixes[] = {"B", "KB", "MB", "GB", "TB"};
+    size_t suffixIndex = 0;
+    double count = static_cast<double>(bytes);
+    while (count >= 1024 && suffixIndex < std::size(suffixes) - 1) {
+        count /= 1024;
+        suffixIndex++;
+    }
+    if (suffixIndex == 0)
+        return fmt::format("{} {}", bytes, suffixes[suffixIndex]);
+    return fmt::format("{:.2f} {} ({} bytes)", count, suffixes[suffixIndex], bytes);
+}
+
 } // namespace dht
@@ -85,7 +85,7 @@ ValueType::DEFAULT_STORE_POLICY(InfoHash, const std::shared_ptr<Value>& v, const
 size_t
 Value::size() const
 {
-    return cypher.size() + data.size() + signature.size() + user_type.size();
+    return cypher.size() + data.size() + signature.size() + user_type.size() + pushType.size();
 }

 void
@@ -104,9 +104,14 @@ Value::msgpack_unpack(const msgpack::object& o)
    } else
        throw msgpack::type_error();

+    priority = 0;
+    pushType.clear();
    if (auto rprio = findMapValue(o, VALUE_KEY_PRIO)) {
        priority = rprio->as<unsigned>();
    }
+    if (auto rpt = findMapValue(o, VALUE_KEY_PUSHTYPE)) {
+        pushType = rpt->as<std::string>();
+    }
 }

 void
@@ -261,6 +266,7 @@ Value::encrypt(const crypto::PrivateKey& from, const crypto::PublicKey& to)
    sign(from);
    Value nv {id};
    nv.priority = priority;
+    nv.pushType = pushType;
    nv.setCypher(to.encrypt(getToEncrypt()));
    return nv;
 }
@@ -1,9 +0,0 @@
-if ENABLE_TESTS
-bin_PROGRAMS = opendht_unit_tests
-
-AM_CPPFLAGS = -I../include -DOPENDHT_JSONCPP
-
-nobase_include_HEADERS = infohashtester.h valuetester.h cryptotester.h dhtrunnertester.h httptester.h dhtproxytester.h
-opendht_unit_tests_SOURCES = tests_runner.cpp cryptotester.cpp infohashtester.cpp valuetester.cpp dhtrunnertester.cpp httptester.cpp dhtproxytester.cpp
-opendht_unit_tests_LDFLAGS = -lopendht -lcppunit -ljsoncpp -L@top_builddir@/src/.libs @GnuTLS_LIBS@
-endif
@@ -1,473 +0,0 @@
-// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
-// SPDX-License-Identifier: MIT
-
-#include "dhtrunnertester.h"
-
-#include <opendht/thread_pool.h>
-
-#include <chrono>
-#include <mutex>
-#include <condition_variable>
-using namespace std::chrono_literals;
-using namespace std::literals;
-
-namespace test {
-CPPUNIT_TEST_SUITE_REGISTRATION(DhtRunnerTester);
-
-void
-DhtRunnerTester::setUp()
-{
-    dht::DhtRunner::Config config;
-    config.dht_config.node_config.max_peer_req_per_sec = -1;
-    config.dht_config.node_config.max_req_per_sec = -1;
-    config.dht_config.node_config.max_store_size = -1;
-    config.dht_config.node_config.max_store_keys = -1;
-
-    node1.run(0, config);
-    node2.run(0, config);
-    auto bound = node1.getBound();
-    if (bound.isUnspecified())
-        bound.setLoopback();
-    node2.bootstrap(bound);
-}
-
-void
-DhtRunnerTester::tearDown()
-{
-    unsigned done {0};
-    std::condition_variable cv;
-    std::mutex cv_m;
-    auto shutdown = [&] {
-        std::lock_guard lk(cv_m);
-        done++;
-        cv.notify_all();
-    };
-    node1.shutdown(shutdown);
-    node2.shutdown(shutdown);
-    std::unique_lock lk(cv_m);
-    CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return done == 2u; }));
-    node1.join();
-    node2.join();
-}
-
-void
-DhtRunnerTester::testConstructors()
-{
-    CPPUNIT_ASSERT(node1.getBoundPort());
-    CPPUNIT_ASSERT_EQUAL(node1.getBoundPort(), node1.getBound().getPort());
-    CPPUNIT_ASSERT(node2.getBoundPort());
-    CPPUNIT_ASSERT_EQUAL(node2.getBoundPort(), node2.getBound().getPort());
-
-    dht::DhtRunner::Config config {};
-    dht::DhtRunner::Context context {};
-    dht::DhtRunner testNode;
-    testNode.run(config, std::move(context));
-    CPPUNIT_ASSERT(testNode.getBoundPort());
-}
-
-void
-DhtRunnerTester::testGetPut()
-{
-    auto key = dht::InfoHash::get("123");
-    dht::Value val {"hey"};
-    auto val_data = val.data;
-    std::promise<bool> p;
-    node2.put(key, std::move(val), [&](bool ok) { p.set_value(ok); });
-    CPPUNIT_ASSERT(p.get_future().get());
-    auto vals = node1.get(key).get();
-    CPPUNIT_ASSERT(not vals.empty());
-    CPPUNIT_ASSERT(vals.front()->data == val_data);
-}
-
-void
-DhtRunnerTester::testPutDuplicate()
-{
-    auto key = dht::InfoHash::get("123");
-    auto val = std::make_shared<dht::Value>("hey");
-    val->id = 42;
-    auto val_data = val->data;
-    std::promise<bool> p1;
-    std::promise<bool> p2;
-    node2.put(key, val, [&](bool ok) { p1.set_value(ok); });
-    node2.put(key, val, [&](bool ok) { p2.set_value(ok); });
-    auto p1ret = p1.get_future().get();
-    auto p2ret = p2.get_future().get();
-    CPPUNIT_ASSERT(p1ret);
-    CPPUNIT_ASSERT(p2ret);
-    auto vals = node1.get(key).get();
-    CPPUNIT_ASSERT(not vals.empty());
-    CPPUNIT_ASSERT(vals.size() == 1);
-    CPPUNIT_ASSERT(vals.front()->data == val_data);
-}
-
-void
-DhtRunnerTester::testPutOverride()
-{
-    auto key = dht::InfoHash::get("123");
-    auto val = std::make_shared<dht::Value>("meh");
-    val->id = 42;
-    auto val2 = std::make_shared<dht::Value>("hey");
-    val2->id = 42;
-    CPPUNIT_ASSERT_EQUAL(val->id, val2->id);
-    auto val_data = val2->data;
-    std::promise<bool> p1;
-    std::promise<bool> p2;
-    node2.put(key, val, [&](bool ok) { p1.set_value(ok); });
-    node2.put(key, val2, [&](bool ok) { p2.set_value(ok); });
-    auto p1ret = p1.get_future().get();
-    auto p2ret = p2.get_future().get();
-    CPPUNIT_ASSERT(!p1ret);
-    CPPUNIT_ASSERT(p2ret);
-    auto vals = node1.get(key).get();
-    CPPUNIT_ASSERT(not vals.empty());
-    CPPUNIT_ASSERT(vals.size() == 1);
-    CPPUNIT_ASSERT(vals.front()->data == val_data);
-}
-
-void
-DhtRunnerTester::testListen()
-{
-    std::mutex mutex;
-    std::condition_variable cv;
-    std::atomic_uint valueCounta(0);
-    std::atomic_uint valueCountb(0);
-    std::atomic_uint valueCountc(0);
-    std::atomic_uint valueCountd(0);
-
-    unsigned putCount(0);
-    unsigned putOkCount1(0);
-    unsigned putOkCount2(0);
-    unsigned putOkCount3(0);
-
-    auto a = dht::InfoHash::get("234");
-    auto b = dht::InfoHash::get("2345");
-    auto c = dht::InfoHash::get("23456");
-    auto d = dht::InfoHash::get("234567");
-    constexpr unsigned N = 256;
-    constexpr unsigned SZ = 56 * 1024;
-
-    auto ftokena = node1.listen(a, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
-        if (expired)
-            valueCounta -= values.size();
-        else
-            valueCounta += values.size();
-        return true;
-    });
-
-    auto ftokenb = node1.listen(b, [&](const std::shared_ptr<dht::Value>&) {
-        /*if (expired)
-            valueCountb -= values.size();
-        else
-            valueCountb += values.size();*/
-        valueCountb++;
-        return false;
-    });
-
-    auto ftokenc = node1.listen(c, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
-        if (expired)
-            valueCountc -= values.size();
-        else
-            valueCountc += values.size();
-        return true;
-    });
-
-    auto ftokend = node1.listen(d, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
-        if (expired)
-            valueCountd -= values.size();
-        else
-            valueCountd += values.size();
-        return true;
-    });
-
-    std::vector<uint8_t> mtu;
-    mtu.reserve(SZ);
-    for (size_t i = 0; i < SZ; i++)
-        mtu.emplace_back((i % 2) ? 'T' : 'M');
-
-    for (unsigned i = 0; i < N; i++) {
-        node2.put(a, dht::Value("v1"), [&](bool ok) {
-            std::lock_guard lock(mutex);
-            putCount++;
-            if (ok)
-                putOkCount1++;
-            cv.notify_all();
-        });
-        node2.put(b, dht::Value("v2"), [&](bool ok) {
-            std::lock_guard lock(mutex);
-            putCount++;
-            if (ok)
-                putOkCount2++;
-            cv.notify_all();
-        });
-        auto bigVal = std::make_shared<dht::Value>();
-        bigVal->data = mtu;
-        node2.put(c, std::move(bigVal), [&](bool ok) {
-            std::lock_guard lock(mutex);
-            putCount++;
-            if (ok)
-                putOkCount3++;
-            cv.notify_all();
-        });
-    }
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N * 3u; }));
-        CPPUNIT_ASSERT_EQUAL(N, putOkCount1);
-        CPPUNIT_ASSERT_EQUAL(N, putOkCount2);
-        CPPUNIT_ASSERT_EQUAL(N, putOkCount3);
-    }
-
-    CPPUNIT_ASSERT(ftokena.valid());
-    CPPUNIT_ASSERT(ftokenb.valid());
-    CPPUNIT_ASSERT(ftokenc.valid());
-    CPPUNIT_ASSERT(ftokend.valid());
-
-    auto tokena = ftokena.get();
-    auto tokenc = ftokenc.get();
-    auto tokend = ftokend.get();
-    // tokenb might be 0 since the callback returns false.
-
-    CPPUNIT_ASSERT(tokena);
-    CPPUNIT_ASSERT(tokenc);
-    CPPUNIT_ASSERT(tokend);
-    CPPUNIT_ASSERT_EQUAL(N, valueCounta.load());
-    CPPUNIT_ASSERT_EQUAL(1u, valueCountb.load());
-    CPPUNIT_ASSERT_EQUAL(N, valueCountc.load());
-    CPPUNIT_ASSERT_EQUAL(0u, valueCountd.load());
-
-    node1.cancelListen(a, tokena);
-    node1.cancelListen(b, std::move(ftokenb));
-    node1.cancelListen(c, tokenc);
-    node1.cancelListen(d, tokend);
-}
-
-void
-DhtRunnerTester::testIdOps()
-{
-    std::mutex mutex;
-    std::condition_variable cv;
-    unsigned identityCount(0);
-    unsigned valueCount(0);
-    unsigned valueCountEdit(0);
-
-    dht::DhtRunner::Config config2;
-    config2.dht_config.node_config.max_peer_req_per_sec = -1;
-    config2.dht_config.node_config.max_req_per_sec = -1;
-    config2.dht_config.id = dht::crypto::generateIdentity();
-
-    dht::DhtRunner::Context context2;
-    context2.identityAnnouncedCb = [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        identityCount++;
-        cv.notify_all();
-    };
-
-    node2.join();
-    node2.run(42232, config2, std::move(context2));
-    auto bound = node1.getBound();
-    if (bound.isUnspecified())
-        bound.setLoopback();
-    node2.bootstrap(bound);
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return identityCount == 1; }));
-    }
-
-    node1.findCertificate(node2.getId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt) {
-        CPPUNIT_ASSERT(crt);
-        std::lock_guard lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 1u; }));
-        CPPUNIT_ASSERT_EQUAL(1u, identityCount);
-    }
-
-    dht::DhtRunner::Context context1;
-    context1.identityAnnouncedCb = [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        identityCount++;
-        cv.notify_all();
-    };
-
-    config2.dht_config.id = dht::crypto::generateIdentity();
-    node1.join();
-    node1.run(42222, config2, std::move(context1));
-    bound = node2.getBound();
-    if (bound.isUnspecified())
-        bound.setLoopback();
-    node1.bootstrap(bound);
-
-    auto key = dht::InfoHash::get("key");
-    node1.putEncrypted(key, node2.getId(), dht::Value("yo"), [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    node1.putEncrypted(key, node2.getPublicKey(), std::make_shared<dht::Value>("yo"), [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    node2.listen<std::string>(key, [&](std::string&& value) {
-        CPPUNIT_ASSERT_EQUAL("yo"s, value);
-        std::lock_guard lk(mutex);
-        valueCount++;
-        cv.notify_all();
-        return true;
-    });
-
-    auto key2 = dht::InfoHash::get("key2");
-    auto editValue = std::make_shared<dht::Value>("v1");
-    node1.putSigned(key2, editValue, [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        valueCountEdit++;
-        cv.notify_all();
-    });
-    node2.listen(key2, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool /*expired*/) {
-        for (const auto& v : values) {
-            if (v->seq == 0)
-                CPPUNIT_ASSERT_EQUAL("v1"s, dht::unpackMsg<std::string>(v->data));
-            else if (v->seq == 1)
-                CPPUNIT_ASSERT_EQUAL("v2"s, dht::unpackMsg<std::string>(v->data));
-            CPPUNIT_ASSERT_EQUAL(v->owner->getLongId(), node1.getPublicKey()->getLongId());
-        }
-        std::lock_guard lk(mutex);
-        valueCountEdit += values.size();
-        cv.notify_all();
-        return true;
-    });
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return identityCount == 2u; }));
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 5u; }));
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCountEdit == 2u; }));
-    }
-
-    node2.findCertificate(node1.getPublicKey()->getLongId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt) {
-        CPPUNIT_ASSERT(crt);
-        std::lock_guard lk(mutex);
-        valueCount++;
-        cv.notify_all();
-    });
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 6u; }));
-    }
-
-    // editValue->data = dht::packMsg("v2");
-    editValue = std::make_shared<dht::Value>(editValue->id);
-    editValue->data = dht::packMsg("v2");
-    node1.putSigned(key2, editValue, [&](bool ok) {
-        CPPUNIT_ASSERT(ok);
-        std::lock_guard lk(mutex);
-        valueCountEdit++;
-        cv.notify_all();
-    });
-    std::unique_lock lk(mutex);
-    CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCountEdit == 4u; }));
-}
-
-void
-DhtRunnerTester::testListenLotOfBytes()
-{
-    std::mutex mutex;
-    std::condition_variable cv;
-    std::atomic_uint valueCount(0);
-    unsigned putCount(0);
-    unsigned putOkCount(0);
-
-    std::string data(10000, 'a');
-
-    auto foo = dht::InfoHash::get("foo");
-    constexpr unsigned N = 1024;
-
-    for (unsigned i = 0; i < N; i++) {
-        node2.put(foo, data, [&](bool ok) {
-            std::lock_guard lock(mutex);
-            putCount++;
-            if (ok)
-                putOkCount++;
-            cv.notify_all();
-        });
-    }
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N; }));
-    }
-
-    dht::DhtRunner node3 {};
-    dht::DhtRunner::Config config;
-    config.dht_config.node_config.max_peer_req_per_sec = -1;
-    config.dht_config.node_config.max_req_per_sec = -1;
-    node3.run(42242, config);
-    auto bound = node1.getBound();
-    if (bound.isUnspecified())
-        bound.setLoopback();
-    node3.bootstrap(bound);
-
-    auto ftokenfoo = node3.listen(foo, [&](const std::shared_ptr<dht::Value>&) {
-        valueCount++;
-        cv.notify_all();
-        return true;
-    });
-
-    {
-        std::unique_lock lk(mutex);
-        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return valueCount == N; }));
-    }
-
-    node3.cancelListen(foo, ftokenfoo.get());
-}
-
-void
-DhtRunnerTester::testMultithread()
-{
-    std::mutex mutex;
-    std::condition_variable cv;
-    unsigned putCount(0);
-    unsigned putOkCount(0);
-
-    constexpr unsigned N = 2048;
-
-    for (unsigned i = 0; i < N; i++) {
-        dht::ThreadPool::computation().run([&] {
-            node2.put(dht::InfoHash::get("123" + std::to_string(i)), "hehe", [&](bool ok) {
-                std::lock_guard lock(mutex);
-                putCount++;
-                if (ok)
-                    putOkCount++;
-                cv.notify_all();
-            });
-            node2.get(
-                dht::InfoHash::get("123" + std::to_string(N - i - 1)),
-                [](const std::shared_ptr<dht::Value>&) { return true; },
-                [&](bool ok) {
-                    std::lock_guard lock(mutex);
-                    putCount++;
-                    if (ok)
-                        putOkCount++;
-                    cv.notify_all();
-                });
-        });
-    }
-    std::unique_lock lk(mutex);
-    CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == 2 * N; }));
-    CPPUNIT_ASSERT_EQUAL(2 * N, putOkCount);
-}
-
-} // namespace test
@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "cryptotester.h"
+#include "test_crypto.h"

 #include <opendht/crypto.h>

@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "dhtproxytester.h"
+#include "test_dhtproxy.h"

 // std
 #include <iostream>
@@ -57,11 +57,11 @@ DhtProxyTester::tearDown()
    std::condition_variable cv;
    std::mutex cv_m;
    nodeProxy->shutdown([&] {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        done = true;
        cv.notify_all();
    });
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&] { return done; }));
    serverProxy.reset();
    nodeProxy.reset();
@@ -81,11 +81,11 @@ DhtProxyTester::testGetPut()
    auto val_data = val.data;
    {
        nodePeer.put(key, std::move(val), [&](bool) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            done = true;
            cv.notify_all();
        });
-        std::unique_lock<std::mutex> lk(cv_m);
+        std::unique_lock lk(cv_m);
        CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&] { return done; }));
    }

@@ -101,7 +101,7 @@ DhtProxyTester::testListen()

    std::condition_variable cv;
    std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    auto key = dht::InfoHash::get("GLaDOs");
    bool done = false;

