diff --git a/‎.clang-tidy‎
Lines changed: 17 additions & 1 deletion b/‎.clang-tidy‎
Lines changed: 17 additions & 1 deletion
diff --git a/‎.github/workflows/reusable/cached-install/action.yml‎
Lines changed: 23 additions & 25 deletions b/‎.github/workflows/reusable/cached-install/action.yml‎
Lines changed: 23 additions & 25 deletions
diff --git a/‎.github/workflows/validate.yml‎
Lines changed: 2 additions & 3 deletions b/‎.github/workflows/validate.yml‎
Lines changed: 2 additions & 3 deletions
diff --git a/‎.github/workflows/validateandroid.yml‎
Lines changed: 4 additions & 2 deletions b/‎.github/workflows/validateandroid.yml‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎.github/workflows/validateios.yml‎
Lines changed: 4 additions & 2 deletions b/‎.github/workflows/validateios.yml‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎.gitmodules‎
Lines changed: 1 addition & 1 deletion b/‎.gitmodules‎
Lines changed: 1 addition & 1 deletion
@@ -1,3 +1,8 @@
+# Note: trailing suppressions (from -modernize-use-designated-initializers
+# on) are checks added in clang-tidy versions newer than the 18 this config
+# was tuned for; they fire on existing code. Suppressed when the linter
+# moved to clangd 22 (needed to parse libc++ 22 headers) — to be triaged
+# and enabled in the lint-toolchain modernization phase.
 Checks: >
   -*,
   bugprone-*,
@@ -12,7 +17,18 @@ Checks: >
   -modernize-return-braced-init-list,
   -misc-non-private-member-variables-in-classes,
   -typecheck-expression-not-modifiable-lvalue,
-  -misc-use-internal-linkage
+  -misc-use-internal-linkage,
+  -modernize-use-designated-initializers,
+  -bugprone-suspicious-stringview-data-usage,
+  -modernize-use-ranges,
+  -modernize-use-starts-ends-with,
+  -readability-container-contains,
+  -readability-avoid-return-with-void-value,
+  -readability-redundant-casting,
+  -readability-use-std-min-max,
+  -bugprone-unused-local-non-trivial-variable,
+  -bugprone-optional-value-conversion,
+  -performance-enum-size
 
