TreeChain Mesh Update — May 16, 2026

Three changes shipped to the live TreeChain mesh today. All five nodes are running them now.

1. Fifth node: EU-Falkenstein

Hetzner Falkenstein (Germany) joined the mesh as the 5th signing node, bringing the jurisdiction count to five:

• EU-Helsinki — Finland
• EU-Falkenstein — Germany (new)
• US-Oregon — West Coast
• US-Ashburn — East Coast
• APAC-Singapore — Asia Pacific

Falkenstein generates its own Ed25519 + Dilithium-5 + SPHINCS+ identity, holds its own slice of the chain, and signs every entry it originates with the same triple-hybrid signature as every other peer. The mesh runs 5-of-5 cross-replication. Every encrypt on any node now fans out to four peers; falkenstein verifies and accepts entries from the other four, and the other four verify and accept entries originated on falkenstein.

Adding Falkenstein gives the mesh two-jurisdiction EU coverage (Finland + Germany) and a fifth independent legal seat — a meaningful step toward provider-and-jurisdiction diversity without changing the security model.

2. Canonical V2 protocol — actually firing now

The canonical V2 chain format (protobuf-serialized, deterministic encoding, domain-separated SHA-256 hash) was rolled into the codebase in May. A version mismatch between the compiled protobuf gencode and the installed runtime had kept the v2 path from actually executing — every node was silently falling back to v1 (a one-line warning in the logs) and signing the legacy hex-string hash.

That's fixed. Every chain entry created on any of the five nodes since this deploy is real v2:

chain_format_version: 2
chain_sig_algo:      hybrid_d5_e25519_slh256f
prev_chain_hash:     <committed in the signed canonical bytes>
chain_ts_ns:         <committed>

The v1→v2 boundary verifies cleanly through /provenance/chain/verify/{shield_id}. Pre-existing v1 entries remain valid.

3. Haiku steganography layer — default on

The third encryption layer — multilingual haiku wrapping over the polyglottal glyph payload — is now applied by default to every /challenge/encrypt response. Previously the layer was loaded but opt-in via include_haiku: true; most clients never asked. Every encrypt response now includes both the raw glyphs field and the haiku-wrapped haiku field.

The decrypt endpoint accepts either, so existing clients continue to work without changes. Callers who specifically don't want haiku can pass include_haiku: false.

Adjacent fix: /challenge/decrypt 500

The decrypt endpoint that powers the /the-math, /break-this, and /enterprise-demo pages had been returning 500 on every request. Root cause: a chain_sig_algo field added by the hybrid-signing migration was being written into the stored metadata at encrypt time but not stripped at decrypt time. The decrypt path was rebuilding the AAD with the extra field in it, so the encrypt-time AAD and the decrypt-time AAD no longer matched — cryptography.exceptions.InvalidTag on every call. The strip set now includes the field. All three demo pages work end-to-end.

And: CMS moved off MongoDB

The /blog endpoint that you are reading this on previously depended on MongoDB. The CMS is now backed by DuckDB — the same engine used for chain provenance storage. No more MongoDB dependency anywhere in the public request path. Blog content, sitemaps, RSS, and admin CRUD all hit DuckDB.

Verify any chain entry on the live mesh: /provenance/chain/head. The same mesh secures Bellacoin transactions — see bellacoin.ai.