@@ -111,7 +111,7 @@ DhtProxyTester::testListen()
    auto firstVal_data = firstVal.data;
    nodePeer.put(key, std::move(firstVal), [&](bool ok) {
        CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        done = true;
        cv.notify_all();
    });
@@ -121,7 +121,7 @@ DhtProxyTester::testListen()
    std::vector<dht::Blob> values;
    auto token = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
        if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            for (const auto& value : v)
                values.emplace_back(value->data);
            done = true;
@@ -156,7 +156,7 @@ DhtProxyTester::testResubscribeGetValues()
    bool done = false;
    std::condition_variable cv;
    std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    auto key = dht::InfoHash::get("GLaDOs");

    // If a peer sent a value, the listen operation from the client
@@ -164,7 +164,7 @@ DhtProxyTester::testResubscribeGetValues()
    dht::Value firstVal {"Hey! It's been a long time. How have you been?"};
    auto firstVal_data = firstVal.data;
    nodePeer.put(key, std::move(firstVal), [&](bool ok) {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        CPPUNIT_ASSERT(ok);
        done = true;
        cv.notify_all();
@@ -186,7 +186,7 @@ DhtProxyTester::testResubscribeGetValues()
    std::vector<std::shared_ptr<dht::Value>> values;
    auto ftoken = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
        if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            values.insert(values.end(), v.begin(), v.end());
            done = true;
            cv.notify_all();
@@ -218,14 +218,14 @@ DhtProxyTester::testPutGet40KChars()
        mtu.emplace_back((i % 2) ? 'T' : 'M');
    std::condition_variable cv;
    std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    bool done_put = false;
    bool done_get = false;

    // Act
    dht::Value val {mtu};
    nodePeer.put(key, std::move(val), [&](bool ok) {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        done_put = ok;
        cv.notify_all();
    });
@@ -238,7 +238,7 @@ DhtProxyTester::testPutGet40KChars()
            return true;
        },
        [&](bool ok) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            done_get = ok;
            cv.notify_all();
        });
@@ -316,12 +316,12 @@ DhtProxyTester::testShutdownStop()
        std::mutex cv_m;
        nodeTest->shutdown(
            [&] {
-                std::lock_guard<std::mutex> lk(cv_m);
+                std::lock_guard lk(cv_m);
                done = true;
                cv.notify_all();
            },
            true);
-        std::unique_lock<std::mutex> lk(cv_m);
+        std::unique_lock lk(cv_m);
        CPPUNIT_ASSERT(cv.wait_for(lk, 10s, [&] { return done; }));
    }
    CPPUNIT_ASSERT_EQUAL(2 * C, callback_count.load());
@@ -0,0 +1,93 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_dhtproxy_client.h"
+
+#include <any>
+#include <mutex>
+
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wkeyword-macro"
+#elif defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wpedantic"
+#endif
+#define private public
+#include "opendht/http.h"
+#include "opendht/dht_proxy_client.h"
+#undef private
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#elif defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+#include "../src/op_cache.cpp"
+#include "../src/dht_proxy_client.cpp"
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(DhtProxyClientTester);
+
+using namespace dht;
+
+void
+DhtProxyClientTester::testResubscribeUsesKeyRoute()
+{
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+    DhtProxyClient client({}, {}, [] {}, "http://127.0.0.1:8080", "OpenDHT-Test", "client-id", "push-token");
+
+    DhtProxyClient::Listener listener {OpValueCache([](const std::vector<Sp<Value>>&, bool) { return true; })};
+    listener.opstate = std::make_shared<DhtProxyClient::OperationState>();
+    listener.cb = [](const std::vector<Sp<Value>>&, bool, system_clock::time_point) {
+        return true;
+    };
+
+    auto key = InfoHash::get("proxy-client-resubscribe");
+    client.resubscribe(key, 1, listener);
+
+    CPPUNIT_ASSERT(listener.request);
+    CPPUNIT_ASSERT_EQUAL(std::string("/key/") + key.toString(), std::string(listener.request->header_.request_target()));
+    CPPUNIT_ASSERT(listener.request->body_.find("\"refresh\"") != std::string::npos);
+    CPPUNIT_ASSERT(listener.request->body_.find("true") != std::string::npos);
+#else
+    CPPUNIT_ASSERT(true);
+#endif
+}
+
+void
+DhtProxyClientTester::testSetPushNotificationTokenResubscribesWithNewToken()
+{
+#ifdef OPENDHT_PUSH_NOTIFICATIONS
+    DhtProxyClient client({}, {}, [] {}, "http://127.0.0.1:8080", "OpenDHT-Test", "client-id", "old-token");
+
+    client.statusIpv4_ = NodeStatus::Connected;
+
+    auto key = InfoHash::get("proxy-client-token-rotation");
+    auto& search = client.searches_[key];
+    auto [it, inserted] = search.listeners.emplace(std::piecewise_construct,
+                                                   std::forward_as_tuple(1),
+                                                   std::forward_as_tuple(OpValueCache(
+                                                       [](const std::vector<Sp<Value>>&, bool) { return true; })));
+    CPPUNIT_ASSERT(inserted);
+
+    auto& listener = it->second;
+    listener.opstate = std::make_shared<DhtProxyClient::OperationState>();
+    listener.cb = [](const std::vector<Sp<Value>>&, bool, system_clock::time_point) {
+        return true;
+    };
+
+    client.setPushNotificationToken("new-token");
+
+    CPPUNIT_ASSERT(listener.request);
+    CPPUNIT_ASSERT_EQUAL(std::string("/key/") + key.toString(), std::string(listener.request->header_.request_target()));
+    CPPUNIT_ASSERT(listener.request->body_.find("new-token") != std::string::npos);
+    CPPUNIT_ASSERT(listener.request->body_.find("old-token") == std::string::npos);
+    CPPUNIT_ASSERT(listener.request->body_.find("\"refresh\"") != std::string::npos);
+    CPPUNIT_ASSERT(listener.request->body_.find("true") != std::string::npos);
+#else
+    CPPUNIT_ASSERT(true);
+#endif
+}
+
+} // namespace test
@@ -0,0 +1,22 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <cppunit/TestFixture.h>
+#include <cppunit/extensions/HelperMacros.h>
+
+namespace test {
+
+class DhtProxyClientTester : public CppUnit::TestFixture
+{
+    CPPUNIT_TEST_SUITE(DhtProxyClientTester);
+    CPPUNIT_TEST(testResubscribeUsesKeyRoute);
+    CPPUNIT_TEST(testSetPushNotificationTokenResubscribesWithNewToken);
+    CPPUNIT_TEST_SUITE_END();
+
+public:
+    void testResubscribeUsesKeyRoute();
+    void testSetPushNotificationTokenResubscribesWithNewToken();
+};
+
+} // namespace test
@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "dhtproxy_stress_tester.h"
+#include "test_dhtproxy_stress.h"

 #include <iostream>
 #include <string>
@@ -51,11 +51,11 @@ DhtProxyStressTester::tearDown()
    std::condition_variable cv;
    std::mutex cv_m;
    nodeProxy->shutdown([&] {
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        done = true;
        cv.notify_all();
    });
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    CPPUNIT_ASSERT(cv.wait_for(lk, 15s, [&] { return done; }));
    serverProxy.reset();
    nodeProxy.reset();
@@ -70,7 +70,7 @@ DhtProxyStressTester::testRepeatValues()

    std::condition_variable cv;
    std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    auto key = dht::InfoHash::get("GLaDOs");
    bool done = false;