 # Turn all the warnings from the checks above into errors.
 WarningsAsErrors: "*"
 
@@ -8,14 +8,14 @@ runs:
       id: cache-homedir
       uses: actions/cache/restore@v4
       with:
-        key: ${{ runner.arch }}-${{ runner.os }}-cache-homedir1-${{ hashFiles('./vcpkg.json') }}
+        key: ${{ runner.arch }}-${{ runner.os }}-cache-homedir2-${{ hashFiles('./vcpkg.json', './overlaytriplets/**', './overlayports/**') }}
         path: |
           ~/.cache/vcpkg/archives
     - name: cache vcpkg installed
       id: cache-vcpkg-installed
       uses: actions/cache/restore@v4
       with:
-        key: ${{ runner.arch }}-${{ runner.os }}-cache-vcpkg-installed1-${{ hashFiles('./vcpkg.json') }}
+        key: ${{ runner.arch }}-${{ runner.os }}-cache-vcpkg-installed2-${{ hashFiles('./vcpkg.json', './overlaytriplets/**', './overlayports/**') }}
         path: |
           ./build/vcpkg_installed
     - name: install-prerequisities
@@ -24,43 +24,41 @@ runs:
       shell: bash
     - name: install
       run: |
-        ./install.sh --prod ${ARCHFLAGS:-} || (
-          for target in arm64-osx x64-osx x64-linux arm64-linux arm64-android arm64-ios; do
-            BASE_DIR="/Users/runner/work/native-sdk/native-sdk/vcpkg/buildtrees/libdatachannel"
-            
-            # Function to print file if it exists
-            print_if_exists() {
-              if [ -f "$1" ]; then
-                echo "=== $2 ==="
-                cat "$1"
-              fi
-            }
-            
-            print_if_exists "$BASE_DIR/config-$target-dbg-CMakeCache.txt.log" "config-$target-dbg-CMakeCache.txt.log"
-            print_if_exists "$BASE_DIR/config-$target-rel-CMakeCache.txt.log" "config-$target-rel-CMakeCache.txt.log"
-            print_if_exists "$BASE_DIR/config-$target-dbg-CMakeConfigureLog.yaml.log" "config-$target-dbg-CMakeConfigureLog.yaml.log"
-            print_if_exists "$BASE_DIR/config-$target-rel-CMakeConfigureLog.yaml.log" "config-$target-rel-CMakeConfigureLog.yaml.log"
-            print_if_exists "$BASE_DIR/config-$target-rel-ninja.log" "config-$target-rel-ninja.log"
-            print_if_exists "$BASE_DIR/config-$target-out.log" "config-$target-out.log"
-            print_if_exists "../../$target-dbg/CMakeCache.txt" "../../$target-dbg/CMakeCache.txt"
+        # Composite steps run under bash -e -o pipefail: disarm around the
+        # pipeline or a failure aborts the script before we can annotate.
+        set +e +o pipefail
+        ./install.sh --prod ${ARCHFLAGS:-} 2>&1 | tee install-output.log
+        EXITCODE=${PIPESTATUS[0]}
+        if [ "$EXITCODE" -ne 0 ]; then
+          # Surface failure context as error annotations so failures are
+          # diagnosable from the Checks UI (raw step logs need auth).
+          set +e
+          MSG=$(tail -40 install-output.log | sed 's/%/%25/g' | awk '{printf "%s%%0A", $0}')
+          echo "::error title=install.sh output tail::${MSG}"
+          for log in $(ls -t vcpkg/buildtrees/*/*.log 2>/dev/null | head -16 | xargs grep -liE "(^|[^a-z])error[: ]" 2>/dev/null | head -3); do
+            echo "::group::${log}"
+            tail -120 "$log"
+            echo "::endgroup::"
+            MSG=$(grep -B3 -A8 -iE "(^|[^a-z])error[: ]" "$log" | tail -30 | sed 's/%/%25/g' | awk '{printf "%s%%0A", $0}')
+            [ -n "$MSG" ] && echo "::error title=${log}::${MSG}"
           done
-          exit 1
-        )
+          exit "$EXITCODE"
+        fi
       shell: bash
     - name: cache homedir save
       id: cache-homedir-save
       if: always()
       uses: actions/cache/save@v4
       with:
-        key: ${{ runner.arch }}-${{ runner.os }}-cache-homedir1-${{ hashFiles('./vcpkg.json') }}
+        key: ${{ runner.arch }}-${{ runner.os }}-cache-homedir2-${{ hashFiles('./vcpkg.json', './overlaytriplets/**', './overlayports/**') }}
         path: |
           ~/.cache/vcpkg/archives
     - name: cache vcpkg installed save
       id: cache-vcpkg-installed-save
       if: always()
       uses: actions/cache/save@v4
       with:
-        key: ${{ runner.arch }}-${{ runner.os }}-cache-vcpkg-installed1-${{ hashFiles('./vcpkg.json') }}
+        key: ${{ runner.arch }}-${{ runner.os }}-cache-vcpkg-installed2-${{ hashFiles('./vcpkg.json', './overlaytriplets/**', './overlayports/**') }}
         path: |
           ./build/vcpkg_installed
     #- name: Commit compiled binaries
 
@@ -20,11 +20,10 @@ jobs:
   install-lint-test:
     strategy:
       # Let each platform report its true status: one platform's failure
-      # must not cancel the others (the macOS legs are expected to fail
-      # until the Phase 1.2 compiler upgrade lands; Linux is the gate).
+      # must not cancel the others.
       fail-fast: false
       matrix:
-        os: [macos-14, macos-13, ubuntu-24.04, linux-arm64-runner]
+        os: [macos-latest, ubuntu-latest, linux-arm64-runner]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
 
@@ -14,13 +14,15 @@ on:
 
 jobs:
   install-lint:
-    if: contains(github.event.head_commit.message, 'androidbuild')
-    runs-on: macos-15
+    if: contains(github.event.head_commit.message, 'androidbuild') || contains(github.event.pull_request.title, 'androidbuild')
+    runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
+          submodules: true
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: install
         uses: ./.github/workflows/reusable/cached-install
       - name: lint
 
@@ -14,12 +14,14 @@ on:
 
 jobs:
   install-lint:
-    if: contains(github.event.head_commit.message, 'iosbuild')
-    runs-on: macos-14
+    if: contains(github.event.head_commit.message, 'iosbuild') || contains(github.event.pull_request.title, 'iosbuild')
+    runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
+          submodules: true
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: install
         uses: ./.github/workflows/reusable/cached-install
@@ -11,4 +11,4 @@
 	url = https://github.com/streamr-dev/native-ts-integration.git
 [submodule "packages/streamr-libstreamrproxyclient/wrappers/go"]
 	path = packages/streamr-libstreamrproxyclient/wrappers/go
-	url = git@github.com:streamr-dev/goproxyclient.git
+	url = https://github.com/streamr-dev/goproxyclient.git