@@ -80,7 +80,7 @@ DhtProxyStressTester::testRepeatValues()
    auto firstVal_data = firstVal.data;
    nodePeer.put(key, std::move(firstVal), [&](bool ok) {
        CPPUNIT_ASSERT(ok);
-        std::lock_guard<std::mutex> lk(cv_m);
+        std::lock_guard lk(cv_m);
        done = true;
        cv.notify_all();
    });
@@ -90,7 +90,7 @@ DhtProxyStressTester::testRepeatValues()
    std::vector<dht::Blob> values;
    auto token = nodeClient.listen(key, [&](const std::vector<std::shared_ptr<dht::Value>>& v, bool expired) {
        if (not expired) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            for (const auto& value : v)
                values.emplace_back(value->data);
            done = true;
@@ -132,7 +132,7 @@ DhtProxyStressTester::testRepeatValues()
        val->id = id++;
        nodePeer.put(key, val, [&](bool ok) {
            CPPUNIT_ASSERT(ok);
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            done = true;
            cv.notify_all();
        });
@@ -145,7 +145,7 @@ DhtProxyStressTester::testRepeatValues()
            if (not expired) {
                for (const auto& value : v) {
                    if (value->id == val->id) {
-                        std::lock_guard<std::mutex> lk(cv_m);
+                        std::lock_guard lk(cv_m);
                        done = true;
                        cv.notify_all();
                        break;
@@ -0,0 +1,889 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_dhtrunner.h"
+
+#include <opendht/thread_pool.h>
+
+#include <chrono>
+#include <future>
+#include <mutex>
+#include <condition_variable>
+using namespace std::chrono_literals;
+using namespace std::literals;
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(DhtRunnerTester);
+
+template<typename T>
+T
+getFutureValue(std::future<T> future, std::chrono::steady_clock::duration timeout = 30s)
+{
+    CPPUNIT_ASSERT(std::future_status::ready == future.wait_for(timeout));
+    return future.get();
+}
+
+void
+DhtRunnerTester::setUp()
+{
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    node1.run(0, config);
+    node2.run(0, config);
+    auto bound = node1.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node2.bootstrap(bound);
+}
+
+void
+DhtRunnerTester::tearDown()
+{
+    unsigned done {0};
+    std::condition_variable cv;
+    std::mutex cv_m;
+    auto shutdown = [&] {
+        std::lock_guard lk(cv_m);
+        done++;
+        cv.notify_all();
+    };
+    node1.shutdown(shutdown);
+    node2.shutdown(shutdown);
+    std::unique_lock lk(cv_m);
+    CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return done == 2u; }));
+    node1.join();
+    node2.join();
+}
+
+void
+DhtRunnerTester::testConstructors()
+{
+    CPPUNIT_ASSERT(node1.getBoundPort());
+    CPPUNIT_ASSERT_EQUAL(node1.getBoundPort(), node1.getBound().getPort());
+    CPPUNIT_ASSERT(node2.getBoundPort());
+    CPPUNIT_ASSERT_EQUAL(node2.getBoundPort(), node2.getBound().getPort());
+
+    dht::DhtRunner::Config config {};
+    dht::DhtRunner::Context context {};
+    dht::DhtRunner testNode;
+    testNode.run(config, std::move(context));
+    CPPUNIT_ASSERT(testNode.getBoundPort());
+}
+
+void
+DhtRunnerTester::testGetPut()
+{
+    auto key = dht::InfoHash::get("123");
+    dht::Value val {"hey"};
+    auto val_data = val.data;
+    std::promise<bool> p;
+    auto future = p.get_future();
+    node2.put(key, std::move(val), [&](bool ok) { p.set_value(ok); });
+    CPPUNIT_ASSERT(getFutureValue(std::move(future)));
+    auto vals = getFutureValue(node1.get(key));
+    CPPUNIT_ASSERT(not vals.empty());
+    CPPUNIT_ASSERT(vals.front()->data == val_data);
+}
+
+void
+DhtRunnerTester::testPutDuplicate()
+{
+    auto key = dht::InfoHash::get("123");
+    auto val = std::make_shared<dht::Value>("hey");
+    val->id = 42;
+    auto val_data = val->data;
+    std::promise<bool> p1;
+    std::promise<bool> p2;
+    auto p1future = p1.get_future();
+    auto p2future = p2.get_future();
+    node2.put(key, val, [&](bool ok) { p1.set_value(ok); });
+    node2.put(key, val, [&](bool ok) { p2.set_value(ok); });
+    auto p1ret = getFutureValue(std::move(p1future));
+    auto p2ret = getFutureValue(std::move(p2future));
+    CPPUNIT_ASSERT(p1ret);
+    CPPUNIT_ASSERT(p2ret);
+    auto vals = getFutureValue(node1.get(key));
+    CPPUNIT_ASSERT(not vals.empty());
+    CPPUNIT_ASSERT(vals.size() == 1);
+    CPPUNIT_ASSERT(vals.front()->data == val_data);
+}
+
+void
+DhtRunnerTester::testPutOverride()
+{
+    auto key = dht::InfoHash::get("123");
+    auto val = std::make_shared<dht::Value>("meh");
+    val->id = 42;
+    auto val2 = std::make_shared<dht::Value>("hey");
+    val2->id = 42;
+    CPPUNIT_ASSERT_EQUAL(val->id, val2->id);
+    auto val_data = val2->data;
+    std::promise<bool> p1;
+    std::promise<bool> p2;
+    auto p1future = p1.get_future();
+    auto p2future = p2.get_future();
+    node2.put(key, val, [&](bool ok) { p1.set_value(ok); });
+    node2.put(key, val2, [&](bool ok) { p2.set_value(ok); });
+    auto p1ret = getFutureValue(std::move(p1future));
+    auto p2ret = getFutureValue(std::move(p2future));
+    CPPUNIT_ASSERT(!p1ret);
+    CPPUNIT_ASSERT(p2ret);
+    auto vals = getFutureValue(node1.get(key));
+    CPPUNIT_ASSERT(not vals.empty());
+    CPPUNIT_ASSERT(vals.size() == 1);
+    CPPUNIT_ASSERT(vals.front()->data == val_data);
+}
+
+void
+DhtRunnerTester::testImportValuesPreservesRemoteQuota()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = 1536;
+    config.dht_config.node_config.max_local_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    node1.run(0, config);
+    node2.run(0, config);
+    auto bound = node1.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node2.bootstrap(bound);
+    std::this_thread::sleep_for(1s);
+
+    auto key1 = dht::InfoHash::get("import-quota-1");
+    auto key2 = dht::InfoHash::get("import-quota-2");
+    auto value1 = std::make_shared<dht::Value>(std::string(1024, 'a'));
+    auto value2 = std::make_shared<dht::Value>(std::string(1024, 'b'));
+
+    std::promise<bool> p1;
+    auto p1future = p1.get_future();
+    node2.put(key1, value1, [&](bool ok) { p1.set_value(ok); });
+    CPPUNIT_ASSERT(getFutureValue(std::move(p1future)));
+
+    std::this_thread::sleep_for(2s);
+    auto exported = node1.exportValues();
+    CPPUNIT_ASSERT(!exported.empty());
+
+    node1.shutdown();
+    node1.join();
+
+    dht::DhtRunner restored;
+    restored.run(0, config);
+    auto restoredBound = restored.getBound();
+    if (restoredBound.isUnspecified())
+        restoredBound.setLoopback();
+
+    node2.shutdown();
+    node2.join();
+    node2.run(0, config);
+    node2.bootstrap(restoredBound);
+    std::this_thread::sleep_for(1s);
+
+    restored.importValues(exported);
+    std::this_thread::sleep_for(500ms);
+
+    std::promise<bool> p2;
+    auto p2future = p2.get_future();
+    node2.put(key2, value2, [&](bool ok) { p2.set_value(ok); });
+    CPPUNIT_ASSERT(getFutureValue(std::move(p2future)));
+
+    std::this_thread::sleep_for(2s);
+
+    auto vals1 = getFutureValue(restored.get(key1));
+    auto vals2 = getFutureValue(restored.get(key2));
+    CPPUNIT_ASSERT(vals1.size() + vals2.size() <= 1);
+
+    restored.shutdown();
+    restored.join();
+}
+
+void
+DhtRunnerTester::testImportValuesPreservesStoredExpiration()
+{
+    static const dht::ValueType SHORT_LIVED_TYPE {200, "Short lived", 2s};
+
+    node1.registerInsecureType(SHORT_LIVED_TYPE);
+
+    auto key = dht::InfoHash::get("import-expiration");
+    auto now = dht::clock::now();
+    auto created = now;
+    auto expiration = now + SHORT_LIVED_TYPE.expiration;
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack_array(4);
+    pk.pack(created.time_since_epoch().count());
+    dht::Value {SHORT_LIVED_TYPE.id, std::string("short-lived")}.msgpack_pack(pk);
+    pk.pack_bin(0);
+    pk.pack(expiration.time_since_epoch().count());
+
+    node1.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    auto exported = node1.exportValues();
+    CPPUNIT_ASSERT(!exported.empty());
+
+    dht::DhtRunner restored;
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+    restored.run(0, config);
+
+    restored.importValues(exported);
+    CPPUNIT_ASSERT(!restored.exportValues().empty());
+
+    std::this_thread::sleep_for(3s);
+
+    auto restoredValues = restored.exportValues();
+    CPPUNIT_ASSERT_EQUAL(size_t(1), restoredValues.size());
+
+    msgpack::unpacked msg;
+    msgpack::unpack(msg, (const char*) restoredValues.front().second.data(), restoredValues.front().second.size());
+    auto valarr = msg.get();
+    CPPUNIT_ASSERT(valarr.type == msgpack::type::ARRAY);
+    CPPUNIT_ASSERT_EQUAL(uint32_t(0), valarr.via.array.size);
+
+    restored.shutdown();
+    restored.join();
+}
+
+void
+DhtRunnerTester::testImportPermanentValueExpires()
+{
+    // Simulate importing a value that was originally stored as permanent
+    // (expiration = time_point::max()). After import the permanent flag is lost,
+    // so the value must expire within the type's normal expiration window.
+    static const dht::ValueType SHORT_TYPE {201, "Short perm", 2s};
+
+    auto key = dht::InfoHash::get("import-permanent-expiration");
+    auto now = dht::clock::now();
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack_array(4);
+    pk.pack(now.time_since_epoch().count());
+    dht::Value {SHORT_TYPE.id, std::string("was-permanent")}.msgpack_pack(pk);
+    pk.pack_bin(0);
+    // Permanent values are exported with time_point::max() expiration
+    pk.pack(dht::clock::time_point::max().time_since_epoch().count());
+
+    dht::DhtRunner restored;
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+    restored.run(0, config);
+
+    restored.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    // Value should be present right after import
+    auto exportedBefore = restored.exportValues();
+    CPPUNIT_ASSERT(!exportedBefore.empty());
+
+    // Wait longer than the default USER_DATA expiration (10 min) is not
+    // practical, but the type is unregistered so the default 10 min expiration
+    // applies.  Instead, register the short type so the cap uses 2 s.
+    // Re-import into a fresh node that knows the short type.
+    dht::DhtRunner restored2;
+    restored2.run(0, config);
+    restored2.registerInsecureType(SHORT_TYPE);
+    restored2.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    CPPUNIT_ASSERT(!restored2.exportValues().empty());
+
+    // Wait for the short expiration to pass
+    std::this_thread::sleep_for(3s);
+
+    auto restoredValues = restored2.exportValues();
+    bool found = false;
+    for (const auto& ve : restoredValues) {
+        if (ve.first == key) {
+            msgpack::unpacked msg;
+            msgpack::unpack(msg, (const char*) ve.second.data(), ve.second.size());
+            auto valarr = msg.get();
+            CPPUNIT_ASSERT(valarr.type == msgpack::type::ARRAY);
+            // The value should have expired
+            CPPUNIT_ASSERT_EQUAL(uint32_t(0), valarr.via.array.size);
+            found = true;
+        }
+    }
+    // Either the key was cleaned up entirely or it was found with 0 values
+    CPPUNIT_ASSERT(found || restoredValues.empty()
+                   || std::none_of(restoredValues.begin(), restoredValues.end(),
+                                   [&](const auto& ve) { return ve.first == key; }));
+
+    restored.shutdown();
+    restored.join();
+    restored2.shutdown();
+    restored2.join();
+}
+
+void
+DhtRunnerTester::testBootstrapSetsConnectingState()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    std::mutex mutex;
+    std::condition_variable cv;
+    bool sawConnecting {false};
+
+    dht::DhtRunner::Context context;
+    context.statusChangedCallback = [&](dht::NodeStatus status4, dht::NodeStatus status6) {
+        std::lock_guard lock(mutex);
+        sawConnecting = sawConnecting || status4 == dht::NodeStatus::Connecting
+                        || status6 == dht::NodeStatus::Connecting;
+        cv.notify_all();
+    };
+
+    dht::DhtRunner bootstrapNode;
+    dht::DhtRunner clientNode;
+    bootstrapNode.run(0, config);
+    clientNode.run(config, std::move(context));
+
+    auto bound = bootstrapNode.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+
+    clientNode.bootstrap("127.0.0.1", std::to_string(bound.getPort()));
+
+    {
+        std::unique_lock lock(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lock, 5s, [&] { return sawConnecting; }));
+    }
+
+    bootstrapNode.shutdown();
+    bootstrapNode.join();
+    clientNode.shutdown();
+    clientNode.join();
+}
+
+void
+DhtRunnerTester::testBootstrapThenPutNoRace()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    dht::DhtRunner bootstrapNode;
+    dht::DhtRunner clientNode;
+    bootstrapNode.run(0, config);
+    clientNode.run(0, config);
+
+    auto bound = bootstrapNode.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+
+    clientNode.bootstrap(bound);
+
+    std::promise<bool> putDone;
+    auto putFuture = putDone.get_future();
+    clientNode.put(dht::InfoHash::get("bootstrap-then-put"), dht::Value {"value"}, [&](bool ok) {
+        putDone.set_value(ok);
+    });
+    CPPUNIT_ASSERT(getFutureValue(std::move(putFuture)));
+
+    auto vals = getFutureValue(bootstrapNode.get(dht::InfoHash::get("bootstrap-then-put")));
+    CPPUNIT_ASSERT(!vals.empty());
+
+    bootstrapNode.shutdown();
+    bootstrapNode.join();
+    clientNode.shutdown();
+    clientNode.join();
+}
+
+void
+DhtRunnerTester::testBootstrapMissingNodeThenPutFails()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    auto getUnusedPort = [&]() {
+        dht::DhtRunner tmpNode;
+        tmpNode.run(0, config);
+        auto port = tmpNode.getBoundPort();
+        tmpNode.shutdown();
+        tmpNode.join();
+        return port;
+    };
+
+    auto missingPort = getUnusedPort();
+
+    std::mutex mutex;
+    std::condition_variable cv;
+    bool sawConnecting {false};
+    bool sawDisconnectedAfterConnecting {false};
+    bool putReturnedBeforeDisconnect {false};
+
+    dht::DhtRunner::Context context;
+    context.statusChangedCallback = [&](dht::NodeStatus status4, dht::NodeStatus status6) {
+        std::lock_guard lock(mutex);
+        if (status4 == dht::NodeStatus::Connecting || status6 == dht::NodeStatus::Connecting)
+            sawConnecting = true;
+        if (sawConnecting && status4 == dht::NodeStatus::Disconnected && status6 == dht::NodeStatus::Disconnected)
+            sawDisconnectedAfterConnecting = true;
+        cv.notify_all();
+    };
+
+    dht::DhtRunner clientNode;
+    clientNode.run(0, config, std::move(context));
+    while (clientNode.getBoundPort() == missingPort)
+        missingPort = getUnusedPort();
+
+    std::promise<bool> putDone;
+    auto putFuture = putDone.get_future();
+
+    clientNode.bootstrap("127.0.0.1", std::to_string(missingPort));
+    clientNode.put(dht::InfoHash::get("bootstrap-missing-put"), dht::Value {"value"}, [&](bool ok) {
+        std::lock_guard lock(mutex);
+        putReturnedBeforeDisconnect = !sawDisconnectedAfterConnecting;
+        putDone.set_value(ok);
+        cv.notify_all();
+    });
+
+    {
+        std::unique_lock lock(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lock, 10s, [&] { return sawConnecting; }));
+        CPPUNIT_ASSERT(cv.wait_for(lock, 20s, [&] { return sawDisconnectedAfterConnecting; }));
+    }
+    CPPUNIT_ASSERT(std::future_status::ready == putFuture.wait_for(20s));
+    CPPUNIT_ASSERT(!putFuture.get());
+    CPPUNIT_ASSERT(!putReturnedBeforeDisconnect);
+
+    clientNode.shutdown();
+    clientNode.join();
+}
+
+void
+DhtRunnerTester::testShutdownCompletesWithPendingPut()
+{
+    node1.shutdown();
+    node1.join();
+    node2.shutdown();
+    node2.join();
+
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+
+    auto getUnusedPort = [&]() {
+        dht::DhtRunner tmpNode;
+        tmpNode.run(0, config);
+        auto port = tmpNode.getBoundPort();
+        tmpNode.shutdown();
+        tmpNode.join();
+        return port;
+    };
+
+    auto missingPort = getUnusedPort();
+
+    dht::DhtRunner clientNode;
+    clientNode.run(0, config);
+    while (clientNode.getBoundPort() == missingPort)
+        missingPort = getUnusedPort();
+
+    clientNode.bootstrap("127.0.0.1", std::to_string(missingPort));
+    clientNode.put(dht::InfoHash::get("shutdown-pending-put"), dht::Value {"value"}, [](bool) {});
+
+    std::promise<void> shutdownDone;
+    auto shutdownFuture = shutdownDone.get_future();
+    clientNode.shutdown([&]() { shutdownDone.set_value(); });
+
+    CPPUNIT_ASSERT(std::future_status::ready == shutdownFuture.wait_for(5s));
+
+    clientNode.join();
+}
+
+void
+DhtRunnerTester::testListen()
+{
+    std::mutex mutex;
+    std::condition_variable cv;
+    std::atomic_uint valueCounta(0);
+    std::atomic_uint valueCountb(0);
+    std::atomic_uint valueCountc(0);
+    std::atomic_uint valueCountd(0);
+
+    unsigned putCount(0);
+    unsigned putOkCount1(0);
+    unsigned putOkCount2(0);
+    unsigned putOkCount3(0);
+
+    auto a = dht::InfoHash::get("234");
+    auto b = dht::InfoHash::get("2345");
+    auto c = dht::InfoHash::get("23456");
+    auto d = dht::InfoHash::get("234567");
+    constexpr unsigned N = 256;
+    constexpr unsigned SZ = 56 * 1024;
+
+    auto ftokena = node1.listen(a, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
+        if (expired)
+            valueCounta -= values.size();
+        else
+            valueCounta += values.size();
+        return true;
+    });
+
+    auto ftokenb = node1.listen(b, [&](const std::shared_ptr<dht::Value>&) {
+        /*if (expired)
+            valueCountb -= values.size();
+        else
+            valueCountb += values.size();*/
+        valueCountb++;
+        return false;
+    });
+
+    auto ftokenc = node1.listen(c, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
+        if (expired)
+            valueCountc -= values.size();
+        else
+            valueCountc += values.size();
+        return true;
+    });
+
+    auto ftokend = node1.listen(d, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool expired) {
+        if (expired)
+            valueCountd -= values.size();
+        else
+            valueCountd += values.size();
+        return true;
+    });
+
+    std::vector<uint8_t> mtu;
+    mtu.reserve(SZ);
+    for (size_t i = 0; i < SZ; i++)
+        mtu.emplace_back((i % 2) ? 'T' : 'M');
+
+    for (unsigned i = 0; i < N; i++) {
+        node2.put(a, dht::Value("v1"), [&](bool ok) {
+            std::lock_guard lock(mutex);
+            putCount++;
+            if (ok)
+                putOkCount1++;
+            cv.notify_all();
+        });
+        node2.put(b, dht::Value("v2"), [&](bool ok) {
+            std::lock_guard lock(mutex);
+            putCount++;
+            if (ok)
+                putOkCount2++;
+            cv.notify_all();
+        });
+        auto bigVal = std::make_shared<dht::Value>();
+        bigVal->data = mtu;
+        node2.put(c, std::move(bigVal), [&](bool ok) {
+            std::lock_guard lock(mutex);
+            putCount++;
+            if (ok)
+                putOkCount3++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N * 3u; }));
+        CPPUNIT_ASSERT_EQUAL(N, putOkCount1);
+        CPPUNIT_ASSERT_EQUAL(N, putOkCount2);
+        CPPUNIT_ASSERT_EQUAL(N, putOkCount3);
+    }
+
+    CPPUNIT_ASSERT(ftokena.valid());
+    CPPUNIT_ASSERT(ftokenb.valid());
+    CPPUNIT_ASSERT(ftokenc.valid());
+    CPPUNIT_ASSERT(ftokend.valid());
+
+    auto tokena = getFutureValue(std::move(ftokena));
+    auto tokenc = getFutureValue(std::move(ftokenc));
+    auto tokend = getFutureValue(std::move(ftokend));
+    // tokenb might be 0 since the callback returns false.
+
+    CPPUNIT_ASSERT(tokena);
+    CPPUNIT_ASSERT(tokenc);
+    CPPUNIT_ASSERT(tokend);
+    CPPUNIT_ASSERT_EQUAL(N, valueCounta.load());
+    CPPUNIT_ASSERT_EQUAL(1u, valueCountb.load());
+    CPPUNIT_ASSERT_EQUAL(N, valueCountc.load());
+    CPPUNIT_ASSERT_EQUAL(0u, valueCountd.load());
+
+    node1.cancelListen(a, tokena);
+    node1.cancelListen(b, std::move(ftokenb));
+    node1.cancelListen(c, tokenc);
+    node1.cancelListen(d, tokend);
+}
+
+void
+DhtRunnerTester::testIdOps()
+{
+    std::mutex mutex;
+    std::condition_variable cv;
+    unsigned identityCount(0);
+    unsigned valueCount(0);
+    unsigned valueCountEdit(0);
+
+    dht::DhtRunner::Config config2;
+    config2.dht_config.node_config.max_peer_req_per_sec = -1;
+    config2.dht_config.node_config.max_req_per_sec = -1;
+    config2.dht_config.id = dht::crypto::generateIdentity();
+
+    dht::DhtRunner::Context context2;
+    context2.identityAnnouncedCb = [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        identityCount++;
+        cv.notify_all();
+    };
+
+    node2.join();
+    node2.run(0, config2, std::move(context2));
+    auto bound = node1.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node2.bootstrap(bound);
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return identityCount == 1; }));
+    }
+
+    node1.findCertificate(node2.getPublicKey()->getLongId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt) {
+        CPPUNIT_ASSERT(crt);
+        std::lock_guard lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 1u; }));
+        CPPUNIT_ASSERT_EQUAL(1u, identityCount);
+    }
+
+    dht::DhtRunner::Context context1;
+    context1.identityAnnouncedCb = [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        identityCount++;
+        cv.notify_all();
+    };
+
+    config2.dht_config.id = dht::crypto::generateIdentity();
+    node1.join();
+    node1.run(0, config2, std::move(context1));
+    bound = node2.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node1.bootstrap(bound);
+
+    auto key = dht::InfoHash::get("key");
+    node1.putEncrypted(key, node2.getPublicKey()->getLongId(), std::make_shared<dht::Value>("yo"), [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    node1.putEncrypted(key, node2.getPublicKey(), dht::Value("yo"), [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    node2.listen<std::string>(key, [&](std::string&& value) {
+        CPPUNIT_ASSERT_EQUAL("yo"s, value);
+        std::lock_guard lk(mutex);
+        valueCount++;
+        cv.notify_all();
+        return true;
+    });
+
+    auto key2 = dht::InfoHash::get("key2");
+    auto editValue = std::make_shared<dht::Value>("v1");
+    node1.putSigned(key2, editValue, [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        valueCountEdit++;
+        cv.notify_all();
+    });
+    node2.listen(key2, [&](const std::vector<std::shared_ptr<dht::Value>>& values, bool /*expired*/) {
+        for (const auto& v : values) {
+            if (v->seq == 0)
+                CPPUNIT_ASSERT_EQUAL("v1"s, dht::unpackMsg<std::string>(v->data));
+            else if (v->seq == 1)
+                CPPUNIT_ASSERT_EQUAL("v2"s, dht::unpackMsg<std::string>(v->data));
+            CPPUNIT_ASSERT_EQUAL(v->owner->getLongId(), node1.getPublicKey()->getLongId());
+        }
+        std::lock_guard lk(mutex);
+        valueCountEdit += values.size();
+        cv.notify_all();
+        return true;
+    });
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return identityCount == 2u; }));
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 5u; }));
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCountEdit == 2u; }));
+    }
+
+    node2.findCertificate(node1.getPublicKey()->getLongId(), [&](const std::shared_ptr<dht::crypto::Certificate>& crt) {
+        CPPUNIT_ASSERT(crt);
+        std::lock_guard lk(mutex);
+        valueCount++;
+        cv.notify_all();
+    });
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCount == 6u; }));
+    }
+
+    // editValue->data = dht::packMsg("v2");
+    editValue = std::make_shared<dht::Value>(editValue->id);
+    editValue->data = dht::packMsg("v2");
+    node1.putSigned(key2, editValue, [&](bool ok) {
+        CPPUNIT_ASSERT(ok);
+        std::lock_guard lk(mutex);
+        valueCountEdit++;
+        cv.notify_all();
+    });
+    std::unique_lock lk(mutex);
+    CPPUNIT_ASSERT(cv.wait_for(lk, 20s, [&] { return valueCountEdit == 4u; }));
+}
+
+void
+DhtRunnerTester::testListenLotOfBytes()
+{
+    std::mutex mutex;
+    std::condition_variable cv;
+    std::atomic_uint valueCount(0);
+    unsigned putCount(0);
+    unsigned putOkCount(0);
+
+    std::string data(10000, 'a');
+
+    auto foo = dht::InfoHash::get("foo");
+    constexpr unsigned N = 1024;
+
+    for (unsigned i = 0; i < N; i++) {
+        node2.put(foo, data, [&](bool ok) {
+            std::lock_guard lock(mutex);
+            putCount++;
+            if (ok)
+                putOkCount++;
+            cv.notify_all();
+        });
+    }
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N; }));
+    }
+
+    dht::DhtRunner node3 {};
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    node3.run(42242, config);
+    auto bound = node1.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node3.bootstrap(bound);
+
+    auto ftokenfoo = node3.listen(foo, [&](const std::shared_ptr<dht::Value>&) {
+        valueCount++;
+        cv.notify_all();
+        return true;
+    });
+
+    {
+        std::unique_lock lk(mutex);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return valueCount == N; }));
+    }
+
+    node3.cancelListen(foo, getFutureValue(std::move(ftokenfoo)));
+}
+
+void
+DhtRunnerTester::testMultithread()
+{
+    std::mutex mutex;
+    std::condition_variable cv;
+    unsigned putCount(0);
+    unsigned putOkCount(0);
+
+    constexpr unsigned N = 2048;
+
+    for (unsigned i = 0; i < N; i++) {
+        dht::ThreadPool::computation().run([&] {
+            node2.put(dht::InfoHash::get("123" + std::to_string(i)), "hehe", [&](bool ok) {
+                std::lock_guard lock(mutex);
+                putCount++;
+                if (ok)
+                    putOkCount++;
+                cv.notify_all();
+            });
+            node2.get(
+                dht::InfoHash::get("123" + std::to_string(N - i - 1)),
+                [](const std::shared_ptr<dht::Value>&) { return true; },
+                [&](bool ok) {
+                    std::lock_guard lock(mutex);
+                    putCount++;
+                    if (ok)
+                        putOkCount++;
+                    cv.notify_all();
+                });
+        });
+    }
+    std::unique_lock lk(mutex);
+    CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == 2 * N; }));
+    CPPUNIT_ASSERT_EQUAL(2 * N, putOkCount);
+}
+
+} // namespace test
@@ -20,6 +20,13 @@ class DhtRunnerTester : public CppUnit::TestFixture
    CPPUNIT_TEST(testListen);
    CPPUNIT_TEST(testListenLotOfBytes);
    CPPUNIT_TEST(testIdOps);
+    CPPUNIT_TEST(testImportValuesPreservesRemoteQuota);
+    CPPUNIT_TEST(testImportValuesPreservesStoredExpiration);
+    CPPUNIT_TEST(testImportPermanentValueExpires);
+    CPPUNIT_TEST(testBootstrapSetsConnectingState);
+    CPPUNIT_TEST(testBootstrapThenPutNoRace);
+    CPPUNIT_TEST(testBootstrapMissingNodeThenPutFails);
+    CPPUNIT_TEST(testShutdownCompletesWithPendingPut);
    CPPUNIT_TEST_SUITE_END();

    dht::DhtRunner node1 {};
@@ -58,6 +65,13 @@ public:
     * Test methods requiring a node identity
     */
    void testIdOps();
+    void testImportValuesPreservesRemoteQuota();
+    void testImportValuesPreservesStoredExpiration();
+    void testImportPermanentValueExpires();
+    void testBootstrapSetsConnectingState();
+    void testBootstrapThenPutNoRace();
+    void testBootstrapMissingNodeThenPutFails();
+    void testShutdownCompletesWithPendingPut();
    /**
     * Test listen method with lot of datas
     */
@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "httptester.h"
+#include "test_http.h"

 #include <opendht/value.h>
 #include <opendht/dhtrunner.h>
@@ -338,7 +338,7 @@ HttpTester::test_send_json()
    // Arrange
    std::condition_variable cv;
    std::mutex cv_m;
-    std::unique_lock<std::mutex> lk(cv_m);
+    std::unique_lock lk(cv_m);
    bool done = false;
    unsigned int status = 0;

@@ -350,7 +350,7 @@ HttpTester::test_send_json()
                                                        "http://127.0.0.1:8080/key/key",
                                                        json,
                                                        [&](Json::Value value, const dht::http::Response& response) {
-                                                            std::lock_guard<std::mutex> lk(cv_m);
+                                                            std::lock_guard lk(cv_m);
                                                            resp_val = std::move(value);
                                                            status = response.status_code;
                                                            done = true;
@@ -368,7 +368,7 @@ HttpTester::test_send_json()
    request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
        "http://google.ca",
        [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            status = response.status_code;
            done = true;
            cv.notify_all();
@@ -382,7 +382,7 @@ HttpTester::test_send_json()
    request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
        "https://google.ca",
        [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            status = response.status_code;
            done = true;
            cv.notify_all();
@@ -396,7 +396,7 @@ HttpTester::test_send_json()
    request = std::make_shared<dht::http::Request>(serverProxy->io_context(),
        "https://google.ca/sdbjklwGBIP",
        [&](const dht::http::Response& response) {
-            std::lock_guard<std::mutex> lk(cv_m);
+            std::lock_guard lk(cv_m);
            status = response.status_code;
            done = true;
            cv.notify_all();
@@ -1,11 +1,12 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "infohashtester.h"
+#include "test_infohash.h"

 // std
 #include <iostream>
 #include <string>
+#include <string_view>

 // opendht
 #include "opendht/infohash.h"
@@ -21,47 +22,60 @@ void
 InfoHashTester::testConstructors()
 {
    // Default constructor creates a null infohash
-    auto nullHash = dht::InfoHash();
+    constexpr auto nullHash = dht::InfoHash();
    CPPUNIT_ASSERT_EQUAL((size_t) 20u, nullHash.size());
    CPPUNIT_ASSERT(!nullHash);
    // Build from a uint8_t. if length to short, should get a null infohash
-    uint8_t to_short[] = {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8};
-    auto infohash = dht::InfoHash(to_short, 8);
+    constexpr uint8_t too_short[] = {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8};
+    auto infohash = dht::InfoHash(too_short, 8);
    CPPUNIT_ASSERT_EQUAL((size_t) 20u, infohash.size());
    CPPUNIT_ASSERT_EQUAL(std::string("0000000000000000000000000000000000000000"), infohash.toString());
    // Build from a uint8_t. if length is enough, data should contains the uint8_t
-    uint8_t enough[] = {0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa,
-                        0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa};
+    constexpr uint8_t enough[] = {0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa,
+                                  0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa};
    infohash = dht::InfoHash(enough, 20);
-    CPPUNIT_ASSERT(infohash.size() == 20);
+    static_assert(dht::InfoHash(enough, 20) != nullHash);
+    CPPUNIT_ASSERT_EQUAL((size_t) 20u, infohash.size());
    const auto* data = infohash.data();
    for (auto i = 0; i < 20; ++i) {
        CPPUNIT_ASSERT_EQUAL(enough[i], data[i]);
    }
    // if too long, should be cutted to 20
-    uint8_t tooLong[] = {0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0x1,
-                         0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb0};
+    constexpr uint8_t tooLong[] = {0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0x1,
+                                   0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb0};
    infohash = dht::InfoHash(tooLong, 21);
-    CPPUNIT_ASSERT(infohash.size() == 20);
    const auto* data2 = infohash.data();
    for (auto i = 0; i < 20; ++i) {
        CPPUNIT_ASSERT_EQUAL(enough[i], data2[i]);
    }
    // Build from string
-    auto infohashFromStr = dht::InfoHash("0102030405060708090A0102030405060708090A");
+    constexpr auto infohashFromStr = dht::InfoHash("0102030405060708090A0102030405060708090A");
    CPPUNIT_ASSERT_EQUAL((size_t) 20u, infohashFromStr.size());
    const auto* dataStr = infohashFromStr.data();
    for (auto i = 0; i < 20; ++i) {
        CPPUNIT_ASSERT_EQUAL((int) dataStr[i], (int) data[i]);
    }
+
+    // invalid strings
+    constexpr auto invalidHash = dht::InfoHash("invalid_string0102030405060708090A010203");
+    CPPUNIT_ASSERT_EQUAL((size_t) 20u, invalidHash.size());
+    CPPUNIT_ASSERT(!invalidHash);
+    CPPUNIT_ASSERT_EQUAL(nullHash, invalidHash);
+    static_assert(invalidHash == nullHash, "Invalid hash string should result in null hash");
+
+    constexpr auto tooShortHash = dht::InfoHash("0123456789abcdef0123456789abcdef012345");
+    CPPUNIT_ASSERT_EQUAL((size_t) 20u, tooShortHash.size());
+    CPPUNIT_ASSERT(!tooShortHash);
+    CPPUNIT_ASSERT_EQUAL(nullHash, tooShortHash);
+    static_assert(tooShortHash == nullHash, "Too short hash string should result in null hash");
 }

 void
 InfoHashTester::testComparators()
 {
-    auto nullHash = dht::InfoHash();
-    auto minHash = dht::InfoHash("0000000000000000000000000000000000111110");
-    auto maxHash = dht::InfoHash("0111110000000000000000000000000000000000");
+    constexpr auto nullHash = dht::InfoHash();
+    constexpr auto minHash = dht::InfoHash("0000000000000000000000000000000000111110");
+    constexpr auto maxHash = dht::InfoHash("0111110000000000000000000000000000000000");
    // operator ==
    CPPUNIT_ASSERT_EQUAL(minHash, minHash);
    CPPUNIT_ASSERT_EQUAL(minHash, dht::InfoHash("0000000000000000000000000000000000111110"));
@@ -126,10 +140,21 @@ InfoHashTester::testXorCmp()
 void
 InfoHashTester::testHex()
 {
-    const std::string TEST_HASH_STR("01b20304d5060708090a010203e05060708090ae");
+    using namespace std::literals;
+    static constexpr auto H = "0123456789abcdef0123456789abcdef01234567"sv;
+    const std::string TEST_HASH_STR(H);
    dht::InfoHash TEST_HASH(TEST_HASH_STR);
+    static constexpr dht::InfoHash TEST_HASH_CONST(H);
    CPPUNIT_ASSERT_EQUAL(TEST_HASH_STR, TEST_HASH.toString());
+    CPPUNIT_ASSERT_EQUAL(H, TEST_HASH.to_view());
    CPPUNIT_ASSERT_EQUAL(TEST_HASH_STR, dht::toHex(TEST_HASH.data(), TEST_HASH.size()));
+    CPPUNIT_ASSERT_EQUAL(TEST_HASH_CONST.to_view(), H);
+
+    static constexpr auto hexArray = dht::toHexArray(TEST_HASH_CONST);
+    static constexpr auto hexArrayView = std::string_view(hexArray.data(), hexArray.size());
+    static_assert(hexArrayView == H, "Hex array does not match");
+
+    CPPUNIT_ASSERT_EQUAL(std::string_view(TEST_HASH_STR), hexArrayView);
 }

 void
@@ -0,0 +1,551 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_networkengine.h"
+
+#ifdef _MSC_VER
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(NetworkEngineTester);
+
+void
+NetworkEngineTester::setUp()
+{}
+
+void
+NetworkEngineTester::tearDown()
+{}
+
+void
+NetworkEngineTester::testDisabledOnMsvc()
+{
+    CPPUNIT_ASSERT(true);
+}
+
+} // namespace test
+
+#else
+
+#include <any>
+#include <mutex>
+
+#ifdef _WIN32
+#ifdef opendht_EXPORTS
+#undef opendht_EXPORTS
+#endif
+#endif
+
+#include "opendht/node.h"
+#include "opendht/network_engine.h"
+#include "opendht/network_utils.h"
+#include "opendht/utils.h"
+#include "opendht/value.h"
+
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wkeyword-macro"
+#elif defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wpedantic"
+#endif
+#define private public
+#include "opendht/dht.h"
+#undef private
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#elif defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+#include "../src/parsed_message.h"
+#include "../src/search.h"
+
+// Hack to test internal classes
+#include "../src/op_cache.cpp"
+#include "../src/routing_table.cpp"
+#include "../src/dht.cpp"
+#include "../src/node.cpp"
+#include "../src/node_cache.cpp"
+#include "../src/network_engine.cpp"
+
+#include <string>
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(NetworkEngineTester);
+
+using namespace dht;
+using namespace dht::net;
+
+static constexpr size_t TEST_MTU {1280};
+
+class TestDatagramSocket : public net::DatagramSocket
+{
+public:
+    TestDatagramSocket()
+    {
+        bound_.setFamily(AF_INET);
+        bound_.setLoopback();
+        bound_.setPort(4222);
+    }
+
+    int sendTo(const SockAddr& dest, const uint8_t* data, size_t size, bool replied) override
+    {
+        sends.emplace_back(SentPacket {dest, Blob(data, data + size), replied});
+        return 0;
+    }
+
+    bool hasIPv4() const override { return true; }
+    bool hasIPv6() const override { return false; }
+    const SockAddr& getBoundRef(sa_family_t family = AF_UNSPEC) const override
+    {
+        (void) family;
+        return bound_;
+    }
+    void stop() override {}
+
+    struct SentPacket
+    {
+        SockAddr dest;
+        Blob data;
+        bool replied;
+    };
+
+    SockAddr bound_;
+    std::vector<SentPacket> sends {};
+};
+
+static Blob
+serializeValue(const std::string& data)
+{
+    auto val = std::make_shared<Value>((const uint8_t*) data.data(), data.size());
+    return packMsg(val);
+}
+
+static Blob
+makeReplyHeaderPacketBlob(const InfoHash& id, Tid tid, const std::vector<size_t>& valueSizes)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_R);
+    pk.pack_map(2);
+    pk.pack(KEY_REQ_ID);
+    pk.pack(id);
+    pk.pack(KEY_REQ_VALUES);
+    pk.pack_array(valueSizes.size());
+    for (const auto& size : valueSizes)
+        pk.pack(size);
+    pk.pack(KEY_TID);
+    pk.pack(tid);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_R);
+
+    return {buffer.data(), buffer.data() + buffer.size()};
+}
+
+static Blob
+makeValueDataPacketBlob(Tid tid, unsigned index, size_t offset, const Blob& data)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_V);
+    pk.pack(KEY_TID);
+    pk.pack(tid);
+    pk.pack(KEY_V);
+    pk.pack_map(1);
+    pk.pack(index);
+    pk.pack_map(2);
+    pk.pack("o");
+    pk.pack(offset);
+    pk.pack("d");
+    pk.pack_bin(data.size());
+    pk.pack_bin_body((const char*) data.data(), data.size());
+
+    return {buffer.data(), buffer.data() + buffer.size()};
+}
+
+static Blob
+makeListenPacketBlob(const InfoHash& id, const InfoHash& hash, Tid tid, Tid socketId, const Blob& token)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(4);
+    pk.pack(KEY_A);
+    pk.pack_map(5);
+    pk.pack(KEY_REQ_ID);
+    pk.pack(id);
+    pk.pack(KEY_VERSION);
+    pk.pack(1);
+    pk.pack(KEY_REQ_H);
+    pk.pack(hash);
+    pk.pack(KEY_REQ_TOKEN);
+    packToken(pk, token);
+    pk.pack(KEY_REQ_SID);
+    pk.pack(socketId);
+    pk.pack(KEY_Q);
+    pk.pack(QUERY_LISTEN);
+    pk.pack(KEY_TID);
+    pk.pack(tid);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_Q);
+
+    return {buffer.data(), buffer.data() + buffer.size()};
+}
+
+static SockAddr
+makeIPv4(const char* ip, in_port_t port)
+{
+    SockAddr addr;
+    addr.setFamily(AF_INET);
+    addr.setAddress(ip);
+    addr.setPort(port);
+    return addr;
+}
+
+static net::NetworkEngine
+makeEngine(std::unique_ptr<TestDatagramSocket>&& socket,
+           Scheduler& scheduler,
+           InfoHash& myid,
+           std::mt19937_64& rd,
+           int& onNewNodeCalls)
+{
+    return net::NetworkEngine(
+        myid,
+        {},
+        std::move(socket),
+        {},
+        rd,
+        scheduler,
+        [](Sp<net::Request>, net::DhtProtocolException) {},
+        [&onNewNodeCalls](const Sp<Node>&, int) { ++onNewNodeCalls; },
+        [](const InfoHash&, const SockAddr&) {},
+        [](Sp<Node>) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, want_t) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, want_t, const Query&) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, const Blob&, Tid, const Query&, int) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, const Blob&, const std::vector<Sp<Value>>&, const time_point&) {
+            return net::RequestAnswer {};
+        },
+        [](Sp<Node>, const InfoHash&, const Blob&, const Value::Id&) { return net::RequestAnswer {}; });
+}
+
+void
+NetworkEngineTester::setUp()
+{}
+
+void
+NetworkEngineTester::tearDown()
+{}
+
+void
+NetworkEngineTester::testIgnoresUnknownPartialData()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(0);
+    InfoHash myid = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    Blob fragment = {1, 2, 3};
+    auto packet = makeValueDataPacketBlob(99, 0, 0, fragment);
+    auto from = makeIPv4("127.0.0.2", 5000);
+
+    engine.processMessage(packet.data(), packet.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT_EQUAL(0, onNewNodeCalls);
+}
+
+void
+NetworkEngineTester::testCompletesPartialSessionFromSameSource()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(1);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    std::string data(TEST_MTU * 2 + 64, 'z');
+    auto serialized = serializeValue(data);
+    auto from = makeIPv4("127.0.0.2", 5001);
+    auto header = makeReplyHeaderPacketBlob(remoteId, 7, {serialized.size()});
+
+    engine.processMessage(header.data(), header.size(), from);
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+
+    for (size_t offset = 0; offset < serialized.size(); offset += TEST_MTU) {
+        auto end = std::min(offset + TEST_MTU, serialized.size());
+        Blob fragment(serialized.begin() + offset, serialized.begin() + end);
+        auto packet = makeValueDataPacketBlob(7, 0, offset, fragment);
+        engine.processMessage(packet.data(), packet.size(), from);
+    }
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT(onNewNodeCalls > 0);
+}
+
+void
+NetworkEngineTester::testKeepsSessionForWrongSourceFragment()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(2);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    int onNewNodeCalls = 0;
+    auto engine = makeEngine(std::make_unique<TestDatagramSocket>(), scheduler, myid, rd, onNewNodeCalls);
+
+    std::string data(TEST_MTU + 32, 'w');
+    auto serialized = serializeValue(data);
+    auto goodFrom = makeIPv4("127.0.0.2", 5002);
+    auto badFrom = makeIPv4("127.0.0.3", 5002);
+    auto header = makeReplyHeaderPacketBlob(remoteId, 11, {serialized.size()});
+
+    engine.processMessage(header.data(), header.size(), goodFrom);
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+
+    auto firstEnd = std::min(TEST_MTU, serialized.size());
+    Blob firstFragment(serialized.begin(), serialized.begin() + firstEnd);
+    auto firstPacket = makeValueDataPacketBlob(11, 0, 0, firstFragment);
+    engine.processMessage(firstPacket.data(), firstPacket.size(), badFrom);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, engine.getPartialCount());
+    CPPUNIT_ASSERT_EQUAL(0, onNewNodeCalls);
+
+    engine.processMessage(firstPacket.data(), firstPacket.size(), goodFrom);
+    if (firstEnd < serialized.size()) {
+        Blob tail(serialized.begin() + firstEnd, serialized.end());
+        auto tailPacket = makeValueDataPacketBlob(11, 0, firstEnd, tail);
+        engine.processMessage(tailPacket.data(), tailPacket.size(), goodFrom);
+    }
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, engine.getPartialCount());
+    CPPUNIT_ASSERT(onNewNodeCalls > 0);
+}
+
+void
+NetworkEngineTester::testListenConfirmationCarriesToken()
+{
+    Scheduler scheduler;
+    std::mt19937_64 rd(3);
+    InfoHash myid = InfoHash::getRandom(rd);
+    InfoHash remoteId = InfoHash::getRandom(rd);
+    InfoHash hash = InfoHash::getRandom(rd);
+    Blob requestToken {0x01, 0x02, 0x03, 0x04};
+    Blob responseToken {0xaa, 0xbb, 0xcc, 0xdd, 0xee};
+    int onNewNodeCalls = 0;
+    net::NetworkConfig config {};
+    config.max_req_per_sec = -1;
+    config.max_peer_req_per_sec = -1;
+
+    auto socket = std::make_unique<TestDatagramSocket>();
+    auto* socketPtr = socket.get();
+    auto engine = net::NetworkEngine(
+        myid,
+        config,
+        std::move(socket),
+        {},
+        rd,
+        scheduler,
+        [](Sp<net::Request>, net::DhtProtocolException) {},
+        [&onNewNodeCalls](const Sp<Node>&, int) { ++onNewNodeCalls; },
+        [](const InfoHash&, const SockAddr&) {},
+        [](Sp<Node>) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, want_t) { return net::RequestAnswer {}; },
+        [](Sp<Node>, const InfoHash&, want_t, const Query&) { return net::RequestAnswer {}; },
+        [responseToken](Sp<Node>, const InfoHash&, const Blob&, Tid, const Query&, int) {
+            net::RequestAnswer answer {};
+            answer.ntoken = responseToken;
+            return answer;
+        },
+        [](Sp<Node>, const InfoHash&, const Blob&, const std::vector<Sp<Value>>&, const time_point&) {
+            return net::RequestAnswer {};
+        },
+        [](Sp<Node>, const InfoHash&, const Blob&, const Value::Id&) { return net::RequestAnswer {}; });
+
+    auto from = makeIPv4("127.0.0.2", 5003);
+    auto packet = makeListenPacketBlob(remoteId, hash, 17, 23, requestToken);
+
+    engine.processMessage(packet.data(), packet.size(), from);
+
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, socketPtr->sends.size());
+
+    const auto& sent = socketPtr->sends.front();
+    CPPUNIT_ASSERT(sent.dest == from);
+
+    auto replyObject = msgpack::unpack((const char*) sent.data.data(), sent.data.size());
+    ParsedMessage reply;
+    reply.msgpack_unpack(replyObject.get());
+
+    CPPUNIT_ASSERT(reply.type == MessageType::Reply);
+    CPPUNIT_ASSERT_EQUAL(myid, reply.id);
+    CPPUNIT_ASSERT(reply.token == responseToken);
+}
+
+void
+NetworkEngineTester::testListenConfirmationUpdatesSearchNodeToken()
+{
+    Config config {};
+    config.max_req_per_sec = -1;
+    config.max_peer_req_per_sec = -1;
+
+    auto rd = std::make_unique<std::mt19937_64>(6);
+    Dht localDht(std::make_unique<TestDatagramSocket>(), config, {}, std::move(rd));
+
+    auto node = std::make_shared<Node>(InfoHash::getRandom(localDht.rd),
+                                       makeIPv4("127.0.0.2", 5006),
+                                       localDht.rd,
+                                       false);
+    auto sr = std::make_shared<Dht::Search>();
+    auto query = std::make_shared<Query>();
+    ValueCallback valueCallback = [](const std::vector<std::shared_ptr<Value>>&, bool) {
+        return true;
+    };
+
+    sr->id = InfoHash::getRandom(localDht.rd);
+    sr->af = AF_INET;
+    sr->nextSearchStep = localDht.scheduler.add(time_point::max(), [] {});
+    sr->listeners.emplace(1, Dht::Search::SearchListener {query, valueCallback, {}});
+
+    auto searchNode = std::make_unique<Dht::SearchNode>(node);
+    auto socketId = node->openSocket([](const Sp<Node>&, net::RequestAnswer&&) {});
+    searchNode->listenStatus.emplace(std::piecewise_construct,
+                                     std::forward_as_tuple(query),
+                                     std::forward_as_tuple(valueCallback, dht::SyncCallback {}, socketId));
+    auto* searchNodePtr = sr->nodes.emplace_back(std::move(searchNode)).get();
+
+    CPPUNIT_ASSERT(searchNodePtr->token.empty());
+    CPPUNIT_ASSERT(!searchNodePtr->isSynced(localDht.scheduler.time()));
+
+    net::RequestAnswer answer {};
+    answer.ntoken = Blob {0xaa, 0xbb, 0xcc, 0xdd};
+
+    localDht.onListenDone(node, answer, sr);
+
+    CPPUNIT_ASSERT(searchNodePtr->token == answer.ntoken);
+    /* last_get_reply should NOT be updated by listen confirmation,
+       so that periodic find_node requests still refresh the search table. */
+    CPPUNIT_ASSERT(searchNodePtr->last_get_reply == time_point::min());
+    CPPUNIT_ASSERT(!searchNodePtr->isSynced(localDht.scheduler.time()));
+}
+
+void
+NetworkEngineTester::testListenReopensSocketAfterNodeExpiration()
+{
+    Config config {};
+    config.max_req_per_sec = -1;
+    config.max_peer_req_per_sec = -1;
+
+    auto rd = std::make_unique<std::mt19937_64>(4);
+    Dht localDht(std::make_unique<TestDatagramSocket>(), config, {}, std::move(rd));
+
+    auto node = std::make_shared<Node>(InfoHash::getRandom(localDht.rd),
+                                       makeIPv4("127.0.0.2", 5004),
+                                       localDht.rd,
+                                       false);
+    auto sr = std::make_shared<Dht::Search>();
+    auto query = std::make_shared<Query>();
+    ValueCallback valueCallback = [](const std::vector<std::shared_ptr<Value>>&, bool) {
+        return true;
+    };
+    dht::SyncCallback syncCallback {};
+
+    sr->id = InfoHash::getRandom(localDht.rd);
+    sr->af = AF_INET;
+    sr->listeners.emplace(1, Dht::Search::SearchListener {query, valueCallback, {}});
+
+    auto searchNode = std::make_unique<Dht::SearchNode>(node);
+    auto staleSocketId = node->openSocket([](const Sp<Node>&, net::RequestAnswer&&) {});
+    auto status = searchNode->listenStatus
+                      .emplace(std::piecewise_construct,
+                               std::forward_as_tuple(query),
+                               std::forward_as_tuple(valueCallback, syncCallback, staleSocketId))
+                      .first;
+    status->second.req = std::make_shared<net::Request>(net::Request::State::COMPLETED);
+    status->second.req->reply_time = time_point::min();
+
+    node->setExpired();
+    CPPUNIT_ASSERT(!node->getSocket(staleSocketId));
+
+    auto* searchNodePtr = sr->nodes.emplace_back(std::move(searchNode)).get();
+    searchNodePtr->token = Blob {0x42};
+    searchNodePtr->last_get_reply = localDht.scheduler.time();
+
+    localDht.searchSynchedNodeListen(sr, *searchNodePtr);
+
+    auto listenIt = searchNodePtr->listenStatus.find(query);
+    CPPUNIT_ASSERT(listenIt != searchNodePtr->listenStatus.end());
+    CPPUNIT_ASSERT(listenIt->second.req);
+    CPPUNIT_ASSERT(listenIt->second.socketId);
+    CPPUNIT_ASSERT(listenIt->second.socketId != staleSocketId);
+    CPPUNIT_ASSERT(node->getSocket(listenIt->second.socketId));
+}
+
+void
+NetworkEngineTester::testUnauthorizedListenFlushClearsListenState()
+{
+    Config config {};
+    config.max_req_per_sec = -1;
+    config.max_peer_req_per_sec = -1;
+
+    auto rd = std::make_unique<std::mt19937_64>(5);
+    Dht localDht(std::make_unique<TestDatagramSocket>(), config, {}, std::move(rd));
+
+    auto node = std::make_shared<Node>(InfoHash::getRandom(localDht.rd),
+                                       makeIPv4("127.0.0.2", 5005),
+                                       localDht.rd,
+                                       false);
+    auto sr = std::make_shared<Dht::Search>();
+    auto query = std::make_shared<Query>();
+    ValueCallback valueCallback = [](const std::vector<std::shared_ptr<Value>>&, bool) {
+        return true;
+    };
+    dht::SyncCallback syncCallback {};
+
+    sr->id = InfoHash::getRandom(localDht.rd);
+    sr->af = AF_INET;
+
+    auto searchNode = std::make_unique<Dht::SearchNode>(node);
+    auto socketId = node->openSocket([](const Sp<Node>&, net::RequestAnswer&&) {});
+    auto listenIt = searchNode->listenStatus
+                        .emplace(std::piecewise_construct,
+                                 std::forward_as_tuple(query),
+                                 std::forward_as_tuple(valueCallback, syncCallback, socketId))
+                        .first;
+    listenIt->second.req = std::make_shared<net::Request>();
+    listenIt->second.refresh = localDht.scheduler.add(localDht.scheduler.time() + std::chrono::seconds(1), [] {});
+    searchNode->token = Blob {0x10, 0x11, 0x12};
+    searchNode->last_get_reply = localDht.scheduler.time();
+    auto* searchNodePtr = sr->nodes.emplace_back(std::move(searchNode)).get();
+
+    localDht.searches(AF_INET).emplace(sr->id, sr);
+
+    auto failingReq = std::make_shared<net::Request>(
+        MessageType::Listen,
+        node->getNewTid(),
+        node,
+        Blob {},
+        [](const net::Request&, ParsedMessage&&) {},
+        [](const net::Request&, bool) {});
+
+    localDht.onError(failingReq,
+                     net::DhtProtocolException {net::DhtProtocolException::UNAUTHORIZED,
+                                                net::DhtProtocolException::LISTEN_WRONG_TOKEN});
+
+    CPPUNIT_ASSERT(searchNodePtr->token.empty());
+    CPPUNIT_ASSERT(searchNodePtr->last_get_reply == time_point::min());
+
+    auto listenStatusIt = searchNodePtr->listenStatus.find(query);
+    CPPUNIT_ASSERT(listenStatusIt != searchNodePtr->listenStatus.end());
+    CPPUNIT_ASSERT(!listenStatusIt->second.req);
+    CPPUNIT_ASSERT(!listenStatusIt->second.refresh);
+}
+
+} // namespace test
+
+#endif
@@ -0,0 +1,43 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <cppunit/TestFixture.h>
+#include <cppunit/extensions/HelperMacros.h>
+
+namespace test {
+
+class NetworkEngineTester : public CppUnit::TestFixture
+{
+    CPPUNIT_TEST_SUITE(NetworkEngineTester);
+#ifdef _MSC_VER
+    CPPUNIT_TEST(testDisabledOnMsvc);
+#else
+    CPPUNIT_TEST(testIgnoresUnknownPartialData);
+    CPPUNIT_TEST(testCompletesPartialSessionFromSameSource);
+    CPPUNIT_TEST(testKeepsSessionForWrongSourceFragment);
+    CPPUNIT_TEST(testListenConfirmationCarriesToken);
+    CPPUNIT_TEST(testListenConfirmationUpdatesSearchNodeToken);
+    CPPUNIT_TEST(testListenReopensSocketAfterNodeExpiration);
+    CPPUNIT_TEST(testUnauthorizedListenFlushClearsListenState);
+#endif
+    CPPUNIT_TEST_SUITE_END();
+
+public:
+    void setUp();
+    void tearDown();
+
+#ifdef _MSC_VER
+    void testDisabledOnMsvc();
+#else
+    void testIgnoresUnknownPartialData();
+    void testCompletesPartialSessionFromSameSource();
+    void testKeepsSessionForWrongSourceFragment();
+    void testListenConfirmationCarriesToken();
+    void testListenConfirmationUpdatesSearchNodeToken();
+    void testListenReopensSocketAfterNodeExpiration();
+    void testUnauthorizedListenFlushClearsListenState();
+#endif
+};
+
+} // namespace test
@@ -0,0 +1,540 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_parsedmessage.h"
+
+#include "opendht/value.h"
+#include "opendht/node.h"
+#include "opendht/utils.h"
+
+#include "../src/parsed_message.h"
+
+#include <iostream>
+#include <limits>
+#include <string>
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(ParsedMessageTester);
+
+using namespace dht;
+using namespace dht::net;
+
+static constexpr size_t TEST_MTU {1280};
+
+// Helper: create a ParsedMessage with a single value_parts entry of given total_size
+static ParsedMessage
+makeHeader(unsigned index, size_t total_size)
+{
+    ParsedMessage msg;
+    msg.value_parts[index].total_size = total_size;
+    return msg;
+}
+
+// Helper: create a ParsedMessage fragment (as if parsed from ValueData)
+static ParsedMessage
+makeFragment(unsigned index, size_t offset, const Blob& data)
+{
+    ParsedMessage frag;
+    frag.fragment_parts[index] = {offset, data};
+    return frag;
+}
+
+// Helper: serialize a Value to a Blob
+static Blob
+serializeValue(const std::string& data)
+{
+    auto val = std::make_shared<Value>((const uint8_t*) data.data(), data.size());
+    return packMsg(val);
+}
+
+static ParsedMessage
+parsePackedMessage(msgpack::sbuffer& buffer)
+{
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    parsed.msgpack_unpack(msg.get());
+    return parsed;
+}
+
+static ParsedMessage
+makeReplyHeaderPacket(Tid tid, const std::vector<size_t>& valueSizes)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_R);
+    pk.pack_map(1);
+    pk.pack(KEY_REQ_VALUES);
+    pk.pack_array(valueSizes.size());
+    for (const auto& size : valueSizes)
+        pk.pack(size);
+    pk.pack(KEY_TID);
+    pk.pack(tid);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_R);
+
+    return parsePackedMessage(buffer);
+}
+
+static ParsedMessage
+makeValueDataPacket(Tid tid, unsigned index, size_t offset, const Blob& data)
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_V);
+    pk.pack(KEY_TID);
+    pk.pack(tid);
+    pk.pack(KEY_V);
+    pk.pack_map(1);
+    pk.pack(index);
+    pk.pack_map(2);
+    pk.pack("o");
+    pk.pack(offset);
+    pk.pack("d");
+    pk.pack_bin(data.size());
+    pk.pack_bin_body((const char*) data.data(), data.size());
+
+    return parsePackedMessage(buffer);
+}
+
+void
+ParsedMessageTester::setUp()
+{}
+
+void
+ParsedMessageTester::tearDown()
+{}
+
+// --- append tests ---
+
+void
+ParsedMessageTester::testAppendInOrder()
+{
+    Blob full = {1, 2, 3, 4, 5, 6};
+    auto msg = makeHeader(0, full.size());
+
+    // Send first half, then second half
+    Blob part1(full.begin(), full.begin() + 3);
+    Blob part2(full.begin() + 3, full.end());
+
+    auto frag1 = makeFragment(0, 0, part1);
+    auto frag2 = makeFragment(0, 3, part2);
+
+    CPPUNIT_ASSERT(msg.append(frag1));
+    CPPUNIT_ASSERT(msg.append(frag2));
+
+    auto& pv = msg.value_parts[0];
+    CPPUNIT_ASSERT(pv.isComplete());
+    CPPUNIT_ASSERT_EQUAL(full.size(), pv.received_bytes);
+
+    auto reassembled = pv.reassemble();
+    CPPUNIT_ASSERT(reassembled == full);
+}
+
+void
+ParsedMessageTester::testAppendOutOfOrder()
+{
+    Blob full = {10, 20, 30, 40, 50, 60};
+    auto msg = makeHeader(0, full.size());
+
+    Blob part1(full.begin(), full.begin() + 2);     // [0..2)
+    Blob part2(full.begin() + 2, full.begin() + 4); // [2..4)
+    Blob part3(full.begin() + 4, full.end());       // [4..6)
+
+    // Send in order: part3, part1, part2
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 4, part3)));
+    CPPUNIT_ASSERT(!msg.value_parts[0].isComplete());
+
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, part1)));
+    CPPUNIT_ASSERT(!msg.value_parts[0].isComplete());
+
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 2, part2)));
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+
+    auto reassembled = msg.value_parts[0].reassemble();
+    CPPUNIT_ASSERT(reassembled == full);
+}
+
+void
+ParsedMessageTester::testAppendReverseOrder()
+{
+    Blob full = {1, 2, 3, 4, 5, 6, 7, 8};
+    auto msg = makeHeader(0, full.size());
+
+    // 4 fragments of 2 bytes each, sent in reverse
+    for (int i = 3; i >= 0; --i) {
+        size_t offset = i * 2;
+        Blob part(full.begin() + offset, full.begin() + offset + 2);
+        CPPUNIT_ASSERT(msg.append(makeFragment(0, offset, part)));
+    }
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.value_parts[0].reassemble() == full);
+}
+
+void
+ParsedMessageTester::testAppendDuplicateFragment()
+{
+    Blob full = {1, 2, 3, 4};
+    auto msg = makeHeader(0, full.size());
+
+    Blob part1(full.begin(), full.begin() + 2);
+    Blob part2(full.begin() + 2, full.end());
+
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, part1)));
+    // Duplicate of first fragment should be rejected
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, 0, part1)));
+
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 2, part2)));
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 4, msg.value_parts[0].received_bytes);
+}
+
+void
+ParsedMessageTester::testAppendOverlappingFragments()
+{
+    Blob full = {1, 2, 3, 4, 5, 6};
+    auto msg = makeHeader(0, full.size());
+
+    // Fragment [0..3)
+    Blob part1(full.begin(), full.begin() + 3);
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, part1)));
+
+    // Overlapping fragment [2..5) should be rejected
+    Blob overlap(full.begin() + 2, full.begin() + 5);
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, 2, overlap)));
+
+    // Non-overlapping fragment [3..6) should succeed
+    Blob part2(full.begin() + 3, full.end());
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 3, part2)));
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.value_parts[0].reassemble() == full);
+}
+
+void
+ParsedMessageTester::testAppendFragmentBeyondTotal()
+{
+    auto msg = makeHeader(0, 4);
+
+    // Fragment at offset 3 with 2 bytes goes beyond total_size of 4
+    Blob data = {1, 2};
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, 3, data)));
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, msg.value_parts[0].received_bytes);
+}
+
+void
+ParsedMessageTester::testAppendEmptyFragment()
+{
+    auto msg = makeHeader(0, 4);
+
+    Blob empty;
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, 0, empty)));
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, msg.value_parts[0].received_bytes);
+}
+
+void
+ParsedMessageTester::testAppendUnknownIndex()
+{
+    auto msg = makeHeader(0, 10);
+
+    // Fragment for index 1 which doesn't exist in value_parts
+    Blob data = {1, 2, 3};
+    CPPUNIT_ASSERT(!msg.append(makeFragment(1, 0, data)));
+    // Index 0 should be untouched
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, msg.value_parts[0].received_bytes);
+}
+
+void
+ParsedMessageTester::testAppendAlreadyComplete()
+{
+    Blob full = {1, 2, 3, 4};
+    auto msg = makeHeader(0, full.size());
+
+    // Complete the value
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, full)));
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+
+    // Further fragment should be rejected
+    Blob extra = {5, 6};
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, 0, extra)));
+}
+
+void
+ParsedMessageTester::testAppendOverflowingOffset()
+{
+    auto msg = makeHeader(0, 4);
+
+    Blob data = {1};
+    CPPUNIT_ASSERT(!msg.append(makeFragment(0, std::numeric_limits<size_t>::max(), data)));
+    CPPUNIT_ASSERT_EQUAL((size_t) 0, msg.value_parts[0].received_bytes);
+}
+
+void
+ParsedMessageTester::testParseRejectsNonMapPacket()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack(42);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseRejectsInvalidValueDataPayload()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_V);
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_V);
+    pk.pack_array(1);
+    pk.pack(42);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseRejectsInvalidValuesField()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_R);
+    pk.pack_map(1);
+    pk.pack(KEY_REQ_VALUES);
+    pk.pack("invalid");
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_R);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    CPPUNIT_ASSERT_THROW(parsed.msgpack_unpack(msg.get()), msgpack::type_error);
+}
+
+void
+ParsedMessageTester::testParseIgnoresIncompleteValueDataEntry()
+{
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+
+    pk.pack_map(3);
+    pk.pack(KEY_Y);
+    pk.pack(KEY_V);
+    pk.pack(KEY_TID);
+    pk.pack(1u);
+    pk.pack(KEY_V);
+    pk.pack_map(1);
+    pk.pack(0u);
+    pk.pack_map(1);
+    pk.pack("o");
+    pk.pack(0u);
+
+    auto msg = msgpack::unpack(buffer.data(), buffer.size());
+    ParsedMessage parsed;
+    parsed.msgpack_unpack(msg.get());
+
+    CPPUNIT_ASSERT(parsed.fragment_parts.empty());
+}
+
+// --- complete tests ---
+
+void
+ParsedMessageTester::testCompleteEmpty()
+{
+    // No value_parts at all — should be trivially complete
+    ParsedMessage msg;
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT(msg.values.empty());
+}
+
+void
+ParsedMessageTester::testCompleteIncomplete()
+{
+    auto msg = makeHeader(0, 100);
+    Blob partial = {1, 2, 3};
+    msg.append(makeFragment(0, 0, partial));
+
+    CPPUNIT_ASSERT(!msg.complete());
+    CPPUNIT_ASSERT(msg.values.empty());
+}
+
+void
+ParsedMessageTester::testCompleteZeroSizedValue()
+{
+    auto msg = makeHeader(0, 0);
+
+    CPPUNIT_ASSERT(!msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(!msg.complete());
+    CPPUNIT_ASSERT(msg.values.empty());
+}
+
+void
+ParsedMessageTester::testCompleteSingleValue()
+{
+    std::string data = "hello world";
+    auto serialized = serializeValue(data);
+
+    auto msg = makeHeader(0, serialized.size());
+    msg.append(makeFragment(0, 0, serialized));
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, msg.values.size());
+
+    std::string recovered(msg.values[0]->data.begin(), msg.values[0]->data.end());
+    CPPUNIT_ASSERT_EQUAL(data, recovered);
+}
+
+void
+ParsedMessageTester::testCompleteMultipleValues()
+{
+    std::string data1 = "first value";
+    std::string data2 = "second value";
+    auto ser1 = serializeValue(data1);
+    auto ser2 = serializeValue(data2);
+
+    ParsedMessage msg;
+    msg.value_parts[0].total_size = ser1.size();
+    msg.value_parts[1].total_size = ser2.size();
+
+    msg.append(makeFragment(0, 0, ser1));
+    msg.append(makeFragment(1, 0, ser2));
+
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 2, msg.values.size());
+
+    std::string r1(msg.values[0]->data.begin(), msg.values[0]->data.end());
+    std::string r2(msg.values[1]->data.begin(), msg.values[1]->data.end());
+    CPPUNIT_ASSERT_EQUAL(data1, r1);
+    CPPUNIT_ASSERT_EQUAL(data2, r2);
+}
+
+void
+ParsedMessageTester::testCompleteReassemblyOrder()
+{
+    // Verify that out-of-order fragments produce correct reassembly
+    std::string data = "test data for fragmentation";
+    auto serialized = serializeValue(data);
+
+    auto msg = makeHeader(0, serialized.size());
+
+    // Split into 3 fragments and send out of order
+    size_t chunk = serialized.size() / 3;
+    Blob frag1(serialized.begin(), serialized.begin() + chunk);
+    Blob frag2(serialized.begin() + chunk, serialized.begin() + 2 * chunk);
+    Blob frag3(serialized.begin() + 2 * chunk, serialized.end());
+
+    // Send: third, first, second
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 2 * chunk, frag3)));
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, frag1)));
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, chunk, frag2)));
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, msg.values.size());
+
+    std::string recovered(msg.values[0]->data.begin(), msg.values[0]->data.end());
+    CPPUNIT_ASSERT_EQUAL(data, recovered);
+}
+
+void
+ParsedMessageTester::testAppendMultipleValuesOutOfOrder()
+{
+    // Two values, both fragmented, fragments interleaved and out of order
+    Blob val1 = {1, 2, 3, 4, 5, 6};
+    Blob val2 = {10, 20, 30, 40};
+
+    ParsedMessage msg;
+    msg.value_parts[0].total_size = val1.size();
+    msg.value_parts[1].total_size = val2.size();
+
+    // val2 second half
+    CPPUNIT_ASSERT(msg.append(makeFragment(1, 2, Blob {30, 40})));
+    // val1 last third
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 4, Blob {5, 6})));
+    // val2 first half
+    CPPUNIT_ASSERT(msg.append(makeFragment(1, 0, Blob {10, 20})));
+    // val1 first third
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 0, Blob {1, 2})));
+    // val1 middle third
+    CPPUNIT_ASSERT(msg.append(makeFragment(0, 2, Blob {3, 4})));
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.value_parts[1].isComplete());
+    CPPUNIT_ASSERT(msg.value_parts[0].reassemble() == val1);
+    CPPUNIT_ASSERT(msg.value_parts[1].reassemble() == val2);
+}
+
+void
+ParsedMessageTester::testReceiveLargeFragmentedValue()
+{
+    std::string data(TEST_MTU * 3, 'x');
+    auto serialized = serializeValue(data);
+    CPPUNIT_ASSERT(serialized.size() > TEST_MTU);
+
+    auto msg = makeReplyHeaderPacket(1, {serialized.size()});
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, msg.value_parts.size());
+    CPPUNIT_ASSERT_EQUAL(serialized.size(), msg.value_parts[0].total_size);
+
+    for (size_t offset = 0; offset < serialized.size(); offset += TEST_MTU) {
+        auto end = std::min(offset + TEST_MTU, serialized.size());
+        Blob fragment(serialized.begin() + offset, serialized.begin() + end);
+        auto packet = makeValueDataPacket(1, 0, offset, fragment);
+        CPPUNIT_ASSERT(msg.append(packet));
+    }
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, msg.values.size());
+
+    std::string recovered(msg.values[0]->data.begin(), msg.values[0]->data.end());
+    CPPUNIT_ASSERT_EQUAL(data, recovered);
+}
+
+void
+ParsedMessageTester::testReceiveLargeFragmentedValueOutOfOrder()
+{
+    std::string data(TEST_MTU * 3 + 117, 'y');
+    auto serialized = serializeValue(data);
+    CPPUNIT_ASSERT(serialized.size() > TEST_MTU);
+
+    auto msg = makeReplyHeaderPacket(7, {serialized.size()});
+    std::vector<ParsedMessage> packets;
+    for (size_t offset = 0; offset < serialized.size(); offset += TEST_MTU) {
+        auto end = std::min(offset + TEST_MTU, serialized.size());
+        Blob fragment(serialized.begin() + offset, serialized.begin() + end);
+        packets.emplace_back(makeValueDataPacket(7, 0, offset, fragment));
+    }
+
+    CPPUNIT_ASSERT(packets.size() >= 3);
+    CPPUNIT_ASSERT(msg.append(packets.back()));
+    CPPUNIT_ASSERT(msg.append(packets.front()));
+    for (size_t i = 1; i + 1 < packets.size(); ++i)
+        CPPUNIT_ASSERT(msg.append(packets[i]));
+
+    CPPUNIT_ASSERT(msg.value_parts[0].isComplete());
+    CPPUNIT_ASSERT(msg.complete());
+    CPPUNIT_ASSERT_EQUAL((size_t) 1, msg.values.size());
+
+    std::string recovered(msg.values[0]->data.begin(), msg.values[0]->data.end());
+    CPPUNIT_ASSERT_EQUAL(data, recovered);
+}
+
+} // namespace test
@@ -0,0 +1,68 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+// cppunit
+#include <cppunit/TestFixture.h>
+#include <cppunit/extensions/HelperMacros.h>
+
+namespace test {
+
+class ParsedMessageTester : public CppUnit::TestFixture
+{
+    CPPUNIT_TEST_SUITE(ParsedMessageTester);
+    CPPUNIT_TEST(testAppendInOrder);
+    CPPUNIT_TEST(testAppendOutOfOrder);
+    CPPUNIT_TEST(testAppendReverseOrder);
+    CPPUNIT_TEST(testAppendDuplicateFragment);
+    CPPUNIT_TEST(testAppendOverlappingFragments);
+    CPPUNIT_TEST(testAppendFragmentBeyondTotal);
+    CPPUNIT_TEST(testAppendEmptyFragment);
+    CPPUNIT_TEST(testAppendUnknownIndex);
+    CPPUNIT_TEST(testAppendAlreadyComplete);
+    CPPUNIT_TEST(testAppendOverflowingOffset);
+    CPPUNIT_TEST(testParseRejectsNonMapPacket);
+    CPPUNIT_TEST(testParseRejectsInvalidValueDataPayload);
+    CPPUNIT_TEST(testParseRejectsInvalidValuesField);
+    CPPUNIT_TEST(testParseIgnoresIncompleteValueDataEntry);
+    CPPUNIT_TEST(testCompleteEmpty);
+    CPPUNIT_TEST(testCompleteIncomplete);
+    CPPUNIT_TEST(testCompleteZeroSizedValue);
+    CPPUNIT_TEST(testCompleteSingleValue);
+    CPPUNIT_TEST(testCompleteMultipleValues);
+    CPPUNIT_TEST(testCompleteReassemblyOrder);
+    CPPUNIT_TEST(testAppendMultipleValuesOutOfOrder);
+    CPPUNIT_TEST(testReceiveLargeFragmentedValue);
+    CPPUNIT_TEST(testReceiveLargeFragmentedValueOutOfOrder);
+    CPPUNIT_TEST_SUITE_END();
+
+public:
+    void setUp();
+    void tearDown();
+
+    void testAppendInOrder();
+    void testAppendOutOfOrder();
+    void testAppendReverseOrder();
+    void testAppendDuplicateFragment();
+    void testAppendOverlappingFragments();
+    void testAppendFragmentBeyondTotal();
+    void testAppendEmptyFragment();
+    void testAppendUnknownIndex();
+    void testAppendAlreadyComplete();
+    void testAppendOverflowingOffset();
+    void testParseRejectsNonMapPacket();
+    void testParseRejectsInvalidValueDataPayload();
+    void testParseRejectsInvalidValuesField();
+    void testParseIgnoresIncompleteValueDataEntry();
+    void testCompleteEmpty();
+    void testCompleteIncomplete();
+    void testCompleteZeroSizedValue();
+    void testCompleteSingleValue();
+    void testCompleteMultipleValues();
+    void testCompleteReassemblyOrder();
+    void testAppendMultipleValuesOutOfOrder();
+    void testReceiveLargeFragmentedValue();
+    void testReceiveLargeFragmentedValueOutOfOrder();
+};
+
+} // namespace test
@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "peerdiscoverytester.h"
+#include "test_peerdiscovery.h"
 #include "opendht/value.h"

 #include <mutex>
@@ -54,7 +54,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
    unsigned countDht {0};
    unsigned countJami {0};
    {
-        std::unique_lock<std::mutex> l(lock);
+        std::unique_lock l(lock);
        dht::PeerDiscovery testDht(MULTICAST_PORT);
        dht::PeerDiscovery testJami(MULTICAST_PORT);

@@ -63,7 +63,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
            CPPUNIT_ASSERT_EQUAL(dhtNode.nodeid, v.nodeid);
            CPPUNIT_ASSERT_EQUAL(dhtNode.nid, v.nid);
            {
-                std::lock_guard<std::mutex> l(lock);
+                std::lock_guard l(lock);
                countDht++;
            }
            cv.notify_all();
@@ -75,7 +75,7 @@ PeerDiscoveryTester::testMulticastToTwoNodes()
            CPPUNIT_ASSERT_EQUAL(jamiNode.cha, v.cha);
            CPPUNIT_ASSERT_EQUAL(jamiNode.str, v.str);
            {
-                std::lock_guard<std::mutex> l(lock);
+                std::lock_guard l(lock);
                countJami++;
            }
            cv.notify_all();
@@ -0,0 +1,323 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_storage.h"
+
+#include <opendht/thread_pool.h>
+
+#include <chrono>
+#include <mutex>
+#include <condition_variable>
+using namespace std::chrono_literals;
+using namespace std::literals;
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(StorageTester);
+
+static constexpr unsigned VAL_SIZE = 1024;
+
+static dht::DhtRunner::Config
+makeConfig(ssize_t maxStore = -1, ssize_t maxLocalStore = -1, ssize_t maxKeys = -1)
+{
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = maxStore;
+    config.dht_config.node_config.max_local_store_size = maxLocalStore;
+    config.dht_config.node_config.max_store_keys = maxKeys;
+    return config;
+}
+
+static std::shared_ptr<dht::Value>
+makeValue(size_t size = VAL_SIZE)
+{
+    return std::make_shared<dht::Value>(std::string(size, 'x'));
+}
+
+void
+StorageTester::setUp()
+{
+    // Tests configure and start nodes with specific limits as needed.
+}
+
+void
+StorageTester::tearDown()
+{
+    node1.shutdown();
+    node2.shutdown();
+    node1.join();
+    node2.join();
+}
+
+void
+StorageTester::startNodes(dht::DhtRunner::Config config1, dht::DhtRunner::Config config2)
+{
+    node1.run(0, config1);
+    node2.run(0, config2);
+    auto bound = node1.getBound();
+    if (bound.isUnspecified())
+        bound.setLoopback();
+    node2.bootstrap(bound);
+    std::this_thread::sleep_for(1s);
+}
+
+void
+StorageTester::testRemoteStorageLimit()
+{
+    constexpr ssize_t REMOTE_LIMIT = 10 * 1024; // 10 KB remote limit
+    startNodes(makeConfig(REMOTE_LIMIT, -1 /* unlimited local */), makeConfig());
+
+    // Put many values from node2 -> they are stored remotely on node1
+    auto key = dht::InfoHash::get("remote_test");
+    constexpr unsigned N = 20; // 20 * ~1KB = ~20KB, more than 10KB limit
+    std::mutex mtx;
+    std::condition_variable cv;
+    unsigned putCount = 0;
+
+    for (unsigned i = 0; i < N; i++) {
+        auto val = makeValue();
+        node2.put(key, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            putCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N; }));
+    }
+
+    // Wait for values to propagate
+    std::this_thread::sleep_for(2s);
+
+    // The combined store size on node1 should be under or near the remote limit
+    auto [storeSize, storeValues] = node1.getStoreSize();
+    CPPUNIT_ASSERT_MESSAGE("Remote store size (" + std::to_string(storeSize)
+                               + ") should be limited (limit: " + std::to_string(REMOTE_LIMIT) + ")",
+                           storeSize <= static_cast<size_t>(REMOTE_LIMIT) * 2 // allow some margin for timing
+    );
+    // We should have fewer values than N since eviction happened
+    CPPUNIT_ASSERT_MESSAGE("Should have fewer than " + std::to_string(N) + " values stored, got "
+                               + std::to_string(storeValues),
+                           storeValues < N);
+}
+
+void
+StorageTester::testLocalStorageLimit()
+{
+    constexpr ssize_t LOCAL_LIMIT = 10 * 1024; // 10 KB local limit
+    // Only node1 is needed - testing local puts
+    auto config = makeConfig(-1 /* unlimited remote */, LOCAL_LIMIT);
+    node1.run(0, config);
+
+    // With 1KB values and 10KB limit, ~10 should fit, rest should be rejected
+    constexpr unsigned N = 20; // 20 * ~1KB = ~20KB, more than 10KB limit
+    std::mutex mtx;
+    std::condition_variable cv;
+    unsigned putCount = 0;
+
+    for (unsigned i = 0; i < N; i++) {
+        auto key = dht::InfoHash::get("local_test_" + std::to_string(i));
+        auto val = makeValue();
+        node1.put(key, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            putCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N; }));
+    }
+
+    auto [storeSize, storeValues] = node1.getStoreSize();
+    CPPUNIT_ASSERT_MESSAGE("Local store size (" + std::to_string(storeSize) + ") should not exceed "
+                               + std::to_string(LOCAL_LIMIT),
+                           storeSize <= static_cast<size_t>(LOCAL_LIMIT));
+    CPPUNIT_ASSERT_MESSAGE("Some values should be stored (got " + std::to_string(storeValues) + ")", storeValues > 0);
+    CPPUNIT_ASSERT_MESSAGE("Not all values should fit (stored " + std::to_string(storeValues) + "/" + std::to_string(N)
+                               + ")",
+                           storeValues < N);
+}
+
+void
+StorageTester::testIndependentLimits()
+{
+    constexpr ssize_t REMOTE_LIMIT = 10 * 1024;
+    constexpr ssize_t LOCAL_LIMIT = 10 * 1024;
+    startNodes(makeConfig(REMOTE_LIMIT, LOCAL_LIMIT), makeConfig());
+
+    // Put local values on node1 — some will be rejected when limit is hit
+    constexpr unsigned N_LOCAL = 20;
+    std::mutex mtx;
+    std::condition_variable cv;
+    unsigned putCount = 0;
+
+    for (unsigned i = 0; i < N_LOCAL; i++) {
+        auto key = dht::InfoHash::get("local_indep_" + std::to_string(i));
+        auto val = makeValue();
+        node1.put(key, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            putCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N_LOCAL; }));
+    }
+
+    // Now put remote values from node2
+    constexpr unsigned N_REMOTE = 20;
+    unsigned remotePutCount = 0;
+    for (unsigned i = 0; i < N_REMOTE; i++) {
+        auto key = dht::InfoHash::get("remote_indep_" + std::to_string(i));
+        auto val = makeValue();
+        node2.put(key, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            remotePutCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return remotePutCount == N_REMOTE; }));
+    }
+
+    // Wait for values to propagate
+    std::this_thread::sleep_for(2s);
+
+    auto [storeSize, storeValues] = node1.getStoreSize();
+    // Combined should be bounded by remote + local limits (with some margin for timing)
+    CPPUNIT_ASSERT_MESSAGE("Combined store size (" + std::to_string(storeSize) + ") should be limited",
+                           storeSize <= static_cast<size_t>(REMOTE_LIMIT + LOCAL_LIMIT) * 2);
+    // Not all values should be stored (both limits should reject/evict some)
+    CPPUNIT_ASSERT_MESSAGE("Should have fewer than " + std::to_string(N_LOCAL + N_REMOTE) + " values, got "
+                               + std::to_string(storeValues),
+                           storeValues < N_LOCAL + N_REMOTE);
+}
+
+void
+StorageTester::testLocalPutNotAffectedByRemoteLimit()
+{
+    constexpr ssize_t REMOTE_LIMIT = 1024; // 1 KB - very small
+    startNodes(makeConfig(REMOTE_LIMIT, -1 /* unlimited local */), makeConfig());
+
+    // Fill up remote storage from node2
+    auto remoteKey = dht::InfoHash::get("fill_remote");
+    constexpr unsigned N_REMOTE = 5;
+    std::mutex mtx;
+    std::condition_variable cv;
+    unsigned putCount = 0;
+
+    for (unsigned i = 0; i < N_REMOTE; i++) {
+        auto val = makeValue();
+        node2.put(remoteKey, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            putCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return putCount == N_REMOTE; }));
+    }
+    std::this_thread::sleep_for(2s);
+
+    // Local puts on node1 should all succeed regardless of remote limit
+    constexpr unsigned N_LOCAL = 10;
+    unsigned localPutCount = 0;
+    unsigned localPutOk = 0;
+    for (unsigned i = 0; i < N_LOCAL; i++) {
+        auto key = dht::InfoHash::get("local_separate_" + std::to_string(i));
+        auto val = makeValue();
+        node1.put(key, val, [&](bool ok) {
+            std::lock_guard lk(mtx);
+            localPutCount++;
+            if (ok)
+                localPutOk++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return localPutCount == N_LOCAL; }));
+    }
+
+    // All local puts should succeed
+    CPPUNIT_ASSERT_EQUAL(N_LOCAL, localPutOk);
+
+    // Verify local values can be retrieved
+    for (unsigned i = 0; i < N_LOCAL; i++) {
+        auto key = dht::InfoHash::get("local_separate_" + std::to_string(i));
+        auto vals = node1.get(key).get();
+        CPPUNIT_ASSERT_MESSAGE("Local value " + std::to_string(i) + " should be retrievable", !vals.empty());
+    }
+}
+
+void
+StorageTester::testRemotePutNotAffectedByLocalLimit()
+{
+    constexpr ssize_t LOCAL_LIMIT = 1024; // 1 KB - very small
+    startNodes(makeConfig(-1 /* unlimited remote */, LOCAL_LIMIT), makeConfig());
+
+    // Fill up local storage on node1
+    constexpr unsigned N_LOCAL = 5;
+    std::mutex mtx;
+    std::condition_variable cv;
+    unsigned localPutCount = 0;
+
+    for (unsigned i = 0; i < N_LOCAL; i++) {
+        auto key = dht::InfoHash::get("fill_local_" + std::to_string(i));
+        auto val = makeValue();
+        node1.put(key, val, [&](bool) {
+            std::lock_guard lk(mtx);
+            localPutCount++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return localPutCount == N_LOCAL; }));
+    }
+
+    // Remote puts from node2 should all succeed despite full local storage
+    auto remoteKey = dht::InfoHash::get("remote_separate");
+    constexpr unsigned N_REMOTE = 10;
+    unsigned remotePutCount = 0;
+    unsigned remotePutOk = 0;
+
+    for (unsigned i = 0; i < N_REMOTE; i++) {
+        auto val = makeValue();
+        node2.put(remoteKey, val, [&](bool ok) {
+            std::lock_guard lk(mtx);
+            remotePutCount++;
+            if (ok)
+                remotePutOk++;
+            cv.notify_all();
+        });
+    }
+
+    {
+        std::unique_lock lk(mtx);
+        CPPUNIT_ASSERT(cv.wait_for(lk, 30s, [&] { return remotePutCount == N_REMOTE; }));
+    }
+
+    // All remote puts should succeed
+    CPPUNIT_ASSERT_EQUAL(N_REMOTE, remotePutOk);
+
+    std::this_thread::sleep_for(2s);
+    auto vals = node1.get(remoteKey).get();
+    CPPUNIT_ASSERT_MESSAGE("Remote values should be stored on node1 despite full local storage, got "
+                               + std::to_string(vals.size()),
+                           !vals.empty());
+}
+
+} // namespace test
@@ -0,0 +1,57 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+// cppunit
+#include <cppunit/TestFixture.h>
+#include <cppunit/extensions/HelperMacros.h>
+
+#include <opendht/dhtrunner.h>
+
+namespace test {
+
+class StorageTester : public CppUnit::TestFixture
+{
+    CPPUNIT_TEST_SUITE(StorageTester);
+    CPPUNIT_TEST(testRemoteStorageLimit);
+    CPPUNIT_TEST(testLocalStorageLimit);
+    CPPUNIT_TEST(testIndependentLimits);
+    CPPUNIT_TEST(testLocalPutNotAffectedByRemoteLimit);
+    CPPUNIT_TEST(testRemotePutNotAffectedByLocalLimit);
+    CPPUNIT_TEST_SUITE_END();
+
+    dht::DhtRunner node1 {};
+    dht::DhtRunner node2 {};
+
+    /**
+     * Start both nodes with given configs, bootstrap node2 to node1
+     */
+    void startNodes(dht::DhtRunner::Config config1, dht::DhtRunner::Config config2);
+
+public:
+    void setUp();
+    void tearDown();
+
+    /**
+     * Test that remote values (received from other nodes) are limited by max_store_size
+     */
+    void testRemoteStorageLimit();
+    /**
+     * Test that locally put values are limited by max_local_store_size
+     */
+    void testLocalStorageLimit();
+    /**
+     * Test that remote and local limits work independently
+     */
+    void testIndependentLimits();
+    /**
+     * Test that local puts are not blocked when remote storage is full
+     */
+    void testLocalPutNotAffectedByRemoteLimit();
+    /**
+     * Test that remote puts are not blocked when local storage is full
+     */
+    void testRemotePutNotAffectedByLocalLimit();
+};
+
+} // namespace test
@@ -1,7 +1,7 @@
 // Copyright (c) 2014-2026 Savoir-faire Linux Inc.
 // SPDX-License-Identifier: MIT

-#include "threadpooltester.h"
+#include "test_threadpool.h"

 #include "opendht/thread_pool.h"
 #include <atomic>
@@ -80,6 +80,46 @@ ThreadPoolTester::testContext()
    CPPUNIT_ASSERT_EQUAL(N, count.load());
 }

+void
+ThreadPoolTester::testJoinNonEmptyTaskQueue()
+{
+    dht::ThreadPool pool(2);
+
+    constexpr unsigned N = 128;
+    std::atomic_uint count {0};
+
+    // Schedule enough work so that the task queue is non-empty when calling
+    // pool.join() below.
+    for (unsigned i = 0; i < N; i++)
+        pool.run([&] {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            count++;
+        });
+
+    std::atomic_bool joined {false};
+    std::condition_variable cv;
+    std::thread joinThread([&] {
+        CPPUNIT_ASSERT(count.load() < N);
+        pool.join();
+        joined = true;
+        cv.notify_one();
+    });
+
+    // After calling join(), all pending tasks should complete, and then all
+    // threads in the pool should join.
+    std::mutex mtx;
+    std::unique_lock lock(mtx);
+    bool poolJoined = cv.wait_for(lock, std::chrono::seconds(10), [&] { return joined.load(); });
+    if (!poolJoined) {
+        // Detach joinThread if we timed out, otherwise the test can crash.
+        joinThread.detach();
+    } else {
+        joinThread.join();
+    }
+    CPPUNIT_ASSERT_EQUAL_MESSAGE("Some tasks were not completed", N, count.load());
+    CPPUNIT_ASSERT_MESSAGE("Thread pool failed to join before timeout", poolJoined);
+}
+
 void
 ThreadPoolTester::tearDown()
 {}
@@ -14,6 +14,7 @@ class ThreadPoolTester : public CppUnit::TestFixture
    CPPUNIT_TEST(testThreadPool);
    CPPUNIT_TEST(testExecutor);
    CPPUNIT_TEST(testContext);
+    CPPUNIT_TEST(testJoinNonEmptyTaskQueue);
    CPPUNIT_TEST_SUITE_END();

 public:
@@ -29,6 +30,7 @@ public:
    void testThreadPool();
    void testExecutor();
    void testContext();
+    void testJoinNonEmptyTaskQueue();
 };

 } // namespace test
@@ -0,0 +1,140 @@
+// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
+// SPDX-License-Identifier: MIT
+
+#include "test_value.h"
+
+#include <iostream>
+#include <string>
+
+// opendht
+#include "opendht/value.h"
+#include "opendht/crypto.h"
+#include <msgpack.hpp>
+
+namespace test {
+CPPUNIT_TEST_SUITE_REGISTRATION(ValueTester);
+
+void
+ValueTester::setUp()
+{}
+
+void
+ValueTester::testConstructors()
+{
+    std::string the_data {"42 cats"};
+    dht::Value the_dht_value {(const uint8_t*) the_data.data(), the_data.size()};
+    std::string from_value {the_dht_value.data.begin(), the_dht_value.data.end()};
+    CPPUNIT_ASSERT_EQUAL(the_data, from_value);
+}
+
+void
+ValueTester::testFilter()
+{
+    dht::Value::Filter defaultFiler {};
+
+    auto isPairSize = dht::Value::Filter([](const dht::Value& v) { return v.data.size() % 2 == 0; });
+
+    auto isUserTypeTest = dht::Value::Filter([](const dht::Value& v) { return v.user_type == "test"; });
+
+    std::string data1 {"42 cats"};
+    dht::Value value1 {(const uint8_t*) data1.data(), data1.size()};
+    value1.user_type = "test";
+
+    std::string data2 {"420 cats"};
+    dht::Value value2 {(const uint8_t*) data2.data(), data2.size()};
+    dht::Value value3 {(const uint8_t*) data2.data(), data2.size()};
+    value3.user_type = "test";
+
+    CPPUNIT_ASSERT(!isPairSize(value1));
+    CPPUNIT_ASSERT(isUserTypeTest(value1));
+
+    auto isBoth = dht::Value::Filter::chain(isPairSize, isUserTypeTest);
+    auto isUserTypeTest2 = dht::Value::Filter::chain(defaultFiler, isUserTypeTest);
+
+    CPPUNIT_ASSERT(isUserTypeTest2(value1));
+    CPPUNIT_ASSERT(!isUserTypeTest2(value2));
+    CPPUNIT_ASSERT(!isBoth(value1));
+    CPPUNIT_ASSERT(!isBoth(value2));
+    CPPUNIT_ASSERT(isBoth(value3));
+}
+
+void
+ValueTester::tearDown()
+{}
+
+void
+ValueTester::testPushTypeMsgpackRoundTrip()
+{
+    dht::Value original {(const uint8_t*) "hello", 5};
+    original.id = 42;
+    original.priority = 3;
+    original.pushType = "audioCall";
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    original.msgpack_pack(pk);
+
+    msgpack::unpacked msg;
+    msgpack::unpack(msg, buffer.data(), buffer.size());
+    dht::Value restored(msg.get());
+
+    CPPUNIT_ASSERT_EQUAL(original.id, restored.id);
+    CPPUNIT_ASSERT_EQUAL(original.priority, restored.priority);
+    CPPUNIT_ASSERT_EQUAL(original.pushType, restored.pushType);
+}
+
+void
+ValueTester::testPushTypeAbsentAfterUnpack()
+{
+    dht::Value withPt {(const uint8_t*) "data", 4};
+    withPt.id = 1;
+    withPt.pushType = "videoCall";
+    withPt.priority = 2;
+
+    msgpack::sbuffer buf1;
+    msgpack::packer<msgpack::sbuffer> pk1(&buf1);
+    withPt.msgpack_pack(pk1);
+
+    msgpack::unpacked msg1;
+    msgpack::unpack(msg1, buf1.data(), buf1.size());
+
+    dht::Value reused;
+    reused.msgpack_unpack(msg1.get());
+    CPPUNIT_ASSERT_EQUAL(std::string("videoCall"), reused.pushType);
+    CPPUNIT_ASSERT_EQUAL(2u, reused.priority);
+
+    dht::Value plain {(const uint8_t*) "data", 4};
+    plain.id = 2;
+
+    msgpack::sbuffer buf2;
+    msgpack::packer<msgpack::sbuffer> pk2(&buf2);
+    plain.msgpack_pack(pk2);
+
+    msgpack::unpacked msg2;
+    msgpack::unpack(msg2, buf2.data(), buf2.size());
+
+    reused.msgpack_unpack(msg2.get());
+    CPPUNIT_ASSERT_EQUAL(std::string(), reused.pushType);
+    CPPUNIT_ASSERT_EQUAL(0u, reused.priority);
+}
+
+void
+ValueTester::testPushTypePreservedAfterEncrypt()
+{
+    auto key = dht::crypto::PrivateKey::generate();
+    const auto& pubkey = key.getPublicKey();
+
+    dht::Value original {(const uint8_t*) "secret", 6};
+    original.id = 99;
+    original.priority = 1;
+    original.pushType = "audioCall";
+
+    auto encrypted = original.encrypt(key, pubkey);
+
+    CPPUNIT_ASSERT_EQUAL(original.pushType, encrypted.pushType);
+    CPPUNIT_ASSERT_EQUAL(original.priority, encrypted.priority);
+    CPPUNIT_ASSERT_EQUAL(original.id, encrypted.id);
+    CPPUNIT_ASSERT(encrypted.isEncrypted());
+}
+
+} // namespace test
@@ -13,6 +13,9 @@ class ValueTester : public CppUnit::TestFixture
    CPPUNIT_TEST_SUITE(ValueTester);
    CPPUNIT_TEST(testConstructors);
    CPPUNIT_TEST(testFilter);
+    CPPUNIT_TEST(testPushTypeMsgpackRoundTrip);
+    CPPUNIT_TEST(testPushTypeAbsentAfterUnpack);
+    CPPUNIT_TEST(testPushTypePreservedAfterEncrypt);
    CPPUNIT_TEST_SUITE_END();

 public:
@@ -32,6 +35,9 @@ public:
     * Test compare operators
     */
    void testFilter();
+    void testPushTypeMsgpackRoundTrip();
+    void testPushTypeAbsentAfterUnpack();
+    void testPushTypePreservedAfterEncrypt();
 };

 } // namespace test
@@ -5,12 +5,29 @@
 #include <cppunit/CompilerOutputter.h>
 #include <iostream>

+namespace {
+
+void
+listTests(CppUnit::Test* test, const std::string& prefix = {})
+{
+    const auto name = test->getName();
+    const auto fullName = prefix.empty() ? name : prefix + "/" + name;
+    if (test->getChildTestCount() == 0) {
+        std::cout << fullName << std::endl;
+        return;
+    }
+    for (int index = 0; index < test->getChildTestCount(); ++index)
+        listTests(test->getChildTestAt(index), fullName);
+}
+
+} // namespace
+
 extern "C" {
 #include <gnutls/gnutls.h>
 }

 int
-main(int /*argc*/, char** /*argv*/)
+main(int argc, char** argv)
 {
 #ifdef _MSC_VER
    if (auto err = gnutls_global_init()) {
@@ -25,8 +42,15 @@ main(int /*argc*/, char** /*argv*/)
        std::cout << "No test cases specified for suite" << std::endl;
        return 1;
    }
+    if (argc > 1 && std::string(argv[1]) == "--list") {
+        listTests(suite);
+        return 0;
+    }
    CppUnit::TextUi::TestRunner runner;
-    runner.addTest(suite);
+    if (argc > 1)
+        runner.addTest(suite->findTest(argv[1]));
+    else
+        runner.addTest(suite);
    auto result = runner.run() ? 0 : 1;
    return result;
 }
@@ -1,62 +0,0 @@
-// Copyright (c) 2014-2026 Savoir-faire Linux Inc.
-// SPDX-License-Identifier: MIT
-
-#include "valuetester.h"
-
-#include <iostream>
-#include <string>
-
-// opendht
-#include "opendht/value.h"
-
-namespace test {
-CPPUNIT_TEST_SUITE_REGISTRATION(ValueTester);
-
-void
-ValueTester::setUp()
-{}
-
-void
-ValueTester::testConstructors()
-{
-    std::string the_data {"42 cats"};
-    dht::Value the_dht_value {(const uint8_t*) the_data.data(), the_data.size()};
-    std::string from_value {the_dht_value.data.begin(), the_dht_value.data.end()};
-    CPPUNIT_ASSERT_EQUAL(the_data, from_value);
-}
-
-void
-ValueTester::testFilter()
-{
-    dht::Value::Filter defaultFiler {};
-
-    auto isPairSize = dht::Value::Filter([](const dht::Value& v) { return v.data.size() % 2 == 0; });
-
-    auto isUserTypeTest = dht::Value::Filter([](const dht::Value& v) { return v.user_type == "test"; });
-
-    std::string data1 {"42 cats"};
-    dht::Value value1 {(const uint8_t*) data1.data(), data1.size()};
-    value1.user_type = "test";
-
-    std::string data2 {"420 cats"};
-    dht::Value value2 {(const uint8_t*) data2.data(), data2.size()};
-    dht::Value value3 {(const uint8_t*) data2.data(), data2.size()};
-    value3.user_type = "test";
-
-    CPPUNIT_ASSERT(!isPairSize(value1));
-    CPPUNIT_ASSERT(isUserTypeTest(value1));
-
-    auto isBoth = dht::Value::Filter::chain(isPairSize, isUserTypeTest);
-    auto isUserTypeTest2 = dht::Value::Filter::chain(defaultFiler, isUserTypeTest);
-
-    CPPUNIT_ASSERT(isUserTypeTest2(value1));
-    CPPUNIT_ASSERT(!isUserTypeTest2(value2));
-    CPPUNIT_ASSERT(!isBoth(value1));
-    CPPUNIT_ASSERT(!isBoth(value2));
-    CPPUNIT_ASSERT(isBoth(value3));
-}
-
-void
-ValueTester::tearDown()
-{}
-} // namespace test
@@ -1,20 +0,0 @@
-bin_PROGRAMS = dhtnode dhtchat dhtscanner
-noinst_HEADERS = tools_common.h
-
-AM_CPPFLAGS = -isystem @top_srcdir@/include @JsonCpp_CFLAGS@ @MsgPack_CFLAGS@
-
-dhtnode_SOURCES = dhtnode.cpp
-dhtnode_LDFLAGS = -lopendht -lreadline -lfmt -L@top_builddir@/src/.libs @GnuTLS_LIBS@
-
-dhtchat_SOURCES = dhtchat.cpp
-dhtchat_LDFLAGS = -lopendht -lreadline -lfmt -L@top_builddir@/src/.libs @GnuTLS_LIBS@
-
-dhtscanner_SOURCES = dhtscanner.cpp
-dhtscanner_LDFLAGS = -lopendht -lreadline -lfmt -L@top_builddir@/src/.libs @GnuTLS_LIBS@
-
-if ENABLE_C
-bin_PROGRAMS += dhtcnode
-dhtcnode_CFLAGS = -std=c11 -isystem @top_srcdir@/c -isystem @top_srcdir@/include
-dhtcnode_SOURCES = dhtcnode.c
-dhtcnode_LDFLAGS = -lopendht-c -lreadline -lfmt -L@top_builddir@/c/.libs
-endif
@@ -12,10 +12,10 @@ extern "C" {
 }
 #include <ctime>

-using namespace dht;
+namespace dht {
+namespace tools {

 static std::mt19937_64 rd {dht::crypto::getSeededRandomEngine<std::mt19937_64>()};
-static std::uniform_int_distribution<dht::Value::Id> rand_id;

 const std::string
 printTime(const std::time_t& now)
@@ -34,12 +34,18 @@ print_usage()
    std::cout << "Report bugs to: https://opendht.net" << std::endl;
 }

+} // namespace tools
+} // namespace dht
+
 int
 main(int argc, char** argv)
 {
-    auto params = parseArgs(argc, argv);
+    using namespace dht;
+    using IdDist = std::uniform_int_distribution<dht::Value::Id>;
+
+    auto params = tools::parseArgs(argc, argv);
    if (params.help) {
-        print_usage();
+        tools::print_usage();
        return 0;
    }
 #ifdef _MSC_VER
@@ -58,14 +64,14 @@ main(int argc, char** argv)
        if (not params.bootstrap.empty())
            dht.bootstrap(params.bootstrap);

-        print_node_info(dht.getNodeInfo());
+        tools::print_node_info(dht.getNodeInfo());
        std::cout << "  type 'c {hash}' to join a channel" << std::endl << std::endl;

        bool connected {false};
        InfoHash room;
        std::future<size_t> token;

-        const InfoHash myid = dht.getId();
+        const auto mypk = dht.getPublicKey();

 #ifndef _MSC_VER
        // using the GNU History API
@@ -74,7 +80,7 @@ main(int argc, char** argv)

        while (true) {
            // using the GNU Readline API
-            std::string line = readLine(connected ? PROMPT : "> ");
+            std::string line = tools::readLine(connected ? tools::PROMPT : "> ");
            if (!line.empty() && line[0] == '\0')
                break;
            if (line.empty())
@@ -95,12 +101,12 @@ main(int argc, char** argv)
                    }

                    token = dht.listen<dht::ImMessage>(room, [&](dht::ImMessage&& msg) {
-                        if (msg.from != myid)
-                            std::cout << msg.from.toString() << " at " << printTime(msg.date) << " (took "
+                        if (msg.owner && msg.owner->getLongId() != mypk->getLongId())
+                            std::cout << msg.from.toString() << " at " << tools::printTime(msg.date) << " (took "
                                      << print_duration(std::chrono::system_clock::now()
                                                        - std::chrono::system_clock::from_time_t(msg.date))
-                                      << ") " << (msg.to == myid ? "ENCRYPTED " : "") << ": " << msg.id << " - "
-                                      << msg.msg << std::endl;
+                                      << ") " << (msg.to == mypk->getId() ? "ENCRYPTED " : "") << ": " << msg.id
+                                      << " - " << msg.msg << std::endl;
                        return true;
                    });
                    connected = true;
@@ -117,15 +123,15 @@ main(int argc, char** argv)
                    iss >> idstr;
                    std::getline(iss, line);
                    dht.putEncrypted(room,
-                                     InfoHash(idstr),
-                                     dht::ImMessage(rand_id(rd), std::move(line), now),
+                                     PkId(idstr),
+                                     dht::ImMessage(IdDist()(tools::rd), std::move(line), now),
                                     [](bool ok) {
                                         // dht.cancelPut(room, id);
                                         if (not ok)
                                             std::cout << "Message publishing failed !" << std::endl;
                                     });
                } else {
-                    dht.putSigned(room, dht::ImMessage(rand_id(rd), std::move(line), now), [](bool ok) {
+                    dht.putSigned(room, dht::ImMessage(IdDist()(tools::rd), std::move(line), now), [](bool ok) {
                        // dht.cancelPut(room, id);
                        if (not ok)
                            std::cout << "Message publishing failed !" << std::endl;
@@ -16,7 +16,8 @@ extern "C" {
 #include <set>
 #include <thread> // std::this_thread::sleep_for

-using namespace dht;
+namespace dht {
+namespace tools {

 void
 print_info()
@@ -156,9 +157,6 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
        } else if (op == "ll") {
            node->getNodeInfo([&](const std::shared_ptr<dht::NodeInfo>& nodeInfo) {
                print_node_info(*nodeInfo);
-                std::cout << nodeInfo->ongoing_ops << " ongoing operations" << std::endl;
-                std::cout << "Storage has " << nodeInfo->storage_values << " values, using "
-                          << (nodeInfo->storage_size / 1024) << " KB" << std::endl;
                std::cout << "IPv4 stats:" << std::endl;
                std::cout << nodeInfo->ipv4.toString() << std::endl;
                std::cout << "IPv6 stats:" << std::endl;
@@ -483,7 +481,7 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
            auto value = std::make_shared<dht::Value>(dht::ValueType::USER_DATA.id,
                                                      std::vector<uint8_t> {v.begin(), v.end()});
            value->user_type = "text/plain";
-            node->putEncrypted(id, InfoHash(tostr), std::move(value), [start](bool ok) {
+            node->putEncrypted(id, PkId(tostr), std::move(value), [start](bool ok) {
                auto end = std::chrono::high_resolution_clock::now();
                std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took "
                          << print_duration(end - start) << ')' << std::endl;
@@ -551,9 +549,14 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
    std::cout << std::endl << "Stopping node..." << std::endl;
 }

+} // namespace tools
+} // namespace dht
+
 int
 main(int argc, char** argv)
 {
+    using namespace dht;
+    using namespace dht::tools;
 #ifdef _WIN32
    SetConsoleOutputCP(CP_UTF8);
    SetConsoleCP(CP_UTF8);
@@ -646,7 +649,7 @@ main(int argc, char** argv)
    });

    // wait for shutdown
-    std::unique_lock<std::mutex> lk(m);
+    std::unique_lock lk(m);
    cv.wait(lk, [&]() { return done; });

    node->join();
@@ -1,54 +1,122 @@
-import requests
+#!/usr/bin/env python3
+"""Collect and aggregate statistics from DHT proxy servers."""
+
+import asyncio
+import json
+import sys
 import time
+from typing import Dict, Any

-ts = time.time()
+import aiohttp

-stats_total = {"users":0, "pushListenersCount":0, "listenCount":0, "totalListeners":0, "totalPermanentPuts":0, "timestamp": str(ts)}

-for i in range(80,101):
-    print("Collecting stats for proxy " + str(i))
-    response = requests.request('GET', 'http://127.0.0.1:' + str(i) + '/node/stats')
+# Configuration
+START_PORT = 80
+END_PORT = 101
+HOST = "localhost"
+OUTPUT_FILE = "stats_proxy_total"
+REQUEST_TIMEOUT = 20  # seconds

-    if response.status_code == 200:
-        result = response.json()

-        stats = {}
-        # Get Total users
-        try:
-            stats['users'] = int(int(result["putCount"])/2)
-            stats_total['users'] += int(int(result["putCount"])/2)
-        except:
-            pass
-        # Get android push
-        try:
-            stats['pushListenersCount'] = int(result["pushListenersCount"])
-            stats_total['pushListenersCount'] += int(result["pushListenersCount"])
-        except:
-            pass
-        # Get Listeners
-        try:
-            stats['listenCount'] = int(result["listenCount"])
-            stats_total['listenCount'] += int(result["listenCount"])
-        except:
-            pass
-        # Get permanents put nb
-        try:
-            stats['totalListeners'] = int(result["pushListenersCount"]) + int(result["listenCount"])
-            stats_total['totalListeners'] += int(result["pushListenersCount"]) + int(result["listenCount"])
-        except:
-            pass
-        try:
-            stats['totalPermanentPuts'] = int(result["totalPermanentPuts"])
-            stats_total['totalPermanentPuts'] += int(result["totalPermanentPuts"])
-        except:
-            pass
+def initialize_stats(timestamp: float) -> Dict[str, Any]:
+    """Initialize the stats dictionary with zero values."""
+    return {
+        "users": 0,
+        "pushListenersCount": 0,
+        "listenCount": 0,
+        "totalListeners": 0,
+        "totalPermanentPuts": 0,
+        "timestamp": timestamp,
+        "local_storage_size": 0,
+        "local_storage_values": 0,
+        "storage_size": 0,
+        "storage_values": 0
+    }

-        stats['timestamp'] = str(ts)

-        #with open("stats_proxy_" + str(i), "a") as stat_file:
-        #    stat_file.write(str(stats))
-        #    stat_file.write('\n')
+async def get_proxy_stats(session: aiohttp.ClientSession, port: int) -> Dict[str, Any]:
+    url = f"http://{HOST}:{port}/node/stats"
+    try:
+        async with session.get(url, timeout=aiohttp.ClientTimeout(total=REQUEST_TIMEOUT)) as response:
+            response.raise_for_status()
+            return await response.json()
+    except (aiohttp.ClientError, asyncio.TimeoutError) as e:
+        print(f"Error fetching stats from proxy {port}: {e}", file=sys.stderr)
+        return None

-with open("stats_proxy_total", "w") as stat_file:
-    stat_file.write(str(stats_total))
-    stat_file.write('\n')
+
+def extract_stat(data: Dict[str, Any], key: str, default: int = 0) -> int:
+    try:
+        return int(data.get(key, default))
+    except (ValueError, TypeError):
+        return default
+
+
+def aggregate_proxy_stats(result: Dict[str, Any], stats_total: Dict[str, Any]):
+    """Aggregate statistics from a single proxy into the total."""
+    # Calculate users from putCount (divide by 2)
+    put_count = extract_stat(result, "putCount")
+    stats_total["users"] += put_count // 2
+
+    # Aggregate listener counts
+    push_listeners = extract_stat(result, "pushListenersCount")
+    listen_count = extract_stat(result, "listenCount")
+
+    stats_total["pushListenersCount"] += push_listeners
+    stats_total["listenCount"] += listen_count
+    stats_total["totalListeners"] += push_listeners + listen_count
+    stats_total["totalPermanentPuts"] += extract_stat(
+        result, "totalPermanentPuts")
+
+    # Aggregate storage statistics from nodeInfo
+    node_info = result.get("nodeInfo", {})
+    stats_total["local_storage_size"] += extract_stat(
+        node_info, "local_storage_size")
+    stats_total["local_storage_values"] += extract_stat(
+        node_info, "local_storage_values")
+    stats_total["storage_size"] += extract_stat(node_info, "storage_size")
+    stats_total["storage_values"] += extract_stat(node_info, "storage_values")
+
+
+async def collect_all_stats() -> Dict[str, Any]:
+    timestamp = time.time()
+    stats_total = initialize_stats(timestamp)
+
+    async with aiohttp.ClientSession() as session:
+        # Create tasks for all proxy requests in parallel
+        tasks = []
+        for port in range(START_PORT, END_PORT):
+            tasks.append(get_proxy_stats(session, port))
+
+        # Wait for all requests to complete
+        print(f"Collecting stats from {len(tasks)} proxies in parallel...")
+        results = await asyncio.gather(*tasks)
+
+        # Aggregate results
+        for port, result in zip(range(START_PORT, END_PORT), results):
+            if result:
+                print(f"Processing stats from proxy {port}")
+                aggregate_proxy_stats(result, stats_total)
+
+    return stats_total
+
+
+def save_stats(stats: Dict[str, Any], filepath: str) -> None:
+    try:
+        with open(filepath, "w") as stat_file:
+            json.dump(stats, stat_file, indent=2)
+            stat_file.write("\n")
+        print(f"Statistics saved to {filepath}")
+    except IOError as e:
+        print(f"Error writing to file {filepath}: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+async def main() -> None:
+    """Main entry point for the statistics collection script."""
+    stats_total = await collect_all_stats()
+    save_stats(stats_total, OUTPUT_FILE)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
@@ -15,7 +15,8 @@ extern "C" {
 #include <condition_variable>
 #include <mutex>

-using namespace dht;
+namespace dht {
+namespace tools {

 void
 print_usage()
@@ -82,9 +83,13 @@ step(DhtRunner& dht, std::atomic_uint& done, std::shared_ptr<NodeSet> all_nodes,
        });
 }

+} // namespace tools
+} // namespace dht
+
 int
 main(int argc, char** argv)
 {
+    using namespace dht::tools;
 #ifdef _MSC_VER
    if (auto err = gnutls_global_init()) {
        fmt::print(stderr, "Failed to initialize GnuTLS: {}\n", gnutls_strerror(err));
@@ -97,7 +102,7 @@ main(int argc, char** argv)
        return EXIT_SUCCESS;
    }

-    DhtRunner dht;
+    dht::DhtRunner dht;
    try {
        auto [config, context] = getDhtConfig(params);
        config.dht_config.node_config.client_mode = true;
@@ -121,7 +126,7 @@ main(int argc, char** argv)

        {
            std::mutex m;
-            std::unique_lock<std::mutex> lk(m);
+            std::unique_lock lk(m);
            cv.wait(lk, [&]() { return done.load() == 0; });
        }

@@ -14,6 +14,14 @@ extern "C" {
 #include <mutex>
 #include <atomic>

+namespace dht {
+namespace tests {
+
+constexpr unsigned PINGPONG_MAX = 2048;
+
+using clock = std::chrono::high_resolution_clock;
+using duration = clock::duration;
+
 void
 print_usage()
 {
@@ -21,14 +29,6 @@ print_usage()
    std::cout << "perftest, a simple OpenDHT basic performance tester." << std::endl;
    std::cout << "Report bugs to: https://opendht.net" << std::endl;
 }
-constexpr unsigned PINGPONG_MAX = 2048;
-using namespace dht;
-
-namespace tests {
-
-using clock = std::chrono::high_resolution_clock;
-using duration = clock::duration;
-
 duration
 benchPingPong(unsigned netSize, unsigned n_parallel)
 {
@@ -68,7 +68,7 @@ benchPingPong(unsigned netSize, unsigned n_parallel)
    unsigned max = PINGPONG_MAX * n_parallel;

    auto ping = [&](DhtRunner& node, InfoHash h) {
-        std::lock_guard<std::mutex> lk(m);
+        std::lock_guard lk(m);
        if (i < max) {
            i++;
            node.put(h, Value("hey"));
@@ -93,7 +93,7 @@ benchPingPong(unsigned netSize, unsigned n_parallel)
        ping(pong_node, locs[i].first);

    {
-        std::unique_lock<std::mutex> lk(m);
+        std::unique_lock lk(m);
        if (not cv.wait_for(lk, std::chrono::minutes(1), [&]() { return i == max; })) {
            throw std::runtime_error(std::string("Timeout: ") + std::to_string(i));
        }
@@ -115,10 +115,13 @@ benchPingPong(unsigned netSize, unsigned n_parallel)
 }

 } // namespace tests
+} // namespace dht

 int
 main(int argc, char** argv)
 {
+    using namespace dht::tools;
+    using namespace dht::tests;
 #ifdef _MSC_VER
    if (auto err = gnutls_global_init()) {
        std::cerr << "Failed to initialize GnuTLS: " << gnutls_strerror(err) << std::endl;
@@ -140,10 +143,10 @@ main(int argc, char** argv)
        results.reserve(8);
        duration total {0};
        for (unsigned i = 2; i < 32; i *= 2) {
-            auto dt = tests::benchPingPong(i - 2, nparallel);
+            auto dt = benchPingPong(i - 2, nparallel);
            std::cout << "Network size: " << i << std::endl;
-            std::cout << max << " ping-pong done, took " << print_duration(dt) << std::endl;
-            std::cout << print_duration(dt / max) << " per rt, " << max / std::chrono::duration<double>(dt).count()
+            std::cout << max << " ping-pong done, took " << dht::print_duration(dt) << std::endl;
+            std::cout << dht::print_duration(dt / max) << " per rt, " << max / std::chrono::duration<double>(dt).count()
                      << " ping per s" << std::endl
                      << std::endl;
            total += dt;
@@ -155,14 +158,14 @@ main(int argc, char** argv)

        std::cout << "Total for " << nparallel << std::endl;
        auto totNum = max * results.size();
-        std::cout << totNum << " ping-pong done, took " << print_duration(total) << std::endl;
-        std::cout << print_duration(total / totNum) << " per rt, "
+        std::cout << totNum << " ping-pong done, took " << dht::print_duration(total) << std::endl;
+        std::cout << dht::print_duration(total / totNum) << " per rt, "
                  << totNum / std::chrono::duration<double>(total).count() << " ping per s" << std::endl
                  << std::endl;
    }

-    std::cout << std::endl << "Grand total: " << print_duration(totalTime) << " for " << totalOps << std::endl;
-    std::cout << print_duration(totalTime / totalOps) << " per rt, "
+    std::cout << std::endl << "Grand total: " << dht::print_duration(totalTime) << " for " << totalOps << std::endl;
+    std::cout << dht::print_duration(totalTime / totalOps) << " per rt, "
              << totalOps / std::chrono::duration<double>(totalTime).count() << " ping per s" << std::endl
              << std::endl;

@@ -31,9 +31,8 @@ ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 ProtectSystem=strict
-ReadOnlyDirectories=/
-ReadWriteDirectories=-/proc/self
-ReadWriteDirectories=-/var/run
+ReadOnlyPaths=/
+ReadWritePaths=-/proc/self -/var/run
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=yes
 RestrictRealtime=yes
@@ -54,6 +54,9 @@
 #include <sstream>
 #include <fstream>

+namespace dht {
+namespace tools {
+
 /*
 * The mapString shall have the following format:
 *
@@ -193,7 +196,9 @@ getDhtConfig(dht_params& params)
    }
    if (context.logger) {
        context.statusChangedCallback = [logger = context.logger](dht::NodeStatus status4, dht::NodeStatus status6) {
-            logger->w("Connectivity changed: IPv4: %s, IPv6: %s", dht::statusToStr(status4), dht::statusToStr(status6));
+            logger->warn("Connectivity changed: IPv4: {}, IPv6: {}",
+                         dht::statusToStr(status4),
+                         dht::statusToStr(status6));
        };
        context.publicAddressChangedCb = [logger = context.logger](std::vector<dht::SockAddr> addrs) {
            logger->warn("Public address changed: {}", addrs);
@@ -212,6 +217,10 @@ print_node_info(const dht::NodeInfo& info)
        std::cout << "IPv4 port " << info.bound4 << ", IPv6 port " << info.bound6 << std::endl;
    if (info.id)
        std::cout << "Public key ID " << info.id << std::endl;
+    std::cout << "Storage: " << info.storage_values << " values, " << printByteCount(info.storage_size) << std::endl;
+    std::cout << "Local storage: " << info.local_storage_values << " values, "
+              << printByteCount(info.local_storage_size) << std::endl;
+    std::cout << "Ongoing operations: " << info.ongoing_ops << std::endl;
 }

 static const constexpr struct option long_options[] = {
@@ -412,7 +421,7 @@ struct ServiceRunner
 {
    bool wait()
    {
-        std::unique_lock<std::mutex> lock(m);
+        std::unique_lock lock(m);
        cv.wait(lock, [&] { return terminate.load(); });
        return !terminate;
    }
@@ -483,3 +492,6 @@ daemonize()
    close(STDERR_FILENO);
 #endif
 }
+
+} // namespace tools
+} // namespace dht
@@ -1,7 +1,7 @@
 {
  "default-registry": {
    "kind": "git",
-    "baseline": "dd3097e305afa53f7b4312371f62058d2e665320",
+    "baseline": "66c0373dc7fca549e5803087b9487edfe3aca0a1",
    "repository": "https://github.com/microsoft/vcpkg"
  },
  "registries": [
@@ -11,4 +11,4 @@
      "name": "microsoft"
    }
  ]
-}
+}